Lightroom[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Lightroom.exe
Size

14.5MB
MD5

0d1da03c51d5bee6b9bc78f20599b394
SHA1

c8bd374441a9055186da12874a364a887edbf0d6
SHA256

0471e3a8c934a2b9f5e64c3764489361168937a4df57fe658df1e0a7c4577fd0
SHA512

1a3ed606957dfec93c5edd341c010590da39dfa79980e67e4c5afe2c4ee865d0afd09d1ce24bc3c85f683052b0492a3fb97e83b0bed43d4266e2954be70d793e
SSDEEP

196608:zs7iY2rhwD3pI3x03P0QRm8icCuAyT5vX3VtHVqBlz4WGHW:QuYuhwDpHf0PcCuA8vVrQzDn

Score

1^/10

Malware Config

Signatures

Files

Lightroom.exe
.exe windows x64

ad8012fd1bb74ec42366b80e34ff775d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crclient

?CrashReporterInitialize@@YA_NPEAXPEBD1111P6A_KAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@ZP6AXXZ_N@Z

headlights

AgWrapperAdobePIPReportSessionCrash

winhttp

WinHttpConnect
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpOpen
WinHttpCrackUrl

crypt32

CertFreeCertificateChain
CertEnumCertificatesInStore
CertGetCertificateChain
CertOpenSystemStoreA
CryptProtectData
CryptUnprotectData
CryptStringToBinaryW
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CryptImportPublicKeyInfoEx2
CryptHashCertificate2
CertCreateCertificateContext
CertVerifySubjectCertificateContext

ahclient

InitializeAdobeHelpClient
DisplayAdobeHelpClientPage

agkernel

AgLua_toStringNoConvert
AgLua_setCodeCapturing
lua_rawseti
lua_toboolean
KrInit
AgLua_popNil
KrDebugger_open
AgLuaUniverse_createMainUniverse
lua_tonumber
AgLua_pushNamedInteger
AgLua_checkString
AgLua_addFunctionsToTable
AgThreadUtils_isCurrentThreadMainThread
lua_createtable
lua_pushboolean
lua_call
lua_gettop
AgLuaState_addSetupProc
lua_pushlightuserdata
AgLua_invalidateProxyUserdata
AgDirectObject_checkPushAllocToLua
lua_pushstring
lua_pushnumber
AgDirectObject_copyFromLuaStateToLuaState
AgDirectObject_predecrementCount
AgThrowProgramError
AgTransitQueue_checkRetainFromLua
AgTransitQueue_release
AgTransitCargo_newTable
luaL_error
AgLua_checkNumber
AgTransitQueue_enqueueAndReleaseCargo
AgLua_dumpTraceback
AgLua_checkInteger
AgTransitCargo_pushString
AgTransitQueue_newCargo
AgTransitCargo_pushNumber
lua_pushnil
luaL_checklstring
AgTransitCargo_pushBoolean
lua_pushlstring
lua_settable
lua_type
lua_gettable
lua_newuserdata
lua_checkstack
lua_getfield
lua_setmetatable
lua_settop
lua_pushvalue
lua_replace
AgLua_getMethodByName
AgLuaUniverse_mainClosing
lua_pcall
lua_next
lua_tolstring
AgLua_throwProgramError
lua_pushinteger
AgLua_setLogToConsole
lua_setfield
AgLua_checkBoolean
KrLuaCoverage_initCoverage
KrLuaCoverage_enableInstructionCoverage
AgLuaUniverse_getMain
lua_tointeger
AgExceptions_setThrowHook
AgLuaUniverse_close
KrLuaCoverage_enableLineCoverage

ui

?Refresh@AgViewManifestationWin@@UEAAX_N@Z
?SetEnabled@AgViewManifestationWin@@UEAAX_N@Z
?getBackgroundColor@AgViewManifestationWin@@UEAAK_N@Z
?getForegroundColor@AgViewManifestationWin@@UEAAK_N@Z
?getUIColor@AgViewManifestationWin@@UEAAKW4SkinColors@1@@Z
?getLuaEmphasisFontRef@AgViewManifestationWin@@UEAA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@XZ
?getLuaFontRef@AgViewManifestationWin@@UEAA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@XZ
?getSkin@AgViewManifestationWin@@UEAA?AW4Skin@1@XZ
?setSkin@AgViewManifestationWin@@UEAAXW4Skin@1@@Z
?isSkinned@AgViewManifestationWin@@UEAA_NXZ
?pushToLuaWithGC@AgViewManifestationWin@@UEAAXPEAUlua_State@@_N@Z
?pushToLua@AgViewManifestationWin@@UEAAXPEAUlua_State@@@Z
?applyLayout_L@AgViewManifestationWin@@UEAAHPEAUlua_State@@@Z
?creationFinalized_L@AgViewManifestationWin@@UEAAHPEAUlua_State@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphics@@VRCObject@@@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphics@@VRCObject@@@@AEBVCRect@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphicsD2D@@VRCObject@@@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphicsD2D@@VRCObject@@@@AEBVCRect@@@Z
?InitializeFonts@AgViewManifestationWin@@UEAAXPEAUlua_State@@@Z
?GetWnd@AgViewManifestationWin@@UEAAPEAVCWnd@@XZ
??1AgViewManifestationWin@@UEAA@XZ
?MakeLogicalColorSpace@AgColorSpace@@AEAA_NXZ
?GetColorProfile@AgColorSpace@@AEAAPEAXXZ
?SetModuleWithToolkitID@AgDocument@@QEAA_NAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetThisClass@AgDocumentView@@SAPEAUCRuntimeClass@@XZ
?registerAgDocument@AgDocument@@SAHPEAUlua_State@@@Z
shutdownWinTab
AgDialogs_isFolderDialogShowing
?ShutdownAgUI@@YAXXZ
AgGraphics_shutdown
SetViewWillHandleMenuKeys
?RestoreWindowFromPrefs@AgViewWinMainFrame@@QEAAXXZ
?SetScreenMode@AgViewWinMainFrame@@QEAAXW4ScreenMode@1@_N@Z
?SuspendFullscreen@AgViewWinMainFrame@@QEAAX_N@Z
?HidePanels@AgViewWinMainFrame@@QEAAXXZ
?ShowPanels@AgViewWinMainFrame@@QEAAXXZ
initWinTab
registerAgViewWinControls
??0AgViewWin32Window@@QEAA@PEAVCWnd@@@Z
?OnDragOver@AgViewWinFrame@@UEAAKPEAVCOleDataObject@@KVCPoint@@@Z
?OnDragLeave@AgViewWinFrame@@UEAAXXZ
?OnDragEnter@AgViewWinFrame@@UEAAKPEAVCOleDataObject@@KVCPoint@@@Z
?OnDrop@AgViewWinFrame@@UEAAHPEAVCOleDataObject@@KVCPoint@@@Z
?PostNcDestroy@AgViewWinFrame@@UEAAXXZ
??0AgViewWinMainFrame@@IEAA@XZ
?GetThisClass@AgViewWinMainFrame@@SAPEAUCRuntimeClass@@XZ
?Create@AgViewWinMainFrame@@UEAAHPEB_W0KAEBUtagRECT@@PEAVCWnd@@0KPEAUCCreateContext@@@Z
?PreTranslateMessage@AgViewWinMainFrame@@UEAAHPEAUtagMSG@@@Z
?OnClose@AgViewWinMainFrame@@UEAAXXZ
?PreCreateWindow@AgViewWinMainFrame@@UEAAHAEAUtagCREATESTRUCTW@@@Z
?OnUpdateFrameTitle@AgViewWinMainFrame@@UEAAXH@Z
?pushToLua@AgViewWinMainFrame@@UEAAXPEAUlua_State@@@Z
?pushToLuaWithGC@AgViewWinMainFrame@@UEAAXPEAUlua_State@@_N@Z
?isSkinned@AgViewWinMainFrame@@UEAA_NXZ
??1AgViewWinMainFrame@@UEAA@XZ
?OnCommand@AgViewWinMainFrame@@MEAAH_K_J@Z
?OnToolHitTest@AgViewWinMainFrame@@MEBA_JVCPoint@@PEAUtagTOOLINFOW@@@Z
?GetThisMessageMap@AgViewWinMainFrame@@KAPEBUAFX_MSGMAP@@XZ
?SuspendPanels@AgViewWinPanelHost@@QEAAXXZ
?ResumePanels@AgViewWinPanelHost@@QEAAXXZ
??0AgPasteboard@@QEAA@PEAUlua_State@@@Z
??0AgDocument@@IEAA@XZ
??1AgDocument@@UEAA@XZ
?OnNewDocument@AgDocument@@UEAAHXZ
?OnCloseDocument@AgDocument@@UEAAXXZ
?SaveModified@AgDocument@@UEAAHXZ
??0AgColorSpace@@IEAA@PEAD_N@Z
??0AgColorSpace@@IEAA@PEA_W@Z
??0AgColorSpace@@IEAA@PEBX_K@Z
??0AgColorSpace@@IEAA@W4AgColorSpaceEnum@@@Z
??0AgColorSpace@@IEAA@AEBV?$RCPtr@VAgDataProvider@@VRCObject@@@@@Z
??0AgWinFont@@IEAA@AEBUtagLOGFONTW@@@Z
??0AgGraphics@@IEAA@PEAVGraphics@Gdiplus@@V?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgGraphics@@IEAA@PEAUHWND__@@@Z
??0AgGraphics@@IEAA@PEAUHDC__@@_NV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgGraphics@@IEAA@AEBV?$RCPtr@VAgGraphics@@VRCObject@@@@HH@Z
??0AgGraphics@@IEAA@HHHV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgPNGProviderWin@@IEAA@PEAXPEBX_KP6AX012@Z@Z
??0AgPNGProviderWin@@IEAA@PEAD@Z
?GetPixelFormat@AgNativeImage@@UEAAHXZ
??1AgNativeImage@@UEAA@XZ
??0CGTransform@@IEAA@XZ
??0CGTransform@@IEAA@MMMMMM@Z
?AgView_changed_user_entered_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_text_color_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_font_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_enabled_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?isHiddenOrHasHiddenAncestor@AgViewViewBehavior@@UEAA_NXZ
?ScrollIntoView@AgViewViewBehavior@@UEAAX_K_J@Z
?OnRevealWindow@AgViewViewBehavior@@UEAAX_K_J_N2@Z
?frameChanged_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?addChildWindow_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?destroyManifestation_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?isHiddenOrHasHiddenAncestor_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?updateWindow_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?visibleBoundsRect_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?boundsRect_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?displayIfNeeded_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?display_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?setRedraw_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?setNeedsDisplay_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?registerForDraggedTypes_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?revealOnScreen_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?restoreDefaultFocus_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?makeKeyAndOrderFront_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?makeFirstResponder_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?toPDF_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?viewLocationFromEvent_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?screenContainingView_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?globalToViewPoint_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?viewToGlobalPoint_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_tooltip_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_visible_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
??0AgViewViewBehavior@@QEAA@XZ
??1AgDataProvider@@UEAA@XZ
??0AgDataProvider@@IEAA@PEAXPEBX_KP6AX012@Z@Z
?LoadInitialModuleWithToolkitID@AgDocument@@IEAAXAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetMessageMap@AgDocument@@MEBAPEBUAFX_MSGMAP@@XZ
?GetThisClass@AgDocument@@SAPEAUCRuntimeClass@@XZ
?Serialize@AgDocument@@UEAAXAEAVCArchive@@@Z

substrate

AgPreferences_getLanguageCode
AgVersion_getProductBuildNumber
??1StRestoreStackContents@@QEAA@XZ
AgPreferences_unregister
AgSubstrate_setSharedDebugger
AgNamespace_import
?removeSubkey@RegKey@@QEAA_NPEB_W@Z
?runScript@AgToolkitWin@@QEAAHPEAUlua_State@@PEBD@Z
?getAppToolkit@AgToolkitWin@@SAPEAV1@XZ
AgPathUtilsWin_stringByDeletingLastPathComponent
AgPreferences_setNativeStringForKey
GetMainWindow
AgUnitTests_runAllTestsForCommandLineWithUI
AgPathUtilsWin_stringByAppendingPathComponent
HandleASAPTasks
AgShutdownNotification_callFinalShutdownProcs
??0StRestoreStackContents@@QEAA@PEAUlua_State@@@Z
AgSubstrate_init
AgPreferences_setLanguageCode
?UTF16ToUTF8@@YAHAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@2@AEAK@Z
WaitMessageWhileHandlingMainThreadAction
?AgStringUtils_CStringFromZString@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEBD@Z
AgPathUtilsWin_getStandardFilePath
AgNamespace_importOptional
AgWorkspace_exitViaCloseMainWindow
?NativeStringFromUTF8@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEBD@Z
??0RegKey@@QEAA@QEAUHKEY__@@PEB_WK_N@Z
?setStringValue@RegKey@@QEAAXPEB_W0@Z
?removeValue@RegKey@@QEAA_NPEB_W@Z
?addSubkey@RegKey@@QEAAPEAUHKEY__@@PEB_W00@Z
?enumValue@RegKey@@QEAAPEA_WJ@Z
??0RegKeyLM@@QEAA@PEB_WK_N@Z
?AgLua_checkNativeString@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEAUlua_State@@H@Z
AgLua_pushNativeString
AgNamespace_importEntryWithCache
AgPathUtilsWin_getPathExtension
AgTempLuaState_begin
AgTempLuaState_restoreTop
AgTempLuaState_end
?push@AgLuaValueRef@@QEBAXPEAUlua_State@@@Z
AgPreferences_stringForKey
??1StTempLuaState@@QEAA@XZ
recordTimeInterval
AgDate_timeIntervalSinceReferenceDate
AgMainThreadAction_release
AgMainThreadAction_trigger
AgMainThreadAction_copy
AgStringUtils_UTF8CStringFromZString
?Instance@RCPtrNull@@SA?AV1@XZ
??1RCPtrBase@@QEAA@XZ
AgConfiguration_isEnabled
??0RegKeyCU@@QEAA@PEB_WK_N@Z
?getStringValue@RegKey@@QEAAPEA_WPEB_W@Z
AgNamespace_importEntry
??1RCObject@@UEAA@XZ
??1RegKey@@QEAA@XZ
??0StTempLuaState@@QEAA@PEAUlua_State@@@Z
?initWithPath@AgToolkitWin@@MEAAXPEBD@Z
??1AgToolkitWin@@UEAA@XZ
?getInstance@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?getInstance@AgToolkitWin@@UEAAPEAUHINSTANCE__@@XZ
?hasResource@AgToolkitWin@@UEAA_NPEBD@Z
?fileNamed@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?getResourceByName@AgToolkitWin@@MEAA?AV?$auto_ptr@VAgMemoryBuffer@@@std@@PEBD@Z
?getCFunction@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?resourcesInPath@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?disableDebugFileSubstitution@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
??1AgLuaValueRef@@UEAA@XZ
AgVersionSetup_init
?ResetBase@RCPtrBase@@IEAAXPEAVRCObject@@@Z
?CountIt@RCPtrBase@@AEAAXXZ
AgNamespace_exportFunctions
logBeforeEventTimeStamp

mfc140u

ord12606
ord10124
ord11929
ord6614
ord1450
ord7393
ord8167
ord11901
ord11933
ord7920
ord11921
ord5706
ord3731
ord365
ord11719
ord11718
ord1059
ord1503
ord13618
ord5709
ord285
ord2921
ord4656
ord14026
ord13986
ord12443
ord296
ord8095
ord4872
ord4873
ord5917
ord12142
ord1766
ord5722
ord13351
ord13360
ord5727
ord13358
ord5726
ord2510
ord4353
ord11119
ord5743
ord8521
ord9043
ord7912
ord8904
ord11484
ord5189
ord3723
ord4443
ord11184
ord10093
ord11850
ord3172
ord3278
ord3279
ord3812
ord2629
ord6631
ord14217
ord7651
ord14211
ord2967
ord4352
ord9384
ord5582
ord4360
ord4828
ord4767
ord4752
ord4814
ord4859
ord4782
ord4837
ord4853
ord4794
ord4800
ord4806
ord4788
ord4843
ord4776
ord12544
ord1734
ord1748
ord1722
ord1700
ord11940
ord11944
ord13513
ord3173
ord10691
ord6729
ord8656
ord941
ord11625
ord3718
ord8830
ord11415
ord11414
ord5451
ord9979
ord7668
ord9977
ord9978
ord9976
ord1775
ord2698
ord9946
ord3209
ord3212
ord13401
ord6002
ord2903
ord11806
ord1454
ord7922
ord5227
ord7450
ord7461
ord7460
ord5062
ord5229
ord5083
ord5339
ord9041
ord5552
ord5363
ord5080
ord13697
ord13468
ord2779
ord5408
ord5981
ord8772
ord3735
ord10713
ord10956
ord12466
ord5376
ord12256
ord10941
ord8093
ord7395
ord2767
ord13023
ord2511
ord12100
ord12341
ord4549
ord9175
ord2662
ord11775
ord3997
ord3947
ord14132
ord5196
ord5188
ord10122
ord9942
ord10411
ord10827
ord10828
ord9054
ord11432
ord9670
ord8903
ord5557
ord7716
ord8023
ord5183
ord2439
ord12222
ord12223
ord14210
ord7650
ord14216
ord9089
ord4011
ord3949
ord1755
ord12625
ord3728
ord2415
ord8026
ord13864
ord11928
ord11709
ord2011
ord11664
ord13761
ord7233
ord2222
ord6505
ord11665
ord1844
ord2212
ord4726
ord4511
ord290
ord286
ord4947
ord1501
ord1033
ord280
ord265
ord266
ord1489
ord1491
ord14219
ord14088
ord14221
ord12212
ord7719
ord14288
ord2270
ord6121
ord2273
ord14290
ord6123
ord14289
ord5555
ord9941
ord8900
ord316
ord1034
ord6122
ord1511
ord14043
ord1670
ord2909
ord4510
ord13545
ord14027
ord8159
ord8451
ord9975
ord983
ord1492
ord324
ord1040
ord2327
ord323
ord1039
ord2372
ord14209
ord2370
ord8084
ord14360

kernel32

OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
WaitForSingleObjectEx
ResetEvent
LocalAlloc
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
FlushConsoleInputBuffer
LoadLibraryA
lstrlenA
lstrcpynA
lstrcmpiA
GetCurrentProcess
CreateMutexA
GlobalMemoryStatus
QueryPerformanceCounter
GetConsoleScreenBufferInfo
GetLocaleInfoA
SystemTimeToFileTime
SetVolumeLabelA
DosDateTimeToFileTime
SetFilePointer
LocalFileTimeToFileTime
GetDriveTypeA
SetConsoleMode
GetConsoleMode
GetVolumeInformationA
GetVersion
SetFileAttributesA
ReadFile
GetFullPathNameA
FileTimeToLocalFileTime
CreateFileA
GetFileAttributesA
FindNextFileA
FindFirstFileA
WriteFile
GetFileType
GetStdHandle
AreFileApisANSI
SetEvent
CreateEventW
GetACP
InitializeCriticalSectionAndSpinCount
CopyFileW
GetModuleHandleA
GetWindowsDirectoryW
SetFileTime
SetEndOfFile
RemoveDirectoryW
GetFileTime
CreateDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableW
FormatMessageA
TlsFree
TlsAlloc
lstrcmpW
GetTickCount
SetCurrentDirectoryW
HeapSetInformation
GetCommandLineW
OutputDebugStringA
GetModuleHandleW
GetModuleFileNameW
MulDiv
IsBadWritePtr
RaiseException
GetNativeSystemInfo
FileTimeToSystemTime
GetComputerNameExW
GetVersionExW
GetTempPathW
DeviceIoControl
GetDateFormatW
GetTimeFormatW
GetLocalTime
DeleteFileW
SetFileAttributesW
GetFileAttributesW
CreateFileW
FindClose
GetFileSizeEx
FindNextFileW
FindFirstFileW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetCurrentThreadId
OpenMutexW
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetProcessHeap
HeapAlloc
HeapFree
LocalFree
GetLastError
FormatMessageW
WideCharToMultiByte
CreateProcessW
CloseHandle
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
InitializeCriticalSectionEx

user32

LoadCursorW
PostQuitMessage
GetDesktopWindow
GetClassInfoExW
GetAncestor
EnableWindow
GetDC
MessageBoxW
ShowWindow
GetAsyncKeyState
SetRect
ReleaseDC
AdjustWindowRectEx
PostMessageW
GetClientRect
TranslateMessage
DispatchMessageW
GetActiveWindow
RegisterClassExW
GetWindowLongPtrW
SendMessageW
OemToCharA
GetUserObjectInformationW
GetProcessWindowStation
CharToOemA
GetKeyState
IsWindow
FindWindowW
UpdateWindow
SetForegroundWindow
IsIconic
InvalidateRect
SetTimer
KillTimer
GetFocus
SetActiveWindow
MonitorFromRect
GetSystemMetrics
GetMonitorInfoW
GetMessageW
DefWindowProcW
GetWindowRect
DestroyWindow
SetWindowPos
SetWindowLongPtrW
CreateWindowExW

gdi32

GetDeviceCaps

advapi32

CredWriteW
CredDeleteW
CredFree
CredEnumerateW
CredReadW
CryptReleaseContext
CryptGenRandom
ReportEventW
SetKernelObjectSecurity
IsValidSid
IsValidSecurityDescriptor
IsValidAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
LookupPrivilegeValueA
GetKernelObjectSecurity
AdjustTokenPrivileges
OpenProcessToken
CryptAcquireContextW
GetUserNameW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
RegFlushKey
DeregisterEventSource
RegisterEventSourceW

shell32

ShellExecuteW
SHGetFolderPathW
SHGetKnownFolderPath
SHCreateDirectoryExW
SHAddToRecentDocs

comctl32

InitCommonControlsEx

shlwapi

PathIsFileSpecW
UrlEscapeW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFileExistsW
PathAddExtensionW
PathQuoteSpacesW
PathAppendW
PathIsDirectoryW
PathRenameExtensionW
UrlCanonicalizeW
StrStrW

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_signal
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Mtx_current_owns
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Query_perf_frequency
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Winerror_message@std@@YAKKPEADK@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_XGetLastError@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
_Thrd_id
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Wcsxfrm
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
_Wcscoll
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Random_device@std@@YAIXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Strcoll
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Strxfrm
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
_Thrd_sleep
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Xbad_alloc@std@@YAXXZ
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
_Cnd_destroy_in_situ
_Cnd_broadcast
_Mtx_unlock
_Cnd_init
_Mtx_destroy
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_start
_Mtx_init
_Cnd_wait
_Cnd_destroy
_Cnd_do_broadcast_at_thread_exit
_Cnd_register_at_thread_exit
_Mtx_init_in_situ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Cnd_timedwait
?_Syserror_map@std@@YAPEBDH@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ

bcrypt

BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptDecrypt
BCryptDestroyKey
BCryptEncrypt
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptVerifySignature
BCryptGetProperty

secur32

GetUserNameExW

ole32

CoTaskMemFree
OleSetContainedObject
CoTaskMemAlloc
OleCreate
OleLockRunning
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CoCreateInstance
CoCreateGuid

oleaut32

SafeArrayGetLBound
VariantClear
VariantChangeType
SafeArrayAccessData
SysAllocStringLen
SysStringLen
SysFreeString
SafeArrayGetUBound
VariantInit
SysAllocString

ws2_32

WSACleanup
WSAStartup

wininet

InternetGetConnectedState
InternetSetOptionW

vcruntime140

__CxxFrameHandler3
__std_terminate
_purecall
__std_exception_destroy
memchr
memcmp
wcsstr
memset
strstr
memcpy
_CxxThrowException
memmove
__std_type_info_name
__C_specific_handler
__std_type_info_compare
__RTDynamicCast
strchr
__std_exception_copy

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
atoi
strtoull

api-ms-win-crt-string-l1-1-0

tolower
_strupr
isxdigit
isupper
isprint
mblen
strcmp
_strnicmp
strncpy
strncat
_stricmp
wcscat_s
wcscpy_s
isdigit
isspace
strncmp
isalnum
islower
isalpha
toupper

api-ms-win-crt-stdio-l1-1-0

fflush
__p__commode
_setmode
_fileno
_wfopen
__stdio_common_vswprintf
fclose
fgetc
_get_osfhandle
putc
_isatty
fputc
_lseeki64
_close
_read
_mktemp
fgets
fopen
fputs
_open
_write
fwrite
__stdio_common_vsprintf
fgetpos
fopen_s
setvbuf
__stdio_common_vfprintf
fseek
ferror
ftell
_set_fmode
ungetc
__stdio_common_vswscanf
__acrt_iob_func
fgetwc
ungetwc
fputwc
__stdio_common_vsnwprintf_s
fsetpos
fread
__stdio_common_vswprintf_s
__stdio_common_vsscanf
__stdio_common_vsprintf_s
feof
_fseeki64
_get_stream_buffer_pointers
__stdio_common_vsnprintf_s
__stdio_common_vfwprintf

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_stat64
_waccess_s
rename
_wstat64i32
_chmod
_unlock_file
_unlink
_mkdir

api-ms-win-crt-heap-l1-1-0

free
calloc
_set_new_mode
realloc
malloc

api-ms-win-crt-runtime-l1-1-0

strerror
exit
perror
signal
_crt_atexit
_register_onexit_function
raise
_initialize_onexit_table
_exit
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
terminate
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_c_exit
_cexit
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_errno

api-ms-win-crt-time-l1-1-0

_gmtime64
_tzset
wcsftime
strftime
_time64
_localtime64
_localtime64_s
_mktime64
_difftime64
_mkgmtime64
_ftime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr
modf
_dtest

api-ms-win-crt-locale-l1-1-0

setlocale
___mb_cur_max_func
localeconv
_configthreadlocale

api-ms-win-crt-environment-l1-1-0

_putenv
getenv
_dupenv_s

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-multibyte-l1-1-0

_mbsinc
_mbsrchr
_mbschr
_mbclen

api-ms-win-crt-conio-l1-1-0

_getch

Exports

Exports

??0AgDragTargetViewBehavior@@QEAA@$$QEAV0@@Z
??0AgDragTargetViewBehavior@@QEAA@AEBV0@@Z
??0AgDragTargetViewBehavior@@QEAA@XZ
??0AgLuaValueRef@@QEAA@AEBV0@@Z
??0AgNativeImage@@QEAA@AEBV0@@Z
??0AgTiledImage@@QEAA@AEBV0@@Z
??0AgTiledImage@@QEAA@XZ
??0AgToolkitWin@@QEAA@AEBV0@@Z
??0AgViewControlBehavior@@QEAA@$$QEAV0@@Z
??0AgViewControlBehavior@@QEAA@AEBV0@@Z
??0AgViewControlBehavior@@QEAA@XZ
??0AgViewManifestationWin@@QEAA@AEBV0@@Z
??0AgViewViewBehavior@@QEAA@$$QEAV0@@Z
??0AgViewViewBehavior@@QEAA@AEBV0@@Z
??0CWinHDCScope@@QEAA@AEBV0@@Z
??0MainThreadReceiverAction@@QEAA@$$QEAV0@@Z
??0MainThreadReceiverAction@@QEAA@AEBV0@@Z
??0MainThreadReceiverAction@@QEAA@XZ
??0RCObject@@QEAA@AEBV0@@Z
??0RCObject@@QEAA@XZ
??0RCPtrBase@@IEAA@AEBV0@@Z
??0RCPtrBase@@IEAA@AEBVRCPtrNull@@@Z
??0RCPtrBase@@IEAA@PEAVRCObject@@@Z
??0RCPtrBase@@IEAA@XZ
??0RCPtrNull@@QEAA@XZ
??0ReferenceCount@@QEAA@AEBV0@@Z
??0ReferenceCount@@QEAA@XZ
??1AgImage@@UEAA@XZ
??1AgPNGProviderWin@@MEAA@XZ
??1AgTiledImage@@UEAA@XZ
??1AgViewWinSwitcherView@@UEAA@XZ
??1ReferenceCount@@QEAA@XZ
??1RegKeyCR@@QEAA@XZ
??1RegKeyCU@@QEAA@XZ
??1RegKeyLM@@QEAA@XZ
??4AgDragTargetViewBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgDragTargetViewBehavior@@QEAAAEAV0@AEBV0@@Z
??4AgDraggingInfo@@QEAAAEAV0@$$QEAV0@@Z
??4AgDraggingInfo@@QEAAAEAV0@AEBV0@@Z
??4AgLuaValueRef@@QEAAAEAV0@AEBV0@@Z
??4AgMutexScope@@QEAAAEAV0@AEBV0@@Z
??4AgNativeImage@@QEAAAEAV0@AEBV0@@Z
??4AgPasteboard@@QEAAAEAV0@AEBV0@@Z
??4AgTiledImage@@QEAAAEAV0@AEBV0@@Z
??4AgToolkitWin@@QEAAAEAV0@AEBV0@@Z
??4AgViewControlBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgViewControlBehavior@@QEAAAEAV0@AEBV0@@Z
??4AgViewManifestationWin@@QEAAAEAV0@AEBV0@@Z
??4AgViewViewBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgViewViewBehavior@@QEAAAEAV0@AEBV0@@Z
??4CWinHDCScope@@QEAAAEAV0@AEBV0@@Z
??4MainThreadReceiverAction@@QEAAAEAV0@$$QEAV0@@Z
??4MainThreadReceiverAction@@QEAAAEAV0@AEBV0@@Z
??4RCObject@@QEAAAEAV0@AEBV0@@Z
??4RCPtrBase@@AEAAXAEBV0@@Z
??4RCPtrNull@@QEAAAEAV0@$$QEAV0@@Z
??4RCPtrNull@@QEAAAEAV0@AEBV0@@Z
??4ReferenceCount@@QEAAAEAV0@AEBV0@@Z
??4RegKey@@QEAAAEAV0@AEBV0@@Z
??4RegKeyCR@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyCR@@QEAAAEAV0@AEBV0@@Z
??4RegKeyCU@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyCU@@QEAAAEAV0@AEBV0@@Z
??4RegKeyLM@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyLM@@QEAAAEAV0@AEBV0@@Z
??7RCPtrBase@@QEBA_NXZ
??8RCPtrBase@@AEBA_NAEBV0@@Z
??9RCPtrBase@@AEBA_NAEBV0@@Z
??IRCObject@@AEBAXXZ
??_7AgDragTargetViewBehavior@@6B@
??_7AgLuaValueRef@@6B@
??_7AgNativeImage@@6B@
??_7AgPNGProviderWin@@6B@
??_7AgTiledImage@@6B@
??_7AgToolkitWin@@6B@
??_7AgViewControlBehavior@@6B@
??_7AgViewManifestationWin@@6B@
??_7AgViewViewBehavior@@6B@
??_7MainThreadReceiverAction@@6B@
??_7RCObject@@6B@
??_FAgPasteboard@@QEAAXXZ
??_FAgViewWin32Window@@QEAAXXZ
??_FStTempLuaState@@QEAAXXZ
?AllowMultipleDestruct@RCObject@@QEAAXXZ
?AllowMultipleDestruct@ReferenceCount@@QEAAXXZ
?CanBecomeKeyWindow@AgViewWin32Window@@UEAA_NXZ
?CanBecomeVisible@AgViewWin32Window@@QEAA_NXZ
?CloneImageWithColorProfile@AgImage@@QEAAPEAVAgTiledImage@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?CloneImageWithColorSpace@AgImage@@QEAAPEAVAgTiledImage@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?Compare@RCPtrBase@@IEBA_NAEBV1@@Z
?CompareNull@RCPtrBase@@IEBA_NXZ
?ComparePointer@RCPtrBase@@IEBA_NPEBVRCObject@@@Z
?CreatedByLua@AgViewManifestationWin@@QEBA_NXZ
?Decrement@ReferenceCount@@QEBA_NXZ
?GetActiveCatalogPath@AgDocument@@UEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetAlwaysShowBars@AgViewWinPanelHost@@QEAA_NXZ
?GetAppInstance@@YAPEAUHINSTANCE__@@XZ
?GetColorSpace@AgGraphics@@QEAA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@XZ
?GetColorSpace@AgImage@@QEAA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@XZ
?GetCurrentModule@AgDocument@@QEAAPEAUAgModule@@XZ
?GetCurrentPath@AgGraphics@@QEAAPEAVGraphicsPath@Gdiplus@@XZ
?GetD2DBitmap@AgNativeImage@@QEAAPEAUID2D1Bitmap@@XZ
?GetDC@CWinHDCScope@@QEAAPEAUHDC__@@XZ
?GetDataAndSize@AgDataProvider@@QEBAXAEAPEAXAEA_K@Z
?GetDocument@AgDocumentView@@QEBAPEAVAgDocument@@XZ
?GetDocumentPath@AgDocument@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFamilyName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFirstMargin@AgViewWinPanel@@QEAAHXZ
?GetFirstPanel@AgViewWinPanelHost@@QEAAAEAVAgViewWinPanel@@XZ
?GetFont@AgWinFont@@QEBAPEAVFont@Gdiplus@@XZ
?GetFontName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFontSize@AgWinFont@@QEBAMXZ
?GetHWnd@AgViewManifestationWin@@UEAAPEAUHWND__@@XZ
?GetLastMargin@AgViewWinPanel@@QEAAHXZ
?GetLastPanel@AgViewWinPanelHost@@QEAAAEAVAgViewWinPanel@@XZ
?GetMaximumSize@AgViewWinPanel@@QEBAHXZ
?GetMinimumSize@AgViewWinPanel@@QEBAHXZ
?GetNativeGraphics@AgGraphics@@QEAAPEAVGraphics@Gdiplus@@XZ
?GetNativeImageRef@AgImage@@QEAA?AV?$RCPtr@VAgNativeImage@@VRCObject@@@@XZ
?GetOffscreenBitmap@AgGraphics@@QEAAPEAVBitmap@Gdiplus@@XZ
?GetPreferredFamilyName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetPreviousModule@AgDocument@@QEAAPEAUAgModule@@XZ
?GetProfilePath@AgColorSpace@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetProviderType@AgDataProvider@@UEAA?AW4WinDataProviderType@@XZ
?GetProviderType@AgPNGProviderWin@@UEAA?AW4WinDataProviderType@@XZ
?GetResizable@AgViewWinPanel@@QEBA_NXZ
?GetSize@AgViewManifestationWin@@QEAAAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetStrokeColor@AgGraphics@@QEAAXAEAVColor@Gdiplus@@@Z
?GetTooltip@AgViewManifestationWin@@QEBAAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetTopWindow@AgViewWinPanelHost@@QEAAPEAVCWnd@@XZ
?HasFirstPanel@AgViewWinPanelHost@@QEAA_NXZ
?HasLastPanel@AgViewWinPanelHost@@QEAA_NXZ
?HasNativeImage@AgImage@@QEAA_NXZ
?HasProfile@AgImage@@QEAA_NXZ
?Increment@ReferenceCount@@QEBAXXZ
?IsAutoLayout@AgViewManifestationWin@@QEAA_NXZ
?IsAutoResize@AgViewManifestationWin@@QEAA_NXZ
?IsComposited@AgViewManifestationWin@@QEAA_NXZ
?IsFloating@AgViewWinPanel@@QEAA_NXZ
?IsInMainFrame@AgViewWinPanelHost@@QEAA_NXZ
?IsLayoutPaused@AgViewManifestationWin@@QEAA_NXZ
?IsPrinterContext@AgGraphics@@QEAA_NXZ
?IsRedrawPaused@AgViewManifestationWin@@QEAA_NXZ
?IsShared@RCObject@@QEBA_NXZ
?IsShared@ReferenceCount@@QEBA_NXZ
?IsToolWindow@AgViewWin32Window@@QEAA_NXZ
?IsUniquelyReferenced@ReferenceCount@@QEBA_NXZ
?IsUnreferenced@ReferenceCount@@QEBA_NXZ
?IsVisible@AgViewWinPanel@@QEAA_NXZ
?LoadDefaultModule@AgDocument@@UEAAXXZ
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@AEBV?$RCPtr@VAgDataProvider@@VRCObject@@@@@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEAD_N@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEA_W@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEBX_K@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@W4AgColorSpaceEnum@@@Z
?Make@AgDataProvider@@SA?AV?$RCPtr@VAgDataProvider@@VRCObject@@@@PEAXPEBX_KP6AX012@Z@Z
?Make@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@PEAUHDC__@@_NV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
?Make@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@PEAUHWND__@@@Z
?Make@AgPNGProviderWin@@SA?AV?$RCPtr@VAgPNGProviderWin@@VAgDataProvider@@@@PEAD@Z
?Make@AgPNGProviderWin@@SA?AV?$RCPtr@VAgPNGProviderWin@@VAgDataProvider@@@@PEAXPEBX_KP6AX012@Z@Z
?Make@AgWinFont@@SA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@AEBUtagLOGFONTW@@@Z
?Make@CGTransform@@SA?AV?$RCPtr@VCGTransform@@VRCObject@@@@MMMMMM@Z
?Make@CGTransform@@SA?AV?$RCPtr@VCGTransform@@VRCObject@@@@XZ
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@AEBV2@HH@Z
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@HHHHV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEAE@Z
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@HHV?$RCPtr@VAgColorSpace@@VRCObject@@@@W4CGImageAlphaInfo@@@Z
?Paint@AgViewManifestationWin@@UEAAXPEAVCDC@@@Z
?PauseLayout@AgViewManifestationWin@@QEAAX_N@Z
?PerformMainThreadAction@MainThreadReceiverAction@@UEAAXXZ
?Pointer@RCPtrBase@@IEBAPEAVRCObject@@XZ
?PreCreateWindow@AgViewWinPanel@@UEAAHAEAUtagCREATESTRUCTW@@@Z
?PushUndoManager@AgDocument@@UEAAXPEAUlua_State@@@Z
?ReleaseNativeImage@AgNativeImage@@UEAAXXZ
?ResetBase@RCPtrBase@@IEAAXAEBV1@@Z
?ResumePanels@AgDocumentView@@QEAAXXZ
?RevealChild@AgViewViewBehavior@@UEAAXPEAUHWND__@@@Z
?RevealRect@AgViewViewBehavior@@UEAAXPEAVCRect@@PEAUHWND__@@@Z
?SetAlwaysShowBars@AgViewWinPanelHost@@QEAAX_N@Z
?SetAutoLayout@AgViewManifestationWin@@QEAAX_N@Z
?SetAutoResize@AgViewManifestationWin@@QEAAX_N@Z
?SetCanBecomeVisible@AgViewWin32Window@@QEAAX_N@Z
?SetComposited@AgViewManifestationWin@@QEAAX_N@Z
?SetCreatedByLua@AgViewManifestationWin@@UEAAX_N@Z
?SetD2DBitmap@AgNativeImage@@QEAAXPEAUID2D1Bitmap@@@Z
?SetDualSize@AgViewWinPanel@@QEAAX_N@Z
?SetFillWithChild@AgViewWin32Window@@QEAAX_N@Z
?SetFirstMargin@AgViewWinPanel@@QEAAXH@Z
?SetIsSecondaryWindow@AgViewWinPanelHost@@QEAAX_N@Z
?SetLastMargin@AgViewWinPanel@@QEAAXH@Z
?SetResizable@AgViewWinPanel@@QEAAX_N@Z
?SetSdkNonModalWindow@AgViewWinFrame@@QEAAX_N@Z
?SetToResumeFocus@AgDocumentView@@QEAAXPEAVCWnd@@@Z
?ShouldDeleteObjectAfterPerformingAction@MainThreadReceiverAction@@UEAA_NXZ
?SuspendPanels@AgDocumentView@@QEAAXXZ
?UseGdiPlusForText@AgGraphics@@QEAA_N_N@Z
?UsePointer@RCPtrBase@@IEBAPEAVRCObject@@XZ
?Verify@AgColorSpace@@QEAA_NXZ
?getClassName@AgDocument@@SAPEBDXZ
?getKey@RegKey@@QEAAPEAUHKEY__@@XZ
?getName@RegKey@@QEAAPEA_WXZ
?getResult@RegKey@@QEAAJXZ
?getTypeName@AgDataProvider@@UEAAPEBDXZ
?getTypeName@AgGraphics@@UEAAPEBDXZ
?getTypeName@AgImage@@UEAAPEBDXZ
?getTypeName@AgPNGProviderWin@@UEAAPEBDXZ
?getTypeName@RCObject@@UEAAPEBDXZ
?isSdkFloatingDialog@AgViewWinFrame@@QEAA_NXZ
?skinChanged@AgViewManifestationWin@@UEAAXXZ
AgApplication_load
AgLicenseController_load_L
AgNglController_bootstrap
AgNglController_launchGoCart_L
AgNglController_new_L
AgNglController_shutdown
AgNgl_init
AgNgl_nativeFuncs_L
private_load_AgHelp
private_load_AgHelpWorker
registerNgl

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 358KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad8012fd1bb74ec42366b80e34ff775d

Headers

DLL Characteristics

File Characteristics

Imports

crclient

headlights

winhttp

crypt32

ahclient

agkernel

ui

substrate

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

msvcp140

bcrypt

secur32

ole32

oleaut32

ws2_32

wininet

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-conio-l1-1-0

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 358KB - Virtual size: 1.4MB

.pdata Size: 172KB - Virtual size: 172KB

.rsrc Size: 9.0MB - Virtual size: 9.0MB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 358KB - Virtual size: 1.4MB

.pdata
Size: 172KB - Virtual size: 172KB

.rsrc
Size: 9.0MB - Virtual size: 9.0MB