Lightroom[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Lightroom.exe
Size

18.3MB
MD5

51f1738c3866c1a92539d778da8fa843
SHA1

fcb703048671b79ffc9939e5e8b5db589882ecb4
SHA256

bdbb4884df52e1a69850614998cb454ba2a9f736e1dbb4b9d73d8f8557a9b7f5
SHA512

43ca20cf678cf78b83b9f8d7055f504e8061b0e0980a7eb80b6cb387a90dd4d1d4ba84d2def0ef486441b6fd56e7ecab0915dc20cb1f2ccab205662fb8a4a103
SSDEEP

393216:OcxPBm/hZxpHf0PcCuA8vVrQzDtUOolYUojCRV:1iiJuAKlQ9elYXGr

Score

1^/10

Malware Config

Signatures

Files

Lightroom.exe
.exe windows x64

5df375ea7d619a844ffd1c2b99acfbcd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crclient

?CrashReporterInitialize@@YA_NPEAXPEBD1111P6A_KAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@ZP6AXXZ_N@Z

headlights

AgWrapperAdobePIPReportSessionCrash

winhttp

WinHttpConnect
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpSetOption
WinHttpSetCredentials
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpCrackUrl

crypt32

CertFreeCertificateChain
CertEnumCertificatesInStore
CertGetCertificateChain
CertOpenSystemStoreA
CryptProtectData
CryptUnprotectData
CryptStringToBinaryW
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CryptImportPublicKeyInfoEx2
CryptHashCertificate2
CertCreateCertificateContext
CertVerifySubjectCertificateContext

ahclient

InitializeAdobeHelpClient
DisplayAdobeHelpClientPage

agkernel

AgLua_toStringNoConvert
AgLua_setCodeCapturing
lua_rawseti
lua_toboolean
KrInit
AgLua_popNil
KrDebugger_open
AgLuaUniverse_createMainUniverse
lua_tonumber
AgLua_pushNamedInteger
AgLua_checkString
AgLua_addFunctionsToTable
AgThreadUtils_isCurrentThreadMainThread
lua_createtable
lua_pushboolean
lua_call
lua_gettop
AgLuaState_addSetupProc
lua_pushlightuserdata
AgLua_invalidateProxyUserdata
AgDirectObject_checkPushAllocToLua
lua_pushstring
lua_pushnumber
AgDirectObject_copyFromLuaStateToLuaState
AgDirectObject_predecrementCount
AgThrowProgramError
AgTransitQueue_checkRetainFromLua
AgTransitQueue_release
AgTransitCargo_newTable
luaL_error
AgLua_checkNumber
AgTransitQueue_enqueueAndReleaseCargo
AgLua_dumpTraceback
AgLua_checkInteger
AgTransitCargo_pushString
AgTransitQueue_newCargo
AgTransitCargo_pushNumber
lua_pushnil
luaL_checklstring
AgTransitCargo_pushBoolean
lua_pushlstring
lua_settable
lua_type
lua_gettable
lua_newuserdata
lua_checkstack
lua_getfield
lua_setmetatable
lua_settop
lua_pushvalue
lua_replace
AgLua_getMethodByName
AgLuaUniverse_mainClosing
lua_pcall
lua_next
lua_tolstring
AgLua_throwProgramError
lua_pushinteger
AgLua_setLogToConsole
lua_setfield
AgLua_checkBoolean
KrLuaCoverage_initCoverage
KrLuaCoverage_enableInstructionCoverage
AgLuaUniverse_getMain
lua_tointeger
AgExceptions_setThrowHook
AgLuaUniverse_close
KrLuaCoverage_enableLineCoverage

ui

?Refresh@AgViewManifestationWin@@UEAAX_N@Z
?SetEnabled@AgViewManifestationWin@@UEAAX_N@Z
?getBackgroundColor@AgViewManifestationWin@@UEAAK_N@Z
?getForegroundColor@AgViewManifestationWin@@UEAAK_N@Z
?getUIColor@AgViewManifestationWin@@UEAAKW4SkinColors@1@@Z
?getLuaEmphasisFontRef@AgViewManifestationWin@@UEAA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@XZ
?getLuaFontRef@AgViewManifestationWin@@UEAA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@XZ
?getSkin@AgViewManifestationWin@@UEAA?AW4Skin@1@XZ
?setSkin@AgViewManifestationWin@@UEAAXW4Skin@1@@Z
?isSkinned@AgViewManifestationWin@@UEAA_NXZ
?pushToLuaWithGC@AgViewManifestationWin@@UEAAXPEAUlua_State@@_N@Z
?pushToLua@AgViewManifestationWin@@UEAAXPEAUlua_State@@@Z
?applyLayout_L@AgViewManifestationWin@@UEAAHPEAUlua_State@@@Z
?creationFinalized_L@AgViewManifestationWin@@UEAAHPEAUlua_State@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphics@@VRCObject@@@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphics@@VRCObject@@@@AEBVCRect@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphicsD2D@@VRCObject@@@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphicsD2D@@VRCObject@@@@AEBVCRect@@@Z
?InitializeFonts@AgViewManifestationWin@@UEAAXPEAUlua_State@@@Z
?GetWnd@AgViewManifestationWin@@UEAAPEAVCWnd@@XZ
??1AgViewManifestationWin@@UEAA@XZ
?MakeLogicalColorSpace@AgColorSpace@@AEAA_NXZ
?GetColorProfile@AgColorSpace@@AEAAPEAXXZ
?Serialize@AgDocument@@UEAAXAEAVCArchive@@@Z
?GetThisClass@AgDocumentView@@SAPEAUCRuntimeClass@@XZ
?registerAgDocument@AgDocument@@SAHPEAUlua_State@@@Z
shutdownWinTab
AgDialogs_isFolderDialogShowing
?ShutdownAgUI@@YAXXZ
AgGraphics_shutdown
SetViewWillHandleMenuKeys
?RestoreWindowFromPrefs@AgViewWinMainFrame@@QEAAXXZ
?SetScreenMode@AgViewWinMainFrame@@QEAAXW4ScreenMode@1@_N@Z
?SuspendFullscreen@AgViewWinMainFrame@@QEAAX_N@Z
?HidePanels@AgViewWinMainFrame@@QEAAXXZ
?ShowPanels@AgViewWinMainFrame@@QEAAXXZ
initWinTab
registerAgViewWinControls
??0AgViewWin32Window@@QEAA@PEAVCWnd@@@Z
?OnDragOver@AgViewWinFrame@@UEAAKPEAVCOleDataObject@@KVCPoint@@@Z
?OnDragLeave@AgViewWinFrame@@UEAAXXZ
?OnDragEnter@AgViewWinFrame@@UEAAKPEAVCOleDataObject@@KVCPoint@@@Z
?OnDrop@AgViewWinFrame@@UEAAHPEAVCOleDataObject@@KVCPoint@@@Z
?PostNcDestroy@AgViewWinFrame@@UEAAXXZ
??0AgViewWinMainFrame@@IEAA@XZ
?GetThisClass@AgViewWinMainFrame@@SAPEAUCRuntimeClass@@XZ
?Create@AgViewWinMainFrame@@UEAAHPEB_W0KAEBUtagRECT@@PEAVCWnd@@0KPEAUCCreateContext@@@Z
?PreTranslateMessage@AgViewWinMainFrame@@UEAAHPEAUtagMSG@@@Z
?OnClose@AgViewWinMainFrame@@UEAAXXZ
?PreCreateWindow@AgViewWinMainFrame@@UEAAHAEAUtagCREATESTRUCTW@@@Z
?OnUpdateFrameTitle@AgViewWinMainFrame@@UEAAXH@Z
?pushToLua@AgViewWinMainFrame@@UEAAXPEAUlua_State@@@Z
?pushToLuaWithGC@AgViewWinMainFrame@@UEAAXPEAUlua_State@@_N@Z
?isSkinned@AgViewWinMainFrame@@UEAA_NXZ
??1AgViewWinMainFrame@@UEAA@XZ
?OnCommand@AgViewWinMainFrame@@MEAAH_K_J@Z
?OnToolHitTest@AgViewWinMainFrame@@MEBA_JVCPoint@@PEAUtagTOOLINFOW@@@Z
?GetThisMessageMap@AgViewWinMainFrame@@KAPEBUAFX_MSGMAP@@XZ
?SuspendPanels@AgViewWinPanelHost@@QEAAXXZ
?ResumePanels@AgViewWinPanelHost@@QEAAXXZ
??0AgPasteboard@@QEAA@PEAUlua_State@@@Z
??0AgDocument@@IEAA@XZ
??1AgDocument@@UEAA@XZ
?OnNewDocument@AgDocument@@UEAAHXZ
?OnCloseDocument@AgDocument@@UEAAXXZ
??0AgColorSpace@@IEAA@PEAD_N@Z
??0AgColorSpace@@IEAA@PEA_W@Z
??0AgColorSpace@@IEAA@PEBX_K@Z
??0AgColorSpace@@IEAA@W4AgColorSpaceEnum@@@Z
??0AgColorSpace@@IEAA@AEBV?$RCPtr@VAgDataProvider@@VRCObject@@@@@Z
??0AgWinFont@@IEAA@AEBUtagLOGFONTW@@@Z
??0AgGraphics@@IEAA@PEAVGraphics@Gdiplus@@V?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgGraphics@@IEAA@PEAUHWND__@@@Z
??0AgGraphics@@IEAA@PEAUHDC__@@_NV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgGraphics@@IEAA@AEBV?$RCPtr@VAgGraphics@@VRCObject@@@@HH@Z
??0AgGraphics@@IEAA@HHHV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgPNGProviderWin@@IEAA@PEAXPEBX_KP6AX012@Z@Z
??0AgPNGProviderWin@@IEAA@PEAD@Z
?GetPixelFormat@AgNativeImage@@UEAAHXZ
??1AgNativeImage@@UEAA@XZ
??0CGTransform@@IEAA@XZ
??0CGTransform@@IEAA@MMMMMM@Z
?AgView_changed_user_entered_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_text_color_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_font_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_enabled_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?isHiddenOrHasHiddenAncestor@AgViewViewBehavior@@UEAA_NXZ
?ScrollIntoView@AgViewViewBehavior@@UEAAX_K_J@Z
?OnRevealWindow@AgViewViewBehavior@@UEAAX_K_J_N2@Z
?frameChanged_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?addChildWindow_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?destroyManifestation_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?isHiddenOrHasHiddenAncestor_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?updateWindow_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?visibleBoundsRect_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?boundsRect_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?displayIfNeeded_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?display_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?setRedraw_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?setNeedsDisplay_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?registerForDraggedTypes_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?revealOnScreen_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?restoreDefaultFocus_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?makeKeyAndOrderFront_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?makeFirstResponder_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?toPDF_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?viewLocationFromEvent_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?screenContainingView_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?globalToViewPoint_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?viewToGlobalPoint_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_tooltip_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_visible_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
??0AgViewViewBehavior@@QEAA@XZ
??1AgDataProvider@@UEAA@XZ
??0AgDataProvider@@IEAA@PEAXPEBX_KP6AX012@Z@Z
?LoadInitialModuleWithToolkitID@AgDocument@@IEAAXAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetMessageMap@AgDocument@@MEBAPEBUAFX_MSGMAP@@XZ
?GetThisClass@AgDocument@@SAPEAUCRuntimeClass@@XZ
?SetModuleWithToolkitID@AgDocument@@QEAA_NAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SaveModified@AgDocument@@UEAAHXZ

substrate

AgPreferences_getLanguageCode
AgVersion_getProductBuildNumber
??1StRestoreStackContents@@QEAA@XZ
AgPreferences_unregister
AgSubstrate_setSharedDebugger
AgNamespace_import
?removeSubkey@RegKey@@QEAA_NPEB_W@Z
?runScript@AgToolkitWin@@QEAAHPEAUlua_State@@PEBD@Z
?getAppToolkit@AgToolkitWin@@SAPEAV1@XZ
AgPathUtilsWin_stringByDeletingLastPathComponent
AgPreferences_setNativeStringForKey
GetMainWindow
AgUnitTests_runAllTestsForCommandLineWithUI
AgPathUtilsWin_stringByAppendingPathComponent
HandleASAPTasks
AgShutdownNotification_callFinalShutdownProcs
??0StRestoreStackContents@@QEAA@PEAUlua_State@@@Z
AgSubstrate_init
AgPreferences_setLanguageCode
?UTF16ToUTF8@@YAHAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@2@AEAK@Z
WaitMessageWhileHandlingMainThreadAction
?AgStringUtils_CStringFromZString@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEBD@Z
AgPathUtilsWin_getStandardFilePath
AgNamespace_importOptional
AgWorkspace_exitViaCloseMainWindow
?NativeStringFromUTF8@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEBD@Z
??0RegKey@@QEAA@QEAUHKEY__@@PEB_WK_N@Z
?setStringValue@RegKey@@QEAAXPEB_W0@Z
?removeValue@RegKey@@QEAA_NPEB_W@Z
?addSubkey@RegKey@@QEAAPEAUHKEY__@@PEB_W00@Z
?enumValue@RegKey@@QEAAPEA_WJ@Z
??0RegKeyLM@@QEAA@PEB_WK_N@Z
?AgLua_checkNativeString@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEAUlua_State@@H@Z
AgLua_pushNativeString
AgNamespace_importEntryWithCache
AgPathUtilsWin_getPathExtension
AgTempLuaState_begin
AgTempLuaState_restoreTop
AgTempLuaState_end
?push@AgLuaValueRef@@QEBAXPEAUlua_State@@@Z
AgPreferences_stringForKey
??1StTempLuaState@@QEAA@XZ
recordTimeInterval
AgDate_timeIntervalSinceReferenceDate
AgMainThreadAction_release
AgMainThreadAction_trigger
AgMainThreadAction_copy
AgStringUtils_UTF8CStringFromZString
?Instance@RCPtrNull@@SA?AV1@XZ
??1RCPtrBase@@QEAA@XZ
AgConfiguration_isEnabled
??0RegKeyCU@@QEAA@PEB_WK_N@Z
?getStringValue@RegKey@@QEAAPEA_WPEB_W@Z
AgNamespace_importEntry
??1RCObject@@UEAA@XZ
??1RegKey@@QEAA@XZ
??0StTempLuaState@@QEAA@PEAUlua_State@@@Z
?initWithPath@AgToolkitWin@@MEAAXPEBD@Z
??1AgToolkitWin@@UEAA@XZ
?getInstance@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?getInstance@AgToolkitWin@@UEAAPEAUHINSTANCE__@@XZ
?hasResource@AgToolkitWin@@UEAA_NPEBD@Z
?fileNamed@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?getResourceByName@AgToolkitWin@@MEAA?AV?$auto_ptr@VAgMemoryBuffer@@@std@@PEBD@Z
?getCFunction@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?resourcesInPath@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?disableDebugFileSubstitution@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
??1AgLuaValueRef@@UEAA@XZ
AgVersionSetup_init
?ResetBase@RCPtrBase@@IEAAXPEAVRCObject@@@Z
?CountIt@RCPtrBase@@AEAAXXZ
AgNamespace_exportFunctions
logBeforeEventTimeStamp

mfc140u

ord2439
ord5183
ord8023
ord7716
ord12544
ord11665
ord10124
ord11929
ord8084
ord1450
ord7393
ord8167
ord11901
ord11933
ord7920
ord11921
ord5706
ord3731
ord365
ord11719
ord11718
ord1059
ord1503
ord13618
ord5709
ord285
ord2921
ord4656
ord14026
ord13986
ord12443
ord296
ord8095
ord4872
ord4873
ord5917
ord12142
ord1766
ord5722
ord13351
ord13360
ord5727
ord13358
ord5726
ord2510
ord4353
ord11119
ord5743
ord8521
ord9043
ord7912
ord8904
ord11484
ord5189
ord3723
ord4443
ord11184
ord10093
ord11850
ord3172
ord3278
ord3279
ord3812
ord2629
ord6631
ord14217
ord7651
ord14211
ord2967
ord4352
ord9384
ord5582
ord4360
ord4828
ord4767
ord4752
ord4814
ord4859
ord4782
ord4837
ord4853
ord4794
ord4800
ord4806
ord12222
ord4843
ord4776
ord1755
ord1734
ord1748
ord1722
ord1700
ord11940
ord11944
ord13513
ord3173
ord10691
ord1844
ord8656
ord14209
ord11625
ord3718
ord8830
ord11415
ord11414
ord5451
ord9979
ord9975
ord14088
ord9978
ord9976
ord7668
ord2698
ord9946
ord3209
ord3212
ord13401
ord6002
ord2903
ord11806
ord1454
ord7922
ord5227
ord7450
ord7461
ord7460
ord5062
ord5229
ord5083
ord5339
ord9041
ord5552
ord5363
ord5080
ord13697
ord13468
ord2779
ord5408
ord5981
ord8772
ord3735
ord10713
ord10956
ord12466
ord5376
ord12256
ord10941
ord8093
ord7395
ord2767
ord13023
ord2511
ord12100
ord12341
ord4549
ord9175
ord2662
ord11775
ord3997
ord3947
ord14132
ord5196
ord5188
ord10122
ord9942
ord10411
ord10827
ord10828
ord9054
ord11432
ord9670
ord8903
ord5557
ord12223
ord14210
ord7650
ord14216
ord9089
ord4011
ord3949
ord4788
ord12625
ord3728
ord2415
ord12212
ord7719
ord14288
ord6121
ord14290
ord6123
ord14289
ord6122
ord13545
ord8159
ord983
ord6614
ord2212
ord4726
ord4511
ord290
ord286
ord4947
ord1501
ord1033
ord280
ord265
ord266
ord1489
ord1491
ord941
ord1775
ord8026
ord13864
ord13761
ord7233
ord2222
ord11928
ord11709
ord2011
ord6505
ord14219
ord14221
ord2270
ord2273
ord5555
ord9941
ord8900
ord316
ord1034
ord1511
ord14043
ord1670
ord2909
ord4510
ord14027
ord8451
ord14360
ord11664
ord1492
ord324
ord1040
ord2327
ord323
ord1039
ord2372
ord6729
ord2370
ord12606
ord9977

kernel32

OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
WaitForSingleObjectEx
ResetEvent
LocalAlloc
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
FlushConsoleInputBuffer
LoadLibraryA
lstrlenA
lstrcpynA
lstrcmpiA
GetCurrentProcess
CreateMutexA
GlobalMemoryStatus
QueryPerformanceCounter
GetConsoleScreenBufferInfo
GetLocaleInfoA
SystemTimeToFileTime
SetVolumeLabelA
DosDateTimeToFileTime
SetFilePointer
LocalFileTimeToFileTime
GetDriveTypeA
SetConsoleMode
GetConsoleMode
GetVolumeInformationA
GetVersion
SetFileAttributesA
ReadFile
GetFullPathNameA
FileTimeToLocalFileTime
CreateFileA
GetFileAttributesA
FindNextFileA
FindFirstFileA
WriteFile
GetFileType
GetStdHandle
AreFileApisANSI
SetEvent
CreateEventW
GetACP
InitializeCriticalSectionAndSpinCount
CopyFileW
GetModuleHandleA
GetWindowsDirectoryW
SetFileTime
SetEndOfFile
RemoveDirectoryW
GetFileTime
CreateDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableW
FormatMessageA
TlsFree
TlsAlloc
lstrcmpW
GetTickCount
SetCurrentDirectoryW
HeapSetInformation
GetCommandLineW
OutputDebugStringA
GetModuleHandleW
GetModuleFileNameW
MulDiv
IsBadWritePtr
RaiseException
GetNativeSystemInfo
FileTimeToSystemTime
GetComputerNameExW
GetVersionExW
GetTempPathW
DeviceIoControl
GetDateFormatW
GetTimeFormatW
GetLocalTime
DeleteFileW
SetFileAttributesW
GetFileAttributesW
CreateFileW
FindClose
GetFileSizeEx
FindNextFileW
FindFirstFileW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetCurrentThreadId
OpenMutexW
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetProcessHeap
HeapAlloc
HeapFree
LocalFree
GetLastError
FormatMessageW
WideCharToMultiByte
CreateProcessW
CloseHandle
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
InitializeCriticalSectionEx

user32

LoadCursorW
PostQuitMessage
GetDesktopWindow
GetClassInfoExW
GetAncestor
EnableWindow
GetDC
MessageBoxW
ShowWindow
GetAsyncKeyState
SetRect
ReleaseDC
AdjustWindowRectEx
PostMessageW
GetClientRect
TranslateMessage
DispatchMessageW
GetActiveWindow
RegisterClassExW
GetWindowLongPtrW
SendMessageW
OemToCharA
GetUserObjectInformationW
GetProcessWindowStation
CharToOemA
GetKeyState
IsWindow
FindWindowW
UpdateWindow
SetForegroundWindow
IsIconic
InvalidateRect
SetTimer
KillTimer
GetFocus
SetActiveWindow
MonitorFromRect
GetSystemMetrics
GetMonitorInfoW
GetMessageW
DefWindowProcW
GetWindowRect
DestroyWindow
SetWindowPos
SetWindowLongPtrW
CreateWindowExW

gdi32

GetDeviceCaps

advapi32

CredWriteW
CredDeleteW
CredFree
CredEnumerateW
CredReadW
CryptReleaseContext
CryptGenRandom
ReportEventW
SetKernelObjectSecurity
IsValidSid
IsValidSecurityDescriptor
IsValidAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
LookupPrivilegeValueA
GetKernelObjectSecurity
AdjustTokenPrivileges
OpenProcessToken
CryptAcquireContextW
GetUserNameW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
RegFlushKey
DeregisterEventSource
RegisterEventSourceW

shell32

ShellExecuteW
SHGetFolderPathW
SHGetKnownFolderPath
SHCreateDirectoryExW
SHAddToRecentDocs

comctl32

InitCommonControlsEx

shlwapi

PathIsFileSpecW
UrlEscapeW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFileExistsW
PathAddExtensionW
PathQuoteSpacesW
PathAppendW
PathIsDirectoryW
PathRenameExtensionW
UrlCanonicalizeW
StrStrW

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_signal
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Mtx_current_owns
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Query_perf_frequency
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Winerror_message@std@@YAKKPEADK@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_XGetLastError@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_timedwait
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
_Thrd_id
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Wcsxfrm
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
_Wcscoll
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Random_device@std@@YAIXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Strcoll
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Strxfrm
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?uncaught_exception@std@@YA_NXZ
_Thrd_sleep
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Xbad_alloc@std@@YAXXZ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Mtx_unlock
_Cnd_init
_Mtx_destroy
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_start
_Mtx_init
_Cnd_wait
_Cnd_destroy
_Cnd_do_broadcast_at_thread_exit
_Cnd_register_at_thread_exit
_Mtx_init_in_situ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_lock
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptVerifySignature
BCryptGetProperty
BCryptDestroyHash

secur32

GetUserNameExW

ole32

CoTaskMemFree
OleSetContainedObject
CoTaskMemAlloc
OleCreate
OleLockRunning
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CoCreateInstance
CoCreateGuid

oleaut32

SafeArrayGetLBound
VariantClear
VariantChangeType
SafeArrayAccessData
SysAllocStringLen
SysStringLen
SysFreeString
SafeArrayGetUBound
VariantInit
SysAllocString

ws2_32

WSAStartup
WSACleanup

wininet

InternetSetOptionW
InternetGetConnectedState

vcruntime140

__CxxFrameHandler3
__std_terminate
_purecall
__std_exception_destroy
memchr
memcmp
wcsstr
memset
strstr
memcpy
_CxxThrowException
memmove
__RTDynamicCast
__std_type_info_name
__C_specific_handler
__std_type_info_compare
strchr
__std_exception_copy

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
strtoull
strtol

api-ms-win-crt-string-l1-1-0

isspace
_strupr
isupper
isdigit
isxdigit
wcscpy_s
islower
wcscat_s
isprint
mblen
strcmp
_strnicmp
strncpy
strncmp
strncat
isalnum
isalpha
toupper
_stricmp
tolower

api-ms-win-crt-stdio-l1-1-0

_close
_read
_mktemp
feof
_open
_write
fputs
__stdio_common_vswprintf
__p__commode
__stdio_common_vsprintf
_get_osfhandle
_set_fmode
_lseeki64
fgets
putc
__stdio_common_vfwprintf
fopen
_wfopen
__stdio_common_vsscanf
__stdio_common_vswprintf_s
_fileno
__acrt_iob_func
fclose
fwrite
fopen_s
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
fseek
ferror
ftell
__stdio_common_vsprintf_s
_isatty
_get_stream_buffer_pointers
__stdio_common_vswscanf
_setmode
fputc
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
fgetwc
fgetc
ungetwc
fputwc
fflush
__stdio_common_vsnwprintf_s

api-ms-win-crt-filesystem-l1-1-0

_waccess_s
_unlink
_lock_file
_stat64
rename
_mkdir
_chmod
_wstat64i32
_unlock_file

api-ms-win-crt-heap-l1-1-0

realloc
malloc
calloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initterm
strerror
_initterm_e
signal
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
raise
_set_app_type
_exit
exit
perror
_configure_wide_argv
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_initialize_wide_environment
terminate
_register_onexit_function
_crt_atexit
_get_wide_winmain_command_line
_errno

api-ms-win-crt-time-l1-1-0

_gmtime64
_localtime64
_difftime64
_mkgmtime64
_ftime64_s
_time64
_localtime64_s
_tzset
_mktime64
wcsftime
strftime

api-ms-win-crt-math-l1-1-0

modf
_dtest
__setusermatherr

api-ms-win-crt-locale-l1-1-0

localeconv
___mb_cur_max_func
setlocale
_configthreadlocale

api-ms-win-crt-environment-l1-1-0

_dupenv_s
getenv
_putenv

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort

api-ms-win-crt-multibyte-l1-1-0

_mbschr
_mbsinc
_mbclen
_mbsrchr

api-ms-win-crt-conio-l1-1-0

_getch

Exports

Exports

??0AgDragTargetViewBehavior@@QEAA@$$QEAV0@@Z
??0AgDragTargetViewBehavior@@QEAA@AEBV0@@Z
??0AgDragTargetViewBehavior@@QEAA@XZ
??0AgLuaValueRef@@QEAA@AEBV0@@Z
??0AgNativeImage@@QEAA@AEBV0@@Z
??0AgTiledImage@@QEAA@AEBV0@@Z
??0AgTiledImage@@QEAA@XZ
??0AgToolkitWin@@QEAA@AEBV0@@Z
??0AgViewControlBehavior@@QEAA@$$QEAV0@@Z
??0AgViewControlBehavior@@QEAA@AEBV0@@Z
??0AgViewControlBehavior@@QEAA@XZ
??0AgViewManifestationWin@@QEAA@AEBV0@@Z
??0AgViewViewBehavior@@QEAA@$$QEAV0@@Z
??0AgViewViewBehavior@@QEAA@AEBV0@@Z
??0CWinHDCScope@@QEAA@AEBV0@@Z
??0MainThreadReceiverAction@@QEAA@$$QEAV0@@Z
??0MainThreadReceiverAction@@QEAA@AEBV0@@Z
??0MainThreadReceiverAction@@QEAA@XZ
??0RCObject@@QEAA@AEBV0@@Z
??0RCObject@@QEAA@XZ
??0RCPtrBase@@IEAA@AEBV0@@Z
??0RCPtrBase@@IEAA@AEBVRCPtrNull@@@Z
??0RCPtrBase@@IEAA@PEAVRCObject@@@Z
??0RCPtrBase@@IEAA@XZ
??0RCPtrNull@@QEAA@XZ
??0ReferenceCount@@QEAA@AEBV0@@Z
??0ReferenceCount@@QEAA@XZ
??1AgImage@@UEAA@XZ
??1AgPNGProviderWin@@MEAA@XZ
??1AgTiledImage@@UEAA@XZ
??1AgViewWinSwitcherView@@UEAA@XZ
??1ReferenceCount@@QEAA@XZ
??1RegKeyCR@@QEAA@XZ
??1RegKeyCU@@QEAA@XZ
??1RegKeyLM@@QEAA@XZ
??4AgDragTargetViewBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgDragTargetViewBehavior@@QEAAAEAV0@AEBV0@@Z
??4AgDraggingInfo@@QEAAAEAV0@$$QEAV0@@Z
??4AgDraggingInfo@@QEAAAEAV0@AEBV0@@Z
??4AgLuaValueRef@@QEAAAEAV0@AEBV0@@Z
??4AgMutexScope@@QEAAAEAV0@AEBV0@@Z
??4AgNativeImage@@QEAAAEAV0@AEBV0@@Z
??4AgPasteboard@@QEAAAEAV0@AEBV0@@Z
??4AgTiledImage@@QEAAAEAV0@AEBV0@@Z
??4AgToolkitWin@@QEAAAEAV0@AEBV0@@Z
??4AgViewControlBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgViewControlBehavior@@QEAAAEAV0@AEBV0@@Z
??4AgViewManifestationWin@@QEAAAEAV0@AEBV0@@Z
??4AgViewViewBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgViewViewBehavior@@QEAAAEAV0@AEBV0@@Z
??4CWinHDCScope@@QEAAAEAV0@AEBV0@@Z
??4MainThreadReceiverAction@@QEAAAEAV0@$$QEAV0@@Z
??4MainThreadReceiverAction@@QEAAAEAV0@AEBV0@@Z
??4RCObject@@QEAAAEAV0@AEBV0@@Z
??4RCPtrBase@@AEAAXAEBV0@@Z
??4RCPtrNull@@QEAAAEAV0@$$QEAV0@@Z
??4RCPtrNull@@QEAAAEAV0@AEBV0@@Z
??4ReferenceCount@@QEAAAEAV0@AEBV0@@Z
??4RegKey@@QEAAAEAV0@AEBV0@@Z
??4RegKeyCR@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyCR@@QEAAAEAV0@AEBV0@@Z
??4RegKeyCU@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyCU@@QEAAAEAV0@AEBV0@@Z
??4RegKeyLM@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyLM@@QEAAAEAV0@AEBV0@@Z
??7RCPtrBase@@QEBA_NXZ
??8RCPtrBase@@AEBA_NAEBV0@@Z
??9RCPtrBase@@AEBA_NAEBV0@@Z
??IRCObject@@AEBAXXZ
??_7AgDragTargetViewBehavior@@6B@
??_7AgLuaValueRef@@6B@
??_7AgNativeImage@@6B@
??_7AgPNGProviderWin@@6B@
??_7AgTiledImage@@6B@
??_7AgToolkitWin@@6B@
??_7AgViewControlBehavior@@6B@
??_7AgViewManifestationWin@@6B@
??_7AgViewViewBehavior@@6B@
??_7MainThreadReceiverAction@@6B@
??_7RCObject@@6B@
??_FAgPasteboard@@QEAAXXZ
??_FAgViewWin32Window@@QEAAXXZ
??_FStTempLuaState@@QEAAXXZ
?AllowMultipleDestruct@RCObject@@QEAAXXZ
?AllowMultipleDestruct@ReferenceCount@@QEAAXXZ
?CanBecomeKeyWindow@AgViewWin32Window@@UEAA_NXZ
?CanBecomeVisible@AgViewWin32Window@@QEAA_NXZ
?CloneImageWithColorProfile@AgImage@@QEAAPEAVAgTiledImage@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?CloneImageWithColorSpace@AgImage@@QEAAPEAVAgTiledImage@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?Compare@RCPtrBase@@IEBA_NAEBV1@@Z
?CompareNull@RCPtrBase@@IEBA_NXZ
?ComparePointer@RCPtrBase@@IEBA_NPEBVRCObject@@@Z
?CreatedByLua@AgViewManifestationWin@@QEBA_NXZ
?Decrement@ReferenceCount@@QEBA_NXZ
?GetActiveCatalogPath@AgDocument@@UEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetAlwaysShowBars@AgViewWinPanelHost@@QEAA_NXZ
?GetAppInstance@@YAPEAUHINSTANCE__@@XZ
?GetColorSpace@AgGraphics@@QEAA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@XZ
?GetColorSpace@AgImage@@QEAA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@XZ
?GetCurrentModule@AgDocument@@QEAAPEAUAgModule@@XZ
?GetCurrentPath@AgGraphics@@QEAAPEAVGraphicsPath@Gdiplus@@XZ
?GetD2DBitmap@AgNativeImage@@QEAAPEAUID2D1Bitmap@@XZ
?GetDC@CWinHDCScope@@QEAAPEAUHDC__@@XZ
?GetDataAndSize@AgDataProvider@@QEBAXAEAPEAXAEA_K@Z
?GetDocument@AgDocumentView@@QEBAPEAVAgDocument@@XZ
?GetDocumentPath@AgDocument@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFamilyName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFirstMargin@AgViewWinPanel@@QEAAHXZ
?GetFirstPanel@AgViewWinPanelHost@@QEAAAEAVAgViewWinPanel@@XZ
?GetFont@AgWinFont@@QEBAPEAVFont@Gdiplus@@XZ
?GetFontName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFontSize@AgWinFont@@QEBAMXZ
?GetHWnd@AgViewManifestationWin@@UEAAPEAUHWND__@@XZ
?GetLastMargin@AgViewWinPanel@@QEAAHXZ
?GetLastPanel@AgViewWinPanelHost@@QEAAAEAVAgViewWinPanel@@XZ
?GetMaximumSize@AgViewWinPanel@@QEBAHXZ
?GetMinimumSize@AgViewWinPanel@@QEBAHXZ
?GetNativeGraphics@AgGraphics@@QEAAPEAVGraphics@Gdiplus@@XZ
?GetNativeImageRef@AgImage@@QEAA?AV?$RCPtr@VAgNativeImage@@VRCObject@@@@XZ
?GetOffscreenBitmap@AgGraphics@@QEAAPEAVBitmap@Gdiplus@@XZ
?GetPreferredFamilyName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetPreviousModule@AgDocument@@QEAAPEAUAgModule@@XZ
?GetProfilePath@AgColorSpace@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetProviderType@AgDataProvider@@UEAA?AW4WinDataProviderType@@XZ
?GetProviderType@AgPNGProviderWin@@UEAA?AW4WinDataProviderType@@XZ
?GetResizable@AgViewWinPanel@@QEBA_NXZ
?GetSize@AgViewManifestationWin@@QEAAAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetStrokeColor@AgGraphics@@QEAAXAEAVColor@Gdiplus@@@Z
?GetTooltip@AgViewManifestationWin@@QEBAAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetTopWindow@AgViewWinPanelHost@@QEAAPEAVCWnd@@XZ
?HasFirstPanel@AgViewWinPanelHost@@QEAA_NXZ
?HasLastPanel@AgViewWinPanelHost@@QEAA_NXZ
?HasNativeImage@AgImage@@QEAA_NXZ
?HasProfile@AgImage@@QEAA_NXZ
?Increment@ReferenceCount@@QEBAXXZ
?IsAutoLayout@AgViewManifestationWin@@QEAA_NXZ
?IsAutoResize@AgViewManifestationWin@@QEAA_NXZ
?IsComposited@AgViewManifestationWin@@QEAA_NXZ
?IsFloating@AgViewWinPanel@@QEAA_NXZ
?IsInMainFrame@AgViewWinPanelHost@@QEAA_NXZ
?IsLayoutPaused@AgViewManifestationWin@@QEAA_NXZ
?IsPrinterContext@AgGraphics@@QEAA_NXZ
?IsRedrawPaused@AgViewManifestationWin@@QEAA_NXZ
?IsShared@RCObject@@QEBA_NXZ
?IsShared@ReferenceCount@@QEBA_NXZ
?IsToolWindow@AgViewWin32Window@@QEAA_NXZ
?IsUniquelyReferenced@ReferenceCount@@QEBA_NXZ
?IsUnreferenced@ReferenceCount@@QEBA_NXZ
?IsVisible@AgViewWinPanel@@QEAA_NXZ
?LoadDefaultModule@AgDocument@@UEAAXXZ
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@AEBV?$RCPtr@VAgDataProvider@@VRCObject@@@@@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEAD_N@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEA_W@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEBX_K@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@W4AgColorSpaceEnum@@@Z
?Make@AgDataProvider@@SA?AV?$RCPtr@VAgDataProvider@@VRCObject@@@@PEAXPEBX_KP6AX012@Z@Z
?Make@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@PEAUHDC__@@_NV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
?Make@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@PEAUHWND__@@@Z
?Make@AgPNGProviderWin@@SA?AV?$RCPtr@VAgPNGProviderWin@@VAgDataProvider@@@@PEAD@Z
?Make@AgPNGProviderWin@@SA?AV?$RCPtr@VAgPNGProviderWin@@VAgDataProvider@@@@PEAXPEBX_KP6AX012@Z@Z
?Make@AgWinFont@@SA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@AEBUtagLOGFONTW@@@Z
?Make@CGTransform@@SA?AV?$RCPtr@VCGTransform@@VRCObject@@@@MMMMMM@Z
?Make@CGTransform@@SA?AV?$RCPtr@VCGTransform@@VRCObject@@@@XZ
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@AEBV2@HH@Z
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@HHHHV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEAE@Z
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@HHV?$RCPtr@VAgColorSpace@@VRCObject@@@@W4CGImageAlphaInfo@@@Z
?Paint@AgViewManifestationWin@@UEAAXPEAVCDC@@@Z
?PauseLayout@AgViewManifestationWin@@QEAAX_N@Z
?PerformMainThreadAction@MainThreadReceiverAction@@UEAAXXZ
?Pointer@RCPtrBase@@IEBAPEAVRCObject@@XZ
?PreCreateWindow@AgViewWinPanel@@UEAAHAEAUtagCREATESTRUCTW@@@Z
?PushUndoManager@AgDocument@@UEAAXPEAUlua_State@@@Z
?ReleaseNativeImage@AgNativeImage@@UEAAXXZ
?ResetBase@RCPtrBase@@IEAAXAEBV1@@Z
?ResumePanels@AgDocumentView@@QEAAXXZ
?RevealChild@AgViewViewBehavior@@UEAAXPEAUHWND__@@@Z
?RevealRect@AgViewViewBehavior@@UEAAXPEAVCRect@@PEAUHWND__@@@Z
?SetAlwaysShowBars@AgViewWinPanelHost@@QEAAX_N@Z
?SetAutoLayout@AgViewManifestationWin@@QEAAX_N@Z
?SetAutoResize@AgViewManifestationWin@@QEAAX_N@Z
?SetCanBecomeVisible@AgViewWin32Window@@QEAAX_N@Z
?SetComposited@AgViewManifestationWin@@QEAAX_N@Z
?SetCreatedByLua@AgViewManifestationWin@@UEAAX_N@Z
?SetD2DBitmap@AgNativeImage@@QEAAXPEAUID2D1Bitmap@@@Z
?SetDualSize@AgViewWinPanel@@QEAAX_N@Z
?SetFillWithChild@AgViewWin32Window@@QEAAX_N@Z
?SetFirstMargin@AgViewWinPanel@@QEAAXH@Z
?SetIsSecondaryWindow@AgViewWinPanelHost@@QEAAX_N@Z
?SetLastMargin@AgViewWinPanel@@QEAAXH@Z
?SetResizable@AgViewWinPanel@@QEAAX_N@Z
?SetSdkNonModalWindow@AgViewWinFrame@@QEAAX_N@Z
?SetToResumeFocus@AgDocumentView@@QEAAXPEAVCWnd@@@Z
?ShouldDeleteObjectAfterPerformingAction@MainThreadReceiverAction@@UEAA_NXZ
?SuspendPanels@AgDocumentView@@QEAAXXZ
?UseGdiPlusForText@AgGraphics@@QEAA_N_N@Z
?UsePointer@RCPtrBase@@IEBAPEAVRCObject@@XZ
?Verify@AgColorSpace@@QEAA_NXZ
?getClassName@AgDocument@@SAPEBDXZ
?getKey@RegKey@@QEAAPEAUHKEY__@@XZ
?getName@RegKey@@QEAAPEA_WXZ
?getResult@RegKey@@QEAAJXZ
?getTypeName@AgDataProvider@@UEAAPEBDXZ
?getTypeName@AgGraphics@@UEAAPEBDXZ
?getTypeName@AgImage@@UEAAPEBDXZ
?getTypeName@AgPNGProviderWin@@UEAAPEBDXZ
?getTypeName@RCObject@@UEAAPEBDXZ
?isSdkFloatingDialog@AgViewWinFrame@@QEAA_NXZ
?skinChanged@AgViewManifestationWin@@UEAAXXZ
AgApplication_load
AgLicenseController_load_L
AgNglController_bootstrap
AgNglController_launchGoCart_L
AgNglController_new_L
AgNglController_shutdown
AgNgl_init
AgNgl_nativeFuncs_L
private_load_AgHelp
private_load_AgHelpWorker
registerNgl

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 335KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13.4MB - Virtual size: 13.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5df375ea7d619a844ffd1c2b99acfbcd

Headers

DLL Characteristics

File Characteristics

Imports

crclient

headlights

winhttp

crypt32

ahclient

agkernel

ui

substrate

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

msvcp140

bcrypt

secur32

ole32

oleaut32

ws2_32

wininet

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-conio-l1-1-0

Exports

Exports

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 335KB - Virtual size: 1.4MB

.pdata Size: 154KB - Virtual size: 154KB

.rsrc Size: 13.4MB - Virtual size: 13.4MB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 335KB - Virtual size: 1.4MB

.pdata
Size: 154KB - Virtual size: 154KB

.rsrc
Size: 13.4MB - Virtual size: 13.4MB