5ħ�W��`b�S��g�@��4p�+�Ya�z�u��ATQ�A������{��s��_s�#�/ �璹C�,/@h8b� Q*�����IŲi��4K�l|n���G�f =5��2 �����X N 8&_��))���[%05�bnx�T&�/W�`�4@� yL �G#���_��w�FʊS�L�)�k�d�K�N��S�1�U%H�$�g�Lk�|�)���p��О.J���V���"�grx�?�`_'����Af��� �{�Q���Ǐ lj�G- �n���` %�)V�t߽��9�F?�o��p�L=Ԃ���/�������/���3�&Z5`t�۾-����H��&ڋhb��H<c������IAe&!ܴ#t�ͪ�p�vI��� � ��3�55I��� A�d8�P7b�0�B�re��m吭38w���ǭ�Q�^(t��N�.-�jHH��5F���v�a�,�0GO��gO�LJ�1v��N���A����8��,��9`�����5g���9�j� �O?��i�Ly2��ς�n�<��U�f4��ɨe��[�e:Y��c���N� 鞒q ʷrMZ9>k�g#;RV��@����u�f~ �\;�����<�p1%���Y��n�(ǚ;�A_lOA�_�ӌ�al�%(_P�NI���Fq3��DLnW�O�n�i:�K2����L�n�y[��+�]�#Q�{�����[����2<%���<���=@�0`j�+`U7�1��*�Q���4e�������d�a9���hfͪ��p/�\9��ڨ[2Z �������N���k�V�����@�[���\�Oy��S�}R�9�ʚ��j���{��g�y$H=���5�v���ޏz ߱��j�1}��� w7�=��$�@A�1?�ϻx&�Y�d��(<���#�N<t@W[�b���\����� ��d��E-�ckd2���lS�-\�mV��+ ��iMV{�k1z�'$�H��ct~� �7�M��OˉRɝ(��r�ibGqR ��^"ܸP�Kx-M�CB�� 3��Z����Q��Ǣ�)����h�][�6Wğ3w?� 5�i�y"�;]G�_@��uT.�hE��~ �*�|W`� R�K�}�;�x0x;(^�$v�N�B%01Ҹ�K����V�W�=B`��q��,����SGx�s{���FF[C%��9D�;�H��]����@�EQ�#�0��U�1����*ټֳ�ºRL`�| �_� ߴ��7H9HM�l���v��'��{@A����+6�sS�@1 ��bL�0~��'�� |�E���j^���hS��Å�^���� =O���We��F�q�!�P���Z��f���(�� ��-����l!A�f�p?:8�x��b)�uo�)�+�+�D�O�E��c纊;�Y��t�u9�2�%'�ހ��okX����!������۹O/�%\��D��a)��j?p�m?����F�������Z|�^V���=/{;BLr�RL��PëY��~唷gT�����!�=psi�39���ǘ���T'���� ��җ�6�7V��Y�F�cã��D {��8μ����d�Eݏs��e>ei�?3�nĜ���㢡Zy��f`%����'} ���}tHZ���8Y@�Z���c�}��ѴFb�'[��� sjD��K�Ìm�6��Ta�ި(T����\���2d���6��ET0�|!���fB<}-ANSӺ�n���q��� �P��G�V��˛nl1�j��?}�XpѿIԛ�UE�.���w��)j���+�=zܷ���Ov�э-��t,^f�đ(f�1B����ŨO��q=)^`jeVԶJ�)���a_�����5{s ���2�@��j��V�G��3�;�~ub��6Q��H�$�L5���E�(9��y�)!0�@Q�%�� 2_<�kN<}�on?��O��$�$.·P��ڏ�p��� ��yX��`�E�i�&�Q?�"0�=�,��T���9pU���S4�n� >9�������|jSDη�T����ċ���A�Ó��X:3�ls��O��� K��el��y�"bX>���B�Ϟ��YЂ6�s������B�_����]Z+��5��b���-���^���{8�"�0�` �Q����KW�?K�� myw�F:'�H�����Q?�H�L�eIHzɎ�B��܉*C4�d������܋O?��3��o��<���Y��{��*J#Ji����,4�0L>ar����΄k8�����g[Q'QS��-:�NZ��UĦqv�sHږNĥ{,-�Q H�#������f���Mt�����#�2�}�C�I��D���'�2�\��Q�A�8�n�����Q ��a�-/ؑ<�iW#J18�m]}c�D�ﲃ�>����4kZi�@�ʏUX҂X(�zl�ao��n>Dsu8%z�P�5}�������`!�!�s��e�����z ����C�7O�[N8#���鲜z�M2�V5M�%�;K�4JD�.�X�Z���RJ�;����Pr�?cWJe���xw�.��A]1�����n������Rr-;_*���E6��@�]`��i�k� 戆�ZeYf�� �Mj`��%�zj���� ��l��)*��S���c���d�I��[��=إ�����������+wPI^N�*�dp��(��q��~d�t�����d$G��#�a?�lm�����&�j���{��"v� �~� uĿ��kf�%�\@���lgj�k����_���6��ա����d��G�'��:����U3mX�P����K"&�2d�V������m��sB,��h�'/��1h�!Ů�b��a�uW�_���o��Q����LK�vw0q�7A9 ��Ii����.�u1J�0�p"\��ʀ��5�u���H�Msܨ!|Uo�52�K:�n)M���[��jJx$�����~.��2u(���Q!�0e��br�5���-�Q���=Wb�~�Q{ �XDq��̈́��-cN!h ��?�+Y��M��o&x���@p�D �Y_��MО�
General
-
Target
Karma Rip.rar
-
Size
35.4MB
-
MD5
82a061c84680a7e53a4a3e63527dec43
-
SHA1
57485f922e71890b4b51225fa8d8a91d75c89fc0
-
SHA256
272c7f05efe0b5a305e024fcba78ca59887df7bd05085320a9cb41c45743e9fb
-
SHA512
2ce1b89694de0c3236e19a05acdb7868e5ca9ab5f86a41806a3bf564739477d8291711e76a69a343a20b22e43998ab643ab8cdbe03a4785b7fe9c2b101f0ec8a
-
SSDEEP
786432:DzlFClYfW2xM6IiENcDs7t1PQYgps41y62/smVhQUixZ404h:DBHNI0w7/74E62rflh
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Karma Rip/ZoomInstallerFull.exe upx -
Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Karma Rip/inject.exe pyinstaller
Files
-
Karma Rip.rar.rar
-
Karma Rip/ZoomInstallerFull.exe.exe windows x64
612e8afb77598c53323490687026d5f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d10
D3D10CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GlobalFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetCurrentHwProfileA
ole32
CoInitializeSecurity
oleaut32
SysAllocString
imm32
ImmSetCandidateWindow
ws2_32
setsockopt
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 808KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 16.6MB - Virtual size: 16.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Karma Rip/adminserver.dll.dll windows x86
19c381d8d9099702a70f36293a05a800
Code Sign
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21-12-2012 00:00Not After30-12-2020 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18-10-2012 00:00Not After29-12-2020 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before28-09-2012 00:00Not After23-11-2015 23:59SubjectCN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:fc:df:f8:62:f6:db:06:b1:40:41:64:01:42:6d:ce:11:76:df:b9Signer
Actual PE Digest52:fc:df:f8:62:f6:db:06:b1:40:41:64:01:42:6d:ce:11:76:df:b9Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US24-04-2014 18:16 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
tier0
Plat_IsInDebugSession
Warning
CommandLine_Tier0
g_ClockSpeedSecondsMultiplier
WriteMiniDump
g_pMemAlloc
Error
Msg
DevMsg
?DevMsg@@YAXPBDZZ
?UnlockRead@CThreadSpinRWLock@@QAEXXZ
?LockForRead@CThreadSpinRWLock@@QAEXXZ
??0CThreadSpinRWLock@@QAE@XZ
?UnlockWrite@CThreadSpinRWLock@@QAEXXZ
?LockForWrite@CThreadSpinRWLock@@QAEXXZ
Plat_FloatTime
vstdlib
KeyValuesSystem
kernel32
TlsFree
CreateFileW
WriteConsoleW
CompareStringW
GetTimeZoneInformation
HeapFree
SetEndOfFile
ReadFile
FlushFileBuffers
GetModuleFileNameA
VirtualQuery
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
GetProcAddress
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetDriveTypeW
GetLastError
GetFullPathNameA
GetSystemTimeAsFileTime
SetEnvironmentVariableA
InterlockedDecrement
InterlockedIncrement
FindClose
GetDriveTypeA
FindFirstFileExA
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
GetModuleHandleW
ExitProcess
RaiseException
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
SetStdHandle
SetLastError
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCurrentDirectoryW
GetStringTypeW
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
shell32
ShellExecuteA
Exports
Exports
CreateInterface
cvar
Sections
.text Size: 570KB - Virtual size: 569KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Karma Rip/inject.exe.exe windows x64
0b5552dccd9d0a834cea55c0c8fc05be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetOEMCP
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetEndOfFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Karma Rip/server.bat
-
Karma Rip/xrNetServer.dll.dll windows x86
842b3611d26efa2ce69dea3a4c1822bb
Code Sign
0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06-08-2003 00:00Not After05-08-2013 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
60:68:30:6b:b7:0d:d7:0a:ea:94:bb:90:d1:23:9b:e6Certificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before03-02-2009 00:00Not After26-04-2011 23:59SubjectCN=GSC Game World,OU=SECURE APPLICATION DEVELOPMENT,O=GSC Game World,L=Kiev,ST=Kiev,C=UAExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
34:3c:96:c3:ae:95:6f:74:a6:b7:6b:64:21:6e:e0:6c:48:f8:35:23Signer
Actual PE Digest34:3c:96:c3:ae:95:6f:74:a6:b7:6b:64:21:6e:e0:6c:48:f8:35:23Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=GSC Game World,OU=SECURE APPLICATION DEVELOPMENT,O=GSC Game World,L=Kiev,ST=Kiev,C=UA15-12-2009 12:14 Valid: false
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostbyname
inet_ntoa
kernel32
InterlockedExchange
DisableThreadLibraryCalls
QueryPerformanceCounter
Sleep
SetThreadPriority
GetTickCount
GetCurrentProcessId
GetCurrentThread
WideCharToMultiByte
MultiByteToWideChar
InterlockedCompareExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
ole32
CoCreateInstance
xrcore
?rtc9_compress@@YAIPAXIPBXI@Z
?rtc9_decompress@@YAIPAXIPBXI@Z
?rtc_csize@@YAII@Z
?w@NET_Packet@@QAEXPBXI@Z
?w_u16@NET_Packet@@QAEXG@Z
?error2string@xrDebug@@QAEPBDJ@Z
?Core@@3VxrCore@@A
?r_begin@NET_Packet@@QAEIAAG@Z
?Leave@xrCriticalSection@@QAEXXZ
?Enter@xrCriticalSection@@QAEXXZ
?Log@@YAXPBDI@Z
?fail@xrDebug@@QAEXPBD0H0AA_N@Z
??1xrCriticalSection@@QAE@XZ
??0xrCriticalSection@@QAE@XZ
?Msg@@YAXPBDZZ
?fail@xrDebug@@QAEXPBDABV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@0H0AA_N@Z
?GetElapsed_ms@CTimer@@QBEIXZ
?Debug@@3VxrDebug@@A
?error@xrDebug@@QAEXJPBD0H0AA_N@Z
?dock@str_container@@QAEPAUstr_value@@PBD@Z
?g_pStringContainer@@3PAVstr_container@@A
?get_path@CLocatorAPI@@QAEPAVFS_Path@@PBD@Z
?mem_free@xrMemory@@QAEXPAX@Z
?Memory@@3VxrMemory@@A
?mem_alloc@xrMemory@@QAEPAXI@Z
?r_line@CInifile@@QBEHPBDHPAPBD1@Z
?line_count@CInifile@@QBEIPBD@Z
?section_exist@CInifile@@QBEHPBD@Z
??1CInifile@@UAE@XZ
??0CInifile@@QAE@PBDHHHIV?$FastDelegate1@PBD_N@fastdelegate@@@Z
?xr_FS@@3PAVCLocatorAPI@@A
?update_path@CLocatorAPI@@QAEPBDAAY0CAI@DPBD1@Z
?w_string@CInifile@@QAEXPBD000@Z
?r_string@CInifile@@QBEPBDABVshared_str@@PBD@Z
?thread_spawn@@YAXP6AXPAX@ZPBDI0@Z
msvcr80
memset
_stricmp
memcpy
memmove
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_vsnprintf_s
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_localtime64
_time64
_mktime64
sscanf
fprintf
vsprintf
exit
fopen
fclose
sscanf_s
_except_handler3
strncmp
_purecall
strncpy_s
abort
strchr
strstr
atol
puts
fwrite
Exports
Exports
??0IBannedClient@@QAE@XZ
??0IClient@@QAE@PAVCTimer@@@Z
??0IClientStatistic@@QAE@PAVCTimer@@@Z
??0INetQueue@@QAE@XZ
??0IPureClient@@QAE@PAVCTimer@@@Z
??0IPureServer@@QAE@PAVCTimer@@H@Z
??0MultipacketReciever@@QAE@ABV0@@Z
??0MultipacketReciever@@QAE@XZ
??0MultipacketSender@@QAE@XZ
??0NET_Compressor@@QAE@XZ
??0syncQueue@@QAE@XZ
??1IClient@@UAE@XZ
??1INetQueue@@QAE@XZ
??1IPureClient@@UAE@XZ
??1IPureServer@@UAE@XZ
??1MultipacketReciever@@UAE@XZ
??1MultipacketSender@@UAE@XZ
??1NET_Compressor@@QAE@XZ
??4IBannedClient@@QAEAAV0@ABV0@@Z
??4IClient@@QAEAAV0@ABV0@@Z
??4IClientStatistic@@QAEAAV0@ABV0@@Z
??4INetQueue@@QAEAAV0@ABV0@@Z
??4IPureClient@@QAEAAV0@ABV0@@Z
??4IPureServer@@QAEAAV0@ABV0@@Z
??4IServerStatistic@@QAEAAV0@ABV0@@Z
??4MultipacketReciever@@QAEAAV0@ABV0@@Z
??4MultipacketSender@@QAEAAV0@ABV0@@Z
??4NET_Compressor@@QAEAAV0@ABV0@@Z
??4ip_address@@QAEAAU0@ABU0@@Z
??4syncQueue@@QAEAAV0@ABV0@@Z
??8ip_address@@QBE_NABU0@@Z
??_7IClient@@6B@
??_7IPureClient@@6BMultipacketReciever@@@
??_7IPureClient@@6BMultipacketSender@@@
??_7IPureServer@@6B@
??_7MultipacketReciever@@6B@
??_7MultipacketSender@@6B@
?Assign_ServerType@IPureServer@@UAEXAAY0CAA@D@Z
?BanAddress@IPureServer@@UAEXABUip_address@@I@Z
?BanClient@IPureServer@@UAEXPAVIClient@@I@Z
?BannedList_Load@IPureServer@@IAEXXZ
?BannedList_Save@IPureServer@@IAEXXZ
?BannedTimeTo@IBannedClient@@QBE?AV?$basic_string@DV?$char_traits@D@stlp_std@@V?$xalloc@D@@@stlp_std@@XZ
?BroadcastCID@@3VClientID@@A
?Check_ServerAccess@IPureServer@@UAE_NPAVIClient@@AAY0CAA@D@Z
?Clear@IClientStatistic@@QAEXXZ
?ClearStatistic@IPureClient@@QAEXXZ
?ClearStatistic@IPureServer@@QAEXXZ
?Compress@NET_Compressor@@QAEGPAEABI01@Z
?Connect@IPureClient@@QAEHPBD@Z
?Connect@IPureServer@@UAE?AW4EConnect@1@PBDAAUGameDescriptionData@@@Z
?Create@INetQueue@@QAEPAVNET_Packet@@ABV2@@Z
?Create@INetQueue@@QAEPAVNET_Packet@@XZ
?Decompress@NET_Compressor@@QAEGPAEABI01@Z
?Disconnect@IPureClient@@QAEXXZ
?Disconnect@IPureServer@@UAEXXZ
?DisconnectAddress@IPureServer@@UAE_NABUip_address@@PBD@Z
?DisconnectClient@IPureServer@@UAE_NPAVIClient@@PBD@Z
?DumpNetCompressorStats@@YAX_N@Z
?DumpStats@NET_Compressor@@QAEX_N@Z
?EndProcessQueue@IPureClient@@QAEXXZ
?FlushSendBuffer@MultipacketSender@@QAEXI@Z
?Flush_Clients_Buffers@IPureServer@@UAEXXZ
?Flush_Send_Buffer@IPureClient@@UAEXXZ
?GetBannedClient@IPureServer@@IAEPAVIBannedClient@@ABUip_address@@@Z
?GetBannedListName@IPureServer@@IAEPBDXZ
?GetClientAddress@IPureServer@@IAE_NPAUIDirectPlay8Address@@AAUip_address@@PAK@Z
?GetClientAddress@IPureServer@@QAE_NVClientID@@AAUip_address@@PAK@Z
?GetClientByID@IPureServer@@QAEPAVIClient@@VClientID@@@Z
?GetClientID@IPureClient@@QAEABVClientID@@XZ
?GetClientsCount@IPureServer@@QAEIXZ
?GetConnectOptions@IPureServer@@QBEABVshared_str@@XZ
?GetMsgId2Name@IPureClient@@UAEPBDG@Z
?GetPort@IPureServer@@QAEHXZ
?GetServerAddress@IPureClient@@QAE_NAAUip_address@@PAK@Z
?GetServerClient@IPureServer@@QAEPAVIClient@@XZ
?GetServerInfo@IPureServer@@UAEXPAVCServerInfo@@@Z
?GetStatistic@IPureClient@@QAEAAVIClientStatistic@@XZ
?GetStatistic@IPureServer@@QAEPBVIServerStatistic@@XZ
?HasBandwidth@IPureServer@@QAEHPAVIClient@@@Z
?ID_to_client@IPureServer@@IAEPAVIClient@@VClientID@@_N@Z
?IpList_Load@IPureServer@@IAEXXZ
?IpList_Unload@IPureServer@@IAEXXZ
?IsPlayerIPDenied@IPureServer@@QAE_NI@Z
?Load@IBannedClient@@QAEXAAVCInifile@@ABVshared_str@@@Z
?Lock@INetQueue@@QAEXXZ
?OnCL_Connected@IPureServer@@UAEXPAVIClient@@@Z
?OnCL_Disconnected@IPureServer@@UAEXPAVIClient@@@Z
?OnCL_QueryHost@IPureServer@@UAE_NXZ
?OnConnectRejected@IPureClient@@UAEXXZ
?OnInvalidHost@IPureClient@@UAEXXZ
?OnInvalidPassword@IPureClient@@UAEXXZ
?OnMessage@IPureClient@@UAEXPAXI@Z
?OnMessage@IPureServer@@UAEIAAVNET_Packet@@VClientID@@@Z
?OnSessionFull@IPureClient@@UAEXXZ
?OnSessionTerminate@IPureClient@@UAEXPBD@Z
?Print_Banned_Addreses@IPureServer@@QAEXXZ
?RecievePacket@MultipacketReciever@@QAEXPBXII@Z
?Release@INetQueue@@QAEXXZ
?Retreive@INetQueue@@QAEPAVNET_Packet@@XZ
?Save@IBannedClient@@QAEXAAVCInifile@@@Z
?Send@IPureClient@@UAEXAAVNET_Packet@@II@Z
?SendBroadcast@IPureServer@@UAEXVClientID@@AAVNET_Packet@@I@Z
?SendBroadcast_LL@IPureServer@@QAEXVClientID@@PAXII@Z
?SendPacket@MultipacketSender@@QAEXPBXIII@Z
?SendTo@IPureServer@@QAEXVClientID@@AAVNET_Packet@@II@Z
?SendTo_Buf@IPureServer@@UAEXVClientID@@PAXIII@Z
?SendTo_LL@IPureClient@@MAEXPAXIII@Z
?SendTo_LL@IPureServer@@UAEXVClientID@@PAXIII@Z
?SetClientID@IPureClient@@IAEXABVClientID@@@Z
?StartProcessQueue@IPureClient@@QAEXXZ
?Sync_Average@IPureClient@@IAEXXZ
?Sync_Thread@IPureClient@@IAEXXZ
?TestLoadBEClient@IPureClient@@UAE_NXZ
?UnBanAddress@IPureServer@@UAEXABUip_address@@@Z
?Unlock@INetQueue@@QAEXXZ
?Update@IClientStatistic@@QAEXAAU_DPN_CONNECTION_INFO@@@Z
?UpdateBannedList@IPureServer@@IAEXXZ
?UpdateClientStatistic@IPureServer@@QAEXPAVIClient@@@Z
?UpdateStatistic@IPureClient@@QAEXXZ
?_FlushSendBuffer@MultipacketSender@@AAEXIPAUBuffer@1@@Z
?_Recieve@IPureClient@@EAEXPBXII@Z
?_Recieve@IPureServer@@EAEXPBXII@Z
?_SendTo_LL@IClient@@EAEXPBXIII@Z
?_SendTo_LL@IPureClient@@EAEXPBXIII@Z
?allow_to_include_path@@YA_NABV?$xr_vector@Vshared_str@@V?$xalloc@Vshared_str@@@@@@PBD@Z
?begin@syncQueue@@QAEPAIXZ
?clear@IServerStatistic@@QAEXXZ
?clear@syncQueue@@QAEXXZ
?compressed_size@NET_Compressor@@QAEGABI@Z
?end@syncQueue@@QAEPAIXZ
?fill_auth_check_params@@YAXAAV?$xr_vector@Vshared_str@@V?$xalloc@Vshared_str@@@@@@0@Z
?g_net_compressor_enabled@@3HA
?g_net_compressor_gather_stats@@3HA
?getBPS@IClientStatistic@@QAEIXZ
?getDroppedCount@IClientStatistic@@QAEIXZ
?getMPS_Receive@IClientStatistic@@QAEIXZ
?getMPS_Send@IClientStatistic@@QAEIXZ
?getPeakBPS@IClientStatistic@@QAEIXZ
?getPing@IClientStatistic@@QAEIXZ
?getReceivedPerSec@IClientStatistic@@QAEIXZ
?getRetriedCount@IClientStatistic@@QAEIXZ
?getSendedPerSec@IClientStatistic@@QAEIXZ
?get_net_DescriptionData@IPureClient@@QBEABUGameDescriptionData@@XZ
?net_Handler@IPureClient@@QAEJIPAX@Z
?net_Handler@IPureServer@@QAEJIPAX@Z
?net_HasBandwidth@IPureClient@@QAEHXZ
?net_IsSyncronised@IPureClient@@UAEHXZ
?net_SessionName@IPureClient@@QAEPBDXZ
?net_Syncronize@IPureClient@@QAEXXZ
?net_isCompleted_Connect@IPureClient@@QAEHXZ
?net_isCompleted_Sync@IPureClient@@QAEHXZ
?net_isDisconnected@IPureClient@@QAEHXZ
?net_isFails_Connect@IPureClient@@QAEHXZ
?net_msg_Release@IPureClient@@QAEXXZ
?net_msg_Retreive@IPureClient@@UAEPAVNET_Packet@@XZ
?psNET_ClientPending@@3HA
?psNET_ClientUpdate@@3HA
?psNET_Flags@@3U?$_flags@I@@A
?psNET_GuaranteedPacketMode@@3HA
?psNET_Name@@3PADA
?psNET_ServerPending@@3HA
?psNET_ServerUpdate@@3HA
?psNET_direct_connect@@3HA
?push@syncQueue@@QAEXI@Z
?set@ip_address@@QAEXPBD@Z
?size@syncQueue@@QAEIXZ
?timeServer@IPureClient@@QAEIXZ
?timeServer_Async@IPureClient@@QAEIXZ
?timeServer_Correct@IPureClient@@QAEXII@Z
?timeServer_Delta@IPureClient@@QAEIXZ
?timeServer_UserDelta@IPureClient@@QAEXH@Z
?to_string@ip_address@@QBE?AV?$basic_string@DV?$char_traits@D@stlp_std@@V?$xalloc@D@@@stlp_std@@XZ
Sections
.text Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ