Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
injector.exe
Resource
win10v2004-20230220-en
Target
Korepi_0.8.0.zip
Size
253.5MB
MD5
a951e7986711840e527fa9de26e360d3
SHA1
76baa548204db5169ea7e95b175181a97c3a09ab
SHA256
dd0628c3a5d977f5eed1e19fd59cdfc67d2eb544f4fa3ea27b44ecfca67bbf6f
SHA512
bd16d9853a78e1c494b2726ec098247a6561dac92dc8c5582fa67b01ed3f2464f696703b76aab5109c2c2e98ad263e346fb87a929f736308c52b7d7601ec1192
SSDEEP
6291456:bE9oTc+5E9oTc+1RJ9uIB4W5398gwl1yzMxIBvw12ABGE:bE9oTlE9oTxRJ9bB18gJ4Av3ABj
Checks for missing Authenticode signature.
resource |
---|
unpack001/HoYoKProtect.dll |
unpack001/injector.exe |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
UnityMain
HeapAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
WTSSendMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
��>ƻ�¥�3�L����}p�x��S?��`�ozD�`�-��n��M�ꑴ�>�y�(��ߧ<��"��*�ϭ����΅`F��Y �W�Nu��'\����:��Rwa�);�%[�� �@�侕��o����'��C i�M��r���s�_�`ǿ��W(H�@1�.��| ��plH�<���'��@�3�ą����F��Oi��|�r�:ѵ3��5�x��(F|e��N�&�������[ͺ0���;( ���#�"͗���|��j;�3RXg<_� ,���!7����{���yʬ�¶w��}G�ϋE�c���d�g��� ���և�!�+_���6���x�`�P�ioO�H��bN-�>����5(��5v�� ��)��kj��l-��2����px<�?0yQ��u\��:1,�8b1�I��a�;���s{� 3����n?GEA���T�<܀��'��j���Eet)��m�������Ѽ�3��q<� ����-66��>�\E�gK�����;UtZ#b���8�D�ƹ�?k�v�m�(���Q�77<������'v6[]��R�}G���n�����j�'�GL��p�Zf~1P j��\Z09֖�X��)65d*�㔈�����e���$� �\�w��H���, �;�7b���|��d:��D'������w�TX����Ԕ�Xi��oH�xdە�c���<�w�?�5#��M2�ť�E=w\�;{q8BD�M�+QN�\P��w�0�n�H`=�{zC� �$ B���m���Sĩ�-y10��I�O"W~�4��%���M�W��p���Cz�L{d�u�� r![p\|�R��68��#+W��lL�w�p�{��9=�?�����bH���=+��p��5^����hi����G����s�\���V���2�,#ʲ�K��y�̡��)fh���ƅ�6�0�ܭ1$�v)n���5�T�"|I��� ���®nsn�R�1�u����_�^�\RX�X��>���D��~����S�<�:�w'���,Ci��K�Q�QkUf�<��>=�>���ENXhk�m�۰����{��w~![��#���zp����i�M��d��\7���T��C�u9�F~`@⿎$�"��l��Y���b�qy���� GΡ\�"��9Y��![P���k�^˚�f� oq�|�d�=����|�+�̀^ ��4wJ�������5C2F�+dwr:�������p�i\�����/�^�W�׳+����'��y��+!os�35?�2ݎ�h�-�AY��R�����E� _ފI˹�!��lNӗ�/����Zkb�"!�1_Uz/�Z�ذ�H�er�9�����=!�ͷv���#�L�Y����)�~j�\���X�Q'���ph �t�Gf����/���o���ٲ�o�tx��$l}�kd�Y�|��A�s�X��Ij�`~��O����(��3�cDk��Y\�]b\wu�߁Y�<U��/ԙ�s�J���C��_o�ˊb��:����5q�H7W|V�h^�o<�1b<�dp lE���[}��SE�ӓ�tUv�P<:l�utUN%f{�[�:��cY�[V"݈zp��FL 2�t�C���"����Avbx�������R�����к�RBloi��>,����M���в��^���W\��h�N�.z��)�=����O��&Rt�c�`���;ؗ%���n#�qay��>䆖�V.5}��.?�u��"���O<J���.'օ���a�P���w@<=�}7!R����BhvX�R�(�T��J��+y���Ԭ�aa 0��q���T�.�f�P�:��F�����d5�L[5�A`祠/�b�y���a���Jb�HFϠ8�Sn�Q��������-bnB+(�)�ĸ�G�$�x:W��f�8��s̟�(��%�!~��و�%��PM��Za�a4�y)Ɛ�F*G�>�Rw�`\�{@�iQ ���a�b��.8���7|��%���Eo6����~ɖ*���+� �/�{P<�M���h��I�&\mVnz�D�1�Bt��+�%�����.�|g�G9W��<+ћ�m]�l��'�q���@g�]�r6Po!و*���I�`�&�9���R�D���/����,��I�7�X9C8^@��V�?4�e����ς��)����F�%tf�A���.�K���i��#Ef���s�z�vD,���h�Y��r���)noh�-�q�:,�=K/�!8/u�PH��}L�ɵSY�aU��g��ɼ��+q�U7���Pl�Y��3��l~�լ2�58�}����V���Sh���&:��!�AB�j���kT��W����K)}�?S��7��w�}�q���K H�q�z"��8/� �|^�7*�?d���A�9m�S}�k�-#������i)}��4�{gۥ4ћ�9�"8%���_S�O#���jfK�<cI�r�=1@ �|�>/�8�����O��|�뒯C�1l��A���W �C}����՛������M��h�W�*���; ��fD��xs0�A �fﭖ*��G���S�O���#6_ N�3>�d�*�v���ڙ[�x�������MA���6!�v�`���w븍k�,y&���Al�V��f�Gְ����YIP�ѝTMyw1��7�?7�\��� �p�4ݿ��v���.��@��h%�4�O��D]M����$ Z@1H Z�c/�0 M��1��i6Dz��,ɾ4$�5��]��B���jrOy��w���h�A�/��b2��!z���93����UD���y{|2��4� �m�C!5JA��9��|O6����o_�(���ۼ���[�NizCϯ/����N���-�Ø�Yư*�b-�G�_ &#�~?!��s�4�A�(\�w�c��/�5})�2D�`S�:[-��9�)�� ���5X��N�#�F�)���C<��H ^�|�N��A۔�R��`vc侹v�зR1� WX)���%$�9���6�j7���Q�����f�c@#�ǟ�D����?�2UM���ˁ�&�ڤ�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
FlushFileBuffers
GetFileAttributesExW
GetFileSizeEx
GetFileType
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
WriteFile
GetTempPathW
IsDebuggerPresent
OutputDebugStringW
CloseHandle
DuplicateHandle
RaiseException
GetLastError
SetLastError
CreatePipe
QueryPerformanceCounter
QueryPerformanceFrequency
GetOverlappedResult
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
SleepEx
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateMutexW
CreateEventW
Sleep
CreateSemaphoreW
QueueUserAPC
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
SwitchToThread
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
OpenProcess
GetSystemTimes
GetSystemInfo
GetSystemTimeAsFileTime
GetVersionExW
GetNativeSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalFree
FormatMessageW
CopyFileW
FindNextFileW
GetComputerNameW
GetTimeZoneInformation
GetDynamicTimeZoneInformation
GetFileInformationByHandleEx
WideCharToMultiByte
GetACP
GetLocaleInfoW
GetThreadLocale
GetConsoleMode
K32GetProcessImageFileNameW
SetFilePointer
WaitForSingleObject
ExitThread
GetExitCodeThread
SuspendThread
ResumeThread
GetThreadContext
GetModuleFileNameA
GetProcessAffinityMask
GetCommandLineW
GetCommandLineA
FindFirstFileExW
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetProcessHeap
SetStdHandle
GetOEMCP
IsValidCodePage
HeapQueryInformation
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
WriteConsoleW
HeapFree
HeapAlloc
CreateProcessW
GetConsoleCP
ReadConsoleW
GetModuleHandleExW
ExitProcess
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
GetCurrentDirectoryW
SetEnvironmentVariableW
GetEnvironmentVariableW
FreeEnvironmentStringsW
InterlockedPopEntrySList
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
TerminateProcess
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
LCMapStringW
CompareStringW
GetTickCount
TlsFree
InitializeCriticalSectionAndSpinCount
QueueUserWorkItem
TryEnterCriticalSection
DecodePointer
EncodePointer
RtlPcToFileHeader
IsProcessorFeaturePresent
lstrcpyW
VirtualProtect
GetEnvironmentStringsW
GetStdHandle
MoveFileExW
RtlCaptureStackBackTrace
K32EnumProcessModules
MultiByteToWideChar
CreateFileMappingA
CreateFileA
FormatMessageA
LoadLibraryExA
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
MessageBoxA
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetUserNameW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetContextToken
CoInitializeEx
CoUninitialize
CoTaskMemFree
SafeArrayDestroy
SysAllocStringLen
SysFreeString
SysStringLen
SafeArrayGetVartype
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SHGetFolderPathW
SHGetKnownFolderPath
WSAPoll
WSASend
WSARecv
WSAIoctl
WSAGetLastError
WSACleanup
WSAStartup
gethostname
getaddrinfo
socket
shutdown
setsockopt
sendto
send
select
freeaddrinfo
ntohs
ntohl
listen
inet_ntoa
inet_addr
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
getnameinfo
inet_pton
inet_ntop
recvfrom
gethostbyaddr
GetNetworkParams
GetIfEntry
GetAdaptersAddresses
WTSSendMessageW
DllCanUnloadNow
DllGetActivationFactory
il2cpp_get_api_table
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
OPENSSL_Applink
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
KeSetEvent
ExReleaseFastMutex
RtlInitUnicodeString
KeDelayExecutionThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ExEventObjectType
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
MmUnlockPages
MmUnmapLockedPages
IoFreeMdl
KeAreApcsDisabled
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
ExGetPreviousMode
ProbeForRead
MmProbeAndLockPages
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
IoAllocateMdl
__C_specific_handler
PsCreateSystemThread
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeEnterCriticalRegion
KeLeaveCriticalRegion
RtlInitAnsiString
RtlEqualUnicodeString
NtClose
RtlCompareUnicodeString
MmGetSystemRoutineAddress
ObfReferenceObject
KeClearEvent
MmBuildMdlForNonPagedPool
KdDebuggerNotPresent
_purecall
DbgPrint
KeSetPriorityThread
PsTerminateSystemThread
IofCompleteRequest
ExSystemTimeToLocalTime
ZwCreateFile
RtlCompareMemory
KeQueryTimeIncrement
ZwOpenKey
ZwDeleteValueKey
ZwFlushKey
ZwQueryValueKey
ZwSetValueKey
IoFileObjectType
RtlRaiseException
ExAcquireFastMutex
KeReleaseSpinLock
ZwCreateSection
PsGetCurrentProcessId
KeAcquireSpinLockRaiseToDpc
MmUserProbeAddress
PsGetVersion
ExEnterCriticalRegionAndAcquireResourceShared
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
MmIsAddressValid
IoThreadToProcess
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
MmHighestUserAddress
PsGetProcessId
RtlEnumerateGenericTableAvl
ZwQuerySystemInformation
ObQueryNameString
ZwQueryObject
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ObGetObjectType
ExEnumHandleTable
ExfUnblockPushLock
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
NtQueryInformationProcess
ZwQueryInformationProcess
PsProcessType
PsThreadType
PsInitialSystemProcess
ZwQueryVirtualMemory
PsGetProcessWow64Process
PsGetProcessPeb
ZwTerminateProcess
IoQueryFileDosDeviceName
ObOpenObjectByPointer
ZwWaitForSingleObject
PsGetProcessImageFileName
PsReferenceProcessFilePointer
PsGetProcessInheritedFromUniqueProcessId
PsLookupThreadByThreadId
ZwSetInformationProcess
ZwQueryInformationThread
ExInitializeRundownProtection
ExAcquireRundownProtection
ExReleaseRundownProtection
ExWaitForRundownProtectionRelease
PsSetCreateProcessNotifyRoutineEx
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetProcessSectionBaseAddress
KdDebuggerEnabled
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
ZwOpenFile
MmSystemRangeStart
ZwOpenProcess
RtlConvertSidToUnicodeString
SeQueryInformationToken
PsReferencePrimaryToken
PsDereferencePrimaryToken
KeWaitForSingleObject
KeReleaseMutex
KeInitializeMutex
KeBugCheckEx
RtlCopyUnicodeString
KeInitializeEvent
ExFreePoolWithTag
PsGetCurrentThreadId
ExAllocatePoolWithTag
KeStallExecutionProcessor
WdfVersionBindClass
WdfVersionBind
WdfVersionUnbindClass
WdfVersionUnbind
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
HidD_SetFeature
HidD_GetFeature
HidP_SetUsageValue
HidP_InitializeReportForID
HidP_GetData
HidP_MaxDataListLength
HidP_GetValueCaps
HidD_GetHidGuid
HidP_GetButtonCaps
HidP_GetCaps
HidD_GetAttributes
HidD_GetIndexedString
HidD_GetSerialNumberString
HidD_GetManufacturerString
HidD_GetProductString
HidD_FreePreparsedData
HidD_GetPreparsedData
HidP_SetUsageValueArray
SetFilePointerEx
SetFileTime
WriteFile
OutputDebugStringA
CreateMutexA
SuspendThread
ResumeThread
GetThreadContext
GetVersionExA
ReadProcessMemory
GetModuleFileNameA
CopyFileW
MoveFileExW
ReplaceFileW
VerSetConditionMask
GetTempPathW
GetTickCount
GetVersionExW
LocalAlloc
GetComputerNameW
VerifyVersionInfoW
GetSystemPowerStatus
GetUserDefaultUILanguage
GetCommandLineW
GetCurrentDirectoryW
DebugBreak
SetUnhandledExceptionFilter
LoadLibraryExW
TerminateProcess
CreateProcessW
GetStartupInfoA
GetOverlappedResult
CancelIo
WaitForMultipleObjects
GetFileSize
GetStdHandle
FlsAlloc
FlsSetValue
FlsFree
GetProcessTimes
GetCurrentProcessorNumber
VirtualQuery
GetLargePageMinimum
VirtualUnlock
GetNumaHighestNodeNumber
GetNumaProcessorNode
GetNumaNodeProcessorMask
WriteConsoleA
FileTimeToLocalFileTime
GetFileTime
SetErrorMode
GlobalMemoryStatus
FileTimeToDosDateTime
lstrcpyA
lstrlenA
CreateSemaphoreW
SwitchToThread
SetThreadAffinityMask
FlushConsoleInputBuffer
ReadConsoleInputW
GetProcessAffinityMask
GetThreadPriority
ExitThread
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
CreateFileA
OpenEventA
SetWaitableTimer
CreateWaitableTimerA
GetSystemDirectoryA
CreatePipe
GetExitCodeProcess
SetFilePointer
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
ReadFile
GetTempFileNameW
GetFileAttributesExW
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
WaitForSingleObject
Sleep
TerminateThread
GetSystemInfo
GetLocalTime
LocalFree
FormatMessageA
CreateSemaphoreA
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemTime
SetEvent
WaitForSingleObjectEx
CreateEventW
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
UnregisterWait
RegisterWaitForSingleObject
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
CreateTimerQueue
DecodePointer
EncodePointer
RtlPcToFileHeader
StartThreadpoolIo
CreateThreadpoolIo
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolWork
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
MoveFileW
GetVolumeInformationW
Process32NextW
Process32FirstW
GetFileAttributesW
FindNextFileW
DeviceIoControl
SetThreadContext
AddVectoredExceptionHandler
QueryFullProcessImageNameW
GetLongPathNameW
K32GetProcessImageFileNameW
lstrcpynW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualProtectEx
OpenProcess
lstrcmpA
K32GetMappedFileNameW
K32GetModuleFileNameExA
VirtualQueryEx
IsBadWritePtr
IsBadReadPtr
Wow64EnableWow64FsRedirection
lstrlenW
lstrcatW
lstrcpyW
lstrcmpiW
Wow64DisableWow64FsRedirection
GetTickCount64
QueryDosDeviceW
GetLogicalDriveStringsW
Module32NextW
Module32FirstW
K32QueryWorkingSet
K32GetModuleFileNameExW
K32GetModuleInformation
K32EnumProcessModules
CreateMutexW
FlushInstructionCache
SignalObjectAndWait
ReleaseMutex
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
GetOEMCP
GetACP
IsValidCodePage
SetConsoleMode
GetCPInfo
FlushFileBuffers
GetProcessHeap
SetStdHandle
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStartupInfoW
HeapAlloc
HeapFree
GetConsoleCP
SetConsoleCtrlHandler
GetFullPathNameW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
DuplicateHandle
HeapQueryInformation
HeapSize
HeapReAlloc
FreeLibraryAndExitThread
GetModuleHandleExW
GetEnvironmentVariableA
RtlVirtualUnwind
RtlLookupFunctionEntry
GlobalLock
GlobalUnlock
GlobalAlloc
ResetEvent
InitializeCriticalSection
Thread32Next
Thread32First
CreateToolhelp32Snapshot
FindNextFileA
FindFirstFileA
CreateDirectoryA
RtlCaptureContext
GetModuleFileNameW
GetQueuedCompletionStatus
CreateIoCompletionPort
SetLastError
GetWindowsDirectoryW
GetCurrentThread
GetCurrentProcessId
RtlCaptureStackBackTrace
GetModuleHandleW
SetThreadPriority
GetCurrentThreadId
CreateThread
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetThreadTimes
OpenThread
SleepEx
RaiseException
ExitProcess
IsProcessorFeaturePresent
UnhandledExceptionFilter
VerifyVersionInfoA
ExpandEnvironmentStringsA
InitializeCriticalSectionEx
GetFileType
GetModuleHandleA
GetProcAddress
FreeLibrary
LoadLibraryA
VirtualAlloc
VirtualProtect
VirtualFree
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsDebuggerPresent
MultiByteToWideChar
CreateEventA
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetCommandLineA
WideCharToMultiByte
LoadLibraryW
SetDllDirectoryW
SetHandleInformation
FormatMessageW
GetFileAttributesA
LoadLibraryExA
GetDiskFreeSpaceExA
GetCurrentProcess
GlobalMemoryStatusEx
K32GetProcessMemoryInfo
FindFirstFileExW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryA
ExpandEnvironmentStringsW
SetDlgItemTextA
SetDlgItemTextW
SendDlgItemMessageW
CopyRect
OffsetRect
EndDialog
DialogBoxParamW
RegisterClassExW
UnregisterClassW
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplaySettingsW
ChangeDisplaySettingsW
GetParent
SetWindowLongPtrA
LoadIconA
GetAncestor
TranslateMessage
DispatchMessageW
PeekMessageW
PostQuitMessage
RegisterClassW
CreateDialogParamW
DialogBoxParamA
CheckDlgButton
IsDlgButtonChecked
SetFocus
GetFocus
GetKeyState
MsgWaitForMultipleObjects
EnableWindow
SetWindowTextW
GetWindowLongPtrA
SetCursorPos
ClipCursor
GetWindowLongPtrW
SetWindowLongPtrW
LoadImageW
CopyImage
IsDialogMessageW
MonitorFromPoint
GetMonitorInfoA
GetProcessWindowStation
GetUserObjectInformationW
GetCursorInfo
GetMessageA
PeekMessageA
SetWindowLongA
GetActiveWindow
DragDetect
ValidateRect
MonitorFromRect
UpdateWindow
DispatchMessageA
GetMessagePos
GetMessageTime
GetMessageExtraInfo
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetAsyncKeyState
GetKeyNameTextW
SetCapture
ReleaseCapture
GetWindowLongA
GetCursorPos
DefWindowProcW
CreateWindowExW
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetDlgItem
CreateDialogParamA
GetWindowPlacement
DestroyWindow
GetDC
ReleaseDC
GetDesktopWindow
EnumDisplayDevicesA
MonitorFromWindow
SetTimer
KillTimer
MessageBoxA
IsWindowVisible
MessageBoxW
SetWindowPos
EnumWindows
SetForegroundWindow
IsIconic
ShowWindow
SendMessageTimeoutA
SendMessageA
RegisterWindowMessageA
DestroyCursor
GetUserObjectInformationA
GetThreadDesktop
FindWindowA
LoadCursorA
CreateIconIndirect
DestroyIcon
ShowCursor
GetCaretBlinkTime
EnumDisplaySettingsA
ClientToScreen
TrackMouseEvent
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetSystemMetrics
SetCursor
PtInRect
SystemParametersInfoW
GetRawInputData
GetRawInputDeviceInfoW
RegisterRawInputDevices
GetRawInputDeviceList
wsprintfA
wvsprintfA
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueW
GetFileVersionInfoSizeW
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
PropVariantClear
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoSetProxyBlanket
CoInitializeSecurity
SHDeleteKeyW
PathFileExistsW
PathCanonicalizeW
PathIsDirectoryW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
RegOpenKeyExW
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
GetUserNameA
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
GetSidSubAuthority
GetTokenInformation
RegCreateKeyW
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
CryptDecrypt
CryptEncrypt
CryptSetKeyParam
CryptDeriveKey
LookupAccountSidW
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
RegOpenKeyExA
CryptDestroyKey
AdjustTokenPrivileges
LookupPrivilegeValueA
CryptAcquireContextW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextA
CreateBitmap
CreateDIBSection
ChoosePixelFormat
SwapBuffers
GetDeviceCaps
SetPixelFormat
DeleteObject
GetObjectA
ShellExecuteW
ShellExecuteExA
SHFileOperationW
CommandLineToArgvW
SHGetFolderPathW
wglMakeCurrent
wglGetProcAddress
wglGetCurrentDC
wglGetCurrentContext
wglDeleteContext
wglCreateContext
waveInStart
waveInReset
waveInAddBuffer
waveInUnprepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
timeGetTime
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
waveOutGetNumDevs
waveInGetNumDevs
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutReset
waveOutOpen
waveInPrepareHeader
waveOutGetPosition
waveInGetDevCapsA
ntohl
bind
closesocket
WSACancelAsyncRequest
WSAAsyncGetHostByName
getsockopt
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSARecvFrom
getprotobyname
gethostbyname
recv
getpeername
getnameinfo
freeaddrinfo
getaddrinfo
WSASocketA
WSAIoctl
WSASetLastError
shutdown
setsockopt
sendto
send
select
recvfrom
ntohs
listen
ioctlsocket
accept
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
socket
inet_ntoa
connect
inet_addr
htons
getsockname
htonl
VariantInit
VariantClear
SysAllocString
SysFreeString
VariantChangeType
ImmGetContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetConversionStatus
ImmSetOpenStatus
ImmReleaseContext
DnsFree
DnsQuery_A
GetIpAddrTable
GetAdaptersInfo
GetExtendedTcpTable
GetExtendedUdpTable
SendARP
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
WinHttpGetIEProxyConfigForCurrentUser
CryptQueryObject
CertGetNameStringW
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertAddEncodedCertificateToStore
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgClose
CryptDecodeObject
CryptCATAdminReleaseContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
BCryptGenRandom
MakeSureDirectoryPathExists
MiniDumpWriteDump
WlanCloseHandle
WlanEnumInterfaces
WlanGetAvailableNetworkList
WlanGetNetworkBssList
WlanFreeMemory
WlanOpenHandle
UnityMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Process32First
CreateToolhelp32Snapshot
Process32Next
GetModuleHandleA
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualFreeEx
WaitForSingleObject
DeleteProcThreadAttributeList
LocalFree
GetStdHandle
SetConsoleTextAttribute
ReleaseSRWLockShared
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
UpdateProcThreadAttribute
CloseHandle
GetLastError
Sleep
OpenProcess
ResumeThread
InitializeProcThreadAttributeList
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
AcquireSRWLockExclusive
AcquireSRWLockShared
SetCurrentDirectoryW
GetCurrentDirectoryW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
GetOpenFileNameA
RegCloseKey
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
RegGetValueW
CreateProcessAsUserA
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Xtime_get_ticks
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
_Strcoll
?_Syserror_map@std@@YAPEBDH@Z
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Winerror_map@std@@YAHH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Strxfrm
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
__CxxFrameHandler4
memcmp
memcpy
memmove
memset
__std_exception_destroy
__std_exception_copy
_purecall
__std_terminate
strchr
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
free
realloc
malloc
_callnewh
_set_new_mode
_register_onexit_function
_crt_atexit
terminate
_cexit
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_set_app_type
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_c_exit
exit
_exit
_configure_narrow_argv
__p___argc
_seh_filter_exe
__p___argv
_invalid_parameter_noinfo_noreturn
system
fopen_s
fclose
_get_stream_buffer_pointers
ftell
__stdio_common_vsprintf
fputs
fread
_set_fmode
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__p__commode
fseek
fputc
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
fwrite
fgetc
ungetc
strtol
_mbsicmp
_gmtime64_s
_unlock_file
_lock_file
_configthreadlocale
___lc_codepage_func
__setusermatherr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
ExReleaseFastMutex
ObfDereferenceObject
PsLookupProcessByProcessId
NtQuerySystemInformation
RtlInitUnicodeString
KeSetEvent
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExAllocatePoolWithTag
ExInitializeResourceLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
ObReferenceObjectByHandle
ZwClose
ZwOpenSection
ZwMapViewOfSection
MmIsAddressValid
PsGetCurrentProcessId
MmCopyVirtualMemory
vsprintf_s
swprintf_s
ExEventObjectType
_wcsicmp
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
IoGetDeviceObjectPointer
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ObReferenceObjectByName
ZwQuerySystemInformation
__C_specific_handler
MmHighestUserAddress
IoDriverObjectType
KeQueryTimeIncrement
KeStackAttachProcess
KeUnstackDetachProcess
PsGetProcessWow64Process
PsGetProcessPeb
ExAcquireFastMutex
MmGetSystemRoutineAddress
MmUnmapLockedPages
IoFreeMdl
ZwTerminateProcess
PsGetProcessImageFileName
ZwQueryObject
ObOpenObjectByPointer
PsReferenceProcessFilePointer
IoQueryFileDosDeviceName
PsProcessType
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateMdl
KeClearEvent
PsSetCreateProcessNotifyRoutineEx
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
RtlUpcaseUnicodeChar
DbgPrint
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
PsGetProcessId
IoThreadToProcess
strcmp
PsThreadType
RtlEqualUnicodeString
RtlGetVersion
ObfReferenceObject
ObGetObjectType
ExEnumHandleTable
ExfUnblockPushLock
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
_snprintf
ZwCreateFile
ZwWriteFile
PsLookupThreadByThreadId
NtQueryInformationThread
PsGetThreadProcess
KeDelayExecutionThread
KdDisableDebugger
KdChangeOption
PsCreateSystemThread
PsTerminateSystemThread
KdDebuggerEnabled
PsGetVersion
RtlCopyUnicodeString
ExFreePoolWithTag
ExAllocatePool
KeInitializeEvent
MmUnlockPages
WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ