?AyamiKaze@@YGXXZ
Static task
static1
Behavioral task
behavioral1
Sample
IATFix.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
IATFix.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
meiqNS_crack.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
meiqNS_crack.exe
Resource
win10v2004-20230703-en
General
-
Target
DRM Removal.zip
-
Size
3.8MB
-
MD5
2d1e4e16816ca75447ea6a932f2851d3
-
SHA1
c7336246339c2af23e8cb0b1a38524f7bb2daf85
-
SHA256
46d367980d58ff659d92322c056e6d0645ae57f144afd6beb8d6f0ce7aa82c89
-
SHA512
d8bc98f482d3c0a7860d37c6ebb513cc0d810f753c84c50f99762f4bc0f8a4ccbbc20b7448e84ad70bfe620f492609e7e05936b7bb5d299cc3a69409cdc7a2a0
-
SSDEEP
98304:lqO5J/XEKac9TaGj1Fugm/YIFa3lLC/SdHZx/Ut:P5FXEKac0GHFmRsg/Wx/Ut
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/IATFix.dll unpack001/meiqNS_crack.exe
Files
-
DRM Removal.zip.zip
-
IATFix.dll.dll windows x86
8d714c000189a997049ea57539edfda8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
user32
MessageBoxW
vcruntime140
memset
_except_handler4_common
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_cexit
_initterm
_initialize_narrow_environment
_seh_filter_dll
_initterm_e
_initialize_onexit_table
_configure_narrow_argv
_execute_onexit_table
Exports
Exports
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
meiqNS_crack.exe.exe windows x86
f7d8ff6dc77fe814a3547b2531667061
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ags5
_AgsModelView@8
_AgsSpritePosSetEx@20
_AgsLanguageSettingWindow@0
_MTaskAgsTextInputSizeGet@8
_MTaskAgsTextInputRun@4
_MTaskAgsTextInputInit@24
_MTaskAgsTextInputStringGet@12
_MTaskAgsTextInputPosSet@12
_AgsDebugIs@0
_MTaskAgsButtonRunHit@8
_MTaskAgsButtonEntryBt@8
_AgsSpriteViewOn@4
_AgsScroolBarInit@8
_AgsSpriteInfoGet@8
_AgsTerritoryPaintBlend@20
_AgsSoundWaveStop@4
_AgsTaskFree@0
_MTaskAgsButtonInit@12
_AgsTaskAllocChild@20
_AgsSpriteCreateFile@12
_AgsTerritoryCreate@8
_AgsTerritoryDelete@4
_MTaskAgsButtonClickSubFileSet@16
_AgsKeyTypeRpt@0
_AgsSpriteAlphaSet@8
_AgsSpritePrioritySet@8
_AgsSoundWaveStatus@4
_AgsKeyWheel@0
_MTaskAgsButtonCursorNextSetRev@20
_AgsScroolBarView@4
_AgsSpriteCreateText@20
_MTaskAgsButtonGet@12
_AgsSpriteCreateEmpty@16
_AgsScroolBarRun@12
_MTaskAgsButtonRun@8
_AgsTerritoryChangeEffect@4
_AgsSpriteViewOff@4
_AgsTerritoryActiveSet@4
_AgsTaskGroundWorkGet@0
_AgsTaskChangeRetrace@4
_AgsKeyTypeCnt@0
_AgsSpritePosSet@12
_AgsKeyTypeTrg@0
_AgsSpriteRectChange@16
_MTaskAgsButtonEntryHandle@8
_AgsTerritoryAllEffect@4
_AgsSpriteFileNameGet@12
_AgsTaskMsgToParent@4
_AgsFileSystemFileCheck@4
_AgsSpaniCountGet@4
_DTaskSpaniDataTask@8
_AgsTaskSubgroundNoSet@4
_AgsDebugWindowDelete@4
_AgsSpriteHandleIs@4
AgsDebugWindowPrintfColor
_SpaniFileKomaListLast@4
_SpaniFileKomaListCreate@8
_AgsSoundBgmStop@0
_AgsSpriteDelete@4
_AgsTaskDiscipleFree@4
_AgsDebugWindowCreate@16
_AgsSpaniRectChange@12
_AgsSpriteCreateCell@16
_AgsTerritoryPaintPosSet@12
_AgsTaskAllocDiscipleStyle@24
_AgsObjFileLoad@8
_AgsSpriteRepaint@4
_AgsSpriteDeleteLump@8
_AgsTaskChildHandleGet@0
_AgsSoundBgmPlay@4
_CTaskMoviePlay@24
AgsDebugWindowPrintf
_AgsTerritoryPaintPosGet@12
_AgsFrameCountGet@0
_AgsDebugWindowTabClear@4
_AgsTaskMaidRun@12
_AgsTerritoryCreateBasic@0
_AgsTaskMsgFromDisciple@4
_CTaskWait@20
_AgsSpritePosOffsetSet@12
_AgsTerritoryChangeEffectGet@0
_AgsTaskFreeChildAll@4
_AgsSpriteRectSet@8
_AgsDebugWindowTab@4
_AgsSpriteTextureModeSet@16
_AgsSpriteGetCell@4
_AgsDebugWindowWorkSet@8
_AgsSpriteCalcWait@0
_AgsFileSystemCreateFile@8
_AgsTaskMsgFromChild@0
_CTaskTaskWait@32
_AgsTaskChangeNext@4
_AgsTerritoryActiveGet@0
_AgsTaskAllocMaid@20
_AgsSpriteZoomParSet@12
_AgsSoundBgmGet@0
_AgsTerritoryChangeBasic@12
_AgsTaskChildHandleGetEx@0
_AgsSpritePgsvGet@0
_AgsTaskMsgFromParent@0
_AgsSoundWavePlayFile@8
_AgsTaskSubgroundNoWorkGet@4
_AgsHwndGet@0
_AgsKeyTrg@0
_MTaskAgsButtonWaitOff@8
_AgsKeyCnt@0
_AgsAppPahtGet@0
_AgsSpriteAlphaColorSet@12
_AgsTerritoryPaint@16
_MTaskAgsButtonWaitOn@8
_AgsSpriteDivideCountGet@4
_AgsTaskAllocDisciple@20
_AgskeyPgsvSet@8
_AgsTaskHandleAutoDeleteTask@8
_AgsKeyMouseX@0
_AgsSpriteView@8
_AgsSpritePosMove@12
_DTaskSpriteAnimeX@8
_AgsSpriteDivide@8
_MTaskAgsButtonInitData@4
_MTaskAgsButtonDataDefault@12
_AgsFileSystemFullPathGet@12
_MTaskAgsButtonInitDataDefault@16
_AgsSpriteViewIs@4
_AgsKeyMouseY@0
_AgsSpritePosCenterSet@12
_AgsVersionSet@4
_AgsStart@4
_AgsEnd@4
_AgsRun@4
_AgsObjFileLoadEx@12
_AgsFileSystemPathSetEx@8
_AgsKeyExTouchGet@4
_AgsKeyMouseMoveY@0
_AgskeyMousePointSet@8
_AgsSpriteRectFixChange@16
_AgsSpriteHitPoss@20
_AgsKeyTouchInfoGet@4
_AgsKeyMouseMoveX@0
_AgskeyWindowInnerForceSet@4
_AgskeyWindowInnerForceGet@0
_AgsMasuPosXGet@12
_AgsMasuNextXGet@16
_AgsMasuPosYGet@12
_AgsMasuDistanceGetSimple@20
_AgsSpriteBaseZoomParSet@12
_AgsMasuNextYGet@16
_AgsNumberSpriteSet@16
_AgsSpriteChangeFuncSet@8
_AgsSpriteChangeBeforeViewSet@8
_AgsSpriteChangeAfterViewSet@8
_AgsSpriteChangeUserDataSet@8
_MTaskAgsButtonEntryDelete@8
_MTaskAgsButtonCursorForceOn@8
_AgsTaskMsgToDisciple@12
_AgsTaskMsgFromParentData@0
_AgsSpriteAlphaColorModeSet@8
_AgsSpriteChangeSpeedSet@4
_MTaskAgsButtonEntryHandlePresetNoBlink@8
_AgsTaskMaidWorkGet@4
_AgsSpriteBaseZoomSet@12
_AgsTaskRunningIs@4
_AgsKeyVirtualTrg@4
_AgsCursorChange@4
_AgsSpriteParentSet@8
_AgsMasuPrioGet@12
_AgsTaskAllocMaidStyle@24
_MTaskAgsButtonCursorNextSet@20
_AgsTerritoryHandleIs@4
_AgsTaskChange@8
_DTaskSpaniData@4
_AgsSpriteCenterSet@12
_AgsSpriteCreateTextEx@24
_MTaskAgsButtonEntryHandlePresetJump@16
_MTaskAgsButtonCursorWaitOn@8
_AgsSpriteGetViewRectSimple@8
_MTaskAgsButtonEntryHandlePresetRpt@8
_AgsSpriteColorFreamSet@16
_DTaskSpani@8
_AgsGaugeLengthSet@12
_AgsGaugeLengthSetForce@12
_DTaskAgsGaugeRefresh@4
_AgsGaugeLast@4
_AgsGaugeInit@48
_DTaskSpriteNumberEffectEx@32
_AgsGaugeStretchChangeAlphaSet@12
_AgsSoundWaveChannelFileGet@12
_AgsSpriteAddColorSet@12
_AgsTaskSubgroundWorkGet@0
_AgsSoundBgmFadeRob@4
_AgsSoundBgmTrackGet@0
_AgsTaskDiscipleIs@4
_AgsTerritoryPaintColor@16
_AgsSpriteCreateTextType@24
_DTaskGameEffectSmokeSprite@52
_DTaskGameEffectChargeSprite@80
_DTaskGameEffectBombSprite@60
_AgsTaskStatus@4
_AgsTaskHandleAutoDeleteFrame@4
_DTaskGameEffectSlashSprite@92
_MTaskSpaniData@4
_AgsSpriteSizeOffsetSet@12
_AgsMasuMoveDataGet@28
_AgsGaugeViewSet@8
_AgsGaugePosSet@12
_DTaskSpaniSpeedChangeTask@12
_MTaskAgsButtonEntryHandlePresetPutCh@24
_AgsSoundWaveStatusEx@4
_AgsTaskParentHandleGet@0
_AgsTaskGroundHandleGet@0
_AgsTaskBackSet@4
_AgsTaskAllocGround@20
_DTaskSpriteAnime@8
?AgsSpriteBgEffModeSet@@YGXH@Z
?AgsSpriteBgEffModeGet@@YGHXZ
_AgsModelRollSet@16
_AgsModelPosSet@16
_AgsModelCreateBox@16
_AgsModelInfoGet@8
_AgsSpriteAlphaSetOne@8
_AgsSoundWaveChannelInfo@8
_AgsSoundBgmVolumeSet@8
AgsSoundMasterVolumeGet
_AgsSoundWaveVolumeGet@4
_AgsSoundBgmSet@4
AgsSoundMasterVolumeSet
_AgsSoundWaveVolumeSet@8
_AgsSoundBgmTrackMax@4
_AgsSoundBgmVolumeGet@4
_AgsSoundWavePlayPermitOff@4
_AgsSoundWavePlayPermitOn@4
_AgsSpriteChangeExecute@8
_AgsModelChangeBeforeViewSet@8
_AgsModelChangeUserDataSet@8
_AgsModelChangeExecute@8
_AgsModelChangeAfterViewSet@8
_AgsTaskSubMemoryAlloc@4
_MTaskAgsButtonCursorModeSet@12
_AgsScroolBarListSet@16
_AgsSpritePause@0
_AgsSpriteRollSet@8
_AgsKeyRpt@0
_AgsDLCheck@4
_AgsCursorSetDefault@8
_AgsSoundBgmWaveFileSet@4
AgsSpriteSysCellPixHoldSet
_AgsSoundWaveChGroupSet@12
_AgsFileSystemPathSet@4
_AgsDiskCheckSave@12
_AgsSpriteChangeFuncDefaultSet@4
_AgsModelLayerEffectDefaultSet@4
_AgsLanguageNoGet@0
_AgsSoundBgmFadeExSet@8
_AgsSpriteCalcTerritoryCountSet@4
_AgsTaskSubgroundSet@0
_AgsCursorViewTime@4
_AgsActiveIs@0
_AgsIniSettingWindowView@0
_AgsTerritoryActiveEx@8
_AgsSoundWaveChGroupFree@4
_AgsKeyTypeOn@12
_AgskeyEntryExAddress@0
_AgskeyEntryExAdd@4
_AgsSpriteFullScreen@4
_AgsKeyJoyMouseMoveSet@4
_AgsSpriteFullScreenIs@0
_AgskeyPause@0
_AgsSystemEnd@0
_AgsModelDelete@4
_AgsModelAlphaColorSet@12
_AgsSpriteZoomSet@12
_AgsSpriteNextGet@4
_AgsSpritePriorityMove@8
_DTaskSpaniLoop@12
_AgsSpriteCreateHBitMap@12
_AgsSpriteIdSet@8
_MTaskAgsButtonCursorForceSet@8
_AgsSpriteChildGet@4
_AgsSpriteViewPortGet@0
_AgsModelViewOff@4
_AgsSoundWavePlayFileEx@8
_AgsModelAlphaSet@8
_MTaskAgsButtonCursorSet@8
_AgsModelViewOn@4
_AgsModelHandleIs@4
aoi5
_AoiRateInit@0
_AoiVfsFileOpen@8
_AoiRectCilp@12
_AoiRandomExLast@4
_AoiTimeLocal32@12
_AoiRectHitRect@12
_AoiMathHexa2DecimalCode@4
_AoiStrw2ByteIs@4
_AoiStringwCpy@8
_AoiStrwcpy@12
_AoiCddaDrvGet@4
_AoiStringwCatBack@8
_AoiStrwtoknGet@20
_AoiStrwstr@8
_AoiStrwlen@4
_AoiStrwtokn@8
_AoiStringwInit@0
_AoiStringwLast@4
_AoiBsearch@24
_AoiCardSet@12
_AoiMathLimit@12
_AoiFilePathFileName@4
AoiwPrintf
_AoiMemoryFree@4
_AoiStrwtoi@8
_AoiCalcGetNumDefault@8
_AoiStrwcmp@8
_AoiCardLast@4
_AoiMathLoop@12
_AoiCalcGetStrFuncSet@4
_AoiCalcGetStrPtrFuncSet@4
_AoiCalcGetNumPtrDefault@12
_AoiRandomSigned@8
_AoiCalcGetStrDefault@16
_AoiStrwncmpi@12
_AoiCalcStrIsFuncSet@4
_AoiCardInit@0
_AoiMemoryResize@8
_AoiCardRandomGet@4
_AoiStrwcmpi@8
AoiStringwPrintfBack
_AoiStrwMatch@8
_AoiCardOrderGet@4
AoiStringwPrintf
_AoiCardMax@4
_AoiFilePathFileName@4
_AoiCalcGetNumPtrFuncSet@4
_AoiCalcGetNumFuncSet@4
_AoiCalcStrIsDefault@8
__AoiwPrintfEx@16
_AoiCalcGetNumPtrDefault@12
_AoiMemoryHandleAddress@4
AoiwPrintfBack
_AoiRandom@8
_AoiMemoryAlloc@4
_AoiCardMax@4
_AoiStrwcat@12
_AoiMemoryHandleAlloc@8
_AoiCalc@8
_AoiMemoryHandleFree@4
_AoiMemoryErrorCheck@4
_AoiStracmp@8
_AoiStracpy@12
AoiMessageBox
__AoiwPrintfBackEx@16
_AoiTimerGetTimeCount@0
_AoiRectHitPoss@12
__AoiStringwPrintfEx@16
_AoiLib_Start@0
_AoiStrAtoW@12
_AoiLib_End@0
_AoiCardSetRange@20
_AoiCardShuffle@8
_AoiRandomPercent@8
_AoiMathDivRoundup@8
_AoiMemoryCopy@12
_AoiMemoryMove@12
_AoiFileCreateZero@4
_AoiFileFindForEach@12
_AoiProfileDefWriteString@16
_AoiProfileDefWriteInt@16
_AoiProfileDefReadInt@16
_AoiQsort@16
_AoiMemorySize@4
_AoiProfileDefInit@4
_AoiProfileDefReadString@24
_AoiProfileDefLast@4
_AoiFileDelete@4
_AoiMathJump@12
_AoiMathAbsInt@4
_AoiQsortParam@20
_AoiFileReadLine@16
_AoiFileOpenWrite@8
_AoiFileClose@4
AoiFilePrintfEncode
_AoiMathParabolaUp@12
_AoiRandomExGet@12
_AoiRateSet@12
_AoiRateReset@4
_AoiRateLast@4
_AoiRateRandomGet@4
_AoiCardPoint@4
_AoiRateOut@12
_AoiRateAdd@12
_AoiMathJumpFloat@12
_AoiMathParabolaDown@12
_AoiTimeNowGet32@4
_AoiRectSet@20
_AoiRandomSeedSet@4
_AoiRateRandomUseGet@4
_AoiRateUse@12
_AoiRateLoop@4
_AoiStrwtoknBranket@12
_AoiStrwtoknBranketGet@24
_AoiStrwtof@8
_AoiFolderMake@8
_AoiMathParabolaUpFloat@12
_AoiMathArcPosGet@16
_AoiMathParabolaDownFloat@12
_AoiStraTblStringGet@8
_AoiStraTblLast@4
_AoiStraTblStringMax@4
_AoiStrwTblStringAdd@8
_AoiStrwTblInit@0
_AoiMemoryZero@8
_AoiStrwncmp@12
_AoiFilePathSearch@4
_AoiDriveList@8
_AoiOsVersionGet@8
_AoiDriveSerialNumberGet@4
_AoiDiskFreeSpace@4
_AoiCddaDrvGet@4
_AoiStrwTblReset@8
AoiMessageBoxStyle
_AoiStrwTblStringTokn@12
_AoiRandomExInit@4
_AoiRandomFloat@8
aoicmp5
?AoiCompressPack@@YGHPAXKKPAPAXPAUtagAOI_COMPRESS_PACK_DATA@@P6AHH0@Z0@Z
?AoiCompressMemoryFree@@YGXPAX@Z
?AoiCompressUnpack@@YGHPAXKPAPAXPAUtagAOI_COMPRESS_PACK_DATA@@P6AHH0@Z0@Z
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
gdi32
SetBrushOrgEx
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SetStretchBltMode
StretchBlt
kernel32
FreeLibrary
LoadLibraryW
GetProcAddress
OpenMutexW
ExpandEnvironmentStringsW
CopyFileW
WaitForSingleObject
Sleep
GetFullPathNameW
FindFirstFileW
SetFileAttributesW
FindNextFileW
GetTickCount
QueryPerformanceCounter
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
CreateFileW
WriteFile
DeleteFileW
CloseHandle
ReadFile
SetFilePointer
RtlUnwind
HeapReAlloc
HeapAlloc
RaiseException
FindClose
FreeEnvironmentStringsW
GetModuleFileNameA
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapSize
InterlockedDecrement
InterlockedIncrement
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
EncodePointer
DecodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
MultiByteToWideChar
IsProcessorFeaturePresent
ExitProcess
GetStdHandle
GetModuleFileNameW
pgsvtd
_PGSVTD_TCellAddress@8
_PGSVTD_TCellPaintRect@16
_PGSVTD_TCellFileWriteAgf@20
_PGSVTD_TCellHandleReadCreate@8
_PGSVTD_TCellDelete@8
_PGSVTD_TCellFileRead@12
user32
ShowWindow
LoadIconW
SetWindowTextW
SendInput
ReleaseDC
GetDC
pgsv
_PGSV_Angle3D@8
_PGSV_CaptureViewPort@8
iatfix
?AyamiKaze@@YGXXZ
Sections
.text Size: 838KB - Virtual size: 840KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 153KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 155KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 267KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 64KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.ierdata Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xfudata Size: 103KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imrdata Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AYKZ Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE