2a3cb655392021792e66335532ac377ac25cd946f75737022dc740c3b1c9b176

Sharing

Copy URL Twitter E-mail

General

Target

2a3cb655392021792e66335532ac377ac25cd946f75737022dc740c3b1c9b176
Size

6.1MB
MD5

c60b876ee18ba4ec5f2d158d8ea755e3
SHA1

2ec9b9dca86d6db21c1ce4b853b2dd0bfa8df779
SHA256

2a3cb655392021792e66335532ac377ac25cd946f75737022dc740c3b1c9b176
SHA512

b0c705111ab5b2534390b64d47502436742cfdcac77cf5c504a4e21f860ddb66c206de3b6f446ffbd6a0493de6b26f7f86d643caab382771ced477ceaf381cd3
SSDEEP

98304:bKy7PPwOvRyBt5RUTF3QACGrp5UgOxAJvKSmSUeWZDW0nLwPbVDa3U4+9O:2yTzyXdACWpigOI14eyW0LwCK9O

Score

3^/10

Malware Config

Signatures

Unsigned PE 129 IoCs

Checks for missing Authenticode signature.

resource
unpack001/inetsrv/AppHostNavigators.dll
unpack001/inetsrv/Cnfgprts.ocx
unpack001/inetsrv/IISUiObj.dll
unpack001/inetsrv/InetMgr.exe
unpack001/inetsrv/InetMgr6.exe
unpack001/inetsrv/Microsoft.Web.Administration.dll
unpack001/inetsrv/Microsoft.Web.Management.dll
unpack001/inetsrv/WMSvc.exe
unpack001/inetsrv/XPath.dll
unpack001/inetsrv/abocomp.dll
unpack001/inetsrv/adsiis.dll
unpack001/inetsrv/appcmd.exe
unpack001/inetsrv/apphostsvc.dll
unpack001/inetsrv/appobj.dll
unpack001/inetsrv/asp.dll
unpack001/inetsrv/aspnetca.exe
unpack001/inetsrv/asptlb.tlb
unpack001/inetsrv/authanon.dll
unpack001/inetsrv/authbas.dll
unpack001/inetsrv/authcert.dll
unpack001/inetsrv/authmap.dll
unpack001/inetsrv/authmd5.dll
unpack001/inetsrv/authsspi.dll
unpack001/inetsrv/browscap.dll
unpack001/inetsrv/cachfile.dll
unpack001/inetsrv/cachhttp.dll
unpack001/inetsrv/cachtokn.dll
unpack001/inetsrv/cachuri.dll
unpack001/inetsrv/cgi.dll
unpack001/inetsrv/coadmin.dll
unpack001/inetsrv/compdyn.dll
unpack001/inetsrv/compstat.dll
unpack001/inetsrv/custerr.dll
unpack001/inetsrv/defdoc.dll
unpack001/inetsrv/diprestr.dll
unpack001/inetsrv/dirlist.dll
unpack001/inetsrv/en-US/appcmd.exe.mui
unpack001/inetsrv/en-US/appobj.dll.mui
unpack001/inetsrv/en-US/iisres.dll.mui
unpack001/inetsrv/en-US/iissetup.exe.mui
unpack001/inetsrv/filter.dll
unpack001/inetsrv/gzip.dll
unpack001/inetsrv/httpcgi.dll
unpack001/inetsrv/httpmib.dll
unpack001/inetsrv/hwebcore.dll
unpack001/inetsrv/iis_ssi.dll
unpack001/inetsrv/iisadmin.dll
unpack001/inetsrv/iiscertprovider.dll
unpack001/inetsrv/iiscfg.dll
unpack001/inetsrv/iiscore.dll
unpack001/inetsrv/iisetw.dll
unpack001/inetsrv/iisext.dll
unpack001/inetsrv/iisfcgi.dll
unpack001/inetsrv/iisfreb.dll
unpack001/inetsrv/iislog.dll
unpack001/inetsrv/iisreg.dll
unpack001/inetsrv/iisreqs.dll
unpack001/inetsrv/iisres.dll
unpack001/inetsrv/iisrstas.exe
unpack001/inetsrv/iissetup.exe
unpack001/inetsrv/iissyspr.dll
unpack001/inetsrv/iisual.exe
unpack001/inetsrv/iisui.dll
unpack001/inetsrv/iisutil.dll
unpack001/inetsrv/iisw3adm.dll
unpack001/inetsrv/iiswmi.dll
unpack001/inetsrv/iiswsock.dll
unpack001/inetsrv/inetinfo.exe
unpack001/inetsrv/inetmgr.dll
unpack001/inetsrv/infocomm.dll
unpack001/inetsrv/iprestr.dll
unpack001/inetsrv/isapi.dll
unpack001/inetsrv/isatq.dll
unpack001/inetsrv/iscomlog.dll
unpack001/inetsrv/logcust.dll
unpack001/inetsrv/loghttp.dll
unpack001/inetsrv/logscrpt.dll
unpack001/inetsrv/logui.ocx
unpack001/inetsrv/metadata.dll
unpack001/inetsrv/modrqflt.dll
unpack001/inetsrv/nativerd.dll
unpack001/inetsrv/protsup.dll
unpack001/inetsrv/redirect.dll
unpack001/inetsrv/rpcref.dll
unpack001/inetsrv/rsca.dll
unpack001/inetsrv/rscaext.dll
unpack001/inetsrv/static.dll
unpack001/inetsrv/svcext.dll
unpack001/inetsrv/uihelper.dll
unpack001/inetsrv/urlauthz.dll
unpack001/inetsrv/validcfg.dll
unpack001/inetsrv/w3ctrlps.dll
unpack001/inetsrv/w3ctrs.dll
unpack001/inetsrv/w3dt.dll
unpack001/inetsrv/w3logsvc.dll
unpack001/inetsrv/w3tp.dll
unpack001/inetsrv/w3wp.exe
unpack001/inetsrv/w3wphost.dll
unpack001/inetsrv/wamreg.dll
unpack001/inetsrv/warmup.dll
unpack001/inetsrv/wbhst_pm.dll
unpack001/inetsrv/wbhstipm.dll
unpack001/inetsrv/webdav.dll
unpack001/inetsrv/webdav_simple_lock.dll
unpack001/inetsrv/webdav_simple_prop.dll
unpack001/inetsrv/wmi-appserver.dll
unpack001/inetsrv/zh-CN/AppHostNavigators.dll.mui
unpack001/inetsrv/zh-CN/Cnfgprts.ocx.mui
unpack001/inetsrv/zh-CN/IISUiObj.dll.mui
unpack001/inetsrv/zh-CN/Inetmgr.exe.mui
unpack001/inetsrv/zh-CN/XPath.dll.mui
unpack001/inetsrv/zh-CN/appcmd.exe.mui
unpack001/inetsrv/zh-CN/appobj.dll.mui
unpack001/inetsrv/zh-CN/browscap.dll.mui
unpack001/inetsrv/zh-CN/iiscertprovider.dll.mui
unpack001/inetsrv/zh-CN/iiscfg.dll.mui
unpack001/inetsrv/zh-CN/iisfcgi.dll.mui
unpack001/inetsrv/zh-CN/iislog.dll.mui
unpack001/inetsrv/zh-CN/iisres.dll.mui
unpack001/inetsrv/zh-CN/iissetup.exe.mui
unpack001/inetsrv/zh-CN/iisui.dll.mui
unpack001/inetsrv/zh-CN/inetmgr.dll.mui
unpack001/inetsrv/zh-CN/inetmgr6.exe.mui
unpack001/inetsrv/zh-CN/infocomm.dll.mui
unpack001/inetsrv/zh-CN/iscomlog.dll.mui
unpack001/inetsrv/zh-CN/logui.ocx.mui
unpack001/inetsrv/zh-CN/metadata.dll.mui
unpack001/inetsrv/zh-CN/uihelper.dll.mui
unpack001/inetsrv/zh-HANS/iisual.resources.dll

Files

2a3cb655392021792e66335532ac377ac25cd946f75737022dc740c3b1c9b176
.zip
inetsrv/AppHostNavigators.dll
.dll regsvr32 windows:10 windows x64

dc3f4381a9427787cd132be43ef36b84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__C_specific_handler
memcmp
_resetstkoflw
_purecall
free
malloc
wcschr
_wcsicmp
strcpy_s
wcsncpy_s
_callnewh
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
__CxxFrameHandler3
memcpy
memset
_CxxThrowException
wcscmp

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyW
RegDeleteKeyW

kernel32

QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
GetCurrentProcessId
Sleep
FindNextFileW
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
WakeAllConditionVariable
FindClose
GetModuleFileNameA
HeapFree
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetProcessHeap
InitializeSRWLock
SetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapReAlloc
ReleaseSRWLockShared
HeapAlloc
AcquireSRWLockShared
CompareStringOrdinal
ExpandEnvironmentStringsW
GetLastError
GetModuleFileNameW
InitializeCriticalSection
RaiseException
DeleteCriticalSection
FormatMessageW
LocalFree
FindFirstFileW

ole32

CoCreateInstance

oleaut32

SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString
LoadTypeLi
LoadRegTypeLi
VariantClear
VariantInit
VariantChangeType
RegisterTypeLi
UnRegisterTypeLi
SetErrorInfo

rpcrt4

RpcStringFreeW
UuidToStringW

user32

CharNextA
UnregisterClassA
CharLowerBuffW
LoadStringW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/Cnfgprts.ocx
.dll regsvr32 windows:10 windows x64

82739e596e84c7dba7318b635064696f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mfc42u

ord4368
ord5724
ord5722
ord3468
ord2412
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord620
ord493
ord971
ord1875
ord4573
ord2488
ord2499
ord4028
ord6571
ord3288
ord6354
ord3217
ord6335
ord2971
ord6249
ord2712
ord1473
ord1510
ord1527
ord455
ord949
ord2422
ord2023
ord4542
ord2589
ord6440
ord4365
ord1778
ord4743
ord5663
ord2399
ord5586
ord6812
ord4694
ord5712
ord4017
ord5229
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord3535
ord4988
ord3751
ord665
ord832
ord4209
ord2550
ord2546
ord5353
ord1677
ord2408
ord2676
ord1574
ord286
ord4754
ord4997
ord1126
ord4131
ord624
ord2629
ord1657
ord1498
ord2783
ord1122
ord2474
ord2936
ord4695
ord3174
ord5113
ord5157
ord4293
ord2062
ord5475
ord4521
ord2781
ord6175
ord4985
ord4372
ord3165
ord3053
ord3374
ord4816
ord3363
ord3244
ord3050
ord6807
ord2398
ord4752
ord3020
ord4895
ord3537
ord2491
ord5385
ord5399
ord4761
ord5416
ord4962
ord5110
ord5111
ord4697
ord4702
ord4713
ord4941
ord4998
ord5004
ord5017
ord5434
ord5056
ord5010
ord5031
ord5032
ord5033
ord5307
ord5308
ord5024
ord5339
ord5334
ord5329
ord5395
ord4951
ord4874
ord4904
ord5302
ord5012
ord5143
ord5025
ord5026
ord5978
ord3069
ord2917
ord5074
ord5730
ord5572
ord4121
ord3019
ord5629
ord1964
ord2159
ord6380
ord5322
ord5248
ord2181
ord6011
ord5000
ord5054
ord4683
ord1345
ord5946
ord1701
ord2450
ord3850
ord3484
ord3384
ord5868
ord4822
ord6800
ord3447
ord6799
ord1891
ord4576
ord1513
ord496
ord974
ord2310
ord2384
ord2300
ord4771
ord4986
ord3385
ord4786
ord5708
ord6808
ord1777
ord6437
ord2517
ord5080
ord5406
ord5245
ord4721
ord5687
ord5419
ord5235
ord5038
ord4926
ord3830
ord1124
ord2846
ord1284
ord1287
ord622
ord6708
ord1286
ord621
ord559
ord1003
ord1365
ord5691
ord2532
ord5655
ord443
ord938
ord6880
ord1383
ord371
ord877
ord5986
ord3222
ord3780
ord367
ord5602
ord3440
ord5807
ord4436
ord6050
ord6705
ord6222
ord3829
ord6171
ord1906
ord549
ord999
ord3894
ord1035
ord2586
ord4741
ord3743
ord822
ord3531
ord3911
ord1056
ord3889
ord1029
ord3774
ord867
ord3758
ord848
ord408
ord904
ord2329
ord2328
ord2311
ord4582
ord6767
ord2661
ord6632
ord3397
ord6582
ord2902
ord4046
ord644
ord6495
ord4267
ord6386
ord6418
ord5382
ord5246
ord4699
ord5061
ord5227
ord4860
ord5709
ord5077
ord4722
ord5352
ord5114
ord5304
ord5583
ord5585
ord5584
ord1427
ord1426
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord5711
ord6053
ord3049
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord3534
ord5065
ord4082
ord4083
ord4077
ord3164
ord4371
ord4983
ord4770
ord3837
ord1530
ord6787
ord1463
ord1517
ord287
ord2751
ord5887
ord2975
ord4473
ord1040
ord626
ord1430
ord4213
ord1063
ord5072
ord659

msvcrt

sprintf_s
fprintf
sscanf_s
strcat_s
_strnicmp
strchr
swscanf
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
memcpy
memset
__CxxFrameHandler3
??1type_info@@UEAA@XZ
__iob_func
strspn
_wcsdup
free
wcscmp

iisui

?CreatePathFromFailedOpen@CMetaKey@@QEAAJXZ
?ReOpen@CMetaKey@@QEAAJK@Z
?DeleteValue@CMetaKey@@QEAAJKPEBG@Z
??0CStringListEx@@QEAA@H@Z
??1CStringListEx@@UEAA@XZ
?SetValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBG@Z
?DoesPathExist@CMetaKey@@QEAAJPEBG@Z
?ConvertToParentPath@CMetabasePath@@SAPEBGAEAVCString@@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetabasePath@@QEAA@HPEBG000@Z
?Succeeded@CMetaKey@@UEBAHXZ
??1CMetaKey@@UEAA@XZ
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@PEBGKK@Z
??1CComAuthInfo@@QEAA@XZ
??0CComAuthInfo@@QEAA@PEBG00@Z
?CopyTo@CStrPassword@@QEAAXAEAVCString@@@Z
??4CStrPassword@@QEAAAEBV0@PEBG@Z
??1CStrPassword@@QEAA@XZ
??0CStrPassword@@QEAA@XZ
??BCMetabasePath@@QEBAPEBGXZ
?QueryValue@CMetaKey@@QEAAJKAEAVCString@@PEAHPEBGPEAK@Z
?QueryResult@CMetaKey@@UEBAJXZ
??4CError@@QEAAAEBV0@J@Z
??1CError@@QEAA@XZ
??0CError@@QEAA@XZ
??1CMetabasePath@@QEAA@XZ
??1CMetaEnumerator@@UEAA@XZ
??0CMetaEnumerator@@QEAA@HPEAVCMetaKey@@@Z
?Next@CMetaEnumerator@@QEAAJAEAVCString@@PEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCString@@PEAHPEBG@Z
?GetServiceInfoPath@CMetabasePath@@SAPEBGPEBGAEAVCString@@0@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBGPEAK@Z

kernel32

GetLocalTime
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
GetTimeFormatW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
FindFirstFileW
LocalFree
LocalReAlloc
GetDateFormatW
GetTimeZoneInformation
FindNextFileW
FindClose
LoadLibraryExA
ExpandEnvironmentStringsA
GetProcAddress
TerminateProcess
ExpandEnvironmentStringsW
LocalAlloc

advapi32

RegQueryValueExA
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExA

comctl32

ImageList_LoadImageW
ImageList_Destroy

shell32

ShellExecuteW

shlwapi

PathAppendW

user32

DestroyAcceleratorTable
SendMessageW
GetWindowLongW
SetWindowLongW
InvalidateRect
CreateAcceleratorTableW
EnableWindow

ole32

CLSIDFromString
CoGetClassObject

oleaut32

LoadRegTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/Config/Schema/ASPNET_schema.xml
inetsrv/Config/Schema/FX_schema.xml
inetsrv/Config/Schema/Ftp_schema.xml
inetsrv/Config/Schema/IIS_schema.xml
.xml .vbs
inetsrv/Config/Schema/WebDAV_schema.xml
inetsrv/Config/Schema/ftp_rscaext.xml
inetsrv/Config/Schema/rewrite_schema.xml
inetsrv/Config/Schema/rscaext.xml
inetsrv/Config/administration.config
.xml
inetsrv/Config/applicationHost.config
.xml
inetsrv/Config/redirection.config
inetsrv/History/MBSchema_0000000032_0000000000.xml
inetsrv/History/MBSchema_0000000033_0000000000.xml
inetsrv/History/MBSchema_0000000034_0000000000.xml
inetsrv/History/MBSchema_0000000035_0000000000.xml
inetsrv/History/MBSchema_0000000036_0000000000.xml
inetsrv/History/MBSchema_0000000037_0000000000.xml
inetsrv/History/MBSchema_0000000038_0000000000.xml
inetsrv/History/MBSchema_0000000039_0000000000.xml
inetsrv/History/MBSchema_0000000040_0000000000.xml
inetsrv/History/MBSchema_0000000041_0000000000.xml
inetsrv/History/MetaBase_0000000032_0000000000.xml
inetsrv/History/MetaBase_0000000033_0000000000.xml
inetsrv/History/MetaBase_0000000034_0000000000.xml
inetsrv/History/MetaBase_0000000035_0000000000.xml
inetsrv/History/MetaBase_0000000036_0000000000.xml
inetsrv/History/MetaBase_0000000037_0000000000.xml
inetsrv/History/MetaBase_0000000038_0000000000.xml
inetsrv/History/MetaBase_0000000039_0000000000.xml
inetsrv/History/MetaBase_0000000040_0000000000.xml
inetsrv/History/MetaBase_0000000041_0000000000.xml
inetsrv/IISUiObj.dll
.dll regsvr32 windows:10 windows x64

011baa9f7cbe90757d4d6101d43ceabe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcscspn
_vsnwprintf
memcpy
_wcsupr
wcsstr
wcsncpy_s
_wsplitpath_s
_ultow
free
malloc
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
__CxxFrameHandler3
?what@exception@@UEBAPEBDXZ
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memcmp
wcschr
_wcsicmp
__C_specific_handler
memset
wcscmp

atl

ord58
ord30
ord44
ord43
ord57
ord18
ord15
ord21
ord32
ord16
ord23

kernel32

UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ExpandEnvironmentStringsA
WakeAllConditionVariable
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
LoadLibraryExW
ReleaseActCtx
GetModuleHandleW
GetCurrentProcessId
SleepConditionVariableSRW
LocalFree
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
SetLastError
ExpandEnvironmentStringsW
LocalAlloc
DeactivateActCtx
ActivateActCtx
LoadLibraryW
FindActCtxSectionStringW
CreateActCtxW
GetModuleFileNameW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
GetComputerNameW
CompareStringW
GetShortPathNameW
Sleep
GetComputerNameExW
GetSystemDirectoryW
lstrcpynW
lstrlenW
GetVersionExW
GetFileAttributesW
GetProcAddress
HeapFree
VirtualFree
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
EncodePointer
HeapAlloc
DecodePointer
GetProcessHeap
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

user32

UpdateWindow
SendDlgItemMessageW
SetDlgItemTextW
GetForegroundWindow
EndDialog
MessageBeep
GetDlgItemTextW
EnableWindow
GetClientRect
GetParent
GetWindowRect
CheckDlgButton
IsDlgButtonChecked
IsWindowEnabled
PostMessageW
DialogBoxParamW
GetDesktopWindow
SystemParametersInfoW
MoveWindow
SetWindowLongPtrW
CharNextW
SendMessageW
GetDlgItem
SetFocus
GetActiveWindow
MessageBoxW
LoadStringW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegConnectRegistryW
RegCreateKeyW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyW

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

ole32

StringFromGUID2
CoCreateGuid
CoTaskMemAlloc
CoUninitialize
CoCreateInstanceEx
CoInitializeEx
CoSetProxyBlanket
CoTaskMemFree

oleaut32

SysFreeString
SysStringByteLen
SysAllocString
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi

netapi32

NetUseDel
NetUseAdd

ntdll

RtlSetEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlExpandEnvironmentStrings_U
RtlInitUnicodeString
RtlDestroyEnvironment
RtlCreateEnvironment

uihelper

?UsesImpersonation@CComAuthInfo@@QEBAHXZ
??0CError@@QEAA@J@Z
??0CString@IIS@@QEAA@PEBG@Z
?TruncatePath@CMetabasePath@@SAPEBGHPEBGAEAVCString@IIS@@PEAV23@@Z
?GetInstanceNumber@CMetabasePath@@SAKPEBG@Z
?FormatMessageW@CString@IIS@@QEAAHPEBGZZ
?EditShowBalloon@@YAXPEAUHWND__@@PEBG@Z
??0CString@IIS@@QEAA@AEBV01@@Z
?GetLength@CString@IIS@@QEBAHXZ
?FreeServerInfoStruct@CComAuthInfo@@QEBAXPEAU_COSERVERINFO@@@Z
?CompareNoCase@CString@IIS@@QEBAHPEBG@Z
?Find@CString@IIS@@QEBAHG@Z
?SetAt@CString@IIS@@QEAAXHG@Z
??ACString@IIS@@QEBAGH@Z
??4CString@IIS@@QEAAAEBV01@AEBV01@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@PEBGKK@Z
??1CMetaKey@@UEAA@XZ
?QueryResult@CMetaKey@@UEBAJXZ
?Succeeded@CMetaKey@@UEBAHXZ
?Format@CString@IIS@@QEAAXPEBGZZ
?CreateServerInfoStruct@CComAuthInfo@@QEBAPEAU_COSERVERINFO@@K@Z
??1CString@IIS@@QEAA@XZ
??0CComAuthInfo@@QEAA@PEBG00@Z
?MessageBoxW@CError@@QEBAHII@Z
??1CError@@QEAA@XZ
DecryptMemoryPassword
IsValidName
IsValidFolderPath
?EditShowBalloon@@YAXPEAUHWND__@@PEAUHINSTANCE__@@I@Z
??1CComAuthInfo@@QEAA@XZ
EditHideBalloon
?ApplyProxyBlanket@CComAuthInfo@@QEAAJPEAUIUnknown@@@Z
?LoadStringW@CString@IIS@@QEAAHPEAUHINSTANCE__@@I@Z
??YCString@IIS@@QEAAAEBV01@PEBG@Z
EncryptMemoryPassword
??4CString@IIS@@QEAAAEBV01@PEBG@Z
?IsEmpty@CString@IIS@@QEBA_NXZ
??BCString@IIS@@QEBAPEBGXZ
??0?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA@XZ
??0CString@IIS@@QEAA@XZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/InetMgr.exe
.exe windows:10 windows x64

4853459dd64f0064e49f07916078eed5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcAddress
GetCommandLineW
GlobalFree
GetModuleFileNameW
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
TerminateProcess

user32

LoadStringW
MessageBoxW

msvcrt

_ismbblead
exit
?terminate@@YAXXZ
_commode
_exit
_cexit
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_wcsicmp
wcscat_s
wcscpy_s

ole32

CoInitializeEx
CoInitializeSecurity

shlwapi

PathAppendW
PathRemoveFileSpecW

shell32

ShellExecuteW
CommandLineToArgvW

mscoree

ClrCreateManagedInstance
LoadLibraryShim
CorBindToRuntimeEx

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/InetMgr6.exe
.exe windows:10 windows x64

265169f7bad9bec55d09d1bebd3a88b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
GetModuleFileNameW
GetModuleHandleW
DebugBreak
UnhandledExceptionFilter
CreateProcessW
GetSystemDirectoryW
ExpandEnvironmentStringsW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
TerminateProcess
GetCurrentProcess

gdi32

GetStockObject

user32

DefWindowProcW
GetMessageW
UpdateWindow
PostQuitMessage
KillTimer
LoadCursorW
LoadIconW
TranslateMessage
CreateWindowExW
RegisterClassW
CharPrevW
SetTimer
DispatchMessageW
ShowWindow
LoadStringW
MessageBoxW

msvcrt

_initterm
__C_specific_handler
_ismbblead
_fmode
_commode
?terminate@@YAXXZ
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
wcsrchr
swprintf_s
wcscat_s
wcscpy_s
_waccess
__setusermatherr
_acmdln
_XcptFilter
memset

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/MBSchema.bin.00000000h
inetsrv/MBSchema.xml
inetsrv/MetaBase.xml
inetsrv/Microsoft.Web.Administration.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 132KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/Microsoft.Web.Management.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1016KB - Virtual size: 1014KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/WMSvc.exe
.exe windows:10 windows x64

55b96c492c26d2a4d1a691a8bc7ac9a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegisterEventSourceW

kernel32

GetProcAddress
SetEvent
GetVersionExW
SetProcessMitigationPolicy
CreateEventW
GetLastError
LoadLibraryExW
WaitForSingleObject
FreeLibrary
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
TerminateProcess

msvcrt

wcscpy_s
wcscat_s
free
?terminate@@YAXXZ
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
__C_specific_handler

ole32

CoInitializeEx
CoInitializeSecurity

user32

LoadStringW

mscoree

CorBindToRuntimeEx
ClrCreateManagedInstance
LoadLibraryShim

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/WebAdministration.mof
inetsrv/XPath.dll
.dll regsvr32 windows:10 windows x64

528aed5f7a9b765f5c9ff4c7aa378900

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_chgsign
wcsncmp
wcsstr
_isnan
_ecvt_s
_fpclass
_ultow_s
_wtof
_purecall
ceil
floor
memset

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleFileNameW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
CompareStringEx

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree

oleaut32

GetErrorInfo
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
SetErrorInfo

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

rpcrt4

UuidToStringW
RpcStringFreeW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegSetValueExW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegCreateKeyW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/abocomp.dll
.dll windows:10 windows x64

dcaa522efd0d4a55a5f595db7841e002

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcscpy_s
memset
_purecall
_ultow
_wcsnicmp
wcschr
wcstoul
wcsncpy_s
wcsrchr
_errno
wcsncmp
_wcslwr
wcsstr
_wtoi
isspace
iswdigit
iswalpha
iswspace
_wcsicmp
_vsnwprintf
_itow
wcstol
_stricmp
strchr
free
malloc
_callnewh
_XcptFilter
_amsg_exit
memmove
memcpy
memcmp
_initterm
__C_specific_handler
_wcslwr_s
wcscmp

ntdll

RtlLengthRequiredSid
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitializeSid
RtlSubAuthoritySid

kernelbase

GetSystemDefaultUILanguage

httpapi

HttpTerminate
HttpDeleteServiceConfiguration
HttpSetServiceConfiguration
HttpInitialize
HttpQueryServiceConfiguration

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-handle-l1-1-0

CloseHandle

ws2_32

WSAStartup
WSAGetLastError
WSACleanup
GetAddrInfoW
FreeAddrInfoW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

GetTokenInformation
AllocateAndInitializeSid
FreeSid
RevertToSelf
EqualSid
AccessCheck

oleaut32

VariantClear
SysAllocString
SysStringLen
SysFreeString
VariantInit

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoImpersonateClient
CoTaskMemAlloc
CoRevertToSelf
CoCreateInstance

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
SetThreadToken
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
OpenThreadToken

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-file-l1-1-0

SetFilePointerEx
WriteFile
CreateFileW
CompareFileTime

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetLocalTime
GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle

crypt32

CertGetCertificateContextProperty
CertCreateCertificateContext
CertFreeCertificateContext

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW
SetEntriesInAclW

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueEx
DeleteTimerQueueTimer

iisutil

?CopyA@STRU@@QEAAJPEBD@Z
?QuerySizeCCH@STRU@@QEBAKXZ
?Append@STRA@@QEAAJPEBD@Z
?SetLen@STRA@@QEAA_NK@Z
?QueryCB@STRA@@QEBAKXZ
?AppendW@STRA@@QEAAJPEBG@Z
?CopyA@STRU@@QEAAJPEBDK@Z
?QueryCCH@STRA@@QEBAKXZ
?Reset@STRA@@QEAAXXZ
??0STRA@@QEAA@XZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@MULTISZ@@QEAAHPEBGK@Z
?IsEmpty@MULTISZ@@QEBAHXZ
?Append@MULTISZ@@QEAAHPEBGK@Z
?QueryStringCount@MULTISZ@@QEBAKXZ
?Reset@MULTISZ@@QEAAXXZ
?Append@STRU@@QEAAJG@Z
?SetLen@STRU@@QEAA_NK@Z
??0MULTISZ@@QEAA@AEBV0@@Z
SplitCommaDelimitedString
?SyncWithBuffer@STRU@@QEAAXXZ
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?Resize@STRU@@QEAAJK@Z
?Resize@BUFFER@@QEAA_NK@Z
?QuerySize@BUFFER@@QEBAKXZ
?CopyToBuffer@MULTISZ@@QEBAHPEAGPEAK@Z
?QueryCCH@MULTISZ@@QEBAIXZ
?QueryCB@STRU@@QEBAKXZ
?Append@STRU@@QEAAJAEBV1@@Z
?Next@MULTISZ@@QEBAPEBGPEBG@Z
?First@MULTISZ@@QEBAPEBGXZ
?QueryCCH@STRU@@QEBAKXZ
?Copy@STRU@@QEAAJAEBV1@@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?Clear@CLKRHashTable@@QEAAXXZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
PuCreateDebugPrintsObject
PuDeleteDebugPrintsObject
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
??1CLKRHashTable@@QEAA@XZ
?QueryStr@STRU@@QEBAPEBGXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??1CReaderWriterLock3@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@XZ
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??1BIG_REF_TRACE@@QEAA@XZ
?Terminate@BIG_REF_TRACE@@QEAAJXZ
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?TraceDelete@BIG_REF_TRACE@@QEAAJPEAX@Z
?TraceDereference@BIG_REF_TRACE@@QEAAJPEAX@Z
??0STRU@@QEAA@PEAGK@Z
?TraceCreate@BIG_REF_TRACE@@QEAAJPEAX@Z
??0BUFFER@@QEAA@PEAEK@Z
??1STRU@@QEAA@XZ
?Reset@STRU@@QEAAXXZ
?QueryStr@STRU@@QEAAPEAGXZ
?Append@STRU@@QEAAJPEBG@Z
uuencode
??1BUFFER@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
?IsEmpty@STRU@@QEBA_NXZ
??0STRU@@QEAA@XZ
?IsValid@CLKRHashTable@@QEBA_NXZ
?Copy@STRU@@QEAAJPEBGK@Z
?TraceReference@BIG_REF_TRACE@@QEAAJPEAX@Z
??0MULTISZ@@QEAA@XZ
?QueryStr@MULTISZ@@QEBAPEAGXZ
??0STRA@@QEAA@PEADK@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?QueryCB@MULTISZ@@QEBAIXZ
?CopyW@STRA@@QEAAJPEBG@Z
?QueryStr@STRA@@QEAAPEADXZ
uudecode
IsPathUnc
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
??1STRA@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
??0BUFFER@@QEAA@XZ

nativerd

InitializeNativeConfiguration
TerminateNativeConfiguration
CreateNativeConfigurationSystem

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptCreateHash

Exports

Exports

DllMain
GetAboWrapper
InitializeAboCompatibilityLayer
TerminateAboCompatibilityLayer

Sections

.text
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/adsiis.dll
.dll regsvr32 windows:10 windows x64

ce1be1cfe1fe9b11f5dd6a3e22097a0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__C_specific_handler
_initterm
memcmp
realloc
qsort
bsearch
_stricmp
strchr
_XcptFilter
_callnewh
strcmp
free
_itow
swprintf_s
sscanf_s
strncmp
strstr
sprintf_s
_purecall
wcscat_s
_wtoi
wcstok
_wcsnicmp
wcschr
wcsrchr
wcscpy_s
_wcsicmp
memcpy_s
wcsstr
memset
memmove
malloc
_wcsupr
memcpy
_amsg_exit
wcscmp

ole32

CoSetProxyBlanket
CoQueryProxyBlanket
StringFromGUID2
CLSIDFromString
IIDFromString
StringFromCLSID
CoCreateInstance
CoGetClassObject
CreatePointerMoniker
CoTaskMemFree

advapi32

RegEnumKeyExW
RegOpenKeyExW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetAce
GetAclInformation
LookupAccountSidW
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
RegQueryValueExW
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
LookupAccountNameW
AddAce
InitializeAcl
MakeSelfRelativeSD
GetSecurityDescriptorLength
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorControl
InitializeSecurityDescriptor
RegCloseKey

kernel32

GetComputerNameW
FormatMessageW
GetSystemDirectoryW
GetProcAddress
FreeLibrary
LocalFree
MultiByteToWideChar
LocalAlloc
GetLastError
GetCurrentThreadId
OutputDebugStringA
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
LoadLibraryExW
GetSystemTimeAsFileTime
GetTickCount
GetCurrentProcessId

oleaut32

VariantClear
VariantCopy
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
VariantCopyInd
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantChangeType
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
DispGetIDsOfNames
SetErrorInfo
DispInvoke
LoadRegTypeLi
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
CreateErrorInfo
SysReAllocString

activeds

ord17
ord18
ord14
ord15
ord16

iisrtl

IISInitializeCriticalSection
PuCreateDebugPrintsObject
PuDeleteDebugPrintsObject
??1STRU@@QEAA@XZ
PuDbgPrint

crypt32

CryptUnprotectMemory
CryptProtectMemory

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/appcmd.exe
.exe windows:10 windows x64

0c59ba75971a266506603cef51da9ceb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

?terminate@@YAXXZ
_wsetlocale
swprintf_s
_commode
_fmode
_initterm
_vsnwprintf
__setusermatherr
clock
_wcsupr
fwprintf
__C_specific_handler
__iob_func
sprintf_s
strchr
isxdigit
strcat_s
wcschr
iswxdigit
iswalnum
_vsnwprintf_s
_vscwprintf
??1type_info@@UEAA@XZ
memset
_cexit
memmove
strnlen
_stricmp
memcpy
wcsnlen
wcsstr
_exit
_wcsicmp
_CxxThrowException
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
feof
ferror
free
fclose
fread
fwrite
wcscmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
ReleaseSemaphore
DeleteCriticalSection

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByteEx
FormatMessageA
SetThreadUILanguage
FormatMessageW
GetSystemDefaultLangID

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoCreateInstance

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleA
GetModuleHandleExW
LoadStringA
GetModuleHandleW
FreeLibrary

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo

appobj

CreateCommandProcessor

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

Exports

Exports

??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
??0CCritSec@@QEAA@XZ
??0CFakeLock@@QEAA@XZ
??0CReaderWriterLock2@@QEAA@AEBV0@@Z
??0CReaderWriterLock2@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@AEBV0@@Z
??0CReaderWriterLock3@@QEAA@XZ
??0CReaderWriterLock@@QEAA@AEBV0@@Z
??0CReaderWriterLock@@QEAA@XZ
??0CRtlResource@@QEAA@AEBV0@@Z
??0CRtlResource@@QEAA@XZ
??0CShareLock@@QEAA@XZ
??0CSharelock@@QEAA@HH@Z
??0CSmallSpinLock@@QEAA@AEBV0@@Z
??0CSmallSpinLock@@QEAA@XZ
??0CSpinLock@@QEAA@AEBV0@@Z
??0CSpinLock@@QEAA@XZ
??0MB@@QEAA@PEAUIMSAdminBaseW@@@Z
??0MULTISZ@@QEAA@AEBV0@@Z
??0MULTISZ@@QEAA@PEAGK@Z
??0MULTISZ@@QEAA@PEBG@Z
??0MULTISZ@@QEAA@XZ
??0STRA@@AEAA@AEBV0@@Z
??0STRA@@AEAA@PEAD@Z
??0STRA@@AEAA@PEBD@Z
??0STRA@@QEAA@PEADK@Z
??0STRA@@QEAA@XZ
??0STRAU@@QEAA@AEAV0@@Z
??0STRAU@@QEAA@PEBD@Z
??0STRAU@@QEAA@PEBDH@Z
??0STRAU@@QEAA@PEBG@Z
??0STRAU@@QEAA@XZ
??0STRU@@AEAA@AEBV0@@Z
??0STRU@@AEAA@PEAG@Z
??0STRU@@AEAA@PEBG@Z
??0STRU@@QEAA@PEAGK@Z
??0STRU@@QEAA@XZ
??0TS_RESOURCE@@QEAA@AEBV0@@Z
??0TS_RESOURCE@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1CCritSec@@QEAA@XZ
??1CFakeLock@@QEAA@XZ
??1CReaderWriterLock2@@QEAA@XZ
??1CReaderWriterLock3@@QEAA@XZ
??1CReaderWriterLock@@QEAA@XZ
??1CRtlResource@@QEAA@XZ
??1CShareLock@@QEAA@XZ
??1CSharelock@@QEAA@XZ
??1CSmallSpinLock@@QEAA@XZ
??1CSpinLock@@QEAA@XZ
??1MB@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
??1STRA@@QEAA@XZ
??1STRAU@@QEAA@XZ
??1STRU@@QEAA@XZ
??1TS_RESOURCE@@QEAA@XZ
??4?$CLockBase@$00$00$02$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$00$00$02$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$01$00$00$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$01$00$00$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$02$00$00$00$00$00@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$02$00$00$00$00$00@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$03$00$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$03$00$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$04$01$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$04$01$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$05$01$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$05$01$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$06$01$01$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$06$01$01$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$07$01$01$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$07$01$01$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$08$01$00$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$08$01$00$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4ALLOC_CACHE_HANDLER@@QEAAAEAV0@AEBV0@@Z
??4BIG_REF_TRACE@@QEAAAEAV0@AEBV0@@Z
??4BUFFER@@QEAAAEAV0@AEBV0@@Z
??4CCritSec@@QEAAAEAV0@AEBV0@@Z
??4CFakeLock@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock2@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock3@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock@@QEAAAEAV0@AEBV0@@Z
??4CRtlResource@@QEAAAEAV0@AEBV0@@Z
??4CSmallSpinLock@@QEAAAEAV0@AEBV0@@Z
??4CSpinLock@@QEAAAEAV0@AEBV0@@Z
??4LANG_STRING@@QEAAAEAV0@$$QEAV0@@Z
??4LANG_STRING@@QEAAAEAV0@AEBV0@@Z
??4MB@@QEAAAEAV0@AEBV0@@Z
??4MULTISZ@@QEAAAEAV0@AEBV0@@Z
??4STRA@@AEAAAEAV0@AEBV0@@Z
??4STRAU@@QEAAAEAV0@AEBV0@@Z
??4STRU@@AEAAAEAV0@AEBV0@@Z
??4TS_RESOURCE@@QEAAAEAV0@AEBV0@@Z
??_FCSharelock@@QEAAXXZ
?ActiveUsers@CSharelock@@QEAAHXZ
?AddObject@MB@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHPEBGK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@STRAU@@QEAAHAEAV1@@Z
?Append@STRAU@@QEAAHPEBD@Z
?Append@STRAU@@QEAAHPEBDK@Z
?Append@STRAU@@QEAAHPEBG@Z
?Append@STRAU@@QEAAHPEBGK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJG@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBGK@Z
?AppendA@STRU@@QEAAJPEBD@Z
?AppendA@STRU@@QEAAJPEBDK@Z
?AppendA_ACP@STRU@@QEAAJPEBD@Z
?AppendA_ACP@STRU@@QEAAJPEBDK@Z
?AppendW@STRA@@QEAAJPEBG@Z
?AppendW@STRA@@QEAAJPEBGK@Z
?AppendWSimple@STRA@@QEAAJPEBGK@Z
?AppendWTruncate@STRA@@QEAAJPEBG@Z
?AppendWTruncate@STRA@@QEAAJPEBGK@Z
?AuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?AuxAppend@STRA@@AEAAJPEBEKK_N@Z
?AuxAppend@STRAU@@AEAAHPEBDIH@Z
?AuxAppend@STRAU@@AEAAHPEBGIH@Z
?AuxAppend@STRU@@AEAAJPEBEKK_N@Z
?AuxAppendA@STRU@@AEAAJPEBEKK_N1@Z
?AuxAppendW@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWSimple@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWTruncate@STRA@@AEAAJPEBGKK_N@Z
?AuxInit@MULTISZ@@AEAAXPEBG@Z
?AuxInit@STRAU@@AEAAXPEBD@Z
?AuxInit@STRAU@@AEAAXPEBG@Z
?CalcLength@MULTISZ@@SAKPEBGPEAK@Z
?ChangeExclusiveLockToSharedLock@CSharelock@@QEAAXXZ
?ChangeSharedLockToExclusiveLock@CSharelock@@QEAAEH@Z
?CheckSignature@BIG_REF_TRACE@@AEBAHXZ
?ClaimExclusiveLock@CSharelock@@QEAAEH@Z
?ClaimShareLock@CSharelock@@QEAAEH@Z
?ClassName@CCritSec@@SAPEBGXZ
?ClassName@CFakeLock@@SAPEBGXZ
?ClassName@CReaderWriterLock2@@SAPEBGXZ
?ClassName@CReaderWriterLock3@@SAPEBGXZ
?ClassName@CReaderWriterLock@@SAPEBGXZ
?ClassName@CRtlResource@@SAPEBDXZ
?ClassName@CShareLock@@SAPEBDXZ
?ClassName@CSmallSpinLock@@SAPEBGXZ
?ClassName@CSpinLock@@SAPEBGXZ
?Clone@MULTISZ@@QEBAHPEAV1@@Z
?Clone@STRA@@QEBAJPEAV1@@Z
?Close@MB@@QEAAHXZ
?Convert@TS_RESOURCE@@QEAAXW4TSRES_CONV_TYPE@@@Z
?ConvertExclusiveToShared@CCritSec@@QEAAXXZ
?ConvertExclusiveToShared@CFakeLock@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock2@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock3@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock@@QEAAXXZ
?ConvertExclusiveToShared@CRtlResource@@QEAAXXZ
?ConvertExclusiveToShared@CShareLock@@QEAAXXZ
?ConvertExclusiveToShared@CSmallSpinLock@@QEAAXXZ
?ConvertExclusiveToShared@CSpinLock@@QEAAXXZ
?ConvertSharedToExclusive@CCritSec@@QEAAXXZ
?ConvertSharedToExclusive@CFakeLock@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock2@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock3@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock@@QEAAXXZ
?ConvertSharedToExclusive@CRtlResource@@QEAAXXZ
?ConvertSharedToExclusive@CShareLock@@QEAAXXZ
?ConvertSharedToExclusive@CSmallSpinLock@@QEAAXXZ
?ConvertSharedToExclusive@CSpinLock@@QEAAXXZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@MULTISZ@@QEAAHPEBGK@Z
?Copy@STRA@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRAU@@QEAAHAEAV1@@Z
?Copy@STRAU@@QEAAHPEBD@Z
?Copy@STRAU@@QEAAHPEBDK@Z
?Copy@STRAU@@QEAAHPEBG@Z
?Copy@STRAU@@QEAAHPEBGK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?CopyA@STRU@@QEAAJPEBD@Z
?CopyA@STRU@@QEAAJPEBDK@Z
?CopyA_ACP@STRU@@QEAAJPEBD@Z
?CopyA_ACP@STRU@@QEAAJPEBDK@Z
?CopyBinary@STRA@@QEAAJPEAXK@Z
?CopyToBuffer@MULTISZ@@QEBAHPEAGPEAK@Z
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
?CopyToBuffer@STRU@@QEBAJPEAGPEAK@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyW@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Escaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?DeleteData@MB@@QEAAHPEBGKKK@Z
?DeleteObject@MB@@QEAAHPEBG@Z
?EnumObjects@MB@@QEAAHPEBGPEAGK@Z
?Equals@MULTISZ@@QEAAHPEAV1@@Z
?Equals@STRA@@QEBA_NAEBV1@@Z
?Equals@STRA@@QEBA_NPEBD@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
?Equals@STRU@@QEBA_NPEBG@Z
?EqualsNoCase@STRA@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRA@@QEBA_NPEBD@Z
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?Escape@STRA@@QEAAJ_N0@Z
?Escape@STRU@@QEAAJXZ
?ExpandEnvironmentVariables@STRU@@SAJPEBGPEAV1@@Z
?FastAppend@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FastAppend@MULTISZ@@QEAAHPEBG@Z
?FastAppend@MULTISZ@@QEAAHPEBGK@Z
?FastAuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?FastCopy@MULTISZ@@QEAAHAEBV1@@Z
?FastCopy@MULTISZ@@QEAAHPEBGK@Z
?FindRefTraceHeadEntry@BIG_REF_TRACE@@SAPEAU_REF_TRACE_HEAD_ENTRY@@PEAV1@PEAX@Z
?FindString@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindString@MULTISZ@@QEAAHPEBG@Z
?FindStringNoCase@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
?First@MULTISZ@@QEBAPEBGXZ
?FormatString@STRA@@QEAAJKQEAPEBDPEBDK@Z
?FreeMemory@BUFFER@@QEAAXXZ
?FreeMemoryInternal@BUFFER@@AEAAXXZ
?GetAll@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAK2@Z
?GetBuffer@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAKK@Z
?GetChildPaths@MB@@QEAAHPEBGPEAVBUFFER@@@Z
?GetData@MB@@QEAAHPEBGKKKPEAXPEAKK@Z
?GetDataPaths@MB@@QEAAHPEBGKKPEAVBUFFER@@@Z
?GetDataSetNumber@MB@@QEAAHPEBGPEAK@Z
?GetDefaultSpinAdjustmentFactor@CCritSec@@SANXZ
?GetDefaultSpinAdjustmentFactor@CFakeLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CRtlResource@@SANXZ
?GetDefaultSpinAdjustmentFactor@CShareLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CSpinLock@@SANXZ
?GetDefaultSpinCount@CCritSec@@SAGXZ
?GetDefaultSpinCount@CFakeLock@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock2@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock3@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock@@SAGXZ
?GetDefaultSpinCount@CRtlResource@@SAGXZ
?GetDefaultSpinCount@CShareLock@@SAGXZ
?GetDefaultSpinCount@CSmallSpinLock@@SAGXZ
?GetDefaultSpinCount@CSpinLock@@SAGXZ
?GetDword@MB@@QEAAHPEBGKKPEAKK@Z
?GetDword@MB@@QEAAXPEBGKKKPEAKK@Z
?GetMultisz@MB@@QEAAHPEBGKKPEAVMULTISZ@@K@Z
?GetSpinCount@CCritSec@@QEBAGXZ
?GetSpinCount@CFakeLock@@QEBAGXZ
?GetSpinCount@CReaderWriterLock2@@QEBAGXZ
?GetSpinCount@CReaderWriterLock3@@QEBAGXZ
?GetSpinCount@CReaderWriterLock@@QEBAGXZ
?GetSpinCount@CRtlResource@@QEBAGXZ
?GetSpinCount@CShareLock@@QEBAGXZ
?GetSpinCount@CSmallSpinLock@@QEBAGXZ
?GetSpinCount@CSpinLock@@QEBAGXZ
?GetStr@MB@@QEAAHPEBGKKPEAVSTRU@@K0@Z
?GetString@MB@@QEAAHPEBGKKPEAGPEAKK@Z
?GetSystemChangeNumber@MB@@QEAAHPEAK@Z
?HTMLEncode@STRA@@QEAAJXZ
?HTMLEncode@STRU@@QEAAJXZ
?Hash@BIG_REF_TRACE@@SAKPEAX@Z
?IsCurrentUnicode@STRAU@@QEAAHXZ
?IsEmpty@MULTISZ@@QEBAHXZ
?IsEmpty@STRA@@QEBA_NXZ
?IsEmpty@STRAU@@QEAAHXZ
?IsEmpty@STRU@@QEBA_NXZ
?IsReadLocked@CCritSec@@QEBA_NXZ
?IsReadLocked@CFakeLock@@QEBA_NXZ
?IsReadLocked@CReaderWriterLock2@@QEBA_NXZ
?IsReadLocked@CReaderWriterLock3@@QEBA_NXZ
?IsReadLocked@CReaderWriterLock@@QEBA_NXZ
?IsReadLocked@CRtlResource@@QEBA_NXZ
?IsReadLocked@CShareLock@@QEBA_NXZ
?IsReadLocked@CSmallSpinLock@@QEBA_NXZ
?IsReadLocked@CSpinLock@@QEBA_NXZ
?IsReadUnlocked@CCritSec@@QEBA_NXZ
?IsReadUnlocked@CFakeLock@@QEBA_NXZ
?IsReadUnlocked@CReaderWriterLock2@@QEBA_NXZ
?IsReadUnlocked@CReaderWriterLock3@@QEBA_NXZ
?IsReadUnlocked@CReaderWriterLock@@QEBA_NXZ
?IsReadUnlocked@CRtlResource@@QEBA_NXZ
?IsReadUnlocked@CShareLock@@QEBA_NXZ
?IsReadUnlocked@CSmallSpinLock@@QEBA_NXZ
?IsReadUnlocked@CSpinLock@@QEBA_NXZ
?IsValid@ALLOC_CACHE_HANDLER@@QEBAHXZ
?IsValid@BUFFER@@QEBA_NXZ
?IsValid@MULTISZ@@QEBAHXZ
?IsValid@STRA@@QEBA_NXZ
?IsValid@STRAU@@QEAAHXZ
?IsWriteLocked@CCritSec@@QEBA_NXZ
?IsWriteLocked@CFakeLock@@QEBA_NXZ
?IsWriteLocked@CReaderWriterLock2@@QEBA_NXZ
?IsWriteLocked@CReaderWriterLock3@@QEBA_NXZ
?IsWriteLocked@CReaderWriterLock@@QEBA_NXZ
?IsWriteLocked@CRtlResource@@QEBA_NXZ
?IsWriteLocked@CShareLock@@QEBA_NXZ
?IsWriteLocked@CSmallSpinLock@@QEBA_NXZ
?IsWriteLocked@CSpinLock@@QEBA_NXZ
?IsWriteUnlocked@CCritSec@@QEBA_NXZ
?IsWriteUnlocked@CFakeLock@@QEBA_NXZ
?IsWriteUnlocked@CReaderWriterLock2@@QEBA_NXZ
?IsWriteUnlocked@CReaderWriterLock3@@QEBA_NXZ
?IsWriteUnlocked@CReaderWriterLock@@QEBA_NXZ
?IsWriteUnlocked@CRtlResource@@QEBA_NXZ
?IsWriteUnlocked@CShareLock@@QEBA_NXZ
?IsWriteUnlocked@CSmallSpinLock@@QEBA_NXZ
?IsWriteUnlocked@CSpinLock@@QEBA_NXZ
?LoadStringW@STRA@@QEAAJKPEAUHINSTANCE__@@@Z
?LoadStringW@STRA@@QEAAJKPEBDK@Z
?Lock@TS_RESOURCE@@QEAAXW4TSRES_LOCK_TYPE@@@Z
?LockType@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?MutexType@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?Next@MULTISZ@@QEBAPEBGPEBG@Z
?Open@MB@@QEAAHKPEBGK@Z
?Open@MB@@QEAAHPEBGK@Z
?PerLockSpin@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PrivateQueryStr@STRAU@@AEAAPEAGH@Z
?QueryAdminBase@MB@@QEBAPEAUIMSAdminBaseW@@XZ
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?QueryCB@MULTISZ@@QEBAIXZ
?QueryCB@STRA@@QEBAKXZ
?QueryCB@STRAU@@QEAAIH@Z
?QueryCB@STRU@@QEBAKXZ
?QueryCBA@STRAU@@QEAAIXZ
?QueryCBW@STRAU@@QEAAIXZ
?QueryCCH@MULTISZ@@QEBAIXZ
?QueryCCH@STRA@@QEBAKXZ
?QueryCCH@STRAU@@QEAAIXZ
?QueryCCH@STRU@@QEBAKXZ
?QueryHandle@MB@@QEBAKXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QuerySize@BUFFER@@QEBAKXZ
?QuerySize@STRA@@QEBAKXZ
?QuerySize@STRU@@QEBAKXZ
?QuerySizeCCH@STRA@@QEBAKXZ
?QuerySizeCCH@STRU@@QEBAKXZ
?QueryStr@MULTISZ@@QEBAPEAGXZ
?QueryStr@STRA@@QEAAPEADXZ
?QueryStr@STRA@@QEBAPEBDXZ
?QueryStr@STRAU@@QEAAPEAGH@Z
?QueryStr@STRU@@QEAAPEAGXZ
?QueryStr@STRU@@QEBAPEBGXZ
?QueryStrA@MULTISZ@@QEBAPEAGXZ
?QueryStrA@STRAU@@QEAAPEADXZ
?QueryStrW@STRAU@@QEAAPEAGXZ
?QueryStringCount@MULTISZ@@QEBAKXZ
?QueueType@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?ReadLock@CCritSec@@QEAAXXZ
?ReadLock@CFakeLock@@QEAAXXZ
?ReadLock@CReaderWriterLock2@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock@@QEAAXXZ
?ReadLock@CRtlResource@@QEAAXXZ
?ReadLock@CShareLock@@QEAAXXZ
?ReadLock@CSmallSpinLock@@QEAAXXZ
?ReadLock@CSpinLock@@QEAAXXZ
?ReadOrWriteLock@CCritSec@@QEAA_NXZ
?ReadOrWriteLock@CFakeLock@@QEAA_NXZ
?ReadOrWriteLock@CReaderWriterLock3@@QEAA_NXZ
?ReadOrWriteLock@CSpinLock@@QEAA_NXZ
?ReadOrWriteUnlock@CCritSec@@QEAAX_N@Z
?ReadOrWriteUnlock@CFakeLock@@QEAAX_N@Z
?ReadOrWriteUnlock@CReaderWriterLock3@@QEAAX_N@Z
?ReadOrWriteUnlock@CSpinLock@@QEAAX_N@Z
?ReadUnlock@CCritSec@@QEAAXXZ
?ReadUnlock@CFakeLock@@QEAAXXZ
?ReadUnlock@CReaderWriterLock2@@QEAAXXZ
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?ReadUnlock@CReaderWriterLock@@QEAAXXZ
?ReadUnlock@CRtlResource@@QEAAXXZ
?ReadUnlock@CShareLock@@QEAAXXZ
?ReadUnlock@CSmallSpinLock@@QEAAXXZ
?ReadUnlock@CSpinLock@@QEAAXXZ
?ReallocStorage@BUFFER@@AEAA_NK@Z
?RecalcLen@MULTISZ@@QEAAXXZ
?Recursion@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?ReleaseExclusiveLock@CSharelock@@QEAAXXZ
?ReleaseShareLock@CSharelock@@QEAAXXZ
?Reset@MULTISZ@@QEAAXXZ
?Reset@STRA@@QEAAXXZ
?Reset@STRAU@@QEAAXXZ
?Reset@STRU@@QEAAXXZ
?Resize@BUFFER@@QEAA_NK@Z
?Resize@BUFFER@@QEAA_NKK@Z
?Resize@STRA@@QEAAJK@Z
?Resize@STRU@@QEAAJK@Z
?ResizeW@STRAU@@QEAAHK@Z
?SAFE_snwprintf@@YAJPEAVSTRU@@PEBGZZ
?SafeCopy@STRAU@@QEAAHPEBD@Z
?SafeCopy@STRAU@@QEAAHPEBG@Z
?Save@MB@@QEAAHXZ
?SetData@MB@@QEAAHPEBGKKKPEAXKK@Z
?SetDefaultSpinAdjustmentFactor@CCritSec@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CFakeLock@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CRtlResource@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CShareLock@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CSpinLock@@SAXN@Z
?SetDefaultSpinCount@CCritSec@@SAXG@Z
?SetDefaultSpinCount@CFakeLock@@SAXG@Z
?SetDefaultSpinCount@CReaderWriterLock2@@SAXG@Z
?SetDefaultSpinCount@CReaderWriterLock3@@SAXG@Z
?SetDefaultSpinCount@CReaderWriterLock@@SAXG@Z
?SetDefaultSpinCount@CRtlResource@@SAXG@Z
?SetDefaultSpinCount@CShareLock@@SAXG@Z
?SetDefaultSpinCount@CSmallSpinLock@@SAXG@Z
?SetDefaultSpinCount@CSpinLock@@SAXG@Z
?SetDword@MB@@QEAAHPEBGKKKK@Z
?SetLen@STRA@@QEAA_NK@Z
?SetLen@STRAU@@QEAAHK@Z
?SetLen@STRU@@QEAA_NK@Z
?SetSpinCount@CCritSec@@QEAA_NG@Z
?SetSpinCount@CCritSec@@SAKPEAU_RTL_CRITICAL_SECTION@@K@Z
?SetSpinCount@CFakeLock@@QEAA_NG@Z
?SetSpinCount@CReaderWriterLock2@@QEAA_NG@Z
?SetSpinCount@CReaderWriterLock3@@QEAA_NG@Z
?SetSpinCount@CReaderWriterLock@@QEAA_NG@Z
?SetSpinCount@CRtlResource@@QEAA_NG@Z
?SetSpinCount@CShareLock@@QEAA_NG@Z
?SetSpinCount@CSmallSpinLock@@QEAA_NG@Z
?SetSpinCount@CSpinLock@@QEAA_NG@Z
?SetString@MB@@QEAAHPEBGKK0K@Z
?SetValid@BUFFER@@QEAAX_N@Z
?SleepWaitingForLock@CSharelock@@AEAAEH@Z
?SyncWithBuffer@STRA@@QEAAXXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?TryConvertSharedToExclusive@CReaderWriterLock3@@QEAA_NXZ
?TryReadLock@CCritSec@@QEAA_NXZ
?TryReadLock@CFakeLock@@QEAA_NXZ
?TryReadLock@CReaderWriterLock2@@QEAA_NXZ
?TryReadLock@CReaderWriterLock3@@QEAA_NXZ
?TryReadLock@CReaderWriterLock@@QEAA_NXZ
?TryReadLock@CRtlResource@@QEAA_NXZ
?TryReadLock@CShareLock@@QEAA_NXZ
?TryReadLock@CSmallSpinLock@@QEAA_NXZ
?TryReadLock@CSpinLock@@QEAA_NXZ
?TryReadOrWriteLock@CReaderWriterLock3@@QEAA_NAEA_N@Z
?TryWriteLock@CCritSec@@QEAA_NXZ
?TryWriteLock@CFakeLock@@QEAA_NXZ
?TryWriteLock@CReaderWriterLock2@@QEAA_NXZ
?TryWriteLock@CReaderWriterLock3@@QEAA_NXZ
?TryWriteLock@CReaderWriterLock@@QEAA_NXZ
?TryWriteLock@CRtlResource@@QEAA_NXZ
?TryWriteLock@CShareLock@@QEAA_NXZ

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/appcmd.xml
inetsrv/apphostsvc.dll
.dll windows:10 windows x64

b0b2974f5c14f8d844c03a91c28ed856

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_lock
__C_specific_handler
_initterm
_wcslwr_s
_unlock
__dllonexit
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
free
swprintf_s
wcstoul
_wcsnicmp
_ultow
_purecall
_wcsicmp
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
memset

api-ms-win-security-lsalookup-l2-1-1

LsaManageSidNameMapping

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-file-l1-1-0

FindNextFileW
FindFirstFileW
RemoveDirectoryW
FindClose
CreateDirectoryW
GetFileAttributesW
DeleteFileW
SetFileAttributesW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
DeleteCriticalSection
CreateEventW
SetEvent

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-core-l1-1-0

SetServiceStatus

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
CreateThread
GetCurrentProcessId
GetExitCodeThread
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

ntdll

RtlInitializeSid
RtlSubAuthoritySid
RtlCreateTimer
RtlDeleteTimerQueueEx
RtlDeleteTimer
RtlCreateTimerQueue
RtlInitUnicodeString
RtlLengthRequiredSid

iisutil

?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
?Find@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@0@Z
?Insert@CLKRHashTable@@QEAA_NPEBXAEAVCLKRHashTable_Iterator@@_N@Z
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?Size@CLKRHashTable@@QEBAKXZ
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?ApplyIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?FindRecord@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
??1CLKRHashTable@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
??1STRU@@QEAA@XZ
??1CLKRHashTable_Iterator@@QEAA@XZ
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
??1CReaderWriterLock3@@QEAA@XZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
PuDbgPrintError
??0STRU@@QEAA@XZ
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0STRU_PATH@@QEAA@G@Z
??1STRU_PATH@@QEAA@XZ
?ExpandEnvironmentVariables@STRU_PATH@@QEAAJPEAG@Z
IsPathUnc
?SetLen@STRU@@QEAA_NK@Z
?Copy@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBG@Z
??0STRU@@QEAA@PEAGK@Z
?Append@STRU@@QEAAJG@Z
?Copy@STRU@@QEAAJAEBV1@@Z
PuDbgPrint
??0EVENT_LOG@@QEAA@PEBG@Z
InitializeIISUtil
TerminateIISUtil
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuDeleteDebugPrintsObject
?Increment@CLKRHashTable_Iterator@@QEAA_NXZ
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?EqualRange@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@1@Z

nativerd

CreateNativeConfigurationSystem
TerminateNativeConfiguration
InitializeNativeConfiguration
GetDefaultNativeConfigurationSystem

api-ms-win-core-threadpool-l1-2-0

CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolTimer
SetThreadpoolTimer
TrySubmitThreadpoolCallback
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
CreateThreadpoolTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

bcrypt

BCryptHashData
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash

Exports

Exports

??0?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA@PEBDNKK_N@Z
??0?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA@PEBDNKK_N@Z
??0HASH_POOL_HASH@@QEAA@XZ
??0POOL_HASH_HASH@@QEAA@XZ
??1?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA@XZ
??1?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA@XZ
??1HASH_POOL_HASH@@QEAA@XZ
??1POOL_HASH_HASH@@QEAA@XZ
?AddRefRecord@HASH_POOL_HASH@@SAXPEAVPOOL_HASH_ENTRY@@H@Z
?AddRefRecord@POOL_HASH_HASH@@SAXPEAVPOOL_HASH_ENTRY@@H@Z
?Apply@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1W4LK_LOCKTYPE@@@Z
?Apply@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?CalcKeyHash@HASH_POOL_HASH@@SAKPEBUAPP_POOL_HASH@@@Z
?CalcKeyHash@POOL_HASH_HASH@@SAKPEBG@Z
?ClearHash@HASH_POOL_HASH@@SAXPEAV1@@Z
?ClearHash@POOL_HASH_HASH@@SAXPEAV1@@Z
?DeleteIf@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1@Z
?DeleteIf@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1@Z
?DeleteKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@QEBUAPP_POOL_HASH@@@Z
?DeleteKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@QEBG@Z
?DeletePoolHashEntriesAction@HASH_POOL_HASH@@SA?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z
?DeletePoolHashEntriesAction@POOL_HASH_HASH@@SA?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z
?DeleteRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?DeleteRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?EqualKeys@HASH_POOL_HASH@@SA_NPEBUAPP_POOL_HASH@@0@Z
?EqualKeys@POOL_HASH_HASH@@SA_NPEBG0@Z
?EqualRange@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NQEBUAPP_POOL_HASH@@AEAViterator@1@1@Z
?EqualRange@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NQEBGAEAViterator@1@1@Z
?Erase@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NAEAViterator@1@0@Z
?Erase@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NAEAViterator@1@@Z
?Erase@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NAEAViterator@1@0@Z
?Erase@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NAEAViterator@1@@Z
?ExtractKey@HASH_POOL_HASH@@SAPEBUAPP_POOL_HASH@@PEBVPOOL_HASH_ENTRY@@@Z
?ExtractKey@POOL_HASH_HASH@@SAPEBGPEBVPOOL_HASH_ENTRY@@@Z
?Find@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NQEBUAPP_POOL_HASH@@AEAViterator@1@@Z
?Find@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NQEBGAEAViterator@1@@Z
?FindKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@QEBUAPP_POOL_HASH@@PEAPEAVPOOL_HASH_ENTRY@@@Z
?FindKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@QEBGPEAPEAVPOOL_HASH_ENTRY@@@Z
?FindRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?FindRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?Insert@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NPEBVPOOL_HASH_ENTRY@@AEAViterator@1@_N@Z
?Insert@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NPEBVPOOL_HASH_ENTRY@@AEAViterator@1@_N@Z
?InsertRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@_N@Z
?InsertRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@_N@Z
?_Action@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?AW4LK_ACTION@@PEBXPEAX@Z
?_Action@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?AW4LK_ACTION@@PEBXPEAX@Z
?_AddRefRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CAXPEBXH@Z
?_AddRefRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CAXPEBXH@Z
?_CalcKeyHash@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CAK_K@Z
?_CalcKeyHash@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CAK_K@Z
?_EqualKeys@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA_N_K0@Z
?_EqualKeys@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA_N_K0@Z
?_ExtractKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?B_KPEBX@Z
?_ExtractKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?B_KPEBX@Z
?_Pred@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?AW4LK_PREDICATE@@PEBXPEAX@Z
?_Pred@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?AW4LK_PREDICATE@@PEBXPEAX@Z
?begin@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AViterator@1@XZ
?begin@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AViterator@1@XZ
?end@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AViterator@1@XZ
?end@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AViterator@1@XZ
ServiceMain

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/appobj.dll
.dll windows:10 windows x64

974cb3d25b3ce3243a13ed0ceabe3bf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

strcpy_s
_vsnprintf_s
_snprintf_s
??1type_info@@UEAA@XZ
iswxdigit
_lock
_aligned_malloc
__C_specific_handler
_aligned_free
_unlock
_initterm
_amsg_exit
__dllonexit
_onexit
memset
_callnewh
malloc
free
sprintf_s
_strcmpi
wcscpy_s
iswdigit
wcstod
wcstol
iswspace
_ultow_s
_wtol
_ltow_s
memmove
wcsncmp
towupper
wcsstr
memcpy
_wcsupr
wcstoul
wcschr
_CxxThrowException
wcsnlen
_XcptFilter
_wcsnicmp
_ultow
wcsrchr
_vsnwprintf
_purecall
strncpy_s
strnlen
_stricmp
_wcsicmp
strrchr
wcscmp

ntdll

RtlGetCurrentPeb
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryInformationProcess

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
CreateSemaphoreExW
WaitForSingleObject
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

CreateThread
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoTaskMemFree
CoCreateInstance

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount
GetLocalTime

api-ms-win-core-file-l1-1-0

CreateFileW
ReadFile
WriteFile
FindFirstFileW
FindNextFileW
FindClose
GetFileSize
FlushFileBuffers

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-0

FormatMessageW
FormatMessageA

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
LocalAlloc
GlobalFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-kernel32-legacy-l1-1-3

FindFirstFileTransactedW
DeleteFileTransactedW
RemoveDirectoryTransactedW
CreateDirectoryTransactedW
CopyFileTransactedW

api-ms-win-security-sddl-l1-1-0

ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-1-0

GetFileSecurityW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CertCloseStore

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle
StartServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
QueryServiceStatusEx
QueryServiceConfig2W
ChangeServiceConfig2W

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey

api-ms-win-core-toolhelp-l1-1-0

Process32NextW
CreateToolhelp32Snapshot
Process32FirstW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ktmw32

CommitTransaction
RollbackTransaction
CreateTransaction

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
QueryDepthSList
InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource

Exports

Exports

??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
??0CCritSec@@QEAA@XZ
??0CDoubleList@@QEAA@XZ
??0CFakeLock@@QEAA@XZ
??0CLKRHashTableStats@@QEAA@XZ
??0CLKRHashTable_Iterator@@IEAA@PEAVCLKRHashTable@@F@Z
??0CLKRHashTable_Iterator@@QEAA@$$QEAV0@@Z
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
??0CLKRHashTable_Iterator@@QEAA@XZ
??0CLKRLinearHashTable_Iterator@@IEAA@PEAVCLKRLinearHashTable@@PEAVCNodeClump@@KF@Z
??0CLKRLinearHashTable_Iterator@@QEAA@AEBV0@@Z
??0CLKRLinearHashTable_Iterator@@QEAA@XZ
??0CLockedDoubleList@@QEAA@$$QEAV0@@Z
??0CLockedDoubleList@@QEAA@AEBV0@@Z
??0CLockedDoubleList@@QEAA@XZ
??0CLockedSingleList@@QEAA@$$QEAV0@@Z
??0CLockedSingleList@@QEAA@AEBV0@@Z
??0CLockedSingleList@@QEAA@XZ
??0CReaderWriterLock2@@QEAA@AEBV0@@Z
??0CReaderWriterLock2@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@AEBV0@@Z
??0CReaderWriterLock3@@QEAA@XZ
??0CReaderWriterLock@@QEAA@AEBV0@@Z
??0CReaderWriterLock@@QEAA@XZ
??0CRtlResource@@QEAA@AEBV0@@Z
??0CRtlResource@@QEAA@XZ
??0CShareLock@@QEAA@XZ
??0CSingleList@@QEAA@XZ
??0CSmallSpinLock@@QEAA@AEBV0@@Z
??0CSmallSpinLock@@QEAA@XZ
??0CSpinLock@@QEAA@AEBV0@@Z
??0CSpinLock@@QEAA@XZ
??0MULTISZ@@QEAA@AEBV0@@Z
??0MULTISZ@@QEAA@PEAGK@Z
??0MULTISZ@@QEAA@PEBG@Z
??0MULTISZ@@QEAA@XZ
??0STRA@@AEAA@AEBV0@@Z
??0STRA@@AEAA@PEAD@Z
??0STRA@@AEAA@PEBD@Z
??0STRA@@QEAA@PEADK@Z
??0STRA@@QEAA@XZ
??0STRU@@AEAA@AEBV0@@Z
??0STRU@@AEAA@PEAG@Z
??0STRU@@AEAA@PEBG@Z
??0STRU@@QEAA@PEAGK@Z
??0STRU@@QEAA@XZ
??0TS_RESOURCE@@QEAA@AEBV0@@Z
??0TS_RESOURCE@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1CCritSec@@QEAA@XZ
??1CDoubleList@@QEAA@XZ
??1CFakeLock@@QEAA@XZ
??1CLKRHashTable_Iterator@@QEAA@XZ
??1CLKRLinearHashTable_Iterator@@QEAA@XZ
??1CLockedDoubleList@@QEAA@XZ
??1CLockedSingleList@@QEAA@XZ
??1CReaderWriterLock2@@QEAA@XZ
??1CReaderWriterLock3@@QEAA@XZ
??1CReaderWriterLock@@QEAA@XZ
??1CRtlResource@@QEAA@XZ
??1CShareLock@@QEAA@XZ
??1CSingleList@@QEAA@XZ
??1CSmallSpinLock@@QEAA@XZ
??1CSpinLock@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
??1STRA@@QEAA@XZ
??1STRU@@QEAA@XZ
??1TS_RESOURCE@@QEAA@XZ
??2CLKRLinearHashTable@@SAPEAX_K@Z
??3CLKRLinearHashTable@@SAXPEAX@Z
??4?$CLockBase@$00$00$02$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$00$00$02$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$01$00$00$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$01$00$00$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$02$00$00$00$00$00@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$02$00$00$00$00$00@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$03$00$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$03$00$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$04$01$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$04$01$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$05$01$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$05$01$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$06$01$01$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$06$01$01$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$07$01$01$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$07$01$01$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$08$01$00$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$08$01$00$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4ALLOC_CACHE_HANDLER@@QEAAAEAV0@AEBV0@@Z
??4BUFFER@@QEAAAEAV0@AEBV0@@Z
??4CCritSec@@QEAAAEAV0@AEBV0@@Z
??4CDoubleList@@QEAAAEAV0@AEBV0@@Z
??4CFakeLock@@QEAAAEAV0@AEBV0@@Z
??4CLKRHashTableStats@@QEAAAEAV0@$$QEAV0@@Z
??4CLKRHashTableStats@@QEAAAEAV0@AEBV0@@Z
??4CLKRHashTable_Iterator@@QEAAAEAV0@$$QEAV0@@Z
??4CLKRHashTable_Iterator@@QEAAAEAV0@AEBV0@@Z
??4CLKRLinearHashTable_Iterator@@QEAAAEAV0@AEBV0@@Z
??4CLockedDoubleList@@QEAAAEAV0@$$QEAV0@@Z
??4CLockedDoubleList@@QEAAAEAV0@AEBV0@@Z
??4CLockedSingleList@@QEAAAEAV0@$$QEAV0@@Z
??4CLockedSingleList@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock2@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock3@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock@@QEAAAEAV0@AEBV0@@Z
??4CRtlResource@@QEAAAEAV0@AEBV0@@Z
??4CSingleList@@QEAAAEAV0@AEBV0@@Z
??4CSmallSpinLock@@QEAAAEAV0@AEBV0@@Z
??4CSpinLock@@QEAAAEAV0@AEBV0@@Z
??4MULTISZ@@QEAAAEAV0@AEBV0@@Z
??4STRA@@AEAAAEAV0@AEBV0@@Z
??4STRU@@AEAAAEAV0@AEBV0@@Z
??4TS_RESOURCE@@QEAAAEAV0@AEBV0@@Z
??8CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
??8CLKRLinearHashTable_Iterator@@QEBA_NAEBV0@@Z
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
??9CLKRLinearHashTable_Iterator@@QEBA_NAEBV0@@Z
??_FCSharelock@@QEAAXXZ
?ActiveUsers@CSharelock@@QEAAHXZ
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHPEBGK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJG@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBGK@Z
?AppendA@STRU@@QEAAJPEBD@Z
?AppendA@STRU@@QEAAJPEBDK@Z
?AppendA_ACP@STRU@@QEAAJPEBD@Z
?AppendA_ACP@STRU@@QEAAJPEBDK@Z
?AppendW@STRA@@QEAAJPEBG@Z
?AppendW@STRA@@QEAAJPEBGK@Z
?AppendWSimple@STRA@@QEAAJPEBGK@Z
?AppendWTruncate@STRA@@QEAAJPEBG@Z
?AppendWTruncate@STRA@@QEAAJPEBGK@Z
?BucketIndex@CLKRHashTableStats@@SAJJ@Z
?BucketSize@CLKRHashTableStats@@SAJJ@Z
?BucketSizes@CLKRHashTableStats@@SAPEBJXZ
?ChangeExclusiveLockToSharedLock@CSharelock@@QEAAXXZ
?ChangeSharedLockToExclusiveLock@CSharelock@@QEAAEH@Z
?ClaimExclusiveLock@CSharelock@@QEAAEH@Z
?ClaimShareLock@CSharelock@@QEAAEH@Z
?ClassName@CCritSec@@SAPEBGXZ
?ClassName@CFakeLock@@SAPEBGXZ
?ClassName@CLKRHashTable@@SAPEBGXZ
?ClassName@CLKRLinearHashTable@@SAPEBGXZ
?ClassName@CReaderWriterLock2@@SAPEBGXZ
?ClassName@CReaderWriterLock3@@SAPEBGXZ
?ClassName@CReaderWriterLock@@SAPEBGXZ
?ClassName@CRtlResource@@SAPEBDXZ
?ClassName@CShareLock@@SAPEBDXZ
?ClassName@CSmallSpinLock@@SAPEBGXZ
?ClassName@CSpinLock@@SAPEBGXZ
?Clear@CLKRLinearHashTable@@QEAAXXZ
?Clone@MULTISZ@@QEBAHPEAV1@@Z
?Clone@STRA@@QEBAJPEAV1@@Z
?CloseIterator@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEAVCConstIterator@1@@Z
?CloseIterator@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@PEAVCIterator@1@@Z
?CloseIterator@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@PEAVCConstIterator@1@@Z
?Convert@TS_RESOURCE@@QEAAXW4TSRES_CONV_TYPE@@@Z
?ConvertExclusiveToShared@CCritSec@@QEAAXXZ
?ConvertExclusiveToShared@CFakeLock@@QEAAXXZ
?ConvertExclusiveToShared@CLKRLinearHashTable@@QEBAXXZ
?ConvertExclusiveToShared@CReaderWriterLock2@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock3@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock@@QEAAXXZ
?ConvertExclusiveToShared@CRtlResource@@QEAAXXZ
?ConvertExclusiveToShared@CShareLock@@QEAAXXZ
?ConvertExclusiveToShared@CSmallSpinLock@@QEAAXXZ
?ConvertExclusiveToShared@CSpinLock@@QEAAXXZ
?ConvertSharedToExclusive@CCritSec@@QEAAXXZ
?ConvertSharedToExclusive@CFakeLock@@QEAAXXZ
?ConvertSharedToExclusive@CLKRLinearHashTable@@QEBAXXZ
?ConvertSharedToExclusive@CReaderWriterLock2@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock3@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock@@QEAAXXZ
?ConvertSharedToExclusive@CRtlResource@@QEAAXXZ
?ConvertSharedToExclusive@CShareLock@@QEAAXXZ
?ConvertSharedToExclusive@CSmallSpinLock@@QEAAXXZ
?ConvertSharedToExclusive@CSpinLock@@QEAAXXZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@MULTISZ@@QEAAHPEBGK@Z
?Copy@STRA@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?CopyA@STRU@@QEAAJPEBD@Z
?CopyA@STRU@@QEAAJPEBDK@Z
?CopyA_ACP@STRU@@QEAAJPEBD@Z
?CopyA_ACP@STRU@@QEAAJPEBDK@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyW@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?DeleteKey@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?DeleteRecord@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?End@CLKRLinearHashTable@@QEAA?AVCLKRLinearHashTable_Iterator@@XZ
?Equals@STRA@@QEBA_NAEBV1@@Z
?Equals@STRA@@QEBA_NPEBD@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
?Equals@STRU@@QEBA_NPEBG@Z
?EqualsNoCase@STRA@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRA@@QEBA_NPEBD@Z
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?FastAppend@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FastAppend@MULTISZ@@QEAAHPEBG@Z
?FastAppend@MULTISZ@@QEAAHPEBGK@Z
?FastCopy@MULTISZ@@QEAAHAEBV1@@Z
?FastCopy@MULTISZ@@QEAAHPEBGK@Z
?FindKey@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?FindRecord@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?FindString@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindStringNoCase@MULTISZ@@QEAAHAEAVSTRU@@@Z
?First@CDoubleList@@QEBAQEAVCListEntry@@XZ
?First@CLockedDoubleList@@QEAAQEAVCListEntry@@XZ
?First@MULTISZ@@QEBAPEBGXZ
?GetDefaultSpinAdjustmentFactor@CCritSec@@SANXZ
?GetDefaultSpinAdjustmentFactor@CFakeLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CRtlResource@@SANXZ
?GetDefaultSpinAdjustmentFactor@CShareLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CSpinLock@@SANXZ
?GetDefaultSpinCount@CCritSec@@SAGXZ
?GetDefaultSpinCount@CFakeLock@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock2@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock3@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock@@SAGXZ
?GetDefaultSpinCount@CRtlResource@@SAGXZ
?GetDefaultSpinCount@CShareLock@@SAGXZ
?GetDefaultSpinCount@CSmallSpinLock@@SAGXZ
?GetDefaultSpinCount@CSpinLock@@SAGXZ
?GetSpinCount@CCritSec@@QEBAGXZ
?GetSpinCount@CFakeLock@@QEBAGXZ
?GetSpinCount@CReaderWriterLock2@@QEBAGXZ
?GetSpinCount@CReaderWriterLock3@@QEBAGXZ
?GetSpinCount@CReaderWriterLock@@QEBAGXZ
?GetSpinCount@CRtlResource@@QEBAGXZ
?GetSpinCount@CShareLock@@QEBAGXZ
?GetSpinCount@CSmallSpinLock@@QEBAGXZ
?GetSpinCount@CSpinLock@@QEBAGXZ
?GetTableLockSpinCount@CLKRLinearHashTable@@QEBAGXZ
?HeadNode@CDoubleList@@QEBAQEBVCListEntry@@XZ
?HeadNode@CLockedDoubleList@@QEBAQEBVCListEntry@@XZ
?Increment@CLKRHashTable_Iterator@@QEAA_NXZ
?Increment@CLKRLinearHashTable_Iterator@@QEAA_NXZ
?IncrementIterator@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEAVCConstIterator@1@@Z
?IncrementIterator@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@PEAVCConstIterator@1@@Z
?InitializeIterator@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEAVCConstIterator@1@@Z
?InitializeIterator@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@PEAVCIterator@1@@Z
?InitializeIterator@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@PEAVCConstIterator@1@@Z
?InsertHead@CDoubleList@@QEAAXQEAVCListEntry@@@Z
?InsertHead@CLockedDoubleList@@QEAAXQEAVCListEntry@@@Z
?InsertRecord@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?InsertTail@CDoubleList@@QEAAXQEAVCListEntry@@@Z
?InsertTail@CLockedDoubleList@@QEAAXQEAVCListEntry@@@Z
?IsEmpty@CDoubleList@@QEBA_NXZ
?IsEmpty@CLockedDoubleList@@QEBA_NXZ
?IsEmpty@CLockedSingleList@@QEBA_NXZ
?IsEmpty@CSingleList@@QEBA_NXZ
?IsEmpty@MULTISZ@@QEBAHXZ
?IsEmpty@STRA@@QEBA_NXZ
?IsEmpty@STRU@@QEBA_NXZ
?IsLocked@CLockedDoubleList@@QEBA_NXZ
?IsLocked@CLockedSingleList@@QEBA_NXZ
?IsReadLocked@CCritSec@@QEBA_NXZ
?IsReadLocked@CFakeLock@@QEBA_NXZ
?IsReadLocked@CLKRLinearHashTable@@QEBA_NXZ
?IsReadLocked@CReaderWriterLock2@@QEBA_NXZ
?IsReadLocked@CReaderWriterLock3@@QEBA_NXZ
?IsReadLocked@CReaderWriterLock@@QEBA_NXZ
?IsReadLocked@CRtlResource@@QEBA_NXZ
?IsReadLocked@CShareLock@@QEBA_NXZ
?IsReadLocked@CSmallSpinLock@@QEBA_NXZ
?IsReadLocked@CSpinLock@@QEBA_NXZ
?IsReadUnlocked@CCritSec@@QEBA_NXZ
?IsReadUnlocked@CFakeLock@@QEBA_NXZ
?IsReadUnlocked@CLKRLinearHashTable@@QEBA_NXZ
?IsReadUnlocked@CReaderWriterLock2@@QEBA_NXZ
?IsReadUnlocked@CReaderWriterLock3@@QEBA_NXZ
?IsReadUnlocked@CReaderWriterLock@@QEBA_NXZ
?IsReadUnlocked@CRtlResource@@QEBA_NXZ
?IsReadUnlocked@CShareLock@@QEBA_NXZ
?IsReadUnlocked@CSmallSpinLock@@QEBA_NXZ
?IsReadUnlocked@CSpinLock@@QEBA_NXZ
?IsUnlocked@CLockedDoubleList@@QEBA_NXZ
?IsUnlocked@CLockedSingleList@@QEBA_NXZ
?IsUsable@CLKRHashTable@@QEBA_NXZ
?IsUsable@CLKRLinearHashTable@@QEBA_NXZ
?IsValid@ALLOC_CACHE_HANDLER@@QEBAHXZ
?IsValid@BUFFER@@QEBA_NXZ
?IsValid@CLKRHashTable_Iterator@@QEBA_NXZ
?IsValid@CLKRLinearHashTable@@QEBA_NXZ
?IsValid@CLKRLinearHashTable_Iterator@@QEBA_NXZ
?IsValid@MULTISZ@@QEBAHXZ
?IsValid@STRA@@QEBA_NXZ
?IsWriteLocked@CCritSec@@QEBA_NXZ
?IsWriteLocked@CFakeLock@@QEBA_NXZ
?IsWriteLocked@CLKRLinearHashTable@@QEBA_NXZ
?IsWriteLocked@CReaderWriterLock2@@QEBA_NXZ
?IsWriteLocked@CReaderWriterLock3@@QEBA_NXZ
?IsWriteLocked@CReaderWriterLock@@QEBA_NXZ
?IsWriteLocked@CRtlResource@@QEBA_NXZ
?IsWriteLocked@CShareLock@@QEBA_NXZ
?IsWriteLocked@CSmallSpinLock@@QEBA_NXZ
?IsWriteLocked@CSpinLock@@QEBA_NXZ
?IsWriteUnlocked@CCritSec@@QEBA_NXZ
?IsWriteUnlocked@CFakeLock@@QEBA_NXZ
?IsWriteUnlocked@CLKRLinearHashTable@@QEBA_NXZ
?IsWriteUnlocked@CReaderWriterLock2@@QEBA_NXZ
?IsWriteUnlocked@CReaderWriterLock3@@QEBA_NXZ
?IsWriteUnlocked@CReaderWriterLock@@QEBA_NXZ
?IsWriteUnlocked@CRtlResource@@QEBA_NXZ
?IsWriteUnlocked@CShareLock@@QEBA_NXZ
?IsWriteUnlocked@CSmallSpinLock@@QEBA_NXZ
?IsWriteUnlocked@CSpinLock@@QEBA_NXZ
?Key@CLKRHashTable_Iterator@@QEBA?B_KXZ
?Key@CLKRLinearHashTable_Iterator@@QEBA?B_KXZ
?Last@CDoubleList@@QEBAQEAVCListEntry@@XZ
?Last@CLockedDoubleList@@QEAAQEAVCListEntry@@XZ
?Lock@CLockedDoubleList@@QEAAXXZ
?Lock@CLockedSingleList@@QEAAXXZ
?Lock@TS_RESOURCE@@QEAAXW4TSRES_LOCK_TYPE@@@Z
?LockType@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?LockType@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_LOCKTYPE@@XZ
?MaxSize@CLKRLinearHashTable@@QEBAKXZ
?MultiKeys@CLKRLinearHashTable@@QEBA_NXZ
?MutexType@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?MutexType@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_RW_MUTEX@@XZ
?Next@MULTISZ@@QEBAPEBGPEBG@Z
?NumSubTables@CLKRHashTable@@QEBAHXZ
?NumSubTables@CLKRLinearHashTable@@QEBAHXZ
?PerLockSpin@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?PerLockSpin@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_PERLOCK_SPIN@@XZ
?Pop@CLockedSingleList@@QEAAQEAVCSingleListEntry@@XZ
?Pop@CSingleList@@QEAAQEAVCSingleListEntry@@XZ
?Push@CLockedSingleList@@QEAAXQEAVCSingleListEntry@@@Z
?Push@CSingleList@@QEAAXQEAVCSingleListEntry@@@Z
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?QueryCB@MULTISZ@@QEBAIXZ
?QueryCB@STRA@@QEBAKXZ
?QueryCB@STRU@@QEBAKXZ
?QueryCCH@MULTISZ@@QEBAIXZ
?QueryCCH@STRA@@QEBAKXZ
?QueryCCH@STRU@@QEBAKXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QuerySize@BUFFER@@QEBAKXZ
?QuerySize@STRA@@QEBAKXZ
?QuerySize@STRU@@QEBAKXZ
?QuerySizeCCH@STRA@@QEBAKXZ
?QuerySizeCCH@STRU@@QEBAKXZ
?QueryStr@MULTISZ@@QEBAPEAGXZ
?QueryStr@STRA@@QEAAPEADXZ
?QueryStr@STRA@@QEBAPEBDXZ
?QueryStr@STRU@@QEAAPEAGXZ
?QueryStr@STRU@@QEBAPEBGXZ
?QueryStrA@MULTISZ@@QEBAPEAGXZ
?QueryStringCount@MULTISZ@@QEBAKXZ
?QueueType@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?QueueType@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_QUEUE_TYPE@@XZ
?ReadLock@CCritSec@@QEAAXXZ
?ReadLock@CFakeLock@@QEAAXXZ
?ReadLock@CLKRLinearHashTable@@QEBAXXZ
?ReadLock@CReaderWriterLock2@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock@@QEAAXXZ
?ReadLock@CRtlResource@@QEAAXXZ
?ReadLock@CShareLock@@QEAAXXZ
?ReadLock@CSmallSpinLock@@QEAAXXZ
?ReadLock@CSpinLock@@QEAAXXZ
?ReadOrWriteLock@CCritSec@@QEAA_NXZ
?ReadOrWriteLock@CFakeLock@@QEAA_NXZ
?ReadOrWriteLock@CReaderWriterLock3@@QEAA_NXZ
?ReadOrWriteLock@CSpinLock@@QEAA_NXZ
?ReadOrWriteUnlock@CCritSec@@QEAAX_N@Z
?ReadOrWriteUnlock@CFakeLock@@QEAAX_N@Z
?ReadOrWriteUnlock@CReaderWriterLock3@@QEAAX_N@Z
?ReadOrWriteUnlock@CSpinLock@@QEAAX_N@Z
?ReadUnlock@CCritSec@@QEAAXXZ
?ReadUnlock@CFakeLock@@QEAAXXZ
?ReadUnlock@CLKRLinearHashTable@@QEBAXXZ
?ReadUnlock@CReaderWriterLock2@@QEAAXXZ
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?ReadUnlock@CReaderWriterLock@@QEAAXXZ
?ReadUnlock@CRtlResource@@QEAAXXZ
?ReadUnlock@CShareLock@@QEAAXXZ
?ReadUnlock@CSmallSpinLock@@QEAAXXZ
?ReadUnlock@CSpinLock@@QEAAXXZ
?RecalcLen@MULTISZ@@QEAAXXZ
?Record@CLKRHashTable_Iterator@@QEBAPEBXXZ
?Record@CLKRLinearHashTable_Iterator@@QEBAPEBXXZ
?Recursion@?$CLockBase@$00$00$02$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$01$00$00$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$02$00$00$00$00$00@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$03$00$00$01$02$02@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$04$01$00$01$02$02@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$05$01$00$01$02$02@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$06$01$01$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$07$01$01$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?Recursion@?$CLockBase@$08$01$00$00$02$01@@SA?AW4LOCK_RECURSION@@XZ
?ReleaseExclusiveLock@CSharelock@@QEAAXXZ
?ReleaseShareLock@CSharelock@@QEAAXXZ
?RemoveEntry@CDoubleList@@SAXQEAVCListEntry@@@Z
?RemoveEntry@CLockedDoubleList@@QEAAXQEAVCListEntry@@@Z
?RemoveHead@CDoubleList@@QEAAQEAVCListEntry@@XZ
?RemoveHead@CLockedDoubleList@@QEAAQEAVCListEntry@@XZ
?RemoveTail@CDoubleList@@QEAAQEAVCListEntry@@XZ
?RemoveTail@CLockedDoubleList@@QEAAQEAVCListEntry@@XZ
?Reset@MULTISZ@@QEAAXXZ
?Reset@STRA@@QEAAXXZ
?Reset@STRU@@QEAAXXZ
?Resize@STRA@@QEAAJK@Z
?Resize@STRU@@QEAAJK@Z
?SetDefaultSpinAdjustmentFactor@CCritSec@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CFakeLock@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CRtlResource@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CShareLock@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SAXN@Z
?SetDefaultSpinAdjustmentFactor@CSpinLock@@SAXN@Z
?SetDefaultSpinCount@CCritSec@@SAXG@Z
?SetDefaultSpinCount@CFakeLock@@SAXG@Z
?SetDefaultSpinCount@CReaderWriterLock2@@SAXG@Z
?SetDefaultSpinCount@CReaderWriterLock3@@SAXG@Z
?SetDefaultSpinCount@CReaderWriterLock@@SAXG@Z
?SetDefaultSpinCount@CRtlResource@@SAXG@Z
?SetDefaultSpinCount@CShareLock@@SAXG@Z
?SetDefaultSpinCount@CSmallSpinLock@@SAXG@Z
?SetDefaultSpinCount@CSpinLock@@SAXG@Z
?SetLen@STRA@@QEAA_NK@Z
?SetLen@STRU@@QEAA_NK@Z
?SetSpinCount@CCritSec@@QEAA_NG@Z
?SetSpinCount@CFakeLock@@QEAA_NG@Z
?SetSpinCount@CReaderWriterLock2@@QEAA_NG@Z
?SetSpinCount@CReaderWriterLock3@@QEAA_NG@Z
?SetSpinCount@CReaderWriterLock@@QEAA_NG@Z
?SetSpinCount@CRtlResource@@QEAA_NG@Z
?SetSpinCount@CShareLock@@QEAA_NG@Z
?SetSpinCount@CSmallSpinLock@@QEAA_NG@Z
?SetSpinCount@CSpinLock@@QEAA_NG@Z
?SetTableLockSpinCount@CLKRLinearHashTable@@QEAAXG@Z
?SetValid@BUFFER@@QEAAX_N@Z
?Size@CLKRLinearHashTable@@QEBAKXZ
?SyncWithBuffer@STRA@@QEAAXXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?TryConvertSharedToExclusive@CReaderWriterLock3@@QEAA_NXZ
?TryReadLock@CCritSec@@QEAA_NXZ
?TryReadLock@CFakeLock@@QEAA_NXZ
?TryReadLock@CReaderWriterLock2@@QEAA_NXZ
?TryReadLock@CReaderWriterLock3@@QEAA_NXZ
?TryReadLock@CReaderWriterLock@@QEAA_NXZ
?TryReadLock@CRtlResource@@QEAA_NXZ
?TryReadLock@CShareLock@@QEAA_NXZ
?TryReadLock@CSmallSpinLock@@QEAA_NXZ
?TryReadLock@CSpinLock@@QEAA_NXZ
?TryReadOrWriteLock@CReaderWriterLock3@@QEAA_NAEA_N@Z
?TryWriteLock@CFakeLock@@QEAA_NXZ

Sections

.text
Size: 227KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/asp.dll
.dll regsvr32 windows:10 windows x64

2b856779d357881437fefeb5963cf610

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_mbsnicmp
rand_s
_wcsnicmp
_ltow
strncpy_s
vsprintf_s
_ltoa
isleadbyte
_mbstok_s
swprintf_s
_wcsicmp
_stricmp
srand
memcpy_s
malloc
_beginthread
wcschr
_purecall
_strnicmp
strcat_s
isdigit
sprintf_s
wcsncpy_s
wcsrchr
wcsncmp
atoi
strncmp
strtoul
strchr
free
strcpy_s
time
wcscat_s
wcscpy_s
_wtoi
wcsstr
_wcsupr
_beginthreadex
_vsnprintf
_strlwr
isxdigit
wcspbrk
_itoa_s
atol
difftime
gmtime
localtime
mktime
iswspace
iswalpha
_ultow
strncat_s
memchr
_memicmp
_wcslwr
_ismbbkana
_ultoa_s
isalnum
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
_errno
realloc
memset
memmove
memcpy
memcmp
strstr
__C_specific_handler
_mbsupr
wcscmp

user32

CharNextExA
UnregisterClassA
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
CharNextW
LoadStringA
CharUpperA
CharPrevW
LoadStringW
CharNextA
CharUpperBuffW
IsCharAlphaW

advapi32

RegQueryInfoKeyW
GetFileSecurityW
RegQueryValueA
RegEnumKeyA
GetKernelObjectSecurity
GetSecurityDescriptorDacl
GetSecurityDescriptorLength
GetTokenInformation
EqualSid
AccessCheck
SetNamedSecurityInfoA
SetEntriesInAclA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
ImpersonateLoggedOnUser
ReportEventW
RegisterEventSourceW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SetThreadToken
RevertToSelf
OpenThreadToken

ole32

CoWaitForMultipleHandles
CLSIDFromString
CoGetObjectContext
CoFreeUnusedLibraries
CoInitialize
CLSIDFromProgID
CoTaskMemRealloc
CoUninitialize
CoInitializeEx
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoDisconnectObject
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

oleaut32

SafeArrayUnaccessData
VariantCopyInd
VarUI4FromStr
LoadTypeLibEx
DispGetIDsOfNames
SetErrorInfo
CreateErrorInfo
GetErrorInfo
UnRegisterTypeLi
VariantChangeTypeEx
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
VariantCopy
DosDateTimeToVariantTime
VariantTimeToDosDateTime
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
SafeArrayCreate
SystemTimeToVariantTime
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysAllocString
VariantChangeType
SafeArrayGetDim

comsvcs

CoLeaveServiceDomain
CoCreateActivity
CoEnterServiceDomain

kernel32

ResetEvent
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
IsValidLocale
GetSystemInfo
GlobalAlloc
GlobalFree
IsValidCodePage
GetACP
FormatMessageA
LoadLibraryExA
FormatMessageW
GetModuleHandleA
IsDBCSLeadByte
GetCPInfo
LoadLibraryW
GetWindowsDirectoryW
GetModuleFileNameA
HeapFree
GetThreadPriority
GetModuleHandleExW
OutputDebugStringA
DisableThreadLibraryCalls
InitializeCriticalSection
FindResourceExW
LoadResource
SizeofResource
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
SetLastError
LocalFree
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
FileTimeToSystemTime
CreateDirectoryA
HeapCreate
GetFileAttributesA
GetCurrentThread
HeapReAlloc
CreateFileMappingA
OpenFileMappingA
OpenMutexA
Sleep
OpenEventW
OpenEventA
ReleaseMutex
ExpandEnvironmentStringsA
IsDBCSLeadByteEx
GetSystemDefaultLCID
ConvertDefaultLocale
GetTempFileNameA
CreateFileA
WriteFile
ReadFile
GetFullPathNameW
GetFileAttributesExW
GetFileInformationByHandle
CreateFileW
GetLongPathNameW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
LeaveCriticalSection
HeapSetInformation
HeapDestroy
MoveFileA
HeapAlloc
SetThreadPriority
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
CompareFileTime
RemoveDirectoryA
ReadDirectoryChangesW
Wow64EnableWow64FsRedirection
GetCurrentProcess
IsWow64Process
OpenProcess
GetModuleFileNameW
RaiseException
WaitForMultipleObjects
WaitForSingleObject
EnterCriticalSection
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
GetLastError
SetEvent
GetCurrentThreadId
CreateEventA
CreateThread
ResumeThread
CloseHandle

crypt32

CertCreateCertificateContext
CryptDecodeObject
CertFreeCertificateContext

iisutil

ScheduleAdjustTime
MakePathCanonicalizationProof
?Size@CLKRHashTable@@QEBAKXZ
?ReadLock@CLKRHashTable@@QEBAXXZ
?ReadUnlock@CLKRHashTable@@QEBAXXZ
WriteRefTraceLogEx
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?Copy@STRU@@QEAAJPEBG@Z
?WriteUnlock@CLKRHashTable@@QEBAXXZ
RemoveWorkItem
ScheduleWorkItem
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
??0BUFFER@@QEAA@XZ
PuDbgPrintError
?Append@STRU@@QEAAJPEBG@Z
?SetLen@STRU@@QEAA_NK@Z
?QuerySizeCCH@STRU@@QEBAKXZ
PuDeleteDebugPrintsObject
DestroyRefTraceLog
CreateRefTraceLog
PuLoadDebugFlagsFromRegStr
PuCreateDebugPrintsObject
?QuerySize@BUFFER@@QEBAKXZ
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?Resize@BUFFER@@QEAA_NK@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??1CLKRHashTable@@QEAA@XZ
??1STRU@@QEAA@XZ
?QueryCCH@STRU@@QEBAKXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?Resize@STRU@@QEAAJK@Z
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QueryStr@STRU@@QEAAPEAGXZ
??0BUFFER@@QEAA@PEAEK@Z
??1BUFFER@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
PuDbgPrint
IISInitializeCriticalSection
WriteRefTraceLog
?WriteLock@CLKRHashTable@@QEAAXXZ

nativerd

GetDefaultNativeConfigurationSystem

w3tp

ThreadPoolBindIoCompletionCallback
ThreadPoolMapErrorCodeIfNecessary
ThreadPoolInitialize
ThreadPoolTerminate

Exports

Exports

AspStatusHtmlDump
DllRegisterServer
DllUnregisterServer
GetExtensionVersion
HttpExtensionProc
TerminateExtension

Sections

.text
Size: 376KB - Virtual size: 376KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/asp.mof
inetsrv/aspnetca.exe
.exe windows:10 windows x64

cfbf32eb8cbe3f43e2dcba60333153e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW
IsValidSid
LookupAccountSidW
GetLengthSid
CopySid
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegGetKeySecurity
GetSecurityDescriptorLength
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
GetFileSecurityW
SetNamedSecurityInfoW
GetAclInformation
GetAce
EqualSid
DeleteAce
InitializeAcl
AddAccessAllowedAce
GetExplicitEntriesFromAclW
SetEntriesInAclW
LogonUserExW
LsaAddAccountRights
LsaManageSidNameMapping
LsaClose
LsaFreeMemory
LsaOpenPolicy

kernel32

GetLocalTime
SetFilePointer
CreateFileW
IsDBCSLeadByteEx
GetSystemDefaultLangID
GetModuleHandleA
WideCharToMultiByte
DeleteCriticalSection
MultiByteToWideChar
HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
ExpandEnvironmentStringsW
FormatMessageA
CloseHandle
FlushFileBuffers
GlobalFree
SetLastError
GetStdHandle
GlobalAlloc
LocalAlloc
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetSystemWindowsDirectoryW
SetDllDirectoryW
CreateDirectoryW
FindClose
FindNextFileW
DeleteFileW
lstrcmpW
FindFirstFileW
RemoveDirectoryW
LocalFree
GetFileAttributesW
lstrcmpiW
GetLastError
GetEnvironmentVariableW
GetCommandLineW
OutputDebugStringA
WriteFile
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

msvcrt

_wcsicmp
_vsnwprintf
swscanf
malloc
memcpy
memmove
memset
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
_wcsnicmp
__set_app_type
__wgetmainargs
_wcslwr
_XcptFilter
_callnewh
strcpy_s
sprintf_s
strcat_s
strnlen
_vsnwprintf_s
wcsnlen
iswxdigit
iswalnum
_vscwprintf
_stricmp
strchr
isxdigit
_vsnprintf
_wcslwr_s
wprintf
free
_amsg_exit
towlower
wcschr
exit
wcscmp

ntdll

RtlInitializeSid
RtlSubAuthoritySid
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlLengthRequiredSid
RtlGetNtProductType
RtlInitUnicodeString

ncrypt

BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptCreateHash

user32

LoadStringA

userenv

UnloadUserProfile
LoadUserProfileW

secur32

LsaFreeReturnBuffer

Exports

Exports

??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
??0MB@@QEAA@PEAUIMSAdminBaseW@@@Z
??0MULTISZ@@QEAA@AEBV0@@Z
??0MULTISZ@@QEAA@PEAGK@Z
??0MULTISZ@@QEAA@PEBG@Z
??0MULTISZ@@QEAA@XZ
??0STRA@@AEAA@AEBV0@@Z
??0STRA@@AEAA@PEAD@Z
??0STRA@@AEAA@PEBD@Z
??0STRA@@QEAA@PEADK@Z
??0STRA@@QEAA@XZ
??0STRAU@@QEAA@AEAV0@@Z
??0STRAU@@QEAA@PEBD@Z
??0STRAU@@QEAA@PEBDH@Z
??0STRAU@@QEAA@PEBG@Z
??0STRAU@@QEAA@XZ
??0STRU@@AEAA@AEBV0@@Z
??0STRU@@AEAA@PEAG@Z
??0STRU@@AEAA@PEBG@Z
??0STRU@@QEAA@PEAGK@Z
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1MB@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
??1STRA@@QEAA@XZ
??1STRAU@@QEAA@XZ
??1STRU@@QEAA@XZ
??4ALLOC_CACHE_HANDLER@@QEAAAEAV0@AEBV0@@Z
??4BIG_REF_TRACE@@QEAAAEAV0@AEBV0@@Z
??4BUFFER@@QEAAAEAV0@AEBV0@@Z
??4LANG_STRING@@QEAAAEAV0@$$QEAV0@@Z
??4LANG_STRING@@QEAAAEAV0@AEBV0@@Z
??4MB@@QEAAAEAV0@AEBV0@@Z
??4MULTISZ@@QEAAAEAV0@AEBV0@@Z
??4STRA@@AEAAAEAV0@AEBV0@@Z
??4STRAU@@QEAAAEAV0@AEBV0@@Z
??4STRU@@AEAAAEAV0@AEBV0@@Z
?AddObject@MB@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHPEBGK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@STRAU@@QEAAHAEAV1@@Z
?Append@STRAU@@QEAAHPEBD@Z
?Append@STRAU@@QEAAHPEBDK@Z
?Append@STRAU@@QEAAHPEBG@Z
?Append@STRAU@@QEAAHPEBGK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJG@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBGK@Z
?AppendA@STRU@@QEAAJPEBD@Z
?AppendA@STRU@@QEAAJPEBDK@Z
?AppendA_ACP@STRU@@QEAAJPEBD@Z
?AppendA_ACP@STRU@@QEAAJPEBDK@Z
?AppendW@STRA@@QEAAJPEBG@Z
?AppendW@STRA@@QEAAJPEBGK@Z
?AppendWSimple@STRA@@QEAAJPEBGK@Z
?AppendWTruncate@STRA@@QEAAJPEBG@Z
?AppendWTruncate@STRA@@QEAAJPEBGK@Z
?AuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?AuxAppend@STRA@@AEAAJPEBEKK_N@Z
?AuxAppend@STRAU@@AEAAHPEBDIH@Z
?AuxAppend@STRAU@@AEAAHPEBGIH@Z
?AuxAppend@STRU@@AEAAJPEBEKK_N@Z
?AuxAppendA@STRU@@AEAAJPEBEKK_N1@Z
?AuxAppendW@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWSimple@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWTruncate@STRA@@AEAAJPEBGKK_N@Z
?AuxInit@MULTISZ@@AEAAXPEBG@Z
?AuxInit@STRAU@@AEAAXPEBD@Z
?AuxInit@STRAU@@AEAAXPEBG@Z
?CalcLength@MULTISZ@@SAKPEBGPEAK@Z
?CheckSignature@BIG_REF_TRACE@@AEBAHXZ
?Clone@MULTISZ@@QEBAHPEAV1@@Z
?Clone@STRA@@QEBAJPEAV1@@Z
?Close@MB@@QEAAHXZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@MULTISZ@@QEAAHPEBGK@Z
?Copy@STRA@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRAU@@QEAAHAEAV1@@Z
?Copy@STRAU@@QEAAHPEBD@Z
?Copy@STRAU@@QEAAHPEBDK@Z
?Copy@STRAU@@QEAAHPEBG@Z
?Copy@STRAU@@QEAAHPEBGK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?CopyA@STRU@@QEAAJPEBD@Z
?CopyA@STRU@@QEAAJPEBDK@Z
?CopyA_ACP@STRU@@QEAAJPEBD@Z
?CopyA_ACP@STRU@@QEAAJPEBDK@Z
?CopyBinary@STRA@@QEAAJPEAXK@Z
?CopyToBuffer@MULTISZ@@QEBAHPEAGPEAK@Z
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
?CopyToBuffer@STRU@@QEBAJPEAGPEAK@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyW@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Escaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?DeleteData@MB@@QEAAHPEBGKKK@Z
?DeleteObject@MB@@QEAAHPEBG@Z
?EnumObjects@MB@@QEAAHPEBGPEAGK@Z
?Equals@MULTISZ@@QEAAHPEAV1@@Z
?Equals@STRA@@QEBA_NAEBV1@@Z
?Equals@STRA@@QEBA_NPEBD@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
?Equals@STRU@@QEBA_NPEBG@Z
?EqualsNoCase@STRA@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRA@@QEBA_NPEBD@Z
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?Escape@STRA@@QEAAJ_N0@Z
?Escape@STRU@@QEAAJXZ
?ExpandEnvironmentVariables@STRU@@SAJPEBGPEAV1@@Z
?FastAppend@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FastAppend@MULTISZ@@QEAAHPEBG@Z
?FastAppend@MULTISZ@@QEAAHPEBGK@Z
?FastAuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?FastCopy@MULTISZ@@QEAAHAEBV1@@Z
?FastCopy@MULTISZ@@QEAAHPEBGK@Z
?FindRefTraceHeadEntry@BIG_REF_TRACE@@SAPEAU_REF_TRACE_HEAD_ENTRY@@PEAV1@PEAX@Z
?FindString@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindString@MULTISZ@@QEAAHPEBG@Z
?FindStringNoCase@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
?First@MULTISZ@@QEBAPEBGXZ
?FormatString@STRA@@QEAAJKQEAPEBDPEBDK@Z
?FreeMemory@BUFFER@@QEAAXXZ
?FreeMemoryInternal@BUFFER@@AEAAXXZ
?GetAll@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAK2@Z
?GetBuffer@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAKK@Z
?GetChildPaths@MB@@QEAAHPEBGPEAVBUFFER@@@Z
?GetData@MB@@QEAAHPEBGKKKPEAXPEAKK@Z
?GetDataPaths@MB@@QEAAHPEBGKKPEAVBUFFER@@@Z
?GetDataSetNumber@MB@@QEAAHPEBGPEAK@Z
?GetDword@MB@@QEAAHPEBGKKPEAKK@Z
?GetDword@MB@@QEAAXPEBGKKKPEAKK@Z
?GetMultisz@MB@@QEAAHPEBGKKPEAVMULTISZ@@K@Z
?GetStr@MB@@QEAAHPEBGKKPEAVSTRU@@K0@Z
?GetString@MB@@QEAAHPEBGKKPEAGPEAKK@Z
?GetSystemChangeNumber@MB@@QEAAHPEAK@Z
?HTMLEncode@STRA@@QEAAJXZ
?HTMLEncode@STRU@@QEAAJXZ
?Hash@BIG_REF_TRACE@@SAKPEAX@Z
?IsCurrentUnicode@STRAU@@QEAAHXZ
?IsEmpty@MULTISZ@@QEBAHXZ
?IsEmpty@STRA@@QEBA_NXZ
?IsEmpty@STRAU@@QEAAHXZ
?IsEmpty@STRU@@QEBA_NXZ
?IsValid@ALLOC_CACHE_HANDLER@@QEBAHXZ
?IsValid@BUFFER@@QEBA_NXZ
?IsValid@MULTISZ@@QEBAHXZ
?IsValid@STRA@@QEBA_NXZ
?IsValid@STRAU@@QEAAHXZ
?LoadStringW@STRA@@QEAAJKPEAUHINSTANCE__@@@Z
?LoadStringW@STRA@@QEAAJKPEBDK@Z
?Next@MULTISZ@@QEBAPEBGPEBG@Z
?Open@MB@@QEAAHKPEBGK@Z
?Open@MB@@QEAAHPEBGK@Z
?PrivateQueryStr@STRAU@@AEAAPEAGH@Z
?QueryAdminBase@MB@@QEBAPEAUIMSAdminBaseW@@XZ
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?QueryCB@MULTISZ@@QEBAIXZ
?QueryCB@STRA@@QEBAKXZ
?QueryCB@STRAU@@QEAAIH@Z
?QueryCB@STRU@@QEBAKXZ
?QueryCBA@STRAU@@QEAAIXZ
?QueryCBW@STRAU@@QEAAIXZ
?QueryCCH@MULTISZ@@QEBAIXZ
?QueryCCH@STRA@@QEBAKXZ
?QueryCCH@STRAU@@QEAAIXZ
?QueryCCH@STRU@@QEBAKXZ
?QueryHandle@MB@@QEBAKXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QuerySize@BUFFER@@QEBAKXZ
?QuerySize@STRA@@QEBAKXZ
?QuerySize@STRU@@QEBAKXZ
?QuerySizeCCH@STRA@@QEBAKXZ
?QuerySizeCCH@STRU@@QEBAKXZ
?QueryStr@MULTISZ@@QEBAPEAGXZ
?QueryStr@STRA@@QEAAPEADXZ
?QueryStr@STRA@@QEBAPEBDXZ
?QueryStr@STRAU@@QEAAPEAGH@Z
?QueryStr@STRU@@QEAAPEAGXZ
?QueryStr@STRU@@QEBAPEBGXZ
?QueryStrA@MULTISZ@@QEBAPEAGXZ
?QueryStrA@STRAU@@QEAAPEADXZ
?QueryStrW@STRAU@@QEAAPEAGXZ
?QueryStringCount@MULTISZ@@QEBAKXZ
?ReallocStorage@BUFFER@@AEAA_NK@Z
?RecalcLen@MULTISZ@@QEAAXXZ
?Reset@MULTISZ@@QEAAXXZ
?Reset@STRA@@QEAAXXZ
?Reset@STRAU@@QEAAXXZ
?Reset@STRU@@QEAAXXZ
?Resize@BUFFER@@QEAA_NK@Z
?Resize@BUFFER@@QEAA_NKK@Z
?Resize@STRA@@QEAAJK@Z
?Resize@STRU@@QEAAJK@Z
?ResizeW@STRAU@@QEAAHK@Z
?SAFE_snwprintf@@YAJPEAVSTRU@@PEBGZZ
?SafeCopy@STRAU@@QEAAHPEBD@Z
?SafeCopy@STRAU@@QEAAHPEBG@Z
?Save@MB@@QEAAHXZ
?SetData@MB@@QEAAHPEBGKKKPEAXKK@Z
?SetDword@MB@@QEAAHPEBGKKKK@Z
?SetLen@STRA@@QEAA_NK@Z
?SetLen@STRAU@@QEAAHK@Z
?SetLen@STRU@@QEAA_NK@Z
?SetString@MB@@QEAAHPEBGKK0K@Z
?SetValid@BUFFER@@QEAAX_N@Z
?SyncWithBuffer@STRA@@QEAAXXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?Unescape@STRA@@QEAAJXZ
?Unescape@STRU@@QEAAJXZ
?UnescapeOnly@STRA@@QEAAJXZ
?UnescapeOnly@STRU@@QEAAJXZ
?VerifyState@BUFFER@@AEBAXXZ

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/asptlb.tlb
.dll windows:10 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/authanon.dll
.dll windows:10 windows x64

bc1ee881845cbab7196f8426fa7ed4b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcspbrk
_wcsupr
wcschr
wcsncpy_s
memset
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
??1type_info@@UEAA@XZ
strcmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlNtStatusToDosError

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-security-base-l1-1-0

GetKernelObjectSecurity
DuplicateTokenEx
CopySid
GetTokenInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount

iisutil

??0STRU@@QEAA@PEAGK@Z
?IsEmpty@STRU@@QEBA_NXZ
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
DecryptMemoryPassword
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
??1CSmallSpinLock@@QEAA@XZ
??0CSmallSpinLock@@QEAA@XZ
?QueryCB@STRU@@QEBAKXZ
?Resize@BUFFER@@QEAA_NK@Z
DisableTokenBackupPrivilege
PuDbgPrint
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QueryStr@STRU@@QEBAPEBGXZ
EncryptMemoryPassword
?Copy@STRU@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ
??1STRU@@QEAA@XZ
PuDeleteDebugPrintsObject
IISGetPlatformType
PuLoadDebugFlagsFromRegStr
?WriteLock@CSmallSpinLock@@QEAAXXZ
?SetLen@STRU@@QEAA_NK@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Resize@STRU@@QEAAJK@Z
?QuerySize@BUFFER@@QEBAKXZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
?QueryCCH@STRA@@QEBAKXZ
PuCreateDebugPrintsObject
?QueryStr@STRU@@QEAAPEAGXZ
?IsEmpty@STRA@@QEBA_NXZ

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-security-logon-l1-1-0

LogonUserExW

cryptsp

CryptHashData
CryptDestroyHash
CryptAcquireContextW
CryptGetHashParam
CryptReleaseContext
CryptCreateHash

api-ms-win-security-lsapolicy-l1-1-0

LsaOpenPolicy
LsaFreeMemory
LsaQueryInformationPolicy
LsaClose

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/authbas.dll
.dll windows:10 windows x64

0f42ec4a9f006a4bb28a45c8b9d176ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_wcsupr
wcschr
wcsncpy_s
wcspbrk
memset
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
strchr
_strnicmp
??1type_info@@UEAA@XZ
strcmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlNtStatusToDosError

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW

iisutil

??1STRA@@QEAA@XZ
?Copy@STRA@@QEAAJPEBD@Z
?AppendW@STRA@@QEAAJPEBG@Z
?Append@STRA@@QEAAJPEBD@Z
??0STRU@@QEAA@PEAGK@Z
uudecode
??0STRA@@QEAA@PEADK@Z
?CopyA_ACP@STRU@@QEAAJPEBD@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
??0STRA@@QEAA@XZ
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ
PuDeleteDebugPrintsObject
??1BUFFER@@QEAA@XZ
??1STRU@@QEAA@XZ
PuLoadDebugFlagsFromRegStr
PuCreateDebugPrintsObject
?CopyA@STRU@@QEAAJPEBD@Z
PuDbgPrint
DisableTokenBackupPrivilege
?Resize@BUFFER@@QEAA_NK@Z
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
?WriteLock@CSmallSpinLock@@QEAAXXZ
?SetLen@STRU@@QEAA_NK@Z
?Resize@STRU@@QEAAJK@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRA@@QEAAJPEBDK@Z
??0BUFFER@@QEAA@XZ

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
GetTokenInformation
GetKernelObjectSecurity

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-logon-l1-1-0

LogonUserExW

cryptsp

CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/authcert.dll
.dll windows:10 windows x64

d4d18aca4c1399e488ed8436fdad3867

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_amsg_exit
_initterm
_XcptFilter
_callnewh
__C_specific_handler
malloc
free
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenProcessToken
SetThreadToken
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetKernelObjectSecurity
GetTokenInformation
RevertToSelf
DuplicateTokenEx

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

iisutil

??1BUFFER@@QEAA@XZ
?SyncWithBuffer@STRU@@QEAAXXZ
?Resize@STRU@@QEAAJK@Z
DisableTokenBackupPrivilege
PuDbgPrint
??0STRU@@QEAA@XZ
??1STRU@@QEAA@XZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
??0BUFFER@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z
PuDeleteDebugPrintsObject

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/authmap.dll
.dll windows:10 windows x64

8e9769dd3fe6a726d54d2a92b24f2b71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcspbrk
_wcsupr
wcschr
wcsncpy_s
memcmp
memset
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_wcsicmp
wcsstr
_wcsnicmp
wcsncmp
??1type_info@@UEAA@XZ
strcmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlNtStatusToDosError

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime

iisutil

??0STRU@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
??0STRA@@QEAA@PEADK@Z
??1STRA@@QEAA@XZ
?CopyW@STRA@@QEAAJPEBG@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRU@@QEAAJPEBGK@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?Resize@STRU@@QEAAJK@Z
?SyncWithBuffer@STRU@@QEAAXXZ
??1STRU@@QEAA@XZ
EncryptMemoryPassword
DecryptMemoryPassword
??1BUFFER@@QEAA@XZ
uudecode
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?Append@STRU@@QEAAJPEBG@Z
??1CLKRHashTable@@QEAA@XZ
PuDeleteDebugPrintsObject
IISGetPlatformType
PuLoadDebugFlagsFromRegStr
PuCreateDebugPrintsObject
??0BUFFER@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
PuDbgPrint
DisableTokenBackupPrivilege
?Resize@BUFFER@@QEAA_NK@Z
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
?WriteLock@CSmallSpinLock@@QEAAXXZ
?SetLen@STRU@@QEAA_NK@Z

api-ms-win-security-base-l1-1-0

GetKernelObjectSecurity
DuplicateTokenEx
GetTokenInformation

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-logon-l1-1-0

LogonUserExW

cryptsp

CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash

api-ms-win-security-lsapolicy-l1-1-0

LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
LsaFreeMemory

Exports

Exports

RegisterModule

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/authmd5.dll
.dll windows:10 windows x64

dd550121dc1063079bf0e31fe843ed0f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_strnicmp
memset
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_stricmp
isspace
wcschr
strcmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

sspicli

QueryContextAttributesW
QuerySecurityPackageInfoW
QuerySecurityContextToken
QueryContextAttributesA
FreeContextBuffer
SspiFreeAuthIdentity
AcquireCredentialsHandleW
SeciFreeCallContext
CompleteAuthToken
VerifySignature
AcceptSecurityContext
DeleteSecurityContext
FreeCredentialsHandle
SeciAllocateAndSetIPAddress

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

iisutil

AdjustTokenIntegrityLevel
DisableTokenBackupPrivilege
PuCreateDebugPrintsObject
IISGetPlatformType
PuDeleteDebugPrintsObject
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
??1STRA@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
??1CLKRHashTable@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?Clear@CLKRHashTable@@QEAAXXZ
?CopyA@STRU@@QEAAJPEBD@Z
??0BUFFER@@QEAA@XZ
??0STRA@@QEAA@XZ
?Copy@STRA@@QEAAJPEBDK@Z
??0STRA@@QEAA@PEADK@Z
??0STRU@@QEAA@PEAGK@Z
PuDbgPrint
?Resize@BUFFER@@QEAA_NK@Z
?Copy@STRA@@QEAAJPEBD@Z
?CopyW@STRA@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJAEBV1@@Z
WriteRefTraceLogEx
?Append@STRA@@QEAAJPEBDK@Z
?Copy@STRU@@QEAAJPEBGK@Z
UlCleanAndCopyUrl
?SyncWithBuffer@STRU@@QEAAXXZ
?Equals@STRU@@QEBA_NPEBG@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?Copy@STRU@@QEAAJPEBG@Z
??0MULTISZ@@QEAA@XZ
?ConvertSharedToExclusive@CReaderWriterLock3@@QEAAXXZ
??1STRU@@QEAA@XZ
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
PuLoadDebugFlagsFromRegStr
??0STRU@@QEAA@XZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ

api-ms-win-security-base-l1-1-0

GetTokenInformation
DuplicateTokenEx

Exports

Exports

RegisterModule

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/authsspi.dll
.dll windows:10 windows x64

e9717a057520eb7b7892102285873f20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
memset
strcmp
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_XcptFilter
_callnewh
malloc
free
wcschr
_wcsnicmp
strncmp
_stricmp
strchr
_wcsicmp
_amsg_exit
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

sspicli

QuerySecurityPackageInfoW
AcquireCredentialsHandleW
SeciFreeCallContext
GetUserNameExW
QuerySecurityContextToken
QueryContextAttributesA
ImportSecurityContextW
FreeContextBuffer
QueryContextAttributesW
CompleteAuthToken
FreeCredentialsHandle
DeleteSecurityContext
AcceptSecurityContext
EnumerateSecurityPackagesW
SspiExcludePackage
SspiFreeAuthIdentity
SeciAllocateAndSetIPAddress

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId

api-ms-win-security-base-l1-1-0

IsWellKnownSid
DuplicateTokenEx
GetTokenInformation

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

iisutil

??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?CopyA@STRU@@QEAAJPEBD@Z
?ConvertSharedToExclusive@CReaderWriterLock3@@QEAAXXZ
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?FindString@MULTISZ@@QEAAHPEBG@Z
?WriteLock@CReaderWriterLock3@@QEAAXXZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
??1STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
PuDeleteDebugPrintsObject
?FindString@MULTISZA@@QEAAHPEBD@Z
??0STRA@@QEAA@PEADK@Z
??0BUFFER@@QEAA@PEAEK@Z
??1STRA@@QEAA@XZ
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRA@@QEAAJPEBD@Z
??0STRU@@QEAA@XZ
??0BUFFER@@QEAA@XZ
??0STRA@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
??0MULTISZ@@QEAA@XZ
??1MULTISZA@@QEAA@XZ
??0MULTISZA@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z
uuencode
?Append@STRA@@QEAAJPEBD@Z
?Equals@STRA@@QEBA_NPEBD@Z
?CopyW@STRA@@QEAAJPEBG@Z
?EqualsNoCase@STRA@@QEBA_NPEBD@Z
PuDbgPrint
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
uudecode
?Append@STRA@@QEAAJPEBDK@Z
?Copy@STRU@@QEAAJPEBG@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
DisableTokenBackupPrivilege
AdjustTokenIntegrityLevel
??0STRU_PATH@@QEAA@G@Z
??1STRU_PATH@@QEAA@XZ
?RetrieveSystemDir@STRU_PATH@@QEAAJXZ
?Append@STRU@@QEAAJPEBG@Z
?Resize@STRU@@QEAAJK@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?Append@STRU@@QEAAJAEBV1@@Z
??0STRU@@QEAA@PEAGK@Z
?AppendA@STRU@@QEAAJPEBD@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?AppendW@MULTISZA@@QEAAHPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/browscap.dll
.dll regsvr32 windows:10 windows x64

3fdc87dc770c43a36438aa96ebd2a3c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

tolower
strchr
strpbrk
strcpy_s
_stricmp
_XcptFilter
_amsg_exit
strrchr
_strnicmp
atol
_strlwr
_purecall
memcpy_s
_resetstkoflw
free
malloc
memmove
memcmp
_CxxThrowException
strncpy_s
__C_specific_handler
wcscat_s
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_errno
realloc
_lock
_unlock
__dllonexit
_onexit
memset
__CxxFrameHandler3
strcmp

iisrtl

IISSetCriticalSectionSpinCount

kernel32

LoadLibraryExW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetSystemDirectoryW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
SleepConditionVariableSRW
FreeLibraryAndExitThread
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExA
GetModuleHandleA
lstrcmpiA
MultiByteToWideChar
IsDBCSLeadByte
WideCharToMultiByte
LeaveCriticalSection
RaiseException
EnterCriticalSection
SizeofResource
LoadResource
FindResourceExA
GetModuleFileNameA
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
LocalFree
GetFileAttributesExA
CompareFileTime
FindFirstChangeNotificationA
FindCloseChangeNotification
FindNextChangeNotification
CreateEventA
CloseHandle
ResetEvent
SetEvent
WaitForSingleObject
CreateThread
WaitForMultipleObjects
LoadLibraryA
ExitThread
CreateMutexA
ReleaseMutex

user32

UnregisterClassA
LoadStringA
CharNextA

advapi32

RegCreateKeyExA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegSetValueExA

ole32

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoGetObjectContext

oleaut32

SysAllocString
VariantChangeType
VariantClear
VariantInit
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarUI4FromStr
SysFreeString
VariantCopy

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/browscap.ini
inetsrv/cachfile.dll
.dll windows:10 windows x64

db9a27c131acc1770697b97f656f3cc1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsrchr
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memcpy
wcsncmp
free
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GlobalMemoryStatusEx

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapCreate
HeapFree
HeapAlloc
HeapDestroy

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
ReadFile
CreateFileW

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-security-base-l1-1-0

GetLengthSid
AccessCheck
RevertToSelf
GetKernelObjectSecurity
EqualSid

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

iisutil

??1STRU@@QEAA@XZ
??0BUFFER@@QEAA@PEAEK@Z
??1BUFFER@@QEAA@XZ
?InsertRecord@TREE_HASH_TABLE@@QEAAJPEAX@Z
?QueryStr@STRU@@QEBAPEBGXZ
WriteRefTraceLog
DestroyRefTraceLog
?Initialize@TREE_HASH_TABLE@@QEAAJK@Z
?Copy@STRU@@QEAAJPEBGK@Z
?QueryCCH@STRU@@QEBAKXZ
IISInitializeCriticalSection
MakePathCanonicalizationProof
??0STRU@@QEAA@PEAGK@Z
?DeleteIf@TREE_HASH_TABLE@@QEAAXP6AHPEAX0@Z0@Z
?QueryStr@STRU@@QEAAPEAGXZ
?Resize@BUFFER@@QEAA_NK@Z
?QuerySize@BUFFER@@QEBAKXZ
?Copy@STRU@@QEAAJPEBG@Z
?QueryPtr@BUFFER@@QEBAPEAXXZ
??1TREE_HASH_TABLE@@QEAA@XZ
??0TREE_HASH_TABLE@@QEAA@H@Z
?DeletePath@TREE_HASH_TABLE@@QEAAXPEBG@Z
?Clear@TREE_HASH_TABLE@@QEAAXXZ
?FindRecord@TREE_HASH_TABLE@@QEAAXPEBGPEAPEAX@Z

Exports

Exports

RegisterModule

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/cachhttp.dll
.dll windows:10 windows x64

1e40533914a577ca06d1b04e4b4fd4c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcmp
memcpy
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
isalnum
strstr
_strnicmp
strchr
isspace
wcsrchr
_ultow
_stricmp
_wcsupr
wcsncmp
_wcsnicmp
_wcsicmp
wcschr
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
SetThreadToken
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-file-l1-1-0

GetFileAttributesExW

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

iisutil

?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?Initialize@TREE_HASH_TABLE@@QEAAJK@Z
?Append@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBG@Z
?FindRecord@TREE_HASH_TABLE@@QEAAXPEBGPEAPEAX@Z
?InsertRecord@TREE_HASH_TABLE@@QEAAJPEAX@Z
??0STRU@@QEAA@XZ
?CopyW@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?Append@MULTISZA@@QEAAHPEBD@Z
?Resize@BUFFER@@QEAA_NKK@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?Equals@STRA@@QEBA_NPEBD@Z
?QueryCCH@STRA@@QEBAKXZ
?Resize@BUFFER@@QEAA_NK@Z
?WriteLock@CLKRHashTable@@QEAAXXZ
?WriteUnlock@CLKRHashTable@@QEBAXXZ
?SetLen@STRA@@QEAA_NK@Z
StringTimeToFileTime
?Copy@STRA@@QEAAJPEBDK@Z
?Append@MULTISZA@@QEAAHAEAVSTRA@@@Z
?FindString@MULTISZA@@QEAAHAEAVSTRA@@@Z
?FindString@MULTISZA@@QEAAHPEBD@Z
?IsEmpty@MULTISZA@@QEBAHXZ
?QueryStr@STRU@@QEBAPEBGXZ
?Next@MULTISZA@@QEBAPEBDPEBD@Z
??1CLKRHashTable@@QEAA@XZ
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?QueryPtr@BUFFER@@QEBAPEAXXZ
?Equals@STRU@@QEBA_NAEBV1@@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??1CReaderWriterLock3@@QEAA@XZ
??1STRA@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1STRU@@QEAA@XZ
??1TREE_HASH_TABLE@@QEAA@XZ
??0TREE_HASH_TABLE@@QEAA@H@Z
??0CReaderWriterLock3@@QEAA@XZ
?QueryStr@STRU@@QEAAPEAGXZ
??0STRU@@QEAA@PEAGK@Z
?Clear@CLKRHashTable@@QEAAXXZ
?Clear@TREE_HASH_TABLE@@QEAAXXZ
?DeletePath@TREE_HASH_TABLE@@QEAAXPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?DeleteIf@TREE_HASH_TABLE@@QEAAXP6AHPEAX0@Z0@Z
?Copy@STRU@@QEAAJPEBG@Z
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?QueryStr@STRA@@QEBAPEBDXZ
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?Copy@STRA@@QEAAJPEBD@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
??1MULTISZA@@QEAA@XZ
??0MULTISZA@@QEAA@XZ
??0BUFFER@@QEAA@XZ
??0STRA@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
?QueryStr@STRA@@QEAAPEADXZ
PuDbgPrint
?First@MULTISZA@@QEBAPEBDXZ

Exports

Exports

RegisterModule

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/cachtokn.dll
.dll windows:10 windows x64

10359470af077d96603b241b38277d6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
free
malloc
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-synch-l1-1-0

CreateEventW
ResetEvent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

iisutil

??1CLKRHashTable@@QEAA@XZ
PuDbgPrint
??1STRU@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
?Clear@CLKRHashTable@@QEAAXXZ
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z

Exports

Exports

RegisterModule

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/cachuri.dll
.dll windows:10 windows x64

2654404d5a2903e9bdedf3f13b6c4bac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__C_specific_handler
free
malloc
_callnewh
wcschr
_initterm
_amsg_exit
_XcptFilter

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

iisutil

?DeleteIf@TREE_HASH_TABLE@@QEAAXP6AHPEAX0@Z0@Z
??0TREE_HASH_TABLE@@QEAA@H@Z
?Clear@TREE_HASH_TABLE@@QEAAXXZ
?DeletePath@TREE_HASH_TABLE@@QEAAXPEBG@Z
?FindRecord@TREE_HASH_TABLE@@QEAAXPEBGPEAPEAX@Z
??1TREE_HASH_TABLE@@QEAA@XZ
?InsertRecord@TREE_HASH_TABLE@@QEAAJPEAX@Z
?Initialize@TREE_HASH_TABLE@@QEAAJK@Z

Exports

Exports

RegisterModule

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/cgi.dll
.dll windows:10 windows x64

73edb913f3f668b24b6777510b413e0b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsrchr
_wcsnicmp
_wcsicmp
wcschr
strncmp
strchr
atoi
_stricmp
atol
_vsnwprintf
wcscspn
memcpy
memset
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
strcmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
FreeEnvironmentStringsW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
GetCurrentProcess
CreateProcessAsUserW
GetCurrentThreadId
TerminateProcess
GetExitCodeProcess
GetCurrentProcessId
SetThreadToken

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
DisconnectNamedPipe

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile
CreateFileW

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

w3tp

ThreadPoolMapErrorCodeIfNecessary

iisutil

?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?Append@STRU@@QEAAJPEBGK@Z
MakePathCanonicalizationProof
??1STRA@@QEAA@XZ
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?Append@STRU@@QEAAJAEBV1@@Z
?Unescape@STRU@@QEAAJXZ
?Copy@STRA@@QEAAJPEBD@Z
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
??1CLKRHashTable@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?Copy@STRU@@QEAAJPEBGK@Z
?Resize@BUFFER@@QEAA_NKK@Z
?CopyA@STRU@@QEAAJPEBDK@Z
??0STRA@@QEAA@PEADK@Z
?Copy@STRA@@QEAAJPEBDK@Z
??0STRU@@QEAA@PEAGK@Z
?Append@STRU@@QEAAJPEBG@Z
??0EVENT_LOG@@QEAA@PEBG@Z
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@XZ
PuDbgPrint
?Resize@BUFFER@@QEAA_NK@Z
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
QueryLocalizedResourceString
??0STRU@@QEAA@XZ
??1STRU@@QEAA@XZ
SAFE_snwprintf
?Copy@STRU@@QEAAJPEBG@Z

Exports

Exports

RegisterModule

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/coadmin.dll
.dll regsvr32 windows:10 windows x64

9f6768d64b6cab2d180f3d93b4c92d7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_onexit
_callnewh
malloc
_ultow
free
_wcsupr
_wcsdup
_wcsicmp
wcscpy_s
wcsncmp
_wcsnicmp
wcsstr
memmove
memcpy
wcschr
wcscat_s
_XcptFilter
memset

advapi32

SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
InitializeAcl
CryptAcquireContextA
ConvertSecurityDescriptorToStringSecurityDescriptorW
LookupAccountSidW
GetLengthSid
GetTokenInformation
OpenProcessToken
GetSecurityDescriptorControl
AccessCheck
AddAccessAllowedAce
SetSecurityDescriptorDacl
OpenSCManagerW
OpenServiceW
EnumDependentServicesW
ControlService
CloseServiceHandle
StartServiceW
QueryServiceStatus
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
QueryServiceStatusEx
InitializeSecurityDescriptor
CreateWellKnownSid

ole32

CoRegisterClassObject
CoDisconnectObject
CoRevokeClassObject
CoGetCallContext
CoUninitialize
CoInitializeEx
CoImpersonateClient
CoCreateInstance
CoCreateFreeThreadedMarshaler

oleaut32

GetErrorInfo

kernel32

UnregisterWaitEx
SetLastError
GetCurrentProcessId
CreateFileW
OutputDebugStringA
GetCurrentProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OpenProcess
GetCurrentThread
QueryFullProcessImageNameW
WaitForMultipleObjects
CloseHandle
SignalObjectAndWait
CreateThread
CreateEventA
InitializeCriticalSectionAndSpinCount
SetEvent
LeaveCriticalSection
EnterCriticalSection
LocalAlloc
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetProcessHeap
HeapFree
GetLastError
SleepEx
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
LocalFree
GetVersionExA
GetSystemDirectoryW
GetProcAddress
FreeLibrary
LoadLibraryExW
RegisterWaitForSingleObject
Sleep
HeapAlloc

rpcrt4

I_RpcBindingIsClientLocal
I_RpcBindingInqLocalClientPID

authz

AuthzRegisterSecurityEventSource
AuthzReportSecurityEventFromParams
AuthzInstallSecurityEventSource

ntdll

NtQueryInformationFile
RtlNtStatusToDosError

iisrtl

?TryReadLock@CReaderWriterLock3@@QEAA_NXZ
?TryConvertSharedToExclusive@CReaderWriterLock3@@QEAA_NXZ
?TryWriteLock@CReaderWriterLock3@@QEAA_NXZ
?ConvertExclusiveToShared@CReaderWriterLock3@@QEAAXXZ
IISInitializeCriticalSection
??1STRU@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z
?Append@STRU@@QEAAJPEBG@Z
CreateRefTraceLog
DestroyRefTraceLog
IISGetPlatformType
?SetLen@STRU@@QEAA_NK@Z
?Append@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBGK@Z
WriteRefTraceLog
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
PuDbgPrint
??0BUFFER@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0STRU@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
?Copy@STRU@@QEAAJPEBG@Z
PuLoadDebugFlagsFromRegStr
?Resize@STRU@@QEAAJK@Z
PuCreateDebugPrintsObject
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock3@@QEAAXXZ
?Copy@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJAEBV1@@Z

admwprox

ReleaseObjectSecurityContextW

iiscfg

DllGetSimpleObjectByIDEx

abocomp

TerminateAboCompatibilityLayer
InitializeAboCompatibilityLayer
GetAboWrapper

iisutil

?EtwTraceEvent@CEtwTracer@@QEAAKPEBU_GUID@@KZZ

Exports

Exports

DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
InitComAdmindata
TerminateComAdmindata

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/compdyn.dll
.dll windows:10 windows x64

1a9f8ca1fdcca535d26be3014216c3ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_callnewh
_XcptFilter
_initterm
__C_specific_handler
memset
memcpy
toupper
strchr
isxdigit
strstr
_stricmp
atof
isalnum
_wcsicmp
wcschr
free
_amsg_exit
wcscmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

iisutil

?QueryStr@STRU@@QEAAPEAGXZ
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?Copy@STRA@@QEAAJPEBDK@Z
?QueryCCH@STRU@@QEBAKXZ
?Equals@STRA@@QEBA_NPEBD@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?QueryPtr@BUFFER@@QEBAPEAXXZ
??1STRA@@QEAA@XZ
?CopyW@STRA@@QEAAJPEBG@Z
?SetLen@STRU@@QEAA_NK@Z
?EqualsNoCase@STRA@@QEBA_NAEBV1@@Z
?Resize@BUFFER@@QEAA_NK@Z
?QueryStr@STRA@@QEAAPEADXZ
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
??0STRA@@QEAA@PEADK@Z
?Copy@STRA@@QEAAJPEBD@Z
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?QueryCCH@STRA@@QEBAKXZ
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
??1STRU@@QEAA@XZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
??1CReaderWriterLock3@@QEAA@XZ
PuDbgPrint
??0CReaderWriterLock3@@QEAA@XZ
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@XZ
??0STRA@@QEAA@XZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z

api-ms-win-core-processthreads-l1-1-2

GetSystemTimes

api-ms-win-core-file-l1-1-0

ReadFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
AcquireSRWLockExclusive
WaitForSingleObject
CreateEventW
ReleaseSRWLockExclusive

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

Exports

Exports

RegisterModule

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/compstat.dll
.dll windows:10 windows x64

6d5b6312d902b380825d6fe91caffd42

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memset
memcpy
free
_wcslwr_s
toupper
strchr
qsort
wcsrchr
_itow
_stricmp
atof
isalnum
_wcsicmp
wcschr
wcsstr
wcscmp

ntdll

RtlLengthRequiredSid
RtlInitializeSid
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSubAuthoritySid

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

iisutil

?Resize@BUFFER@@QEAA_NK@Z
?EqualsNoCase@STRA@@QEBA_NAEBV1@@Z
??0STRA@@QEAA@PEADK@Z
MakePathCanonicalizationProof
?Copy@STRU@@QEAAJPEBGK@Z
??1STRA@@QEAA@XZ
?Append@STRU@@QEAAJPEBG@Z
?QuerySize@BUFFER@@QEBAKXZ
?SetLen@STRU@@QEAA_NK@Z
?QueryStr@STRU@@QEAAPEAGXZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?QueryCCH@STRA@@QEBAKXZ
?Resize@BUFFER@@QEAA_NKK@Z
?QueryStr@STRA@@QEBAPEBDXZ
?CopyW@STRA@@QEAAJPEBG@Z
PuDbgPrint
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
?Append@STRU@@QEAAJPEBGK@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?QueryCCH@STRU@@QEBAKXZ
?Append@STRU@@QEAAJAEBV1@@Z
?QueryPtr@BUFFER@@QEBAPEAXXZ
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
??1STRU@@QEAA@XZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0STRU@@QEAA@PEAGK@Z
??1CReaderWriterLock3@@QEAA@XZ
??0EVENT_LOG@@QEAA@PEBG@Z
??0CReaderWriterLock3@@QEAA@XZ
?Equals@STRA@@QEBA_NPEBD@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@XZ
??0STRA@@QEAA@XZ
?CopyWTruncate@STRA@@QEAAJPEBGK@Z

api-ms-win-core-processthreads-l1-1-2

GetSystemTimes

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
WriteFile
CreateDirectoryW
SetFileTime
RemoveDirectoryW
FindClose
ReadFile
FindFirstFileW
CreateFileW
CompareFileTime
GetVolumeInformationW
FindNextFileW
DeleteFileW

api-ms-win-security-base-l1-1-0

EqualSid
InitializeSecurityDescriptor
CreateWellKnownSid
GetFileSecurityW
GetTokenInformation
SetSecurityDescriptorDacl
GetSecurityDescriptorOwner

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateEventW

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-file-l2-1-0

MoveFileExW

bcrypt

BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptCreateHash

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW
SetEntriesInAclW

Exports

Exports

RegisterModule

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/custerr.dll
.dll windows:10 windows x64

49d044742e308babb0063c0b6372bb72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
free
memset
__C_specific_handler
_wcsicmp
iswalpha
_itow
wcschr
wcsrchr
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

iisutil

?Resize@STRU@@QEAAJK@Z
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?QueryStr@STRA@@QEBAPEBDXZ
?Copy@STRU@@QEAAJAEBV1@@Z
?Terminate@LANG_STRING@@QEAAJXZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
??0LANG_STRING@@QEAA@XZ
?GetFallbackLanguage@LANG_STRING@@QEAAJPEAPEBD@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?AppendA@STRU@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBD@Z
?GetString@LANG_STRING@@QEAAJPEBDKIPEAPEBGPEAK@Z
?Append@STRU@@QEAAJG@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?GetString@LANG_STRING@@QEAAJIPEBDPEAPEBGPEAK@Z
?QueryCCH@STRA@@QEBAKXZ
??1STRU@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
??1STRA@@QEAA@XZ
?GetLanguage@LANG_STRING@@QEAAJPEBDKPEAPEBDHH@Z
IsLocalRequest
?QueryStr@STRU@@QEAAPEAGXZ
?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z
?QueryStr@STRA@@QEAAPEADXZ
?Copy@STRU@@QEAAJPEBG@Z
?HTMLEncode@STRU@@QEAAJXZ
?IsEmpty@STRU@@QEBA_NXZ
?Reset@STRU@@QEAAXXZ
SAFE_snwprintf
??0STRU@@QEAA@XZ
?QueryCCH@STRU@@QEBAKXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?QuerySize@BUFFER@@QEBAKXZ
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJPEBG@Z
??0STRA@@QEAA@XZ
?Copy@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBGK@Z
?SetLen@STRU@@QEAA_NK@Z
??0STRU@@QEAA@PEAGK@Z

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared

Exports

Exports

RegisterModule

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/de-DE/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

5b:83:f2:76:43:b4:84:3d:f5:1a:49:81:3d:10:c1:13:17:a7:14:07
Signer

Actual PE Digest

5b:83:f2:76:43:b4:84:3d:f5:1a:49:81:3d:10:c1:13:17:a7:14:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/defdoc.dll
.dll windows:10 windows x64

59bd6e707c5195e95c5a3fc5b96945c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
wcschr
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

iisutil

??1STRA@@QEAA@XZ
??1STRU@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
?Append@STRU@@QEAAJPEBGK@Z
?Append@STRA@@QEAAJPEBD@Z
?CopyWToUTF8Escaped@STRA@@QEAAJAEBVSTRU@@@Z
?Append@STRU@@QEAAJPEBG@Z
??0MULTISZ@@QEAA@XZ
?Append@MULTISZ@@QEAAHPEBG@Z
FlipSlashes
??0STRU@@QEAA@PEAGK@Z
?Copy@STRU@@QEAAJPEBG@Z
??0STRA@@QEAA@PEADK@Z

Exports

Exports

RegisterModule

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/diprestr.dll
.dll windows:10 windows x64

14206c5b20d9e3f4dc8ab9195d679ff2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memset
_initterm
_amsg_exit
_XcptFilter
_callnewh
strrchr
memcpy
memcmp
malloc
free
strchr
isspace
__C_specific_handler
strpbrk
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

ws2_32

WSAStringToAddressA
WSAGetLastError

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

oleaut32

VariantClear
VariantChangeType
VariantInit
SysFreeString
SysAllocString
SysStringLen

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
CreateEventW
SetEvent

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

iisutil

PuDbgPrint
PuLoadDebugFlagsFromRegStr
PuCreateDebugPrintsObject

Exports

Exports

RegisterModule

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/dirlist.dll
.dll windows:10 windows x64

6866f575fd21676b96479b465f6b1a21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_i64toa_s
_wcsicmp
qsort
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
memmove
__C_specific_handler
memset

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-file-l1-1-0

FindClose
FileTimeToLocalFileTime
FindNextFileW
FindFirstFileW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SetThreadToken

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

iisutil

?Append@STRA@@QEAAJPEBDK@Z
?AppendW@STRA@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBG@Z
??0LANG_STRING@@QEAA@XZ
?Append@STRU@@QEAAJPEBGK@Z
?GetString@LANG_STRING@@QEAAJIPEBDPEAPEBGPEAK@Z
?CopyA@STRU@@QEAAJPEBD@Z
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
?Resize@BUFFER@@QEAA_NK@Z
?Terminate@LANG_STRING@@QEAAJXZ
??0STRA@@QEAA@XZ
??1STRU@@QEAA@XZ
?Append@STRU@@QEAAJPEBG@Z
?Resize@BUFFER@@QEAA_NKK@Z
??1STRA@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
??1BUFFER@@QEAA@XZ
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?HTMLEncode@STRA@@QEAAJXZ
??0STRU@@QEAA@PEAGK@Z
??0BUFFER@@QEAA@XZ
??0STRU@@QEAA@XZ
?GetLanguage@LANG_STRING@@QEAAJPEBDKPEAPEBDHH@Z

Exports

Exports

RegisterModule

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/en-US/appcmd.exe.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/en-US/appobj.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/en-US/iisres.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 488KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/en-US/iissetup.exe.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/en-US/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

5f:22:2e:f4:f4:65:0b:cb:3b:89:f2:b6:cb:0f:38:8a:e5:33:9c:c5
Signer

Actual PE Digest

5f:22:2e:f4:f4:65:0b:cb:3b:89:f2:b6:cb:0f:38:8a:e5:33:9c:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/es-ES/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

05:2d:75:83:ef:ff:24:bf:06:26:b3:32:34:ae:75:cc:30:aa:e2:52
Signer

Actual PE Digest

05:2d:75:83:ef:ff:24:bf:06:26:b3:32:34:ae:75:cc:30:aa:e2:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/filter.dll
.dll windows:10 windows x64

4fcb35214498e8ea0c09a683a3ace4ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_vsnwprintf
_wcsicmp
_strnicmp
strchr
wcsncmp
_itoa_s
atoi
isdigit
isspace
_ui64toa_s
strncmp
strstr
_stricmp
_ultoa_s
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memset
memcpy
memmove
strcmp

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-file-l1-1-0

ReadFile

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

iisutil

?Copy@STRA@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?CopyW@STRA@@QEAAJPEBGK@Z
?QueryCCH@STRA@@QEBAKXZ
uuencode
?QueryCB@STRU@@QEBAKXZ
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
?SetLen@STRA@@QEAA_NK@Z
?QuerySizeCCH@STRA@@QEBAKXZ
?SyncWithBuffer@STRA@@QEAAXXZ
NormalizeUrl
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?QuerySize@STRA@@QEBAKXZ
?QueryStr@STRA@@QEAAPEADXZ
?CopyA@STRU@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
uudecode
?IsEmpty@STRA@@QEBA_NXZ
?Equals@STRA@@QEBA_NPEBD@Z
?IsEmpty@STRU@@QEBA_NXZ
DestroyRefTraceLog
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?CopyW@STRA@@QEAAJPEBG@Z
??0STRU@@QEAA@PEAGK@Z
??0EVENT_LOG@@QEAA@PEBG@Z
??0LANG_STRING@@QEAA@XZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
?Terminate@LANG_STRING@@QEAAJXZ
??0BUFFER@@QEAA@PEAEK@Z
??1BUFFER@@QEAA@XZ
??1STRU@@QEAA@XZ
?GetString@LANG_STRING@@QEAAJPEBDKIPEAPEBGPEAK@Z
?Resize@STRU@@QEAAJK@Z
?QueryCCH@STRU@@QEBAKXZ
?QueryStr@STRU@@QEAAPEAGXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QuerySizeCCH@STRU@@QEBAKXZ
?QuerySize@BUFFER@@QEBAKXZ
?SyncWithBuffer@STRU@@QEAAXXZ
??0BUFFER@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ
??1STRA@@QEAA@XZ
??0STRA@@QEAA@XZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
WriteRefTraceLog
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
PuDbgPrint
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
?Resize@BUFFER@@QEAA_NK@Z
?Reset@STRU@@QEAAXXZ
??0STRA@@QEAA@PEADK@Z
?Copy@STRA@@QEAAJPEBD@Z

Exports

Exports

RegisterModule

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/fr-FR/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

55:12:18:c8:bb:1f:e1:c5:50:24:d3:73:e5:44:c6:f5:d4:1a:b8:65
Signer

Actual PE Digest

55:12:18:c8:bb:1f:e1:c5:50:24:d3:73:e5:44:c6:f5:d4:1a:b8:65

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/gzip.dll
.dll windows:10 windows x64

56cc296a7bb7d69a48a7b17d079b27db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__C_specific_handler
_initterm
memcpy
_XcptFilter
malloc
free
_amsg_exit
memset

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

Exports

Exports

Compress
CreateCompression
DeInitCompression
DestroyCompression
InitCompression
ResetCompression

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/httpcgi.dll
.dll windows:6 windows x64

c5d3e85c84b399e03e5379f103e76d45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
lstrcmpiW
MultiByteToWideChar
DebugBreak
OutputDebugStringA
WriteConsoleW
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapReAlloc
HeapAlloc
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetFilePointerEx
SetStdHandle
HeapSize
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
CloseHandle

wininet

InternetCloseHandle

Exports

Exports

RegisterModule

Sections

.text
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/httpmib.dll
.dll windows:10 windows x64

92a5fe3bbc5f56a9519af91969b6e85d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsncmp
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_callnewh
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

snmpapi

SnmpUtilOidCpy
SnmpUtilOidFree
SnmpUtilOidAppend
SnmpUtilOidCmp

iisutil

?Copy@STRU@@QEAAJPEBG@Z
??1STRU@@QEAA@XZ
PuDbgPrintError
??0STRU@@QEAA@XZ
PuDeleteDebugPrintsObject
PuDbgPrint
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-synch-l1-1-0

SetEvent
OpenEventW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
OpenFileMappingW
UnmapViewOfFile

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-handle-l1-1-0

CloseHandle

Exports

Exports

DllMain
SnmpExtensionInit
SnmpExtensionQuery
SnmpExtensionTrap

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/hwebcore.dll
.dll windows:10 windows x64

61034941c2bf3213f54f19dd2a6e1014

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_snprintf_s
strnlen
memset
_vsnprintf_s
strrchr
sprintf_s
__C_specific_handler
_initterm
_amsg_exit
strcpy_s
_XcptFilter
_callnewh
malloc
free
_wcsicmp
wcscpy_s
memcpy
wcscmp

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection

api-ms-win-core-file-l1-1-0

FlushFileBuffers
WriteFile
GetFileAttributesExW

api-ms-win-core-wow64-l1-1-0

IsWow64Process
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetStdHandle

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-kernel32-legacy-l1-1-1

SetDllDirectoryW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalFree
GlobalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-0

FormatMessageA

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc

Exports

Exports

WebCoreActivate
WebCoreSetMetadata
WebCoreShutdown

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iis.msc
.xml
inetsrv/iis6.msc
.xml
inetsrv/iis_ssi.dll
.dll windows:10 windows x64

a834447eeabfdea134733924259bbfcf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

strncmp
memchr
tolower
_strnicmp
isspace
strftime
_itoa_s
_ultoa_s
_wcsicmp
_vsnprintf
free
malloc
_callnewh
_XcptFilter
_amsg_exit
memcpy
__C_specific_handler
_initterm
memcmp
memset

api-ms-win-core-localization-l1-2-0

FormatMessageA

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
ReadFile

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetSystemTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-localization-ansi-l1-1-0

GetNumberFormatA

iisutil

?SetLen@STRU@@QEAA_NK@Z
NormalizeUrlW
?Append@STRA@@QEAAJPEBD@Z
?Resize@STRU@@QEAAJK@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?Append@STRA@@QEAAJPEBDK@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJKPEAPEAD@Z
?Append@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBG@Z
?Resize@STRA@@QEAAJK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJAEBV1@@Z
?CopyA@STRU@@QEAAJPEBD@Z
?Unescape@STRA@@QEAAJXZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?CopyW@STRA@@QEAAJPEBG@Z
PuCreateDebugPrintsObject
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
PuDeleteDebugPrintsObject
?Equals@STRU@@QEBA_NAEBV1@@Z
??0STRU@@QEAA@XZ
??1STRU@@QEAA@XZ
??1STRA@@QEAA@XZ
?Escape@STRA@@QEAAJ_N0@Z
?Copy@STRA@@QEAAJPEBD@Z
??0STRA@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
??0STRA@@QEAA@PEADK@Z
??1CHUNK_BUFFER@@QEAA@XZ
?Initialize@CHUNK_BUFFER@@AEAAXXZ
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ

Exports

Exports

RegisterModule

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisadmin.dll
.dll windows:10 windows x64

0fc5ac05ce40d8034543a6075c761c72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_purecall
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
memset

advapi32

SetServiceStatus
AddAccessAllowedAce
InitializeAcl
CreateWellKnownSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetEntriesInAclA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegisterServiceCtrlHandlerA

kernel32

CloseHandle
GetLastError
SetEvent
SetLastError
CreateThread
WaitForSingleObject
CreateTimerQueueTimer
DeleteTimerQueueTimer
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
LocalFree
LocalAlloc
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventA
RtlCaptureContext

user32

SetThreadDesktop
CloseDesktop
CloseWindowStation
CreateDesktopA
GetProcessWindowStation
CreateWindowStationA
SetProcessWindowStation
GetThreadDesktop

ole32

CoInitializeSecurity
CoGetMalloc
CoSuspendClassObjects
CoInitializeEx
CoCreateInstance
CoUninitialize
StringFromCLSID

rpcrt4

RpcMgmtStopServerListening
RpcMgmtWaitServerListen

vssapi

CreateWriter

coadmin

TerminateComAdmindata
InitComAdmindata

iisrtl

IISGetPlatformType
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuDeleteDebugPrintsObject
PuDbgPrint
InitializeIISRTL
TerminateIISRTL
?Resize@BUFFER@@QEAA_NK@Z
??0BUFFER@@QEAA@XZ
??1BUFFER@@QEAA@XZ

iisutil

?UnRegister@CEtwTracer@@QEAAKXZ
??1CEtwTracer@@QEAA@XZ
?EtwTraceEvent@CEtwTracer@@QEAAKPEBU_GUID@@KZZ
?Register@CEtwTracer@@QEAAKPEBU_GUID@@PEAG1@Z
??0CEtwTracer@@QEAA@XZ

Exports

Exports

RetrieveTracingHandle
ServiceEntry

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iiscertprovider.dll
.dll regsvr32 windows:10 windows x64

b0b392d1f77635e66a14d2442cf45d41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memset
_amsg_exit
_initterm
_callnewh
malloc
free
_XcptFilter
__C_specific_handler
_wtol
wcsncpy_s
wcsstr
wcsncmp
_wcsicmp
_wcslwr
wcschr
wcscpy_s
memcpy
wcscmp

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

crypt32

CryptUnregisterDefaultOIDFunction
CryptRegisterDefaultOIDFunction

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptGetUserKey
CryptAcquireContextW
CryptDestroyKey
CryptDecrypt

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateEventW
InitializeSRWLock

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
UnregisterWait

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
GetProcessHeap
HeapCreate
HeapDestroy
HeapAlloc

api-ms-win-core-file-l1-1-0

ReadFile
FindNextFileW
CompareFileTime
CreateFileW
GetFileSizeEx
GetFileAttributesW
FindClose
FindFirstFileW

api-ms-win-core-io-l1-1-0

GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-file-l2-1-0

ReadDirectoryChangesW

api-ms-win-core-processthreads-l1-1-0

TerminateThread
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-security-logon-l1-1-1

LogonUserW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

Exports

Exports

DllMain
DllRegisterServer
DllUnregisterServer
SslObjectLocatorInitializePfx

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iiscfg.dll
.dll windows:10 windows x64

3e0da98f53b768da27b48b3aa8ced757

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_ultow
_purecall
swprintf_s
wcsncmp
wcstok
wcsncpy_s
_memicmp
wcstoul
__CxxFrameHandler3
wcscpy_s
_wcsicmp
memcmp
memcpy
memmove
_snwprintf_s
memset
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_CxxThrowException
wcscat_s
realloc
wcsrchr
wcstol
_wtol
wcsstr
memcpy_s
wcsspn
malloc
free
_amsg_exit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_XcptFilter
wcscmp

kernel32

RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
RtlLookupFunctionEntry
OutputDebugStringA
WideCharToMultiByte
LocalAlloc
LocalFree
MoveFileExW
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW
GetLocalTime
WriteFile
SetFilePointer
FreeLibrary
SetEndOfFile
FlushFileBuffers
CreateFileW
CompareStringW
GetFileAttributesExW
GetFileAttributesW
CloseHandle
UnmapViewOfFile
FlushViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
GetTimeFormatW
InitializeCriticalSectionAndSpinCount
GetLastError
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
FormatMessageW
GetComputerNameW
GetDateFormatW
GetModuleFileNameW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

iisrtl

PuDbgPrintW
PuDeleteDebugPrintsObject
PuDbgPrint
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr

atl

ord30
ord31

advapi32

InitializeSecurityDescriptor
GetUserNameW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
FreeSid

oleaut32

SysAllocString
VariantClear
SetErrorInfo
SysStringLen
SysAllocStringLen
SysFreeString

Exports

Exports

DllGetSimpleObject
DllGetSimpleObjectByID
DllGetSimpleObjectByIDEx

Sections

.text
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

TSHEAP
Size: 721KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iiscore.dll
.dll windows:10 windows x64

1c375d20382c6727d5ace3d96d9c8b89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
memmove
memset
strcmp
memcmp
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
wcstoul
strnlen
_itoa_s
_aligned_malloc
_aligned_free
_vsnwprintf
_strupr
atoi
_ui64toa_s
isspace
strcspn
_ultow
wcscat_s
_wcsnicmp
_vsnprintf
_strnicmp
_stricmp
strchr
strncmp
_ultoa_s
_wcsicmp
wcsrchr
__C_specific_handler
_ultow_s
_wtoi
wcspbrk
wcsncpy_s
wcschr
_wcsupr
wcsncmp
_purecall
wcscmp

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateThread
SetThreadToken
OpenProcessToken
OpenThreadToken
GetCurrentThread
TlsGetValue
TlsSetValue
TerminateProcess
TlsFree
GetCurrentThreadId
TlsAlloc
GetCurrentProcess

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetComputerNameExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetComputerNameExA
GetSystemInfo
GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockShared
LeaveCriticalSection
CreateEventW
EnterCriticalSection
DeleteCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject

api-ms-win-core-file-l1-1-0

CompareFileTime
CreateFileW
FindClose
GetFileSizeEx
FindFirstFileW
GetFinalPathNameByHandleW
GetFileType

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
GetTokenInformation
GetKernelObjectSecurity
CopySid
RevertToSelf

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

IdnToAscii

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetCommandLineW
ExpandEnvironmentStringsW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

sspicli

GetUserNameExW
LsaFreeReturnBuffer
SeciAllocateAndSetIPAddress
SeciFreeCallContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

ntdll

RtlIpv6AddressToStringExA
RtlIpv6AddressToStringExW
NtQueryInformationFile
RtlNtStatusToDosError
RtlIpv4AddressToStringExW

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask

cryptsp

CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash

iisutil

IISInitializeCriticalSection
?ReadLock@CLKRHashTable@@QEBAXXZ
?ReadUnlock@CLKRHashTable@@QEBAXXZ
?FindString@MULTISZ@@QEAAHAEAVSTRU@@@Z
?WriteLock@CSmallSpinLock@@QEAAXXZ
?Size@CLKRHashTable@@QEBAKXZ
??0CEtwTracer@@QEAA@XZ
??0CSmallSpinLock@@QEAA@XZ
PuCreateDebugPrintsObject
??0MULTISZA@@QEAA@XZ
?FindString@MULTISZ@@QEAAHPEBG@Z
??1MULTISZA@@QEAA@XZ
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
?Register@CEtwTracer@@QEAAKPEBU_GUID@@PEAG1@Z
DisableTokenBackupPrivilege
?SyncWithBuffer@STRA@@QEAAXXZ
??1CSmallSpinLock@@QEAA@XZ
?QueryStr@MULTISZA@@QEBAPEADXZ
IISGetPlatformType
?AppendW@MULTISZA@@QEAAHPEBGK@Z
PuLoadDebugFlagsFromRegStr
??0EVENT_LOG@@QEAA@PEBG@Z
??0CReaderWriterLock3@@QEAA@XZ
??1CReaderWriterLock3@@QEAA@XZ
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@XZ
??1STRU@@QEAA@XZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QueryStr@STRU@@QEBAPEBGXZ
??0MULTISZ@@QEAA@XZ
?QueryStr@MULTISZ@@QEBAPEAGXZ
??1MULTISZ@@QEAA@XZ
??1CLKRHashTable@@QEAA@XZ
?QueryCCH@STRU@@QEBAKXZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?IsEmpty@STRU@@QEBA_NXZ
??1TREE_HASH_TABLE@@QEAA@XZ
??0TREE_HASH_TABLE@@QEAA@H@Z
PuDbgPrint
?EtwTraceEvent@CEtwTracer@@QEAAKPEAU_EVENT_TRACE_HEADER@@@Z
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?IsValid@ALLOC_CACHE_HANDLER@@QEBAHXZ
?QuerySize@BUFFER@@QEBAKXZ
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?QueryStr@STRU@@QEAAPEAGXZ
?Resize@STRU@@QEAAJK@Z
?Resize@BUFFER@@QEAA_NK@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?QuerySizeCCH@STRU@@QEBAKXZ
InitializeIISUtil
InitializeLocalRequest
??0LANG_STRING@@QEAA@XZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
AdjustTokenIntegrityLevel
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?Initialize@TREE_HASH_TABLE@@QEAAJK@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
DestroyRefTraceLog
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?Terminate@LANG_STRING@@QEAAJXZ
TerminateLocalRequest
TerminateIISUtil
?Append@MULTISZ@@QEAAHPEBG@Z
?Copy@STRU@@QEAAJPEBG@Z
PuDbgPrintError
?Clear@CLKRHashTable@@QEAAXXZ
?Clear@TREE_HASH_TABLE@@QEAAXXZ
??0STRU@@QEAA@PEAGK@Z
??0BUFFER@@QEAA@PEAEK@Z
LookupTokenAccountName
?QueryCCH@MULTISZ@@QEBAIXZ
?DeletePath@TREE_HASH_TABLE@@QEAAXPEBG@Z
?WriteUnlock@CLKRHashTable@@QEBAXXZ
?WriteLock@CLKRHashTable@@QEAAXXZ
?Append@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?SetLen@STRU@@QEAA_NK@Z
?FindRecord@TREE_HASH_TABLE@@QEAAXPEBGPEAPEAX@Z
?InsertRecord@TREE_HASH_TABLE@@QEAAJPEAX@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
MakePathCanonicalizationProof
WriteRefTraceLog
??1STRA@@QEAA@XZ
?QueryStr@STRA@@QEBAPEBDXZ
?Copy@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
?IsEmpty@STRA@@QEBA_NXZ
?GetString@LANG_STRING@@QEAAJPEBDKIPEAPEBGPEAK@Z
IsLocalRequest
??0STRA@@QEAA@PEADK@Z
?QueryStr@STRA@@QEAAPEADXZ
?Copy@STRA@@QEAAJPEBDK@Z
?Append@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
??0STRA@@QEAA@XZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?QueryCCH@STRA@@QEBAKXZ
?Resize@BUFFER@@QEAA_NKK@Z
?Unescape@STRA@@QEAAJXZ
?CopyA@STRU@@QEAAJPEBDK@Z
?AppendWTruncate@STRA@@QEAAJPEBG@Z
?HTMLEncode@STRA@@QEAAJXZ
?CopyToBuffer@STRU@@QEBAJPEAGPEAK@Z
?FreeMemory@BUFFER@@QEAAXXZ
??0MULTISZ@@QEAA@PEBG@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?Reset@STRU@@QEAAXXZ
?HTMLEncode@STRU@@QEAAJXZ
?Append@STRA@@QEAAJAEBV1@@Z
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
?QueryCB@STRA@@QEBAKXZ
?CopyWToUTF8Escaped@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
UlCleanAndCopyUrl
?QueryCB@STRU@@QEBAKXZ
?AppendW@STRA@@QEAAJPEBG@Z
?AppendW@STRA@@QEAAJPEBGK@Z
?AppendWTruncate@STRA@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?CopyW@STRA@@QEAAJPEBGK@Z
SystemTimeToGMT
SAFE_snwprintf
?CopyW@STRA@@QEAAJPEBG@Z

w3tp

ThreadPoolBindIoCompletionCallback
ThreadPoolPostCompletion
ThreadPoolMapErrorCodeIfNecessary
ThreadPoolSetupCounters
ThreadPoolInitialize
ThreadPoolSetInfo
ThreadPoolTerminate

w3dt

UlAtqCancelRequest
UlAtqGetContextProperty
UlAtqAllocateMainContext
UlAtqSetContextProperty
UlAtqFreeContext
UlAtqCancelIo
UlAtqSendHttpResponse
UlAtqRemoveFragmentFromCache
UlAtqReadFragmentFromCache
UlAtqAddFragmentToCache
UlAtqStopListen
UlAtqStartListen
UlAtqTerminate
UlAtqInitialize
UlAtqSendEntityBody
UlAtqPushPromise
UlAtqReceiveEntityBody
UlAtqReceiveClientCertificate
UlAtqWaitForDisconnect
UlAtqReceiveChannelBindingToken
UlAtqFlushUlCache

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-file-l2-1-0

ReadDirectoryChangesW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

GetProtocolManager

Sections

.text
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisetw.dll
.dll windows:10 windows x64

cfe9c3490a74c9bcff12543b4cc2d52d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

towupper
free
malloc
_callnewh
_wcsicmp
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
wcschr
memset

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventActivityIdControl
EventWrite

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

iisutil

?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?Append@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBG@Z
?Resize@STRU@@QEAAJK@Z
?Copy@STRU@@QEAAJPEBGK@Z
??0STRU@@QEAA@PEAGK@Z
?EtwTraceEvent@CEtwTracer@@QEAAKPEAU_ETW_TRACE_EVENT@@@Z
PuDbgPrint
?Clear@CLKRHashTable@@QEAAXXZ
?UnRegister@CEtwTracer@@QEAAKXZ
??1CEtwTracer@@QEAA@XZ
??0BUFFER@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0EVENT_LOG@@QEAA@PEBG@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?Register@CEtwTracer@@QEAAKPEBU_GUID@@PEAG1@Z
??1CLKRHashTable@@QEAA@XZ
??1STRU@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CEtwTracer@@QEAA@XZ

Exports

Exports

RegisterModule

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisext.dll
.dll regsvr32 windows:10 windows x64

b021d94d641e0132b5e9d7afaf9a3be9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcmp
memcpy
memset
__C_specific_handler
_initterm
_wcsnicmp
__CxxFrameHandler3
_purecall
wcschr
_ultow
?terminate@@YAXXZ
_amsg_exit
_XcptFilter
_callnewh
malloc
free
swprintf_s
wcscpy_s
wcscat_s
_wcsicmp
wcstok
wcscmp

ole32

CoCreateInstanceEx
CoTaskMemFree
CoSetProxyBlanket
CoQueryProxyBlanket
CoGetClassObject
CoCreateInstance

advapi32

RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
IsValidSecurityDescriptor
RegCloseKey

kernel32

OutputDebugStringA
GetModuleFileNameW
GetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
LocalFree
LocalAlloc
FileTimeToDosDateTime
Sleep
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleW

oleaut32

VariantClear
SetErrorInfo
DispInvoke
LoadRegTypeLi
SysFreeString
SysStringLen
DosDateTimeToVariantTime
VariantChangeType
VariantCopyInd
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SysAllocStringLen
SysAllocString
SafeArrayAccessData
SafeArrayUnaccessData
VariantCopy
SafeArrayPutElement
VariantInit
SafeArrayCreate
UnRegisterTypeLi
LoadTypeLibEx
SafeArrayDestroy
DispGetIDsOfNames

activeds

ord14
ord16
ord18
ord15
ord17

crypt32

CryptProtectMemory
CryptUnprotectMemory
CertCreateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

iisrtl

??1STRU@@QEAA@XZ
PuDbgPrint
PuDeleteDebugPrintsObject
PuCreateDebugPrintsObject
IISInitializeCriticalSection

atl

ord30

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisfcgi.dll
.dll windows:10 windows x64

6d6cefff6d6492fd43c364ff2f6a7205

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__C_specific_handler
_strnicmp
memcpy
atoi
_initterm
_amsg_exit
_XcptFilter
wcschr
_callnewh
malloc
wcsrchr
_wcsnicmp
free
wcsstr
_wcsicmp
strchr
_purecall
memcpy_s
memmove
memset

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
ResetEvent
DeleteCriticalSection
SetEvent

api-ms-win-core-handle-l1-1-0

CloseHandle
SetHandleInformation

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetOverlappedResult

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
GetCurrentThread
GetCurrentProcessId
OpenThreadToken
CreateThread
GetCurrentProcess
GetCurrentThreadId
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessW
ResumeThread
DeleteProcThreadAttributeList
TerminateProcess
GetExitCodeProcess

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-namedpipe-l1-1-0

DisconnectNamedPipe
CreateNamedPipeW

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
ReadFile
WriteFile
FlushFileBuffers
CreateFileW
CompareFileTime

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GlobalMemoryStatusEx
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-wow64-l1-1-0

IsWow64Process
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-0

ReadDirectoryChangesW

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-heap-l1-1-0

HeapCreate
HeapFree
GetProcessHeap
HeapAlloc
HeapDestroy

api-ms-win-core-psapi-l1-1-0

K32EmptyWorkingSet

api-ms-win-core-processthreads-l1-1-2

GetSystemTimes

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

ntdll

NtQuerySystemInformation

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueue
UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueEx
DeleteTimerQueueTimer

api-ms-win-core-job-l2-1-0

SetInformationJobObject
AssignProcessToJobObject
CreateJobObjectW
QueryInformationJobObject

iisutil

?CopyW@STRA@@QEAAJPEBG@Z
?Append@MULTISZA@@QEAAHAEAVSTRA@@@Z
??0MULTISZA@@QEAA@XZ
?GetString@LANG_STRING@@QEAAJPEBDKIPEAPEBGPEAK@Z
?CopyA@STRU@@QEAAJPEBDK@Z
??1MULTISZA@@QEAA@XZ
??0LANG_STRING@@QEAA@XZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
?Terminate@LANG_STRING@@QEAAJXZ
?CopyA@STRU@@QEAAJPEBD@Z
??0BUFFER@@QEAA@XZ
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
ReadMultiStringParameterValueFromAnyService
?Resize@STRU@@QEAAJK@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Reset@MULTISZ@@QEAAXXZ
IsPathUnc
??0STRU@@QEAA@PEAGK@Z
??1STRU@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
?SetLen@STRU@@QEAA_NK@Z
?Append@STRU@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
?Append@STRA@@QEAAJAEBV1@@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?Resize@BUFFER@@QEAA_NK@Z
??0MULTISZ@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
SAFE_snwprintf
?Append@STRU@@QEAAJG@Z
?First@MULTISZ@@QEBAPEBGXZ
?Copy@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJAEBV1@@Z
??0STRA@@QEAA@PEADK@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@MULTISZ@@QEAAHPEBG@Z
??1STRA@@QEAA@XZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Equals@MULTISZ@@QEAAHPEAV1@@Z
?Equals@STRU@@QEBA_NPEBG@Z
??0STRA@@QEAA@XZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisfreb.dll
.dll windows:10 windows x64

c3ca996c888393d4b2138dce273f207b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_amsg_exit
_initterm
iswspace
memcpy
__C_specific_handler
memset
_callnewh
_wcsnicmp
malloc
free
_purecall
_wcsicmp
towupper
wcscpy_s
_snprintf_s
_wcsupr
wcstoul
_ultow
_vsnwprintf
_XcptFilter
wcscmp

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc

api-ms-win-core-synch-l1-1-0

SetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadResource
LockResource
LoadLibraryExW
SizeofResource

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetExitCodeProcess
GetCurrentThread
GetThreadId
CreateProcessW
GetCurrentProcessId
CreateThread
GetCurrentProcess
GetCurrentThreadId
OpenThreadToken
GetProcessId
SetThreadToken
TerminateProcess

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-1-0

FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
WriteFile
CreateFileW
CreateDirectoryW

api-ms-win-core-com-l1-1-0

CLSIDFromString

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-localization-l1-2-2

GetSystemDefaultLocaleName

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlExpandEnvironmentStrings

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

iisutil

?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?Resize@BUFFER@@QEAA_NK@Z
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
ConvertToXmlEscapedStringQuicklyA
ConvertToXmlEscapedStringQuickly
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
??0STRA@@QEAA@PEADK@Z
MakePathCanonicalizationProof
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
??1STRA@@QEAA@XZ
?Resize@STRU@@QEAAJK@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
??1STRU@@QEAA@XZ
IISInitializeCriticalSection
??1BUFFER@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
??0STRU@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?SetLen@STRU@@QEAA_NK@Z
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?SyncWithBuffer@STRU@@QEAAXXZ
PuDbgPrint
??1CLKRHashTable@@QEAA@XZ
PuDeleteDebugPrintsObject
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
??0EVENT_LOG@@QEAA@PEBG@Z
IsStringEqualOrdinalIgnoreCase
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?GetString@LANG_STRING@@QEAAJPEBDKIPEAPEBGPEAK@Z
??1CReaderWriterLock3@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@XZ
??0LANG_STRING@@QEAA@XZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
?Terminate@LANG_STRING@@QEAAJXZ
PuDbgPrintError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iislog.dll
.dll regsvr32 windows:10 windows x64

b96dc9034d53378fa7cf3f14f3b57fdb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_strnicmp
strcpy_s
strcat_s
sprintf_s
strchr
isdigit
atoi
_ultoa
_purecall
_stricmp
_itoa_s
_ultoa_s
_ltoa_s
fgets
strstr
strtok
fprintf
strncmp
fclose
wcscpy_s
wcsncat_s
isspace
_callnewh
_XcptFilter
_amsg_exit
_initterm
memcpy
wcscat_s
fopen
free
atol
strncpy_s
__C_specific_handler
memset

atl

ord32
ord16
ord21
ord15

iisrtl

??0TS_RESOURCE@@QEAA@AEBV0@@Z
?Unlock@TS_RESOURCE@@QEAAXXZ
?Lock@TS_RESOURCE@@QEAAXW4TSRES_LOCK_TYPE@@@Z
??1TS_RESOURCE@@QEAA@XZ
??0STR@@QEAA@AEBV0@@Z
??1STR@@QEAA@XZ
??4TS_RESOURCE@@QEAAAEAV0@AEBV0@@Z
IISInitializeCriticalSection
?Copy@STR@@QEAAHPEBD@Z
RemoveWorkItem
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBDK@Z
IISCreateDirectory
PuDbgPrint
?Append@STR@@QEAAHPEBD@Z
ScheduleWorkItem
?Append@STR@@QEAAXD@Z
?Clear@CLKRHashTable@@QEAAXXZ
?Copy@STR@@QEAAHAEBV1@@Z
??0EXTLOG_DATETIME_CACHE@@QEAA@XZ
??_7CACHED_DATETIME_FORMATS@@6B@
??0TS_RESOURCE@@QEAA@XZ
??1CLKRHashTable@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0ASCLOG_DATETIME_CACHE@@QEAA@XZ
?SetLen@STR@@QEAAHK@Z
??0STR@@QEAA@PEADKH@Z
?GetFormattedCurrentDateTime@CACHED_DATETIME_FORMATS@@QEAAKPEAD@Z
?SetSystemTime@EXTLOG_DATETIME_CACHE@@QEAAXPEAU_SYSTEMTIME@@@Z
?SetLocalTime@ASCLOG_DATETIME_CACHE@@QEAAXPEAU_SYSTEMTIME@@@Z
?GetFormattedDateTime@CACHED_DATETIME_FORMATS@@QEAAKPEBU_SYSTEMTIME@@PEAD@Z
?Append@STR@@QEAAHAEBV1@@Z
?Convert@TS_RESOURCE@@QEAAXW4TSRES_CONV_TYPE@@@Z
?CloseIterator@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEAVCIterator@1@@Z
?IncrementIterator@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEAVCIterator@1@@Z
?InitializeIterator@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEAVCIterator@1@@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?GenerateDateTimeString@ASCLOG_DATETIME_CACHE@@UEAAXPEAUDATETIME_FORMAT_ENTRY@@PEBU_SYSTEMTIME@@@Z
Month3CharNames
IISGetPlatformType
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
??0EVENT_LOG@@QEAA@PEBD@Z
PuDeleteDebugPrintsObject
??1EVENT_LOG@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z
?LoadStringA@STR@@QEAAHKPEBDK@Z
??0STR@@QEAA@XZ

kernel32

GetSystemDirectoryW
FreeLibrary
CloseHandle
LoadLibraryExW
GetSystemTimeAsFileTime
GetCurrentProcessId
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetSystemInfo
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetLastError
GetProcAddress
GetCurrentProcess
QueryPerformanceCounter
GetCurrentThread
CreateDirectoryA
LocalFree
InitializeCriticalSection
DeleteCriticalSection
LocalAlloc
ExpandEnvironmentStringsA
FindFirstFileA
FindNextFileA
FindClose
GetTickCount
GetLocalTime
GetTimeZoneInformation
OutputDebugStringA
DisableThreadLibraryCalls
lstrlenA
GetComputerNameA
CreateFileMappingA
MapViewOfFile
CreateFileA
GetFileSize
SetFilePointer
ReadFile
SetEndOfFile
UnmapViewOfFile
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess

user32

CharPrevA

advapi32

SetThreadToken
RevertToSelf
ConvertStringSecurityDescriptorToSecurityDescriptorA
OpenThreadToken

oleaut32

SysFreeString
SysAllocStringLen
VarDateFromDec
VarDecAdd
VarDecFromDate
VarDateFromStr
SafeArrayPutElement
SafeArrayCreate
SystemTimeToVariantTime
SafeArrayUnaccessData
SafeArrayAccessData
VariantTimeToSystemTime
SetErrorInfo
LoadRegTypeLi
SysAllocString
VariantInit
VariantClear

odbc32

ord45
ord10
ord50
ord15
ord14
ord9
ord7
ord1
ord2
ord61
ord13
ord4
ord8
ord18
ord20
ord12
ord19
ord11
ord16
ord72
ord3

Exports

Exports

??0LOGGING@@QEAA@AEBV0@@Z
??0ODBC_CONNECTION@@QEAA@XZ
??0ODBC_PARAMETER@@QEAA@GFFFK@Z
??1ODBC_CONNECTION@@QEAA@XZ
??1ODBC_PARAMETER@@QEAA@XZ
??1ODBC_STATEMENT@@QEAA@XZ
??4LOGGING@@QEAAAEAV0@AEBV0@@Z
?AllocStatement@ODBC_CONNECTION@@QEAAPEAVODBC_STATEMENT@@XZ
?Bind@ODBC_PARAMETER@@QEAAFPEAX@Z
?BindParameter@ODBC_STATEMENT@@QEAAHPEAVODBC_PARAMETER@@@Z
?Close@ODBC_CONNECTION@@QEAAHXZ
?CopyValue@ODBC_PARAMETER@@QEAAHK@Z
?CopyValue@ODBC_PARAMETER@@QEAAHPEAU_SYSTEMTIME@@@Z
?CopyValue@ODBC_PARAMETER@@QEAAHPEAXJ@Z
?CopyValue@ODBC_PARAMETER@@QEAAHPEBD@Z
?CopyValue@ODBC_PARAMETER@@QEAAHPEBG@Z
?DisplaySize@ODBC_CONNECTION@@SA_KF_K@Z
?ExecDirect@ODBC_STATEMENT@@QEAAHPEBDK@Z
?ExecuteStatement@ODBC_STATEMENT@@QEAAHXZ
?FreeColumnMemory@ODBC_STATEMENT@@QEAAXXZ
?GetInfo@ODBC_CONNECTION@@QEAAHKPEAXKPEAK@Z
?GetLastErrorText@ODBC_CONNECTION@@QEBAHPEAVSTR@@PEAXF@Z
?GetLastErrorTextAsHtml@ODBC_CONNECTION@@QEBAHPEAVSTR@@PEAXF@Z
?IsValid@ODBC_CONNECTION@@QEBAHXZ
?IsValid@ODBC_STATEMENT@@QEBAHXZ
?LockExclusive@LOGGING@@AEAAXXZ
?LockShared@LOGGING@@AEAAXXZ
?MoreResults@ODBC_STATEMENT@@QEAAHPEAH@Z
?Open@ODBC_CONNECTION@@QEAAHPEBD00H@Z
?PrepareStatement@ODBC_STATEMENT@@QEAAHPEBD@Z
?QueryCType@ODBC_PARAMETER@@QEBAFXZ
?QueryCbValue@ODBC_PARAMETER@@QEBA_JXZ
?QueryCbValueRef@ODBC_PARAMETER@@QEAAAEA_JXZ
?QueryColNames@ODBC_STATEMENT@@QEAAHPEAPEAVSTR@@PEAKKPEAH@Z
?QueryErrorCode@ODBC_CONNECTION@@QEBAFXZ
?QueryErrorCode@ODBC_STATEMENT@@QEBAFXZ
?QueryMaxCbValue@ODBC_PARAMETER@@QEBA_JXZ
?QueryParamNumber@ODBC_PARAMETER@@QEBAGXZ
?QueryParamType@ODBC_PARAMETER@@QEBAFXZ
?QueryPrecision@ODBC_PARAMETER@@QEBAKXZ
?QueryRowCount@ODBC_STATEMENT@@QEAAHPEA_J@Z
?QueryScale@ODBC_PARAMETER@@QEBAFXZ
?QuerySqlType@ODBC_PARAMETER@@QEBAFXZ
?QueryValue@ODBC_PARAMETER@@QEBAPEAXXZ
?QueryValuesAsStr@ODBC_STATEMENT@@QEAAHPEAPEAVSTR@@PEAH@Z
?SetConnectOption@ODBC_CONNECTION@@QEAAHG_K@Z
?SetValueBuffer@ODBC_PARAMETER@@QEAAHJJ@Z
?Success@ODBC_CONNECTION@@SAHF@Z
?Unlock@LOGGING@@AEAAXXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisreg.dll
.dll windows:10 windows x64

c5449b19d4fc10b405c8c6a0b961c3a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

sprintf_s
memcpy
memset
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcspbrk
_wtoi
wcsnlen
_wcsicmp
wcscmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

HeapReAlloc
GetProcessHeap
HeapAlloc
GetLastError
GetModuleHandleW
HeapFree
GetSystemWow64DirectoryW
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CloseHandle
MultiByteToWideChar
DeleteCriticalSection
ExpandEnvironmentStringsW
FlushFileBuffers
OutputDebugStringA
GlobalFree
SetLastError
LocalFree

advapi32

RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegDeleteKeyW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW

user32

LoadStringA

Exports

Exports

InstallComponent
RemoveComponent

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisreqs.dll
.dll windows:10 windows x64

437b2bf551fc3bd698f53b6adc5c0680

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

free
_initterm
_amsg_exit
_XcptFilter
malloc
_callnewh
__C_specific_handler
_i64tow_s
_vsnwprintf
_wtol
wcspbrk
memset
memcpy
wcscmp

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

iisutil

?Copy@STRU@@QEAAJPEBGK@Z
?CopyA@STRU@@QEAAJPEBDK@Z
PuDbgPrint
?Resize@BUFFER@@QEAA_NK@Z
??1STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisres.dll
.dll windows:10 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/iisrstas.exe
.exe windows:10 windows x64

abb20199eefa5e3f1cd91006827ae5bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wtol
sprintf_s
wcscpy_s
_wcsicmp
iswctype
swprintf_s
__setusermatherr
_cexit
_exit
_initterm
_fmode
_commode
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
?terminate@@YAXXZ
free
_callnewh
malloc
memcpy
memcmp
_strcmpi
__C_specific_handler
memset

atl

ord17
ord23
ord32
ord16
ord20
ord21
ord30
ord58

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
NtQueryInformationProcess

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorGroup
InitializeSecurityDescriptor
AdjustTokenPrivileges
SetSecurityDescriptorDacl
GetTokenInformation
SetSecurityDescriptorOwner
MakeSelfRelativeSD

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
SetEvent
InitializeCriticalSection
CreateEventW
DeleteCriticalSection
WaitForSingleObject

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-com-l1-1-0

CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

SysStringLen
SysFreeString
LoadRegTypeLi

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
CreateThread
TerminateProcess
GetCurrentProcess

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupPrivilegeValueW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW
ReportEventW

api-ms-win-core-misc-l1-1-0

lstrcmpiW

ext-ms-win-ntuser-message-l1-1-0

DispatchMessageW
GetMessageW
PostThreadMessageW

iisutil

PuDbgPrintError
??0BUFFER@@QEAA@XZ
FreeWellKnownSid
AllocateAndCreateWellKnownSid
SetExplicitAccessSettings
??1BUFFER@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
QueryServiceConfig2W
ChangeServiceConfig2W
QueryServiceStatusEx

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iissetup.exe
.exe windows:10 windows x64

c466c59c403e6dddce391a25c64635cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
strrchr
memmove
memcpy
strnlen
__wgetmainargs
_amsg_exit
_vsnprintf
_XcptFilter
_callnewh
malloc
free
_exit
wcsnlen
_vsnwprintf
_purecall
__set_app_type
isxdigit
strchr
_stricmp
wcsrchr
sprintf_s
strcpy_s
wcsstr
_cexit
_vscwprintf
iswalnum
__setusermatherr
_vsnprintf_s
strcat_s
_initterm
wcschr
_snprintf_s
_vsnwprintf_s
__C_specific_handler
wprintf
_wcsicmp
_wcsupr
_fmode
wcstok
_commode
exit
_wtoi
?terminate@@YAXXZ
iswxdigit
wcscmp

ntdll

VerSetConditionMask
RtlGetNtProductType
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

httpapi

HttpSetServiceConfiguration
HttpDeleteServiceConfiguration
HttpInitialize
HttpTerminate

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetEnvironmentVariableW
GetCommandLineW
ExpandEnvironmentStringsW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetExitCodeProcess
GetCurrentThreadId
GetCurrentProcessId
CreateProcessW
GetCurrentProcess

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoQueryProxyBlanket
CoSetProxyBlanket
CLSIDFromProgID
CoUninitialize
CoInitializeEx
CoTaskMemFree

api-ms-win-security-base-l1-1-0

InitializeAcl
EqualSid
CheckTokenMembership
AddAccessAllowedAceEx
GetSecurityDescriptorDacl
GetLengthSid
GetAclInformation
AllocateAndInitializeSid
InitializeSecurityDescriptor
CreateWellKnownSid
GetSecurityDescriptorLength
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
MakeSelfRelativeSD
GetAce

api-ms-win-core-file-l1-1-0

CreateDirectoryW
WriteFile
SetFilePointer
FlushFileBuffers
CreateFileW
DeleteFileW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalFree
LocalAlloc
GlobalFree

ws2_32

WSACleanup
WSAGetLastError
WSAStringToAddressW
WSAStartup

crypt32

CertSetCertificateContextProperty
CertFreeCertificateContext
CryptEncodeObjectEx
CertCreateSelfSignCertificate
CertGetCertificateContextProperty
CertOpenStore
CertAddCertificateContextToStore
CertCloseStore
CertDeleteCertificateFromStore
CertFindCertificateInStore
CertStrToNameW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegDeleteValueW
RegSetKeySecurity
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
RegDeleteTreeW
RegOpenKeyExW
RegEnumValueW
RegQueryValueExW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
LoadStringW
GetProcAddress
GetModuleHandleA
LoadStringA
LoadLibraryExW

samcli

NetLocalGroupDelMembers

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

oleaut32

SafeArrayDestroy
SysAllocString
SafeArrayPutElement
SafeArrayCreate
VariantInit
SysFreeString
VariantClear

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-provider-l1-1-0

GetExplicitEntriesFromAclW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

api-ms-win-security-trustee-l1-1-0

BuildTrusteeWithSidW

cryptsp

CryptGetProvParam
CryptAcquireContextW
CryptGenKey
CryptReleaseContext
CryptDestroyKey
CryptSetProvParam
CryptGetUserKey
CryptExportKey

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaOpenPolicy
LsaAddAccountRights

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByteEx
FormatMessageA
GetSystemDefaultLangID

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

ncrypt

NCryptSetProperty
NCryptCreatePersistedKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenKey
NCryptOpenStorageProvider
NCryptFinalizeKey

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

Exports

Exports

??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
??0MB@@QEAA@PEAUIMSAdminBaseW@@@Z
??0MULTISZ@@QEAA@AEBV0@@Z
??0MULTISZ@@QEAA@PEAGK@Z
??0MULTISZ@@QEAA@PEBG@Z
??0MULTISZ@@QEAA@XZ
??0STRA@@AEAA@AEBV0@@Z
??0STRA@@AEAA@PEAD@Z
??0STRA@@AEAA@PEBD@Z
??0STRA@@QEAA@PEADK@Z
??0STRA@@QEAA@XZ
??0STRAU@@QEAA@AEAV0@@Z
??0STRAU@@QEAA@PEBD@Z
??0STRAU@@QEAA@PEBDH@Z
??0STRAU@@QEAA@PEBG@Z
??0STRAU@@QEAA@XZ
??0STRU@@AEAA@AEBV0@@Z
??0STRU@@AEAA@PEAG@Z
??0STRU@@AEAA@PEBG@Z
??0STRU@@QEAA@PEAGK@Z
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1MB@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
??1STRA@@QEAA@XZ
??1STRAU@@QEAA@XZ
??1STRU@@QEAA@XZ
??4ALLOC_CACHE_HANDLER@@QEAAAEAV0@AEBV0@@Z
??4BIG_REF_TRACE@@QEAAAEAV0@AEBV0@@Z
??4BUFFER@@QEAAAEAV0@AEBV0@@Z
??4LANG_STRING@@QEAAAEAV0@$$QEAV0@@Z
??4LANG_STRING@@QEAAAEAV0@AEBV0@@Z
??4MB@@QEAAAEAV0@AEBV0@@Z
??4MULTISZ@@QEAAAEAV0@AEBV0@@Z
??4STRA@@AEAAAEAV0@AEBV0@@Z
??4STRAU@@QEAAAEAV0@AEBV0@@Z
??4STRU@@AEAAAEAV0@AEBV0@@Z
?AddObject@MB@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHPEBGK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@STRAU@@QEAAHAEAV1@@Z
?Append@STRAU@@QEAAHPEBD@Z
?Append@STRAU@@QEAAHPEBDK@Z
?Append@STRAU@@QEAAHPEBG@Z
?Append@STRAU@@QEAAHPEBGK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJG@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBGK@Z
?AppendA@STRU@@QEAAJPEBD@Z
?AppendA@STRU@@QEAAJPEBDK@Z
?AppendA_ACP@STRU@@QEAAJPEBD@Z
?AppendA_ACP@STRU@@QEAAJPEBDK@Z
?AppendW@STRA@@QEAAJPEBG@Z
?AppendW@STRA@@QEAAJPEBGK@Z
?AppendWSimple@STRA@@QEAAJPEBGK@Z
?AppendWTruncate@STRA@@QEAAJPEBG@Z
?AppendWTruncate@STRA@@QEAAJPEBGK@Z
?AuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?AuxAppend@STRA@@AEAAJPEBEKK_N@Z
?AuxAppend@STRAU@@AEAAHPEBDIH@Z
?AuxAppend@STRAU@@AEAAHPEBGIH@Z
?AuxAppend@STRU@@AEAAJPEBEKK_N@Z
?AuxAppendA@STRU@@AEAAJPEBEKK_N1@Z
?AuxAppendW@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWSimple@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWTruncate@STRA@@AEAAJPEBGKK_N@Z
?AuxInit@MULTISZ@@AEAAXPEBG@Z
?AuxInit@STRAU@@AEAAXPEBD@Z
?AuxInit@STRAU@@AEAAXPEBG@Z
?CalcLength@MULTISZ@@SAKPEBGPEAK@Z
?CheckSignature@BIG_REF_TRACE@@AEBAHXZ
?Clone@MULTISZ@@QEBAHPEAV1@@Z
?Clone@STRA@@QEBAJPEAV1@@Z
?Close@MB@@QEAAHXZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@MULTISZ@@QEAAHPEBGK@Z
?Copy@STRA@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRAU@@QEAAHAEAV1@@Z
?Copy@STRAU@@QEAAHPEBD@Z
?Copy@STRAU@@QEAAHPEBDK@Z
?Copy@STRAU@@QEAAHPEBG@Z
?Copy@STRAU@@QEAAHPEBGK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?CopyA@STRU@@QEAAJPEBD@Z
?CopyA@STRU@@QEAAJPEBDK@Z
?CopyA_ACP@STRU@@QEAAJPEBD@Z
?CopyA_ACP@STRU@@QEAAJPEBDK@Z
?CopyBinary@STRA@@QEAAJPEAXK@Z
?CopyToBuffer@MULTISZ@@QEBAHPEAGPEAK@Z
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
?CopyToBuffer@STRU@@QEBAJPEAGPEAK@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyW@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Escaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?DeleteData@MB@@QEAAHPEBGKKK@Z
?DeleteObject@MB@@QEAAHPEBG@Z
?EnumObjects@MB@@QEAAHPEBGPEAGK@Z
?Equals@MULTISZ@@QEAAHPEAV1@@Z
?Equals@STRA@@QEBA_NAEBV1@@Z
?Equals@STRA@@QEBA_NPEBD@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
?Equals@STRU@@QEBA_NPEBG@Z
?EqualsNoCase@STRA@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRA@@QEBA_NPEBD@Z
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?Escape@STRA@@QEAAJ_N0@Z
?Escape@STRU@@QEAAJXZ
?ExpandEnvironmentVariables@STRU@@SAJPEBGPEAV1@@Z
?FastAppend@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FastAppend@MULTISZ@@QEAAHPEBG@Z
?FastAppend@MULTISZ@@QEAAHPEBGK@Z
?FastAuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?FastCopy@MULTISZ@@QEAAHAEBV1@@Z
?FastCopy@MULTISZ@@QEAAHPEBGK@Z
?FindRefTraceHeadEntry@BIG_REF_TRACE@@SAPEAU_REF_TRACE_HEAD_ENTRY@@PEAV1@PEAX@Z
?FindString@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindString@MULTISZ@@QEAAHPEBG@Z
?FindStringNoCase@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
?First@MULTISZ@@QEBAPEBGXZ
?FormatString@STRA@@QEAAJKQEAPEBDPEBDK@Z
?FreeMemory@BUFFER@@QEAAXXZ
?FreeMemoryInternal@BUFFER@@AEAAXXZ
?GetAll@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAK2@Z
?GetBuffer@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAKK@Z
?GetChildPaths@MB@@QEAAHPEBGPEAVBUFFER@@@Z
?GetData@MB@@QEAAHPEBGKKKPEAXPEAKK@Z
?GetDataPaths@MB@@QEAAHPEBGKKPEAVBUFFER@@@Z
?GetDataSetNumber@MB@@QEAAHPEBGPEAK@Z
?GetDword@MB@@QEAAHPEBGKKPEAKK@Z
?GetDword@MB@@QEAAXPEBGKKKPEAKK@Z
?GetMultisz@MB@@QEAAHPEBGKKPEAVMULTISZ@@K@Z
?GetStr@MB@@QEAAHPEBGKKPEAVSTRU@@K0@Z
?GetString@MB@@QEAAHPEBGKKPEAGPEAKK@Z
?GetSystemChangeNumber@MB@@QEAAHPEAK@Z
?HTMLEncode@STRA@@QEAAJXZ
?HTMLEncode@STRU@@QEAAJXZ
?Hash@BIG_REF_TRACE@@SAKPEAX@Z
?IsCurrentUnicode@STRAU@@QEAAHXZ
?IsEmpty@MULTISZ@@QEBAHXZ
?IsEmpty@STRA@@QEBA_NXZ
?IsEmpty@STRAU@@QEAAHXZ
?IsEmpty@STRU@@QEBA_NXZ
?IsValid@ALLOC_CACHE_HANDLER@@QEBAHXZ
?IsValid@BUFFER@@QEBA_NXZ
?IsValid@MULTISZ@@QEBAHXZ
?IsValid@STRA@@QEBA_NXZ
?IsValid@STRAU@@QEAAHXZ
?LoadStringW@STRA@@QEAAJKPEAUHINSTANCE__@@@Z
?LoadStringW@STRA@@QEAAJKPEBDK@Z
?Next@MULTISZ@@QEBAPEBGPEBG@Z
?Open@MB@@QEAAHKPEBGK@Z
?Open@MB@@QEAAHPEBGK@Z
?PrivateQueryStr@STRAU@@AEAAPEAGH@Z
?QueryAdminBase@MB@@QEBAPEAUIMSAdminBaseW@@XZ
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?QueryCB@MULTISZ@@QEBAIXZ
?QueryCB@STRA@@QEBAKXZ
?QueryCB@STRAU@@QEAAIH@Z
?QueryCB@STRU@@QEBAKXZ
?QueryCBA@STRAU@@QEAAIXZ
?QueryCBW@STRAU@@QEAAIXZ
?QueryCCH@MULTISZ@@QEBAIXZ
?QueryCCH@STRA@@QEBAKXZ
?QueryCCH@STRAU@@QEAAIXZ
?QueryCCH@STRU@@QEBAKXZ
?QueryHandle@MB@@QEBAKXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QuerySize@BUFFER@@QEBAKXZ
?QuerySize@STRA@@QEBAKXZ
?QuerySize@STRU@@QEBAKXZ
?QuerySizeCCH@STRA@@QEBAKXZ
?QuerySizeCCH@STRU@@QEBAKXZ
?QueryStr@MULTISZ@@QEBAPEAGXZ
?QueryStr@STRA@@QEAAPEADXZ
?QueryStr@STRA@@QEBAPEBDXZ
?QueryStr@STRAU@@QEAAPEAGH@Z
?QueryStr@STRU@@QEAAPEAGXZ
?QueryStr@STRU@@QEBAPEBGXZ
?QueryStrA@MULTISZ@@QEBAPEAGXZ
?QueryStrA@STRAU@@QEAAPEADXZ
?QueryStrW@STRAU@@QEAAPEAGXZ
?QueryStringCount@MULTISZ@@QEBAKXZ
?ReallocStorage@BUFFER@@AEAA_NK@Z
?RecalcLen@MULTISZ@@QEAAXXZ
?Reset@MULTISZ@@QEAAXXZ
?Reset@STRA@@QEAAXXZ
?Reset@STRAU@@QEAAXXZ
?Reset@STRU@@QEAAXXZ
?Resize@BUFFER@@QEAA_NK@Z
?Resize@BUFFER@@QEAA_NKK@Z
?Resize@STRA@@QEAAJK@Z
?Resize@STRU@@QEAAJK@Z
?ResizeW@STRAU@@QEAAHK@Z
?SAFE_snwprintf@@YAJPEAVSTRU@@PEBGZZ
?SafeCopy@STRAU@@QEAAHPEBD@Z
?SafeCopy@STRAU@@QEAAHPEBG@Z
?Save@MB@@QEAAHXZ
?SetData@MB@@QEAAHPEBGKKKPEAXKK@Z
?SetDword@MB@@QEAAHPEBGKKKK@Z
?SetLen@STRA@@QEAA_NK@Z
?SetLen@STRAU@@QEAAHK@Z
?SetLen@STRU@@QEAA_NK@Z
?SetString@MB@@QEAAHPEBGKK0K@Z
?SetValid@BUFFER@@QEAAX_N@Z
?SyncWithBuffer@STRA@@QEAAXXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?Unescape@STRA@@QEAAJXZ
?Unescape@STRU@@QEAAJXZ
?UnescapeOnly@STRA@@QEAAJXZ
?UnescapeOnly@STRU@@QEAAJXZ
?VerifyState@BUFFER@@AEBAXXZ

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iissyspr.dll
.dll windows:10 windows x64

2b553578d1f6164f804a66c8f5e920cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
memset
wcsnlen
_vsnprintf
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
_wcsicmp
_vsnwprintf
_wcsnicmp
wcschr

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoUninitialize

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileAttributesW
WriteFile
SetFileAttributesW
GetTempFileNameW
SetFilePointer
DeleteFileW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegFlushKey
RegCloseKey
RegSetValueExW

oleaut32

GetErrorInfo

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

samcli

NetUserGetInfo
NetUserSetInfo

netutils

NetApiBufferFree

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetSystemDirectoryW

ws2_32

WSACleanup
WSAStartup
WSAGetLastError
WSAStringToAddressW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

crypt32

CertCreateSelfSignCertificate
CertAddCertificateContextToStore
CryptEncodeObjectEx
CertStrToNameW
CertCloseStore
CertDeleteCertificateFromStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-security-lsapolicy-l1-1-0

LsaRetrievePrivateData
LsaOpenPolicy
LsaStorePrivateData
LsaClose
LsaFreeMemory

cryptsp

CryptGenRandom
CryptSetProvParam
CryptGetProvParam
CryptGenKey
CryptAcquireContextW
CryptReleaseContext
CryptGetUserKey
CryptDestroyKey

httpapi

HttpDeleteServiceConfiguration
HttpSetServiceConfiguration
HttpInitialize
HttpTerminate

ntdll

RtlNtStatusToDosError

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-1-0

GetAce
GetAclInformation
GetSecurityDescriptorDacl
GetLengthSid
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
EqualSid
InitializeAcl

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-service-management-l1-1-0

OpenServiceW
StartServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-security-provider-l1-1-0

GetExplicitEntriesFromAclW
SetEntriesInAclW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

Exports

Exports

IIS_Generalize
IIS_Specialize_Offline
IIS_Specialize_Online

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisual.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisui.dll
.dll regsvr32 windows:10 windows x64

631b6a9cbd52149a13876a91e4d47658

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mfc42u

ord6705
ord5694
ord2979
ord1548
ord1443
ord2384
ord4557
ord3761
ord5077
ord911
ord1774
ord6801
ord2425
ord2024
ord4543
ord2592
ord4746
ord3805
ord1463
ord1483
ord6021
ord4436
ord1259
ord1261
ord5937
ord5951
ord2329
ord2846
ord1286
ord4601
ord6614
ord3177
ord2898
ord2900
ord1477
ord1553
ord355
ord1498
ord1124
ord4131
ord2783
ord4522
ord6050
ord1263
ord1471
ord6184
ord2459
ord2049
ord1123
ord445
ord940
ord5949
ord5921
ord2779
ord5933
ord3831
ord6173
ord6632
ord2661
ord1441
ord1647
ord336
ord6127
ord2420
ord1646
ord6238
ord655
ord1059
ord2670
ord826
ord6133
ord6226
ord4249
ord5938
ord6545
ord1035
ord2591
ord4745
ord3794
ord6708
ord4599
ord6351
ord4860
ord2132
ord2101
ord4609
ord6612
ord1966
ord6102
ord4623
ord1930
ord4014
ord2393
ord1846
ord2422
ord2023
ord4542
ord2589
ord4743
ord3751
ord832
ord1806
ord1264
ord5927
ord1383
ord644
ord1262
ord4523
ord1499
ord1812
ord1908
ord561
ord4583
ord5082
ord1906
ord549
ord4582
ord6243
ord4828
ord5382
ord4779
ord2059
ord4787
ord5710
ord2532
ord1698
ord5227
ord5709
ord5246
ord4722
ord4699
ord5352
ord5114
ord5304
ord5583
ord5585
ord5584
ord4789
ord5229
ord4017
ord2764
ord5693
ord1442
ord6216
ord1287
ord1126
ord2781
ord1379
ord624
ord4473
ord622
ord1284
ord2629
ord5887
ord5687
ord4721
ord5245
ord5406
ord2517
ord6437
ord1777
ord4752
ord5702
ord4771
ord6180
ord3900
ord2121
ord5804
ord6821
ord2876
ord5815
ord5712
ord4694
ord6812
ord5586
ord2399
ord5663
ord4741
ord1778
ord4365
ord6440
ord2585
ord822
ord3740
ord3790
ord286
ord1574
ord2427
ord2408
ord1042
ord628
ord6832
ord2906
ord339
ord337
ord338
ord999
ord851
ord3742
ord1003
ord3783
ord852
ord1122
ord620
ord2975
ord1040
ord626
ord6880
ord665
ord3741
ord4770
ord4988
ord4371
ord3164
ord4077
ord4083
ord4082
ord3535
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord5699
ord2140
ord2457
ord5683
ord1736
ord5484
ord3933
ord6814
ord899
ord2060
ord310
ord3830

msvcrt

_wcsicmp
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
gmtime
localtime
_tzset
_wcsnicmp
towupper
wcsncmp
strncmp
_itow
wcscmp
qsort
_vsnwprintf_s
_lock
_unlock
__dllonexit
_onexit
memset
_purecall
__CxxFrameHandler3
_callnewh
memcmp
memcpy
memmove
malloc
wcscpy_s
wcsncpy_s
wcscat_s
swprintf_s
swscanf
_wtoi
_ltow
wcsrchr
_wsplitpath_s
wcstok
iswdigit
free
_stricmp
strchr
_ultow
_wtol
wcschr
vswprintf_s

netapi32

NetShareGetInfo
NetApiBufferFree

ws2_32

freeaddrinfo
WSAGetLastError
getaddrinfo
getnameinfo
htonl
ntohl
WSAStringToAddressW
WSAStartup

kernel32

GetExitCodeThread
WaitForSingleObject
CreateThread
GetComputerNameW
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryExA
ExpandEnvironmentStringsW
SetUnhandledExceptionFilter
TerminateThread
GetUserDefaultUILanguage
GetProcAddress
GetModuleHandleA
GetVolumeInformationW
lstrcmpiW
GetComputerNameExW
LocalFree
lstrlenW
LocalAlloc
SetLastError
GetLastError
GetCurrentProcess
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
FormatMessageW
GlobalLock
GlobalUnlock
GetTickCount
GetDriveTypeW
GetEnvironmentVariableW
GetTimeZoneInformation
GetFullPathNameW
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetLocaleInfoW
UnhandledExceptionFilter
TerminateProcess
ExpandEnvironmentStringsA
InitializeCriticalSection

advapi32

RegQueryValueExW
RegCloseKey
LookupAccountSidW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
MakeSelfRelativeSD
FreeSid
IsValidSecurityDescriptor
GetSecurityDescriptorDacl
IsValidAcl
GetAce
LogonUserW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
EqualSid

comctl32

ord410
ord8
ord413
ord412

user32

EnableWindow
GetParent
PostMessageW
CharNextW
SendMessageW
IsWindowEnabled
SetFocus
GetWindowTextLengthW
GetWindowTextW
KillTimer
DestroyWindow
GetDC
GetCaretPos
GetClientRect
GetWindowRect
ReleaseDC
CreateWindowExW
SetTimer
LoadStringW
MessageBoxW
RegisterClipboardFormatW
MapWindowPoints
GetKeyState
LoadBitmapW
FillRect
GetSysColor
CopyRect
SystemParametersInfoW
InvalidateRect
DrawFocusRect
SetParent

mpr

WNetGetConnectionW

ole32

ReleaseStgMedium
CoCreateInstance
CoUninitialize
CoCreateInstanceEx
CoInitialize
CoSetProxyBlanket
StringFromGUID2

oleaut32

SysAllocStringLen
SafeArrayAccessData
SysAllocString
SysFreeString
SysStringLen

gdi32

CreateCompatibleBitmap
CreateSolidBrush
CreateFontIndirectW
GetObjectW
CreateCompatibleDC
GetTextExtentPoint32W
GetTextMetricsW
GetStockObject
CreateBitmap
BitBlt

shlwapi

StrRChrW
PathIsUNCServerShareW
PathIsUNCW
StrSpnW
PathIsUNCServerW
PathIsRelativeW
PathIsDirectoryW
PathFileExistsW
UrlGetPartW
PathSkipRootW
PathStripToRootW

ntdll

RtlIpv4StringToAddressW
RtlCopySid
RtlLengthSid
RtlIpv6StringToAddressW

crypt32

CryptUnprotectMemory
CryptProtectMemory

shell32

ord754

iisrtl

IISInitializeCriticalSection

atl

ord30

Exports

Exports

??0CAccessEntry@@QEAA@AEAV0@@Z
??0CAccessEntry@@QEAA@KPEAXPEBGH@Z
??0CAccessEntry@@QEAA@PEAXH@Z
??0CAccessEntry@@QEAA@PEAXPEBG1@Z
??0CBlob@@QEAA@AEBV0@@Z
??0CBlob@@QEAA@KPEAEH@Z
??0CBlob@@QEAA@XZ
??0CComAuthInfo@@QEAA@AEAV0@@Z
??0CComAuthInfo@@QEAA@PEAV0@@Z
??0CComAuthInfo@@QEAA@PEBG00@Z
??0CConfirmDlg@@QEAA@PEAVCWnd@@@Z
??0CDownButton@@QEAA@XZ
??0CEmphasizedDialog@@QEAA@IPEAVCWnd@@@Z
??0CEmphasizedDialog@@QEAA@PEBGPEAVCWnd@@@Z
??0CEmphasizedDialog@@QEAA@XZ
??0CError@@QEAA@J@Z
??0CError@@QEAA@K@Z
??0CError@@QEAA@XZ
??0CGetComputer@@QEAA@AEBV0@@Z
??0CGetComputer@@QEAA@XZ
??0CGetUsers@@QEAA@PEBGH@Z
??0CHeaderListBox@@QEAA@KPEBG@Z
??0CIISAppPool@@QEAA@$$QEAV0@@Z
??0CIISAppPool@@QEAA@AEAV0@@Z
??0CIISAppPool@@QEAA@PEAVCComAuthInfo@@PEBG@Z
??0CIISApplication@@QEAA@$$QEAV0@@Z
??0CIISApplication@@QEAA@AEAV0@@Z
??0CIISApplication@@QEAA@PEAVCComAuthInfo@@PEBG@Z
??0CIISIMSAdminBaseSink@@QEAA@AEAV0@@Z
??0CIISIMSAdminBaseSink@@QEAA@PEAVCMetaInterface@@PEAVCComAuthInfo@@@Z
??0CIISInterface@@QEAA@AEAV0@@Z
??0CIISInterface@@QEAA@PEAVCComAuthInfo@@J@Z
??0CIISSvcControl@@QEAA@AEAV0@@Z
??0CIISSvcControl@@QEAA@PEAV0@@Z
??0CIISSvcControl@@QEAA@PEAVCComAuthInfo@@@Z
??0CIISWizardBookEnd@@QEAA@IIIII@Z
??0CIISWizardBookEnd@@QEAA@PEAJIIIIIII@Z
??0CIISWizardPage@@QEAA@IIHII@Z
??0CIISWizardSheet@@QEAA@IIKK@Z
??0CILong@@QEAA@J@Z
??0CILong@@QEAA@PEBG@Z
??0CILong@@QEAA@XZ
??0CINumber@@IEAA@XZ
??0CIPAccessDescriptor@@QEAA@AEBV0@@Z
??0CIPAccessDescriptor@@QEAA@H@Z
??0CIPAccessDescriptor@@QEAA@HKKH@Z
??0CIPAccessDescriptor@@QEAA@HPEBG@Z
??0CIPAddress@@QEAA@AEBV0@@Z
??0CIPAddress@@QEAA@AEBVCString@@@Z
??0CIPAddress@@QEAA@EEEE@Z
??0CIPAddress@@QEAA@KH@Z
??0CIPAddress@@QEAA@PEAEH@Z
??0CIPAddress@@QEAA@PEBGH@Z
??0CIPAddress@@QEAA@XZ
??0CInheritanceDlg@@QEAA@HKKKKPEBGHPEAVCComAuthInfo@@0PEAVCWnd@@@Z
??0CInheritanceDlg@@QEAA@KHPEAVCComAuthInfo@@PEBG1PEAVCWnd@@@Z
??0CInheritanceDlg@@QEAA@KHPEAVCComAuthInfo@@PEBGAEAVCStringList@@1PEAVCWnd@@@Z
??0CMappedBitmapButton@@QEAA@XZ
??0CMetaBack@@QEAA@$$QEAV0@@Z
??0CMetaBack@@QEAA@AEAV0@@Z
??0CMetaBack@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetaEnumerator@@QEAA@$$QEAV0@@Z
??0CMetaEnumerator@@QEAA@AEAV0@@Z
??0CMetaEnumerator@@QEAA@HPEAVCMetaKey@@@Z
??0CMetaEnumerator@@QEAA@PEAVCComAuthInfo@@PEBGK@Z
??0CMetaEnumerator@@QEAA@PEAVCMetaInterface@@PEBGK@Z
??0CMetaInterface@@IEAA@PEAV0@H@Z
??0CMetaInterface@@IEAA@PEAVCComAuthInfo@@H@Z
??0CMetaInterface@@QEAA@AEAV0@@Z
??0CMetaKey@@QEAA@AEAV0@@Z
??0CMetaKey@@QEAA@HPEAV0@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@PEBGKK@Z
??0CMetaKey@@QEAA@PEAVCMetaInterface@@@Z
??0CMetaKey@@QEAA@PEAVCMetaInterface@@PEBGKK@Z
??0CMetabasePath@@QEAA@$$QEAV0@@Z
??0CMetabasePath@@QEAA@AEBV0@@Z
??0CMetabasePath@@QEAA@HPEBG000@Z
??0CMetabasePath@@QEAA@PEBGK00@Z
??0CODLBox@@IEAA@XZ
??0CObListIter@@QEAA@AEBVCObListPlus@@@Z
??0CObListPlus@@QEAA@H@Z
??0CObjHelper@@IEAA@XZ
??0CObjHelper@@QEAA@$$QEAV0@@Z
??0CObjHelper@@QEAA@AEBV0@@Z
??0CObjectPlus@@QEAA@XZ
??0CRMCComboBox@@QEAA@XZ
??0CRMCListBox@@QEAA@XZ
??0CRMCListBoxDrawStruct@@QEAA@PEAVCDC@@PEAUtagRECT@@H_KHPEBVCRMCListBoxResources@@@Z
??0CRMCListBoxHeader@@QEAA@K@Z
??0CRMCListBoxResources@@QEAA@HHK@Z
??0CStrPassword@@QEAA@AEAV0@@Z
??0CStrPassword@@QEAA@PEAG@Z
??0CStrPassword@@QEAA@PEBG@Z
??0CStrPassword@@QEAA@XZ
??0CStringListEx@@QEAA@H@Z
??0CUpButton@@QEAA@XZ
??0CWamInterface@@IEAA@PEAV0@@Z
??0CWamInterface@@IEAA@PEAVCComAuthInfo@@@Z
??0CWamInterface@@QEAA@AEAV0@@Z
??1CAccessEntry@@UEAA@XZ
??1CBlob@@QEAA@XZ
??1CComAuthInfo@@QEAA@XZ
??1CConfirmDlg@@UEAA@XZ
??1CDownButton@@UEAA@XZ
??1CEmphasizedDialog@@UEAA@XZ
??1CError@@QEAA@XZ
??1CGetComputer@@QEAA@XZ
??1CGetUsers@@UEAA@XZ
??1CHeaderListBox@@UEAA@XZ
??1CIISAppPool@@UEAA@XZ
??1CIISApplication@@UEAA@XZ
??1CIISIMSAdminBaseSink@@UEAA@XZ
??1CIISInterface@@QEAA@XZ
??1CIISSvcControl@@UEAA@XZ
??1CIISWizardBookEnd@@UEAA@XZ
??1CIISWizardPage@@UEAA@XZ
??1CIISWizardSheet@@UEAA@XZ
??1CILong@@QEAA@XZ
??1CINumber@@IEAA@XZ
??1CIPAccessDescriptor@@UEAA@XZ
??1CIPAddress@@UEAA@XZ
??1CInheritanceDlg@@UEAA@XZ
??1CMappedBitmapButton@@UEAA@XZ
??1CMetaBack@@UEAA@XZ
??1CMetaEnumerator@@UEAA@XZ
??1CMetaInterface@@UEAA@XZ
??1CMetaKey@@UEAA@XZ
??1CMetabasePath@@QEAA@XZ
??1CODLBox@@IEAA@XZ
??1CObListIter@@UEAA@XZ
??1CObListPlus@@UEAA@XZ
??1CObjectPlus@@UEAA@XZ
??1CRMCComboBox@@UEAA@XZ
??1CRMCListBox@@UEAA@XZ
??1CRMCListBoxHeader@@UEAA@XZ
??1CRMCListBoxResources@@QEAA@XZ
??1CStrPassword@@QEAA@XZ
??1CStringListEx@@UEAA@XZ
??1CUpButton@@UEAA@XZ
??1CWamInterface@@UEAA@XZ
??4CBlob@@QEAAAEAV0@AEBV0@@Z
??4CComAuthInfo@@QEAAAEAV0@AEAV0@@Z
??4CComAuthInfo@@QEAAAEAV0@PEAV0@@Z
??4CComAuthInfo@@QEAAAEAV0@PEBG@Z
??4CError@@QEAAAEBV0@AEBV0@@Z
??4CError@@QEAAAEBV0@J@Z
??4CGetComputer@@QEAAAEAV0@AEBV0@@Z
??4CIISAppPool@@QEAAAEAV0@$$QEAV0@@Z
??4CIISAppPool@@QEAAAEAV0@AEAV0@@Z
??4CIISApplication@@QEAAAEAV0@$$QEAV0@@Z
??4CIISApplication@@QEAAAEAV0@AEAV0@@Z
??4CIISIMSAdminBaseSink@@QEAAAEAV0@AEAV0@@Z
??4CIISInterface@@QEAAAEAV0@AEAV0@@Z
??4CIISSvcControl@@QEAAAEAV0@AEAV0@@Z
??4CILong@@QEAAAEAV0@$$QEAV0@@Z
??4CILong@@QEAAAEAV0@AEBV0@@Z
??4CILong@@QEAAAEAV0@J@Z
??4CILong@@QEAAAEAV0@PEBG@Z
??4CINumber@@QEAAAEAV0@AEBV0@@Z
??4CIPAddress@@QEAAAEBV0@AEBV0@@Z
??4CIPAddress@@QEAAAEBV0@AEBVCString@@@Z
??4CIPAddress@@QEAAAEBV0@K@Z
??4CIPAddress@@QEAAAEBV0@PEBG@Z
??4CMetaBack@@QEAAAEAV0@$$QEAV0@@Z
??4CMetaBack@@QEAAAEAV0@AEAV0@@Z
??4CMetaEnumerator@@QEAAAEAV0@$$QEAV0@@Z
??4CMetaEnumerator@@QEAAAEAV0@AEAV0@@Z
??4CMetaInterface@@QEAAAEAV0@AEAV0@@Z
??4CMetaKey@@QEAAAEAV0@AEAV0@@Z
??4CMetabasePath@@QEAAAEAV0@$$QEAV0@@Z
??4CMetabasePath@@QEAAAEAV0@AEBV0@@Z
??4CObjHelper@@QEAAAEAV0@$$QEAV0@@Z
??4CObjHelper@@QEAAAEAV0@AEBV0@@Z
??4CRMCListBoxDrawStruct@@QEAAAEAV0@$$QEAV0@@Z
??4CRMCListBoxDrawStruct@@QEAAAEAV0@AEBV0@@Z
??4CStrPassword@@QEAAAEBV0@AEAV0@@Z
??4CStrPassword@@QEAAAEBV0@PEBG@Z
??4CStringListEx@@QEAAAEAV0@AEBV0@@Z
??4CStringListEx@@QEAAAEAV0@AEBVCStringList@@@Z
??4CWamInterface@@QEAAAEAV0@AEAV0@@Z
??8CAccessEntry@@QEBAHAEBV0@@Z
??8CAccessEntry@@QEBAHQEAX@Z
??8CBlob@@QEBAHAEBV0@@Z
??8CError@@QEAA?BHAEAV0@@Z
??8CError@@QEAA?BHJ@Z
??8CILong@@QEAAHJ@Z
??8CIPAccessDescriptor@@QEBAHAEBV0@@Z
??8CIPAddress@@QEBAHAEBV0@@Z
??8CIPAddress@@QEBAHK@Z
??8CStrPassword@@QEAA_NAEAV0@@Z
??8CStringListEx@@QEAAHAEBVCStringList@@@Z
??9CBlob@@QEBAHAEBV0@@Z
??9CError@@QEAA?BHAEAV0@@Z
??9CError@@QEAA?BHJ@Z
??9CILong@@QEAAHAEAV0@@Z
??9CIPAddress@@QEBAHAEBV0@@Z
??9CIPAddress@@QEBAHK@Z
??9CStrPassword@@QEAA_NAEAV0@@Z
??9CStringListEx@@QEAAHAEBVCStringList@@@Z
??BCComAuthInfo@@QEAAPEAGXZ
??BCComAuthInfo@@QEAAPEAV0@XZ
??BCError@@QEAAPEAGXZ
??BCError@@QEAAPEBGXZ
??BCError@@QEBA?BHXZ
??BCError@@QEBA?BJXZ
??BCError@@QEBA?BKXZ
??BCIISInterface@@QEBAHXZ
??BCIISInterface@@QEBAJXZ
??BCILong@@QEBA?BJXZ
??BCILong@@QEBAPEBGXZ
??BCIPAddress@@QEBA?AVCString@@XZ
??BCIPAddress@@QEBA?BKXZ
??BCIPAddress@@QEBAPEBGXZ
??BCMetaKey@@QEBAHXZ
??BCMetaKey@@QEBAKXZ
??BCMetaKey@@QEBAPEBGXZ
??BCMetabasePath@@QEBAPEBGXZ
??BCObjHelper@@QEAAHXZ
??BCStrPassword@@QEAA?AVCString@@XZ
??XCILong@@QEAAAEAV0@AEBV0@@Z
??XCILong@@QEAAAEAV0@J@Z
??XCILong@@QEAAAEAV0@QEBG@Z
??YCILong@@QEAAAEAV0@AEBV0@@Z
??YCILong@@QEAAAEAV0@J@Z
??YCILong@@QEAAAEAV0@QEBG@Z
??ZCILong@@QEAAAEAV0@AEBV0@@Z
??ZCILong@@QEAAAEAV0@J@Z
??ZCILong@@QEAAAEAV0@QEBG@Z
??_0CILong@@QEAAAEAV0@AEBV0@@Z
??_0CILong@@QEAAAEAV0@J@Z
??_0CILong@@QEAAAEAV0@QEBG@Z
??_7CAccessEntry@@6BCObjHelper@@@
??_7CAccessEntry@@6BCObject@@@
??_7CConfirmDlg@@6B@
??_7CDownButton@@6B@
??_7CEmphasizedDialog@@6B@
??_7CGetUsers@@6B@
??_7CHeaderListBox@@6BCListBox@@@
??_7CHeaderListBox@@6BCODLBox@@@
??_7CIISAppPool@@6BCMetaKey@@@
??_7CIISAppPool@@6BCWamInterface@@@
??_7CIISApplication@@6BCMetaKey@@@
??_7CIISApplication@@6BCWamInterface@@@
??_7CIISIMSAdminBaseSink@@6B@
??_7CIISInterface@@6B@
??_7CIISSvcControl@@6B@
??_7CIISWizardBookEnd@@6B@
??_7CIISWizardPage@@6B@
??_7CIISWizardSheet@@6B@
??_7CIPAccessDescriptor@@6BCObjHelper@@@
??_7CIPAccessDescriptor@@6BCObject@@@
??_7CIPAddress@@6BCObjHelper@@@
??_7CIPAddress@@6BCObject@@@
??_7CInheritanceDlg@@6B@
??_7CMappedBitmapButton@@6B@
??_7CMetaBack@@6BCMetaInterface@@@
??_7CMetaBack@@6BCWamInterface@@@
??_7CMetaEnumerator@@6B@
??_7CMetaInterface@@6B@
??_7CMetaKey@@6B@
??_7CODLBox@@6B@
??_7CObListIter@@6BCObjHelper@@@
??_7CObListIter@@6BCObject@@@
??_7CObListPlus@@6BCObList@@@
??_7CObListPlus@@6BCObjHelper@@@
??_7CObjHelper@@6B@
??_7CObjectPlus@@6BCObjHelper@@@
??_7CObjectPlus@@6BCObject@@@
??_7CRMCComboBox@@6BCComboBox@@@
??_7CRMCComboBox@@6BCODLBox@@@
??_7CRMCListBox@@6BCListBox@@@
??_7CRMCListBox@@6BCODLBox@@@
??_7CRMCListBoxHeader@@6B@
??_7CStringListEx@@6B@
??_7CUpButton@@6B@
??_7CWamInterface@@6B@
??_FCComAuthInfo@@QEAAXXZ
??_FCConfirmDlg@@QEAAXXZ
??_FCHeaderListBox@@QEAAXXZ
??_FCIISWizardBookEnd@@QEAAXXZ
??_FCIISWizardPage@@QEAAXXZ
??_FCIISWizardSheet@@QEAAXXZ
??_FCIPAccessDescriptor@@QEAAXXZ
??_FCMetabasePath@@QEAAXXZ
??_FCObListPlus@@QEAAXXZ
??_FCRMCListBoxHeader@@QEAAXXZ
??_FCStringListEx@@QEAAXXZ
?AddKey@CMetaInterface@@IEAAJKPEBG@Z
?AddKey@CMetaKey@@QEAAJPEBG@Z
?AddOverride@CError@@QEAAIJI@Z
?AddPermissions@CAccessEntry@@QEAAXK@Z
?AddTab@CODLBox@@QEAAHI@Z
?AddTabFromHeaders@CODLBox@@QEAAHAEAVCWnd@@0@Z
?AddTabFromHeaders@CODLBox@@QEAAHII@Z
?Allocate@CINumber@@KAHXZ
?AllocateStatics@CError@@KAHXZ
?AppCreate@CWamInterface@@IEAAJPEBGK@Z
?AppDelete@CWamInterface@@IEAAJPEBGH@Z
?AppDeleteRecoverable@CWamInterface@@IEAAJPEBGH@Z
?AppGetStatus@CWamInterface@@IEAAJPEBGPEAK@Z
?AppRecover@CWamInterface@@IEAAJPEBGH@Z
?AppUnLoad@CWamInterface@@IEAAJPEBGH@Z
?AppendPath@CMetabasePath@@IEAAXK@Z
?AppendPath@CMetabasePath@@IEAAXPEBG@Z
?ApplyProxyBlanket@CComAuthInfo@@QEAAJPEAUIUnknown@@@Z
?ApplyProxyBlanket@CComAuthInfo@@QEAAJPEAUIUnknown@@K@Z
?ApplyProxyBlanket@CIISIMSAdminBaseSink@@MEAAJXZ
?ApplyProxyBlanket@CIISSvcControl@@MEAAJXZ
?ApplyProxyBlanket@CMetaBack@@MEAAJXZ
?ApplyProxyBlanket@CMetaInterface@@MEAAJXZ
?ApplyProxyBlanket@CWamInterface@@MEAAJXZ
?AreStaticsAllocated@CError@@KAHXZ
?AttachResources@CODLBox@@QEAAXPEBVCRMCListBoxResources@@@Z
?AttachWindow@CODLBox@@IEAAXPEAVCWnd@@@Z
?Backup@CMetaBack@@QEAAJPEBG@Z
?Backup@CMetaInterface@@IEAAJPEBGKK@Z
?BackupWithPassword@CMetaBack@@QEAAJPEBG0@Z
?BackupWithPassword@CMetaInterface@@IEAAJPEBGKK0@Z
?BitmapHeight@CRMCListBoxResources@@QEBAHXZ
?BitmapWidth@CRMCListBoxResources@@QEBAHXZ
?BuildFloat@CINumber@@SANJJ@Z
?BuildMetaPath@CMetabasePath@@IEAAXPEBG000@Z
?BuildMetaPath@CMetabasePath@@IEAAXPEBGK00@Z
?CalculateTextHeight@CODLBox@@IEAAXPEAVCFont@@@Z
?ChangeFont@CODLBox@@QEAAHPEAVCFont@@@Z
?ChangeProxyBlanket@CIISInterface@@UEAAJPEBG0@Z
?CheckDescendants@CMetaKey@@QEAAJKPEAVCComAuthInfo@@PEBG@Z
?CleanDescendantPath@CInheritanceDlg@@IEAAAEAVCString@@AEAV2@@Z
?CleanMetaPath@CMetabasePath@@SAPEBGAEAVCString@@@Z
?CleanUp@CBlob@@QEAAXXZ
?ClearPasswordBuffers@CStrPassword@@AEAAXXZ
?Close@CMetaKey@@QEAAJXZ
?CloseKey@CMetaInterface@@IEAAJK@Z
?ColorHighlight@CRMCListBoxResources@@QEBAKXZ
?ColorHighlightText@CRMCListBoxResources@@QEBAKXZ
?ColorWindow@CRMCListBoxResources@@QEBAKXZ
?ColorWindowText@CRMCListBoxResources@@QEBAKXZ
?ColumnText@CODLBox@@IEAAHAEAVCRMCListBoxDrawStruct@@HHPEBG@Z
?ColumnText@CODLBox@@KAHPEAVCDC@@HHHHPEBG@Z
?CommonConstruct@CIISApplication@@IEAAXXZ
?Compare@CObjectPlus@@UEBAHPEBV1@@Z
?Compare@CStrPassword@@QEBAHAEAV1@@Z
?Compare@CStrPassword@@QEBAHAEAVCString@@@Z
?Compare@CStrPassword@@QEBAHPEBG@Z
?CompareItem@CIPAddress@@QEBAHAEBV1@@Z
?ComputeMargins@CODLBox@@IEAAXAEAVCRMCListBoxDrawStruct@@HAEAH1@Z
?Construct@CError@@IEAAAEBV1@AEBV1@@Z
?Construct@CError@@IEAAAEBV1@J@Z
?ConvertFloatToString@CINumber@@SAPEBGNHAEAVCString@@@Z
?ConvertLongToString@CINumber@@SAPEBGJAEAVCString@@@Z
?ConvertStringToFloat@CINumber@@SAHPEBGAEAN@Z
?ConvertStringToLong@CINumber@@SAHPEBGAEAJ@Z
?ConvertStringToLongLong@CINumber@@SAHPEBGAEA_K@Z
?ConvertToParentPath@CMetaKey@@QEAAJH@Z
?ConvertToParentPath@CMetabasePath@@SAPEBGAEAVCString@@@Z
?CopyData@CMetaInterface@@IEAAJKPEBGK0KKKH@Z
?CopyKey@CMetaInterface@@IEAAJKPEBGK0HH@Z
?CopyTo@CStrPassword@@QEAAXAEAV1@@Z
?CopyTo@CStrPassword@@QEAAXAEAVCString@@@Z
?Create@CIISAppPool@@QEAAJPEBG@Z
?Create@CIISApplication@@QEAAJPEBGK@Z
?Create@CIISInterface@@IEAAJHHQEBU_GUID@@0PEAHPEAPEAUIUnknown@@@Z
?Create@CIISSvcControl@@IEAAJXZ
?Create@CMetaInterface@@IEAAJH@Z
?Create@CRMCListBoxHeader@@QEAAHKAEBUtagRECT@@PEAVCWnd@@PEAVCHeaderListBox@@I@Z
?Create@CWamInterface@@IEAAJXZ
?CreateApplication@CWamInterface@@IEAAJPEBGK0H@Z
?CreateApplicationPool@CWamInterface@@IEAAJPEBG@Z
?CreateObject@CEmphasizedDialog@@SAPEAVCObject@@XZ
?CreateObject@CIISWizardBookEnd@@SAPEAVCObject@@XZ
?CreateObject@CIISWizardPage@@SAPEAVCObject@@XZ
?CreateObject@CIISWizardSheet@@SAPEAVCObject@@XZ
?CreatePathFromFailedOpen@CMetaKey@@QEAAJXZ
?CreatePooled@CIISApplication@@QEAAJPEBGK0H@Z
?CreateServerInfoStruct@CComAuthInfo@@QEBAPEAU_COSERVERINFO@@K@Z
?CreateServerInfoStruct@CComAuthInfo@@QEBAPEAU_COSERVERINFO@@XZ
?CreateSink@CIISIMSAdminBaseSink@@IEAAJPEAVCMetaInterface@@H@Z
?CreateSite@CMetaInterface@@QEAAJPEBG000PEAK1@Z
?CvtToInternalFormat@CError@@KAJJ@Z
?DDV_ShowBalloonAndFail@@YAXPEAVCDataExchange@@I@Z
?DDV_ShowBalloonAndFail@@YAXPEAVCDataExchange@@VCString@@@Z
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAE@Z
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAF@Z
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAH@Z
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAI@Z
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAJ@Z
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAK@Z
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEA_J@Z
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEA_K@Z
?DWORDtoLPBYTE@CIPAddress@@SAPEAEKPEAE@Z
?DeAllocate@CINumber@@KAXXZ
?DeAllocateStatics@CError@@KAXXZ
?Delete@CIISAppPool@@QEAAJPEBG@Z
?Delete@CIISApplication@@QEAAJH@Z
?Delete@CMetaBack@@QEAAJPEBGK@Z
?DeleteAllData@CMetaInterface@@IEAAJKPEBGKK@Z
?DeleteApplication@CWamInterface@@IEAAJPEBGH@Z
?DeleteApplicationPool@CWamInterface@@IEAAJPEBG@Z
?DeleteBackup@CMetaInterface@@IEAAJPEBGK@Z
?DeleteChildKeys@CMetaInterface@@IEAAJKPEBG@Z
?DeleteData@CMetaInterface@@IEAAJKPEBGKK@Z
?DeleteHeaderItem@CHeaderListBox@@IEAAHH@Z
?DeleteItem@CRMCListBoxHeader@@QEAAHH@Z
?DeleteKey@CMetaInterface@@IEAAJKPEBG@Z
?DeleteKey@CMetaKey@@QEAAJPEBG@Z
?DeleteRecoverable@CIISApplication@@QEAAJH@Z
?DeleteValue@CMetaKey@@QEAAJKPEBG@Z
?DestroyClearTextPassword@CStrPassword@@QEBAXPEAG@Z
?DistributeColumns@CHeaderListBox@@IEAAXXZ
?DoDataExchange@CConfirmDlg@@MEAAXPEAVCDataExchange@@@Z
?DoDataExchange@CInheritanceDlg@@MEAAXPEAVCDataExchange@@@Z
?DoModal@CInheritanceDlg@@UEAA_JXZ
?DoesPathExist@CMetaKey@@QEAAJPEBG@Z
?DoesRespondToColumnWidthChanges@CRMCListBoxHeader@@QEBAHXZ
?DrawBitmap@CODLBox@@IEAAHAEAVCRMCListBoxDrawStruct@@HH@Z
?DrawItem@CRMCComboBox@@MEAAXPEAUtagDRAWITEMSTRUCT@@@Z
?DrawItem@CRMCListBox@@MEAAXPEAUtagDRAWITEMSTRUCT@@@Z
?DrawItemEx@CRMCComboBox@@MEAAXAEAVCRMCListBoxDrawStruct@@@Z
?DrawItemEx@CRMCListBox@@MEAAXAEAVCRMCListBoxDrawStruct@@@Z
?DuplicateInList@CIPAccessDescriptor@@QEAAHAEAVCObListPlus@@@Z
?EditShowBalloon@@YAXPEAUHWND__@@I@Z
?EditShowBalloon@@YAXPEAUHWND__@@VCString@@@Z
?Empty@CStrPassword@@QEAAXXZ
?EnableButton@CIISWizardSheet@@QEAAXHH@Z
?EnableSheetButton@CIISWizardPage@@IEAAXHH@Z
?EnableWindow@CHeaderListBox@@QEAAHH@Z
?EnumBackups@CMetaInterface@@IEAAJPEAGPEAKPEAU_FILETIME@@K@Z
?EnumData@CMetaInterface@@IEAAJKPEBGPEAU_METADATA_RECORD@@KPEAK@Z
?EnumHistory@CMetaInterface@@IEAAJPEAGPEAK1PEAU_FILETIME@@K@Z
?EnumKeys@CMetaInterface@@IEAAJKPEBGPEAGK@Z
?EnumerateApplications@CIISAppPool@@QEAAJAEAVCStringListEx@@@Z
?EnumerateApplicationsInPool@CWamInterface@@IEAAJPEBGPEAPEAG@Z
?ExpandEscapeCode@CError@@IEBAHPEAGKAEAPEAGAEAVCString@@AEAJ@Z
?Failed@CError@@QEBAHXZ
?Failed@CError@@SAHJ@Z
?FindElement@CObListPlus@@QEBAHPEAVCObject@@@Z
?FindFacility@CError@@KAPEBGK@Z
?FlagForDeletion@CAccessEntry@@QEAAXH@Z
?FreeServerInfoStruct@CComAuthInfo@@QEBAXPEAU_COSERVERINFO@@@Z
?FriendlyInstance@CInheritanceDlg@@IEAAHAEAVCString@@0@Z
?GetAdminInterface2@CMetaInterface@@QEAAJPEAPEAUIMSAdminBase2W@@@Z
?GetAdminInterface3@CMetaInterface@@QEAAJPEAPEAUIMSAdminBase3W@@@Z
?GetAllData@CMetaInterface@@IEAAJKPEBGKKKPEAK1KPEAE1@Z
?GetAllData@CMetaKey@@IEAAJKKKPEAK0PEAPEAEPEBG@Z
?GetAppAdminInterface@CWamInterface@@QEAAJPEAPEAUIIISApplicationAdmin@@@Z
?GetBackgroundBrush@CIISWizardPage@@IEBAPEAUHBRUSH__@@XZ
?GetBackgroundBrush@CIISWizardSheet@@QEBAPEAUHBRUSH__@@XZ
?GetBase@CMetaKey@@QEBAKXZ
?GetBigFont@CIISWizardPage@@IEAAPEAVCFont@@XZ
?GetBigFont@CIISWizardSheet@@QEAAPEAVCFont@@XZ
?GetBitmapMemDC@CIISWizardPage@@IEAAPEAVCDC@@XZ
?GetBitmapMemDC@CIISWizardSheet@@QEAAPEAVCDC@@H@Z
?GetBoldFont@CIISWizardPage@@IEAAPEAVCFont@@XZ
?GetBoldFont@CIISWizardSheet@@QEAAPEAVCFont@@XZ
?GetByteLength@CStrPassword@@QEBAHXZ
?GetChildPaths@CMetaInterface@@IEAAJKPEBGKPEAGPEAK@Z
?GetChildPaths@CMetaKey@@QEAAJAEAVCStringListEx@@PEBG@Z
?GetClearTextPassword@CStrPassword@@QEAAPEAGXZ
?GetColumnWidth@CRMCListBoxHeader@@QEBAHH@Z
?GetComputer@CGetComputer@@QEAAHPEAUHWND__@@@Z
?GetCurSel@CRMCListBox@@QEBAHXZ
?GetData@CBlob@@QEAAPEAEXZ
?GetData@CMetaInterface@@IEAAJKPEBGPEAU_METADATA_RECORD@@PEAK@Z
?GetDataPaths@CInheritanceDlg@@IEAAJXZ
?GetDataPaths@CMetaInterface@@IEAAJKPEBGKKKPEAGPEAK@Z
?GetDataPaths@CMetaKey@@QEAAJAEAVCStringListEx@@KKPEBG@Z
?GetHandle@CMetaKey@@QEBAKXZ
?GetHeader@CHeaderListBox@@IEAAPEAVCRMCListBoxHeader@@XZ
?GetHeaderItem@CHeaderListBox@@IEBAHHPEAU_HD_ITEMW@@@Z
?GetHeaderItemCount@CHeaderListBox@@IEBAHXZ
?GetIUsrAccount@@YAHPEBGPEAVCWnd@@AEAVCString@@@Z
?GetIUsrAccount@@YAHPEBGPEAVCWnd@@PEAGH@Z
?GetInstanceNumber@CMetabasePath@@SAKPEBG@Z
?GetInstancePath@CMetabasePath@@SAPEBGPEBGAEAVCString@@PEAV2@@Z
?GetInterface@CMetaInterface@@QEAAPEAUIMSAdminBaseW@@XZ
?GetItem@CRMCListBoxHeader@@QEBAHHPEAU_HD_ITEMW@@@Z
?GetItemCount@CRMCListBoxHeader@@QEBAHXZ
?GetLastChangeTime@CMetaInterface@@IEAAJKPEBGPEAU_FILETIME@@H@Z
?GetLastNodeName@CMetabasePath@@SAPEBGPEBGAEAVCString@@@Z
?GetLastWinError@CError@@QEAAXXZ
?GetLength@CStrPassword@@QEBAHXZ
?GetMDFieldDef@CMetaKey@@SAHKAEAK000@Z
?GetMachinePath@CMetabasePath@@SAPEBGPEBGAEAVCString@@PEAV2@@Z
?GetMessageMap@CConfirmDlg@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CEmphasizedDialog@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CHeaderListBox@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CIISWizardBookEnd@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CIISWizardPage@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CIISWizardSheet@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CInheritanceDlg@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CRMCComboBox@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CRMCListBox@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMessageMap@CRMCListBoxHeader@@MEBAPEBUAFX_MSGMAP@@XZ
?GetMetaProp@CMetaKey@@SAPEBUtagMDFIELDDEF@1@K@Z
?GetNextSelectedItem@CRMCListBox@@QEAAPEAXPEAH@Z
?GetPassword@CConfirmDlg@@QEAAAEAVCString@@XZ
?GetProcessMode@CIISAppPool@@QEAAJPEAK@Z
?GetProcessMode@CWamInterface@@IEAAJPEAK@Z
?GetPropertyDescription@CMetaKey@@SAHKAEAVCString@@@Z

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisutil.dll
.dll windows:10 windows x64

b5ad768ed2464cf420ca46a068aa277e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_callnewh
malloc
free
_wcsnicmp
__C_specific_handler
atof
isdigit
strtok
isalnum
isalpha
atoi
tolower
toupper
_itoa_s
wcsstr
_wcslwr
_aligned_malloc
_aligned_free
_XcptFilter
_lock
swprintf_s
_unlock
_vsnprintf_s
__dllonexit
_onexit
wcsnlen
strrchr
strcpy_s
_purecall
wcsrchr
??1type_info@@UEAA@XZ
strcat_s
sprintf_s
isxdigit
memmove
strchr
_vscwprintf
iswalnum
_amsg_exit
_snprintf_s
memcpy
_CxxThrowException
iswxdigit
wcschr
wcsncpy_s
_vsnwprintf_s
_initterm
strncpy_s
strnlen
_stricmp
_wcsicmp
_vsnprintf
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlSetThreadPreferredUILanguages
RtlGetCurrentPeb
RtlUpcaseUnicodeChar
RtlNtStatusToDosError
RtlMultiByteToUnicodeN
EtwGetTraceEnableFlags
RtlVirtualUnwind
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwLogTraceEvent
RtlAddMandatoryAce
RtlCreateAcl
RtlGetNtProductType
RtlCaptureStackBackTrace
EtwGetTraceEnableLevel

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
CreateThread
TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
GetCurrentThread
SetThreadToken
OpenThreadToken

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree
GlobalAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
WaitForMultipleObjectsEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
SetEvent
CreateMutexA
WaitForSingleObject
CreateEventA
CreateEventW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetWindowsDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetTickCount64
GetSystemDirectoryW
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
GetModuleHandleA
LoadStringA
GetProcAddress
FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameW
LoadStringW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeaps
HeapSetInformation
HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetStdHandle

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
IsDBCSLeadByteEx
GetSystemDefaultLangID
GetThreadPreferredUILanguages
FormatMessageA
IsDBCSLeadByte

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-file-l1-1-0

CreateFileW
FileTimeToLocalFileTime
WriteFile
FlushFileBuffers
CreateFileA
ReadFile

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead
QueryDepthSList
InterlockedPopEntrySList

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoDisconnectObject

api-ms-win-security-base-l1-1-0

InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AddAccessDeniedAce
GetKernelObjectSecurity
GetAce
SetTokenInformation
AddAce
InitializeAcl
GetLengthSid
GetTokenInformation
DuplicateTokenEx
FreeSid
AllocateAndInitializeSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
CreateWellKnownSid
GetAclInformation
GetSecurityDescriptorDacl
EqualSid
AddAccessAllowedAce
SetKernelObjectSecurity
SetSecurityDescriptorDacl
RevertToSelf
AdjustTokenPrivileges
MakeAbsoluteSD

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatA
GetDateFormatA

api-ms-win-core-io-l1-1-0

CancelIoEx
GetOverlappedResult

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe
SetNamedPipeHandleState
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

ws2_32

FreeAddrInfoW
ntohl
WSAStartup
GetHostNameW
GetAddrInfoW
WSAGetLastError
WSACleanup

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
EnumUILanguagesW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
UnregisterWait

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW
ReportEventW

api-ms-win-core-threadpool-l1-1-0

CreateTimerQueueTimer
RegisterWaitForSingleObjectEx
CreateTimerQueue
DeleteTimerQueueTimer
UnregisterWaitEx
DeleteTimerQueueEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

??0?$CDataCache@UDATETIME_FORMAT_ENTRY@@@@QEAA@XZ
??0?$CDataCache@VCDateTime@@@@QEAA@XZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
??0ASCLOG_DATETIME_CACHE@@QEAA@XZ
??0BIG_REF_TRACE@@QEAA@XZ
??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
??0CACHED_DATETIME_FORMATS@@QEAA@XZ
??0CCritSec@@QEAA@XZ
??0CDFTCache@@QEAA@XZ
??0CDateTime@@QEAA@AEBU_FILETIME@@@Z
??0CDateTime@@QEAA@AEBU_FILETIME@@AEBU_SYSTEMTIME@@@Z
??0CDateTime@@QEAA@AEBU_SYSTEMTIME@@@Z
??0CDateTime@@QEAA@XZ
??0CDoubleList@@QEAA@XZ
??0CEtwTracer@@QEAA@XZ
??0CFakeLock@@QEAA@XZ
??0CHUNK_BUFFER@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CLKRHashTableStats@@QEAA@XZ
??0CLKRHashTable_Iterator@@IEAA@PEAVCLKRHashTable@@F@Z
??0CLKRHashTable_Iterator@@QEAA@$$QEAV0@@Z
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
??0CLKRHashTable_Iterator@@QEAA@XZ
??0CLKRLinearHashTable@@AEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKPEAVCLKRHashTable@@_N@Z
??0CLKRLinearHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CLKRLinearHashTable_Iterator@@IEAA@PEAVCLKRLinearHashTable@@PEAVCNodeClump@@KF@Z
??0CLKRLinearHashTable_Iterator@@QEAA@AEBV0@@Z
??0CLKRLinearHashTable_Iterator@@QEAA@XZ
??0CLockedDoubleList@@QEAA@$$QEAV0@@Z
??0CLockedDoubleList@@QEAA@AEBV0@@Z
??0CLockedDoubleList@@QEAA@XZ
??0CLockedSingleList@@QEAA@$$QEAV0@@Z
??0CLockedSingleList@@QEAA@AEBV0@@Z
??0CLockedSingleList@@QEAA@XZ
??0CReaderWriterLock2@@QEAA@AEBV0@@Z
??0CReaderWriterLock2@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@AEBV0@@Z
??0CReaderWriterLock3@@QEAA@XZ
??0CReaderWriterLock@@QEAA@AEBV0@@Z
??0CReaderWriterLock@@QEAA@XZ
??0CRtlResource@@QEAA@AEBV0@@Z
??0CRtlResource@@QEAA@XZ
??0CSecurityDispenser@@QEAA@XZ
??0CShareLock@@QEAA@XZ
??0CSharelock@@QEAA@HH@Z
??0CSingleList@@QEAA@XZ
??0CSmallSpinLock@@QEAA@AEBV0@@Z
??0CSmallSpinLock@@QEAA@XZ
??0CSpinLock@@QEAA@AEBV0@@Z
??0CSpinLock@@QEAA@XZ
??0EVENT_LOG@@QEAA@PEBG@Z
??0EXTLOG_DATETIME_CACHE@@QEAA@XZ
??0IPM2_MESSAGE_PIPE@@AEAA@XZ
??0IPM2_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??0IPM_MESSAGE_PIPE@@AEAA@XZ
??0IPM_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??0LANG_STRING@@QEAA@XZ
??0MB@@QEAA@PEAUIMSAdminBaseW@@@Z
??0MB_BASE_NOTIFICATION_SINK@@QEAA@XZ
??0MULTISZ@@QEAA@AEBV0@@Z
??0MULTISZ@@QEAA@PEAGK@Z
??0MULTISZ@@QEAA@PEBG@Z
??0MULTISZ@@QEAA@XZ
??0MULTISZA@@QEAA@AEBV0@@Z
??0MULTISZA@@QEAA@PEADK@Z
??0MULTISZA@@QEAA@PEBD@Z
??0MULTISZA@@QEAA@XZ
??0MULTI_IPM@@QEAA@XZ
??0STRA@@AEAA@AEBV0@@Z
??0STRA@@AEAA@PEAD@Z
??0STRA@@AEAA@PEBD@Z
??0STRA@@QEAA@PEADK@Z
??0STRA@@QEAA@XZ
??0STRAU@@QEAA@AEAV0@@Z
??0STRAU@@QEAA@PEBD@Z
??0STRAU@@QEAA@PEBDH@Z
??0STRAU@@QEAA@PEBG@Z
??0STRAU@@QEAA@XZ
??0STRU@@AEAA@AEBV0@@Z
??0STRU@@AEAA@PEAG@Z
??0STRU@@AEAA@PEBG@Z
??0STRU@@QEAA@PEAGK@Z
??0STRU@@QEAA@XZ
??0STRU_PATH@@QEAA@G@Z
??0STRU_PATH@@QEAA@PEAGKG@Z
??0TREE_HASH_TABLE@@QEAA@AEBV0@@Z
??0TREE_HASH_TABLE@@QEAA@H@Z
??0TS_RESOURCE@@QEAA@AEBV0@@Z
??0TS_RESOURCE@@QEAA@XZ
??0W3_TRACE_LOG@@QEAA@PEAVW3_TRACE_LOG_FACTORY@@@Z
??0W3_TRACE_LOG_FACTORY@@AEAA@XZ
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??1ASCLOG_DATETIME_CACHE@@UEAA@XZ
??1BIG_REF_TRACE@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1CACHED_DATETIME_FORMATS@@UEAA@XZ
??1CCritSec@@QEAA@XZ
??1CDoubleList@@QEAA@XZ
??1CEtwTracer@@QEAA@XZ
??1CFakeLock@@QEAA@XZ
??1CHUNK_BUFFER@@QEAA@XZ
??1CLKRHashTable@@QEAA@XZ
??1CLKRHashTable_Iterator@@QEAA@XZ
??1CLKRLinearHashTable@@QEAA@XZ
??1CLKRLinearHashTable_Iterator@@QEAA@XZ
??1CLockedDoubleList@@QEAA@XZ
??1CLockedSingleList@@QEAA@XZ
??1CReaderWriterLock2@@QEAA@XZ
??1CReaderWriterLock3@@QEAA@XZ
??1CReaderWriterLock@@QEAA@XZ
??1CRtlResource@@QEAA@XZ
??1CSecurityDispenser@@QEAA@XZ
??1CShareLock@@QEAA@XZ
??1CSharelock@@QEAA@XZ
??1CSingleList@@QEAA@XZ
??1CSmallSpinLock@@QEAA@XZ
??1CSpinLock@@QEAA@XZ
??1EXTLOG_DATETIME_CACHE@@UEAA@XZ
??1IPM2_MESSAGE_PIPE@@EEAA@XZ
??1IPM_MESSAGE_PIPE@@EEAA@XZ
??1MB@@QEAA@XZ
??1MB_BASE_NOTIFICATION_SINK@@UEAA@XZ
??1MULTISZ@@QEAA@XZ
??1MULTISZA@@QEAA@XZ
??1MULTI_IPM@@QEAA@XZ
??1STRA@@QEAA@XZ
??1STRAU@@QEAA@XZ
??1STRU@@QEAA@XZ
??1STRU_PATH@@QEAA@XZ
??1TREE_HASH_TABLE@@QEAA@XZ
??1TS_RESOURCE@@QEAA@XZ
??1W3_TRACE_LOG@@AEAA@XZ
??1W3_TRACE_LOG_FACTORY@@AEAA@XZ
??2CLKRLinearHashTable@@SAPEAX_K@Z
??3CLKRLinearHashTable@@SAXPEAX@Z
??4?$CLockBase@$00$00$02$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$00$00$02$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$01$00$00$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$01$00$00$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$02$00$00$00$00$00@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$02$00$00$00$00$00@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$03$00$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$03$00$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$04$01$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$04$01$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$05$01$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$05$01$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$06$01$01$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$06$01$01$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$07$01$01$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$07$01$01$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$08$01$00$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$08$01$00$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4ALLOC_CACHE_HANDLER@@QEAAAEAV0@AEBV0@@Z
??4BIG_REF_TRACE@@QEAAAEAV0@AEBV0@@Z
??4BUFFER@@QEAAAEAV0@AEBV0@@Z
??4CCritSec@@QEAAAEAV0@AEBV0@@Z
??4CDateTime@@QEAAAEAV0@$$QEAV0@@Z
??4CDateTime@@QEAAAEAV0@AEBV0@@Z
??4CDoubleList@@QEAAAEAV0@AEBV0@@Z
??4CFakeLock@@QEAAAEAV0@AEBV0@@Z
??4CHUNK_BUFFER@@QEAAAEAV0@AEBV0@@Z
??4CLKRHashTableStats@@QEAAAEAV0@$$QEAV0@@Z
??4CLKRHashTableStats@@QEAAAEAV0@AEBV0@@Z
??4CLKRHashTable_Iterator@@QEAAAEAV0@$$QEAV0@@Z
??4CLKRHashTable_Iterator@@QEAAAEAV0@AEBV0@@Z
??4CLKRLinearHashTable_Iterator@@QEAAAEAV0@AEBV0@@Z
??4CLockedDoubleList@@QEAAAEAV0@$$QEAV0@@Z
??4CLockedDoubleList@@QEAAAEAV0@AEBV0@@Z
??4CLockedSingleList@@QEAAAEAV0@$$QEAV0@@Z
??4CLockedSingleList@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock2@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock3@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock@@QEAAAEAV0@AEBV0@@Z
??4CRtlResource@@QEAAAEAV0@AEBV0@@Z
??4CSecurityDispenser@@QEAAAEAV0@AEBV0@@Z
??4CSingleList@@QEAAAEAV0@AEBV0@@Z
??4CSmallSpinLock@@QEAAAEAV0@AEBV0@@Z
??4CSpinLock@@QEAAAEAV0@AEBV0@@Z
??4DATETIME_FORMAT_ENTRY@@QEAAAEAU0@$$QEAU0@@Z
??4DATETIME_FORMAT_ENTRY@@QEAAAEAU0@AEBU0@@Z
??4EVENT_LOG@@QEAAAEAV0@$$QEAV0@@Z
??4EVENT_LOG@@QEAAAEAV0@AEBV0@@Z
??4IPM2_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??4IPM_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??4LANG_STRING@@QEAAAEAV0@$$QEAV0@@Z
??4LANG_STRING@@QEAAAEAV0@AEBV0@@Z
??4MB@@QEAAAEAV0@AEBV0@@Z
??4MULTISZ@@QEAAAEAV0@AEBV0@@Z
??4MULTISZA@@QEAAAEAV0@AEBV0@@Z
??4STRA@@AEAAAEAV0@AEBV0@@Z
??4STRAU@@QEAAAEAV0@AEBV0@@Z
??4STRU@@AEAAAEAV0@AEBV0@@Z
??4TREE_HASH_TABLE@@QEAAAEAV0@AEBV0@@Z
??4TS_RESOURCE@@QEAAAEAV0@AEBV0@@Z
??4W3_TRACE_LOG@@QEAAAEAV0@AEBV0@@Z
??4W3_TRACE_LOG_FACTORY@@QEAAAEAV0@AEBV0@@Z
??8CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
??8CLKRLinearHashTable_Iterator@@QEBA_NAEBV0@@Z
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
??9CLKRLinearHashTable_Iterator@@QEBA_NAEBV0@@Z
??_7ASCLOG_DATETIME_CACHE@@6B@
??_7CACHED_DATETIME_FORMATS@@6B@
??_7EXTLOG_DATETIME_CACHE@@6B@
??_7IPM2_MESSAGE_PIPE@@6B@
??_7IPM_MESSAGE_PIPE@@6B@
??_7TREE_HASH_TABLE@@6B@
??_FCSharelock@@QEAAXXZ
??_FSTRU_PATH@@QEAAXXZ
?ActiveUsers@CSharelock@@QEAAHXZ
?AddNewBlock@CHUNK_BUFFER@@AEAAJK@Z
?AddNodeInternal@TREE_HASH_TABLE@@AEAAJPEBGKPEAXPEAUTREE_HASH_NODE@@PEAPEAU2@@Z
?AddObject@MB@@QEAAHPEBG@Z
?AddRef@MB_BASE_NOTIFICATION_SINK@@UEAAKXZ
?AddTrace@BIG_REF_TRACE@@AEAAJPEAXHH@Z
?AdjustTokenForAdministrators@CSecurityDispenser@@QEAAKPEAX@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?AllocateEntry@BIG_REF_TRACE@@AEAAPEAU_REF_TRACE_ENTRY@@XZ
?AllocateHeadEntry@BIG_REF_TRACE@@AEAAPEAU_REF_TRACE_HEAD_ENTRY@@PEAX@Z
?AllocateNode@TREE_HASH_TABLE@@AEAAJPEBGKPEAXPEAUTREE_HASH_NODE@@PEAPEAU2@@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJKPEAPEAD@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJKPEAPEAG@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJKPEAPEAX@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJPEADKPEAPEAD@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJPEAGKPEAPEAG@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHPEBGK@Z
?Append@MULTISZA@@QEAAHAEAVSTRA@@@Z
?Append@MULTISZA@@QEAAHPEBD@Z
?Append@MULTISZA@@QEAAHPEBDK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@STRAU@@QEAAHAEAV1@@Z
?Append@STRAU@@QEAAHPEBD@Z
?Append@STRAU@@QEAAHPEBDK@Z
?Append@STRAU@@QEAAHPEBG@Z
?Append@STRAU@@QEAAHPEBGK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJG@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBGK@Z
?AppendA@STRU@@QEAAJPEBD@Z
?AppendA@STRU@@QEAAJPEBDK@Z
?AppendA_ACP@STRU@@QEAAJPEBD@Z
?AppendA_ACP@STRU@@QEAAJPEBDK@Z
?AppendData@W3_TRACE_LOG_FACTORY@@QEAAJPEAXK@Z
?AppendW@MULTISZA@@QEAAHPEBG@Z
?AppendW@MULTISZA@@QEAAHPEBGK@Z
?AppendW@STRA@@QEAAJPEBG@Z
?AppendW@STRA@@QEAAJPEBGK@Z
?AppendWSimple@STRA@@QEAAJPEBGK@Z
?AppendWTruncate@STRA@@QEAAJPEBG@Z
?AppendWTruncate@STRA@@QEAAJPEBGK@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?Apply@CLKRLinearHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@CLKRLinearHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@TREE_HASH_TABLE@@QEAAXP6AXPEAX0@Z0@Z
?AuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?AuxAppend@MULTISZA@@AEAAHPEBEIH@Z
?AuxAppend@STRA@@AEAAJPEBEKK_N@Z
?AuxAppend@STRAU@@AEAAHPEBDIH@Z
?AuxAppend@STRAU@@AEAAHPEBGIH@Z
?AuxAppend@STRU@@AEAAJPEBEKK_N@Z
?AuxAppendA@STRU@@AEAAJPEBEKK_N1@Z
?AuxAppendW@MULTISZA@@AEAAHPEBGIH@Z
?AuxAppendW@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWSimple@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWTruncate@STRA@@AEAAJPEBGKK_N@Z
?AuxInit@MULTISZ@@AEAAXPEBG@Z
?AuxInit@MULTISZA@@AEAAXPEBE@Z
?AuxInit@STRAU@@AEAAXPEBD@Z
?AuxInit@STRAU@@AEAAXPEBG@Z
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?Begin@CLKRLinearHashTable@@QEAA?AVCLKRLinearHashTable_Iterator@@XZ
?BucketIndex@CLKRHashTableStats@@SAJJ@Z
?BucketSize@CLKRHashTableStats@@SAJJ@Z
?BucketSizes@CLKRHashTableStats@@SAPEBJXZ
?CalcHash@TREE_HASH_TABLE@@QEAAKPEBG@Z
?CalcLength@MULTISZ@@SAKPEBGPEAK@Z
?CalcLength@MULTISZA@@SAKPEBDPEAK@Z
?ChangeExclusiveLockToSharedLock@CSharelock@@QEAAXXZ
?ChangeSharedLockToExclusiveLock@CSharelock@@QEAAEH@Z
?CheckSignature@BIG_REF_TRACE@@AEBAHXZ
?CheckTable@CLKRHashTable@@QEBAHXZ
?CheckTable@CLKRLinearHashTable@@QEBAHXZ
?ClaimExclusiveLock@CSharelock@@QEAAEH@Z
?ClaimShareLock@CSharelock@@QEAAEH@Z
?ClassName@CCritSec@@SAPEBGXZ
?ClassName@CFakeLock@@SAPEBGXZ
?ClassName@CLKRHashTable@@SAPEBGXZ
?ClassName@CLKRLinearHashTable@@SAPEBGXZ
?ClassName@CReaderWriterLock2@@SAPEBGXZ
?ClassName@CReaderWriterLock3@@SAPEBGXZ
?ClassName@CReaderWriterLock@@SAPEBGXZ
?ClassName@CRtlResource@@SAPEBDXZ
?ClassName@CShareLock@@SAPEBDXZ
?ClassName@CSmallSpinLock@@SAPEBGXZ
?ClassName@CSpinLock@@SAPEBGXZ
?Cleanup@ALLOC_CACHE_HANDLER@@SAHH@Z
?CleanupAllLookasides@ALLOC_CACHE_HANDLER@@SAXPEAXE@Z
?CleanupLookaside@ALLOC_CACHE_HANDLER@@QEAAXH@Z
?Clear@CLKRHashTable@@QEAAXXZ
?Clear@CLKRLinearHashTable@@QEAAXXZ
?Clear@TREE_HASH_TABLE@@QEAAXXZ
?ClearBuffer@W3_TRACE_LOG@@QEAAXXZ
?Clone@MULTISZ@@QEBAHPEAV1@@Z
?Clone@MULTISZA@@QEBAHPEAV1@@Z
?Clone@STRA@@QEBAJPEAV1@@Z
?Close@MB@@QEAAHXZ
?Convert@TS_RESOURCE@@QEAAXW4TSRES_CONV_TYPE@@@Z
?ConvertExclusiveToShared@CCritSec@@QEAAXXZ
?ConvertExclusiveToShared@CFakeLock@@QEAAXXZ
?ConvertExclusiveToShared@CLKRHashTable@@QEBAXXZ
?ConvertExclusiveToShared@CLKRLinearHashTable@@QEBAXXZ
?ConvertExclusiveToShared@CReaderWriterLock2@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock3@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock@@QEAAXXZ
?ConvertExclusiveToShared@CRtlResource@@QEAAXXZ
?ConvertExclusiveToShared@CShareLock@@QEAAXXZ
?ConvertExclusiveToShared@CSmallSpinLock@@QEAAXXZ
?ConvertExclusiveToShared@CSpinLock@@QEAAXXZ
?ConvertSharedToExclusive@CCritSec@@QEAAXXZ
?ConvertSharedToExclusive@CFakeLock@@QEAAXXZ
?ConvertSharedToExclusive@CLKRHashTable@@QEBAXXZ
?ConvertSharedToExclusive@CLKRLinearHashTable@@QEBAXXZ
?ConvertSharedToExclusive@CReaderWriterLock2@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock3@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock@@QEAAXXZ
?ConvertSharedToExclusive@CRtlResource@@QEAAXXZ
?ConvertSharedToExclusive@CShareLock@@QEAAXXZ
?ConvertSharedToExclusive@CSmallSpinLock@@QEAAXXZ
?ConvertSharedToExclusive@CSpinLock@@QEAAXXZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@MULTISZ@@QEAAHPEBGK@Z
?Copy@MULTISZA@@QEAAHAEBV1@@Z
?Copy@MULTISZA@@QEAAHPEBDK@Z
?Copy@STRA@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRAU@@QEAAHAEAV1@@Z
?Copy@STRAU@@QEAAHPEBD@Z
?Copy@STRAU@@QEAAHPEBDK@Z
?Copy@STRAU@@QEAAHPEBG@Z
?Copy@STRAU@@QEAAHPEBGK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?CopyA@STRU@@QEAAJPEBD@Z
?CopyA@STRU@@QEAAJPEBDK@Z
?CopyA_ACP@STRU@@QEAAJPEBD@Z
?CopyA_ACP@STRU@@QEAAJPEBDK@Z
?CopyBinary@STRA@@QEAAJPEAXK@Z
?CopyFormattedData@CDFTCache@@QEBAHPEBU_SYSTEMTIME@@PEAD@Z
?CopyFormattedData@DATETIME_FORMAT_ENTRY@@QEBAXPEBU_SYSTEMTIME@@PEAD@Z
?CopyToBuffer@MULTISZ@@QEBAHPEAGPEAK@Z
?CopyToBuffer@MULTISZA@@QEBAHPEADPEAK@Z
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
?CopyToBuffer@STRU@@QEBAJPEAGPEAK@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyW@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Escaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SAJPEAVIPM2_MESSAGE_ACCEPTOR@@PEBGHHKPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@PEAH@Z
?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SAJPEAVIPM2_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
?CreateIpmMessagePipe@IPM_MESSAGE_PIPE@@SAJPEAVIPM_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
?CreateServer@MULTI_IPM@@QEAAJPEBGKPEAU_SECURITY_ATTRIBUTES@@@Z
?CreateTraceLog@W3_TRACE_LOG_FACTORY@@QEAAJPEAPEAVW3_TRACE_LOG@@@Z
?CreateTraceLogFactory@W3_TRACE_LOG_FACTORY@@SAJPEAPEAV1@PEAX@Z
?DateTimeChars@CDFTCache@@QEBAKXZ
?DecrementAcceptorInUse@IPM2_MESSAGE_PIPE@@AEAAXXZ
?DecrementAcceptorInUse@IPM_MESSAGE_PIPE@@AEAAXXZ
?DeleteData@MB@@QEAAHPEBGKKK@Z
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?DeleteIf@CLKRLinearHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?DeleteIf@TREE_HASH_TABLE@@QEAAXP6AHPEAX0@Z0@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?DeleteKey@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?DeleteNode@TREE_HASH_TABLE@@AEAAXPEAUTREE_HASH_NODE@@@Z
?DeleteNodeInternal@TREE_HASH_TABLE@@AEAAXPEAPEAUTREE_HASH_NODE@@PEAU2@@Z
?DeleteObject@MB@@QEAAHPEBG@Z
?DeletePath@TREE_HASH_TABLE@@QEAAXPEBG@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?DeleteRecord@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?DestroyEventLogSource@EVENT_LOG@@CAXPEAU_EVENT_LOG_SOURCE@@@Z
?DestroyIpmMessagePipe@IPM2_MESSAGE_PIPE@@QEAAXXZ
?DestroyIpmMessagePipe@IPM_MESSAGE_PIPE@@QEAAXXZ
?DestroyTraceLog@W3_TRACE_LOG@@QEAAXXZ
?DestroyTraceLogFactory@W3_TRACE_LOG_FACTORY@@QEAAXXZ
?DisableEventsCallbackCustomHandler@CEtwTracer@@UEAAKXZ
?DisableFreeList@ALLOC_CACHE_HANDLER@@QEAAXXZ
?DumpStatsToHtml@ALLOC_CACHE_HANDLER@@SAHPEADPEAK@Z
?EmptyAndFreeHeadEntry@BIG_REF_TRACE@@AEAAJPEAU_REF_TRACE_HEAD_ENTRY@@@Z
?EnableEventsCallbackCustomHandler@CEtwTracer@@UEAAKXZ
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?End@CLKRLinearHashTable@@QEAA?AVCLKRLinearHashTable_Iterator@@XZ
?EnumObjects@MB@@QEAAHPEBGPEAGK@Z
?EnumUILanguagesProc@LANG_STRING@@CAHPEAG_J@Z
?EqualRange@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@1@Z
?EqualRange@CLKRLinearHashTable@@QEAA_N_KAEAVCLKRLinearHashTable_Iterator@@1@Z
?Equals@MULTISZ@@QEAAHPEAV1@@Z
?Equals@STRA@@QEBA_NAEBV1@@Z
?Equals@STRA@@QEBA_NPEBD@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
?Equals@STRU@@QEBA_NPEBG@Z
?EqualsNoCase@STRA@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRA@@QEBA_NPEBD@Z
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@0@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRLinearHashTable@@QEAA_NAEAVCLKRLinearHashTable_Iterator@@0@Z
?Erase@CLKRLinearHashTable@@QEAA_NAEAVCLKRLinearHashTable_Iterator@@@Z
?Escape@STRA@@QEAAJ_N0@Z
?Escape@STRU@@QEAAJXZ
?EtwTraceEvent@CEtwTracer@@QEAAKPEAU_ETW_TRACE_EVENT@@@Z
?EtwTraceEvent@CEtwTracer@@QEAAKPEAU_EVENT_TRACE_HEADER@@@Z
?EtwTraceEvent@CEtwTracer@@QEAAKPEBU_GUID@@KZZ
?ExpandEnvironmentVariables@STRU@@SAJPEBGPEAV1@@Z
?ExpandEnvironmentVariables@STRU_PATH@@QEAAJPEAG@Z
?ExpandEnvironmentVariables@STRU_PATH@@QEAAJXZ
?FastAppend@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FastAppend@MULTISZ@@QEAAHPEBG@Z
?FastAppend@MULTISZ@@QEAAHPEBGK@Z
?FastAuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?FastCopy@MULTISZ@@QEAAHAEBV1@@Z
?FastCopy@MULTISZ@@QEAAHPEBGK@Z
?Find@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@@Z
?Find@CLKRLinearHashTable@@QEAA_N_KAEAVCLKRLinearHashTable_Iterator@@@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?FindKey@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?FindNodeInternal@TREE_HASH_TABLE@@AEAAHPEBGKPEAPEAUTREE_HASH_NODE@@PEAPEAPEAU2@@Z
?FindRecord@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?FindRecord@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?FindRecord@TREE_HASH_TABLE@@QEAAXPEBGPEAPEAX@Z
?FindRefTraceHeadEntry@BIG_REF_TRACE@@SAPEAU_REF_TRACE_HEAD_ENTRY@@PEAV1@PEAX@Z
?FindString@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindString@MULTISZ@@QEAAHPEBG@Z
?FindString@MULTISZA@@QEAAHAEAVSTRA@@@Z
?FindString@MULTISZA@@QEAAHPEBD@Z
?FindStringNoCase@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
?First@CDoubleList@@QEBAQEAVCListEntry@@XZ
?First@CLockedDoubleList@@QEAAQEAVCListEntry@@XZ
?First@MULTISZ@@QEBAPEBGXZ
?First@MULTISZA@@QEBAPEBDXZ
?FormatString@STRA@@QEAAJKQEAPEBDPEBDK@Z
?FormattedBuffer@CDFTCache@@QEBAPEBDXZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?FreeAllAllocatedSpace@CHUNK_BUFFER@@QEAAXXZ
?FreeEntry@BIG_REF_TRACE@@AEAAXPEAU_REF_TRACE_ENTRY@@@Z
?FreeHeadEntry@BIG_REF_TRACE@@AEAAXPEAU_REF_TRACE_HEAD_ENTRY@@@Z
?FreeMemory@BUFFER@@QEAAXXZ
?FreeMemoryInternal@BUFFER@@AEAAXXZ
?GenerateDateTimeString@ASCLOG_DATETIME_CACHE@@UEAAXPEAUDATETIME_FORMAT_ENTRY@@PEBU_SYSTEMTIME@@@Z
?GenerateDateTimeString@EXTLOG_DATETIME_CACHE@@UEAAXPEAUDATETIME_FORMAT_ENTRY@@PEBU_SYSTEMTIME@@@Z
?GetAll@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAK2@Z
?GetBucketLockSpinCount@CLKRHashTable@@QEBAGXZ
?GetBucketLockSpinCount@CLKRLinearHashTable@@QEBAGXZ
?GetBuffer@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAKK@Z
?GetChildPaths@MB@@QEAAHPEBGPEAVBUFFER@@@Z
?GetData@MB@@QEAAHPEBGKKKPEAXPEAKK@Z
?GetDataPaths@MB@@QEAAHPEBGKKPEAVBUFFER@@@Z
?GetDataSetNumber@MB@@QEAAHPEBGPEAK@Z
?GetDefaultSpinAdjustmentFactor@CCritSec@@SANXZ
?GetDefaultSpinAdjustmentFactor@CFakeLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CRtlResource@@SANXZ
?GetDefaultSpinAdjustmentFactor@CShareLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CSpinLock@@SANXZ
?GetDefaultSpinCount@CCritSec@@SAGXZ
?GetDefaultSpinCount@CFakeLock@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock2@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock3@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock@@SAGXZ
?GetDefaultSpinCount@CRtlResource@@SAGXZ
?GetDefaultSpinCount@CShareLock@@SAGXZ
?GetDefaultSpinCount@CSmallSpinLock@@SAGXZ
?GetDefaultSpinCount@CSpinLock@@SAGXZ
?GetDword@MB@@QEAAHPEBGKKPEAKK@Z
?GetDword@MB@@QEAAXPEBGKKKPEAKK@Z
?GetFallbackLanguage@LANG_STRING@@QEAAJPEAPEBD@Z
?GetFormattedCurrentDateTime@CACHED_DATETIME_FORMATS@@QEAAKPEAD@Z
?GetFormattedDateTime@CACHED_DATETIME_FORMATS@@QEAAKPEBU_SYSTEMTIME@@PEAD@Z
?GetIisIusrsSID@CSecurityDispenser@@QEAAKPEAPEAX@Z
?GetLanguage@LANG_STRING@@QEAAJPEBDKPEAPEBDHH@Z
?GetLanguages@LANG_STRING@@QEBAJPEAPEAPEBDPEAK@Z

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iisw3adm.dll
.dll regsvr32 windows:10 windows x64

9871789262da58b7b2f41b5c02470f24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsstr
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
_ultow_s
wcstoul
memcpy_s
_wcsdup
wcscat_s
_wcslwr_s
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
swprintf_s
wcsncmp
_vsnprintf
_CxxThrowException
malloc
wcsncpy_s
__C_specific_handler
memcpy
_vsnwprintf
memmove
wcscpy_s
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memset
_wcsupr
_ltow_s
memcmp
_wcsnicmp
wcschr
_ultow
wcsrchr
__CxxFrameHandler3
free
_purecall
_wcsicmp
_i64tow_s
wcscmp

ntdll

RtlInitializeSid
RtlLengthRequiredSid
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv4StringToAddressW
WinSqmSetDWORD64
WinSqmSetDWORD
RtlNtStatusToDosError
RtlInitUnicodeString
RtlExpandEnvironmentStrings_U
RtlInitUnicodeStringEx
RtlDeregisterWaitEx
RtlRegisterWait
NtQuerySystemInformation
RtlSubAuthoritySid

api-ms-win-service-core-l1-1-0

SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW
QueryServiceStatus
ControlService

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
StartServiceW
OpenSCManagerW

api-ms-win-core-synch-l1-1-0

ResetEvent
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventA
EnterCriticalSection
CreateEventW
ReleaseMutex
SetEvent
AcquireSRWLockShared
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateMutexA
InitializeSRWLock

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
CreateProcessAsUserW
ResumeThread
CreateThread
GetExitCodeThread
SetThreadPriority
DeleteProcThreadAttributeList
GetCurrentThread
TerminateProcess
UpdateProcThreadAttribute
GetCurrentProcessId
CreateProcessW
GetExitCodeProcess
OpenProcessToken
InitializeProcThreadAttributeList
GetCurrentProcess

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetTickCount
GetSystemInfo
GetSystemDirectoryW
GetLogicalProcessorInformationEx

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoRegisterClassObject
CoTaskMemFree
CoTaskMemAlloc
CoFreeUnusedLibrariesEx
CoCreateInstance
CoRevokeClassObject
CoInitializeSecurity
CoUninitialize

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolThreadMaximum
WaitForThreadpoolIoCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CloseThreadpool
CloseThreadpoolCleanupGroupMembers
CreateThreadpool
CloseThreadpoolIo
SetThreadpoolThreadMinimum
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolIo
WaitForThreadpoolTimerCallbacks
StartThreadpoolIo

api-ms-win-core-io-l1-1-0

GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile
GetFileAttributesW
DeleteFileW
CreateFileW
SetFileAttributesW
GetTempFileNameW
RemoveDirectoryW
CreateDirectoryW
SetEndOfFile

api-ms-win-security-base-l1-1-0

GetLengthSid
CreateWellKnownSid
AddAccessAllowedAce
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
EqualSid
CreateRestrictedToken
AllocateLocallyUniqueId
DuplicateTokenEx
SetTokenInformation
IsValidSid
GetSecurityDescriptorDacl
CopySid
InitializeAcl
GetTokenInformation

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
FreeEnvironmentStringsW
ExpandEnvironmentStringsW

oleaut32

SysAllocString
GetErrorInfo
VariantClear
VariantInit
SysFreeString

api-ms-win-core-file-l2-1-0

MoveFileExW

dnsapi

GetCurrentTimeInSeconds

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegDeleteKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegSetKeySecurity
RegSetValueExW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

logoncli

NetGetDCName
NetIsServiceAccount

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

ws2_32

WSAGetLastError
GetNameInfoW
WSAStartup
WSACleanup

api-ms-win-security-provider-l1-1-0

SetSecurityInfo
GetSecurityInfo
SetNamedSecurityInfoW
SetEntriesInAclW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA
GetComputerNameW
UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-kernel32-legacy-l1-1-2

OpenFileMappingA

api-ms-win-core-kernel32-legacy-l1-1-1

GetNumaAvailableMemoryNodeEx
SetDllDirectoryW

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject
CreateJobObjectW
QueryInformationJobObject
SetInformationJobObject

api-ms-win-core-perfcounters-l1-1-0

PerfSetULongLongCounterValue
PerfSetCounterRefValue
PerfCreateInstance
PerfSetCounterSetInfo
PerfDeleteInstance
PerfStopProvider
PerfStartProvider

api-ms-win-core-processtopology-private-l1-1-0

SetProcessGroupAffinity

api-ms-win-core-normalization-l1-1-0

IdnToNameprepUnicode

xmllite

CreateXmlReader
CreateXmlWriter

iisutil

?Resize@STRA@@QEAAJK@Z
?Equals@STRA@@QEBA_NAEBV1@@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
??0STRA@@QEAA@PEADK@Z
DisableTokenBackupPrivilege
?WriteLock@CSmallSpinLock@@QEAAXXZ
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Append@STRU@@QEAAJPEBGK@Z
?Reset@MULTISZ@@QEAAXXZ
?Equals@MULTISZ@@QEAAHPEAV1@@Z
??1IPM_MESSAGE_PIPE@@EEAA@XZ
?EqualRange@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@1@Z
?Find@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@0@Z
?Insert@CLKRHashTable@@QEAA_NPEBXAEAVCLKRHashTable_Iterator@@_N@Z
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?Size@CLKRHashTable@@QEBAKXZ
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?ApplyIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?FindRecord@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
??1CLKRHashTable@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
??1STRU@@QEAA@XZ
??4CReaderWriterLock3@@QEAAAEAV0@AEBV0@@Z
??0CReaderWriterLock3@@QEAA@AEBV0@@Z
??1CLKRHashTable_Iterator@@QEAA@XZ
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
??1CReaderWriterLock3@@QEAA@XZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuDbgPrint
PuDbgPrintError
PuDeleteDebugPrintsObject
??0EVENT_LOG@@QEAA@PEBG@Z
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@XZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
??1STRA@@QEAA@XZ
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??0CSecurityDispenser@@QEAA@XZ
??1CSecurityDispenser@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
InitializeIISUtil
?Append@STRU@@QEAAJPEBG@Z
?GetSID@CSecurityDispenser@@QEAAKW4WELL_KNOWN_SID_TYPE@@PEAPEAX@Z
ReadDwordParameterValueFromAnyService
ReadStringParameterValueFromAnyService
?Resize@BUFFER@@QEAA_NK@Z
?GetLocalGroupSID@CSecurityDispenser@@QEAAKPEAPEAX@Z
?GetIisIusrsSID@CSecurityDispenser@@QEAAKPEAPEAX@Z
?Clear@CLKRHashTable@@QEAAXXZ
TerminateIISUtil
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0MULTISZ@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
ReadMultiStringParameterValueFromAnyService
?Append@MULTISZ@@QEAAHPEBG@Z
??0STRU@@QEAA@PEAGK@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
IsStringEqualOrdinalIgnoreCase
?SetLen@STRU@@QEAA_NK@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@MULTISZ@@QEAAHAEBV1@@Z
IsPathUnc
?Append@STRU@@QEAAJG@Z
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?Copy@STRU@@QEAAJAEBV1@@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?Resize@STRU@@QEAAJK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?FastAppend@MULTISZ@@QEAAHPEBG@Z
??0STRA@@QEAA@XZ
?Append@STRA@@QEAAJPEBD@Z
?AppendW@STRA@@QEAAJPEBG@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
?Increment@CLKRHashTable_Iterator@@QEAA_NXZ
AllocateAndCreateWellKnownSid
GetTokenUserSID
DupTokenAddAccess
FreeWellKnownSid
FreeTokenUserSID
?Append@STRU@@QEAAJAEBV1@@Z
?IsValid@CLKRHashTable@@QEBA_NXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?GetStringizedIpmOpcode@IPM_MESSAGE_PIPE@@SAPEBGW4IPM_OPCODE@@@Z
GetSecurityAttributesForSid
GenerateNameWithGUID
?CreateIpmMessagePipe@IPM_MESSAGE_PIPE@@SAJPEAVIPM_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
FreeSecurityAttributes
?DestroyIpmMessagePipe@IPM_MESSAGE_PIPE@@QEAAXXZ
?WriteMessage@IPM_MESSAGE_PIPE@@QEAAJW4IPM_OPCODE@@KPEAX@Z
CreateSubkey
SetStringParameterValueInAnyService
MakeAllProcessHeapsLFH
SetExplicitAccessSettings
??0MULTISZ@@QEAA@PEBG@Z
GetTokenSID
?AdjustTokenForAdministrators@CSecurityDispenser@@QEAAKPEAX@Z
?Clone@MULTISZ@@QEBAHPEAV1@@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
??1CSmallSpinLock@@QEAA@XZ

nativerd

TerminateNativeConfiguration
InitializeNativeConfiguration
CreateNativeConfigurationSystem
GetDefaultNativeConfigurationSystem

w3tp

ThreadPoolInitialize
ThreadPoolSetInfo
ThreadPoolTerminate

sspicli

LsaFreeReturnBuffer
LogonUserExExW

bcrypt

BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash

api-ms-win-security-lsalookup-l2-1-1

LsaManageSidNameMapping

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-logon-l1-1-0

LogonUserExW

api-ms-win-security-lsapolicy-l1-1-0

LsaAddAccountRights
LsaClose
LsaOpenPolicy
LsaFreeMemory

Exports

Exports

??0?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA@PEBDNKK_N@Z
??0?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA@PEBDNKK_N@Z
??0HASH_POOL_HASH@@QEAA@XZ
??0IPM_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??0POOL_HASH_HASH@@QEAA@XZ
??1?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA@XZ
??1?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA@XZ
??1HASH_POOL_HASH@@QEAA@XZ
??1POOL_HASH_HASH@@QEAA@XZ
??4CSecurityDispenser@@QEAAAEAV0@AEBV0@@Z
??4IPM_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??_7IPM_MESSAGE_PIPE@@6B@
?AddRefRecord@HASH_POOL_HASH@@SAXPEAVPOOL_HASH_ENTRY@@H@Z
?AddRefRecord@POOL_HASH_HASH@@SAXPEAVPOOL_HASH_ENTRY@@H@Z
?Apply@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1W4LK_LOCKTYPE@@@Z
?Apply@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?CalcKeyHash@HASH_POOL_HASH@@SAKPEBUAPP_POOL_HASH@@@Z
?CalcKeyHash@POOL_HASH_HASH@@SAKPEBG@Z
?ClearHash@HASH_POOL_HASH@@SAXPEAV1@@Z
?ClearHash@POOL_HASH_HASH@@SAXPEAV1@@Z
?DeleteIf@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1@Z
?DeleteIf@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1@Z
?DeleteKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@QEBUAPP_POOL_HASH@@@Z
?DeleteKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@QEBG@Z
?DeletePoolHashEntriesAction@HASH_POOL_HASH@@SA?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z
?DeletePoolHashEntriesAction@POOL_HASH_HASH@@SA?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z
?DeleteRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?DeleteRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?EqualKeys@HASH_POOL_HASH@@SA_NPEBUAPP_POOL_HASH@@0@Z
?EqualKeys@POOL_HASH_HASH@@SA_NPEBG0@Z
?EqualRange@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NQEBUAPP_POOL_HASH@@AEAViterator@1@1@Z
?EqualRange@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NQEBGAEAViterator@1@1@Z
?Erase@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NAEAViterator@1@0@Z
?Erase@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NAEAViterator@1@@Z
?Erase@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NAEAViterator@1@0@Z
?Erase@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NAEAViterator@1@@Z
?ExtractKey@HASH_POOL_HASH@@SAPEBUAPP_POOL_HASH@@PEBVPOOL_HASH_ENTRY@@@Z
?ExtractKey@POOL_HASH_HASH@@SAPEBGPEBVPOOL_HASH_ENTRY@@@Z
?Find@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NQEBUAPP_POOL_HASH@@AEAViterator@1@@Z
?Find@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NQEBGAEAViterator@1@@Z
?FindKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@QEBUAPP_POOL_HASH@@PEAPEAVPOOL_HASH_ENTRY@@@Z
?FindKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@QEBGPEAPEAVPOOL_HASH_ENTRY@@@Z
?FindRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?FindRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?Insert@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NPEBVPOOL_HASH_ENTRY@@AEAViterator@1@_N@Z
?Insert@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NPEBVPOOL_HASH_ENTRY@@AEAViterator@1@_N@Z
?InsertRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@_N@Z
?InsertRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@_N@Z
?QueryState@HTTP_WRAPPER@@QEBA?AW4HTTP_WRAPPER_STATE@@XZ
?_Action@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?AW4LK_ACTION@@PEBXPEAX@Z
?_Action@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?AW4LK_ACTION@@PEBXPEAX@Z
?_AddRefRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CAXPEBXH@Z
?_AddRefRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CAXPEBXH@Z
?_CalcKeyHash@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CAK_K@Z
?_CalcKeyHash@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CAK_K@Z
?_EqualKeys@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA_N_K0@Z
?_EqualKeys@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA_N_K0@Z
?_ExtractKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?B_KPEBX@Z
?_ExtractKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?B_KPEBX@Z
?_Pred@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?AW4LK_PREDICATE@@PEBXPEAX@Z
?_Pred@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?AW4LK_PREDICATE@@PEBXPEAX@Z
?begin@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AViterator@1@XZ
?begin@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AViterator@1@XZ
?end@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AViterator@1@XZ
?end@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AViterator@1@XZ
DllRegisterServer
DllUnregisterServer
HostedW3SVCStart
HostedW3SVCStop
ServiceMain

Sections

.text
Size: 401KB - Virtual size: 401KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iiswmi.dll
.dll regsvr32 windows:10 windows x64

10815dec71e88d8a004dab404ffce7db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

bsearch
qsort
wcscat_s
__C_specific_handler
wcschr
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_callnewh
memcmp
memcpy
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
memset
wcstok
swprintf_s
_itow
iswspace
sprintf_s
atol
sscanf_s
_wtol
_wcsnicmp
wcsncpy_s
wcscpy_s
malloc
free
_purecall
wcsrchr
_wcsicmp
_ultow
__CxxFrameHandler3
wcscmp

atl

ord30

kernel32

GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
LocalAlloc
GetSystemDirectoryW
GetTickCount
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeLibrary
LoadLibraryExW
OutputDebugStringA
GetSystemWindowsDirectoryW
GetLastError
GetFileAttributesW
LocalFree
MultiByteToWideChar
WideCharToMultiByte
FileTimeToSystemTime
FormatMessageW
FileTimeToLocalFileTime
Sleep
ExpandEnvironmentStringsW
IsWow64Process
GetCurrentProcess
Wow64EnableWow64FsRedirection
FindFirstFileW
FindClose
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrlenA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

oleaut32

SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VariantCopy
SafeArrayPutElement
SysStringByteLen
SafeArrayDestroy
VariantChangeTypeEx
SafeArrayGetElement
VariantClear
SysFreeString
SysAllocString
VariantInit
SafeArrayGetUBound
SysStringLen
SysAllocStringLen
VariantChangeType
SafeArrayGetLBound
SysAllocStringByteLen

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoImpersonateClient

advapi32

IsValidSecurityDescriptor
RegOpenKeyW
RegQueryValueExW
RegCloseKey

crypt32

CertGetCertificateContextProperty
CertCreateCertificateContext
CertFreeCertificateContext

activeds

ord3

iisutil

??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
??0CLKRHashTable_Iterator@@QEAA@XZ
??4CLKRHashTable_Iterator@@QEAAAEAV0@AEBV0@@Z
?Increment@CLKRHashTable_Iterator@@QEAA_NXZ
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
??1CLKRHashTable_Iterator@@QEAA@XZ
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0EVENT_LOG@@QEAA@PEBG@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
??1CLKRHashTable@@QEAA@XZ
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
PuDeleteDebugPrintsObject
PuDbgPrint
PuCreateDebugPrintsObject

iiscfg

DllGetSimpleObjectByIDEx

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoMofComp

Sections

.text
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iiswsock.dll
.dll windows:10 windows x64

5f93413491ca713b8f64ccd502000dc8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcscmp
memcpy
memset
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
tolower
_itow
_stricmp
free
malloc

oleaut32

VariantClear
SysFreeString
VariantInit
VariantChangeType
GetErrorInfo
SysAllocString

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
DeleteCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
EnterCriticalSection
InitializeSRWLock

websocket

WebSocketGetGlobalProperty
WebSocketCompleteAction
WebSocketAbortHandle
WebSocketGetAction
WebSocketSend
WebSocketReceive
WebSocketBeginServerHandshake
WebSocketCreateServerHandle
WebSocketDeleteHandle
WebSocketEndServerHandshake

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

iisutil

IISInitializeCriticalSection
?CopyA@STRU@@QEAAJPEBDK@Z
??1STRA@@QEAA@XZ
?Append@STRU@@QEAAJPEBG@Z
??1STRU@@QEAA@XZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
WriteRefTraceLog
PuDbgPrint
??0STRA@@QEAA@XZ
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
??0STRU@@QEAA@XZ

Exports

Exports

RegisterModule

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/inetinfo.exe
.exe windows:10 windows x64

59a80f67f641d3a594375876ca29751a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
RegQueryValueExA
StartServiceCtrlDispatcherA
RegCloseKey
RegOpenKeyExA

kernel32

SetLastError
EnterCriticalSection
OutputDebugStringA
LoadLibraryExA
LeaveCriticalSection
InitializeCriticalSection
SetErrorMode
LocalAlloc
Sleep
GetLastError
LoadLibraryA
GetProcAddress
LocalFree
DeleteCriticalSection
FreeLibrary
lstrcmpiA

msvcrt

?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
sprintf_s
strcat_s
strcpy_s
_exit
memset

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

iisutil

PuDeleteDebugPrintsObject
PuDbgPrint
PuCreateDebugPrintsObject

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/inetmgr.dll
.dll regsvr32 windows:10 windows x64

ac7c6e9ad374893908df36a642c915cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mfc42u

ord5082
ord5709
ord5246
ord5352
ord5382
ord5114
ord5304
ord5583
ord5585
ord5584
ord3830
ord5804
ord6821
ord5815
ord6832
ord287
ord1499
ord1677
ord2408
ord2676
ord1574
ord286
ord2846
ord1774
ord6801
ord2425
ord2024
ord4543
ord2592
ord4746
ord3805
ord911
ord3758
ord848
ord2331
ord1812
ord6583
ord6612
ord4046
ord3458
ord641
ord2422
ord2023
ord4542
ord2589
ord4743
ord3751
ord832
ord2325
ord2975
ord5887
ord1286
ord6632
ord2156
ord1950
ord4314
ord2845
ord2665
ord4860
ord2783
ord1264
ord2784
ord4027
ord372
ord2518
ord3652
ord5694
ord1379
ord628
ord1042
ord1847
ord4424
ord6102
ord909
ord1441
ord1443
ord4722
ord4699
ord644
ord6582
ord2793
ord6495
ord1471
ord6707
ord6184
ord2459
ord5710
ord4161
ord2785
ord5937
ord6018
ord1262
ord1384
ord1124
ord1259
ord4523
ord568
ord1006
ord2906
ord3873
ord1442
ord4598
ord5039
ord4800
ord1063
ord659
ord1430
ord4214
ord2752
ord1426
ord3916
ord4983
ord6053
ord5711
ord5730
ord5065
ord4368
ord5724
ord5722
ord3468
ord2412
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord1123
ord1380
ord640
ord2948
ord1385
ord2795
ord3928
ord3319
ord622
ord4254
ord1381
ord5935
ord1908
ord560
ord1003
ord4583
ord1906
ord549
ord999
ord3783
ord2427
ord3790
ord4582
ord6418
ord3867
ord996
ord2393
ord1404
ord1771
ord3804
ord4795
ord5149
ord4894
ord2377
ord3437
ord5693
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord1698
ord4787
ord2059
ord4779
ord6326
ord4131
ord1033
ord3892
ord4127
ord2371
ord1263
ord6021
ord6216
ord5227
ord6395
ord6385
ord4262
ord4257
ord1383
ord6393
ord3396
ord3177
ord6147
ord2801
ord1284
ord6050
ord4602
ord2782
ord4436
ord2532
ord1365
ord6588
ord4473
ord912
ord3806
ord3501
ord4747
ord2593
ord2121
ord2876
ord1287
ord5927
ord1483
ord6880
ord2629
ord5687
ord4721
ord5245
ord5406
ord2517
ord6437
ord1777
ord5702
ord4771
ord3761
ord6767
ord6351
ord6614
ord5077
ord2661
ord4557
ord2764
ord1498
ord2781
ord4601
ord6708
ord6705
ord2384
ord2329
ord2328
ord620
ord822
ord3743
ord4741
ord2586
ord1035
ord3894
ord867
ord665
ord1067
ord3774
ord4770
ord4988
ord4371
ord3164
ord4077
ord4083
ord4082
ord3535
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord5699
ord2140
ord2457
ord5683
ord1736
ord5484
ord3933
ord6814
ord2060
ord2670
ord4789
ord5229
ord4017
ord5712
ord4694
ord6812
ord5586
ord2399
ord5663
ord4752
ord1778
ord4365
ord6440
ord852
ord337
ord1122
ord1463
ord6886
ord624
ord1126
ord1040
ord626
ord2049
ord6887

msvcrt

??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
swprintf_s
wcscpy_s
wcschr
wcscspn
?what@exception@@UEBAPEBDXZ
free
realloc
wcsncmp
wcsncpy_s
iswspace
_vsnwprintf_s
wcsrchr
_purecall
_itow
_wtol
malloc
wcscat_s
_ultow
wcsstr
towupper
isspace
_wtoi
wcstok
_wsplitpath_s
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
memset
memmove
memcpy
memcmp
__RTDynamicCast
__CxxFrameHandler3
__C_specific_handler
_wcsicmp
memcpy_s
memmove_s
wcscmp

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

kernel32

EnterCriticalSection
LeaveCriticalSection
LoadResource
lstrcmpiW
GetDriveTypeW
GetFileAttributesW
lstrlenW
OutputDebugStringA
QueryActCtxW
GetModuleHandleExW
GetModuleFileNameW
CreateActCtxW
GetSystemTime
ActivateActCtx
GetProcAddress
LoadLibraryW
GetLastError
DeactivateActCtx
SetLastError
GlobalAlloc
GetComputerNameExW
ExpandEnvironmentStringsW
FreeLibrary
OutputDebugStringW
CreateThread
WaitForSingleObject
GetExitCodeThread
TerminateThread
CloseHandle
GetComputerNameW
FindFirstFileW
FindClose
FindNextFileW
GlobalFree
LocalAlloc
LocalFree
ReleaseActCtx
LoadLibraryExW
GetModuleHandleW
lstrcpynW
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
MultiByteToWideChar
SizeofResource
FindResourceExW
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
lstrcpyW
GetWindowsDirectoryW
SystemTimeToFileTime
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrentThread
WideCharToMultiByte
GetSystemDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
lstrcmpW
Sleep
LoadLibraryExA
ExpandEnvironmentStringsA
QueryPerformanceCounter
FindActCtxSectionStringW
GetCurrentProcessId

wsock32

WSAGetLastError
WSAStartup
htonl
WSACleanup
gethostname
inet_addr
ntohl

ws2_32

freeaddrinfo
getaddrinfo
getnameinfo

shell32

ord754
ord18
ord16
ord17
ord152
ord155
ord190
SHGetPathFromIDListW
SHGetFolderLocation
SHBrowseForFolderW
SHGetMalloc
SHFileOperationW
ShellExecuteW
ShellExecuteExW

oleaut32

LoadTypeLi
RegisterTypeLi
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString

ole32

CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CLSIDFromProgID
CoTaskMemRealloc
StringFromCLSID
CreateStreamOnHGlobal

gdi32

DeleteDC
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
SetBkColor
SetTextColor
CreateSolidBrush
GetTextMetricsW
SelectObject
DeleteObject

user32

UnhookWindowsHookEx
MessageBoxIndirectW
MessageBoxW
ShowScrollBar
CallNextHookEx
SetWindowsHookExW
MessageBeep
RegisterClipboardFormatW
EnableWindow
SendMessageW
GetDlgItem
SetFocus
IsWindowEnabled
GetKeyState
GetWindowTextLengthW
SetWindowTextW
GetClientRect
LoadStringW
SetForegroundWindow
LoadBitmapW
GetDC
ReleaseDC
GetSysColor
FillRect
DrawTextW
GetWindowRect
InvalidateRect
IsWindow
GetFocus
LoadIconW
GetParent
GetDesktopWindow
GetActiveWindow
CharNextW
CharPrevW
LoadImageW
DestroyIcon
KillTimer
DialogBoxParamW
ShowWindow
EndDialog
SetWindowLongPtrW
GetWindowLongPtrW
GetForegroundWindow
SetTimer
SendDlgItemMessageW

advapi32

RegCreateKeyExW
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
QueryServiceStatus
CloseServiceHandle
RegSetValueExW
RegQueryValueExA
ChangeServiceConfigW
SetThreadToken
ImpersonateLoggedOnUser
RevertToSelf
OpenThreadToken
LogonUserW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
StartServiceW
RegCloseKey

shlwapi

StrCmpIW
PathIsFileSpecW
StrChrW
PathIsURLW
wnsprintfW
PathFindFileNameW
UrlCreateFromPathW
PathFindNextComponentW
PathAppendW
PathRemoveBackslashW
StrCmpW
PathRemoveArgsW
PathUnquoteSpacesW
PathIsUNCW
PathIsNetworkPathW
PathIsDirectoryW
PathRemoveBlanksW
PathIsUNCServerShareW
PathIsRelativeW
PathIsUNCServerW
StrDupW
PathBuildRootW
PathGetDriveNumberW
PathIsRootW
PathRemoveFileSpecW
StrToIntW

mpr

WNetAddConnection2W
WNetCancelConnection2W

credui

CredUIParseUserNameW

infoadmn

IISEnumerateUsers
IISDisconnectUser

iisui

??1CIPAccessDescriptor@@UEAA@XZ
?DuplicateInList@CIPAccessDescriptor@@QEAAHAEAVCObListPlus@@@Z
?SetValues@CIPAccessDescriptor@@QEAAXHKKH@Z
?SetValues@CIPAccessDescriptor@@QEAAXHPEBG@Z
??0CIPAccessDescriptor@@QEAA@H@Z
AllocAnsiString
?QuerySubnetMask@CIPAccessDescriptor@@QEBA?AVCIPAddress@@XZ
?QueryIPAddress@CIPAccessDescriptor@@QEBA?AVCIPAddress@@XZ
?QueryDomainName@CIPAccessDescriptor@@QEBAPEBGXZ
AllocString
?Start@CIISSvcControl@@QEAAJK@Z
?Kill@CIISSvcControl@@QEAAJXZ
DDV_Url
?RefreshAppState@CIISApplication@@QEAAJXZ
??0CIISApplication@@QEAA@PEAVCComAuthInfo@@PEBG@Z
?QueryResult@CIISApplication@@UEBAJXZ
?Create@CIISApplication@@QEAAJPEBGK@Z
?WriteFriendlyName@CIISApplication@@QEAAJPEBG@Z
??0CIPAddress@@QEAA@AEBV0@@Z
?WritePoolId@CIISApplication@@QEAAJPEBG@Z
?Delete@CIISApplication@@QEAAJH@Z
?Unload@CIISApplication@@QEAAJH@Z
?Succeeded@CIISApplication@@UEBAHXZ
?ApplyProxyBlanket@CWamInterface@@MEAAJXZ
??1CIISApplication@@UEAA@XZ
?CreatePooled@CIISApplication@@QEAAJPEBGK0H@Z
LimitInputDomainName
??BCStrPassword@@QEAA?AVCString@@XZ
?SelectItem@CRMCListBox@@QEAAHPEAX@Z
?MessageBoxFormat@CError@@QEBAHPEAUHWND__@@IIIZZ
?QueryValue@CMetaKey@@QEAAJKAEAVCBlob@@PEAHPEBGPEAK@Z
??0CMetaEnumerator@@QEAA@PEAVCComAuthInfo@@PEBGK@Z
?IsEmpty@CStrPassword@@QEBAHXZ
?ReOpen@CMetaKey@@QEAAJK@Z
?RemoveAt@CObListPlus@@QEAAXAEAPEAU__POSITION@@@Z
?Reboot@CIISSvcControl@@QEAAJKH@Z
?Stop@CIISSvcControl@@QEAAJKH@Z
??1CIISSvcControl@@UEAA@XZ
??0CIISSvcControl@@QEAA@PEAVCComAuthInfo@@@Z
ApplyFontToControls
CreateSpecialDialogFont
IsAllNumHostHeader
IsValidHostHeader
?classCRMCListBox@CRMCListBox@@2UCRuntimeClass@@B
?DDV_ShowBalloonAndFail@@YAXPEAVCDataExchange@@VCString@@@Z
??1CMetaBack@@UEAA@XZ
?RestoreWithPassword@CMetaBack@@QEAAJPEBGK0@Z
?Restore@CMetaBack@@QEAAJPEBGK@Z
?RestoreHistoryBackup@CMetaBack@@QEAAJPEBGKKK@Z
?Delete@CMetaBack@@QEAAJPEBGK@Z
?EditShowBalloon@@YAXPEAUHWND__@@VCString@@@Z
??0CStrPassword@@QEAA@AEAV0@@Z
?NextHistory@CMetaBack@@QEAAJPEAK0PEAGPEAU_FILETIME@@@Z
?Next@CMetaBack@@QEAAJPEAKPEAGPEAU_FILETIME@@@Z
GetFullPathLocalOrRemote
SupportsSecurityACLs
??1CStrPassword@@QEAA@XZ
DDV_MinMaxChars
DDX_Password_SecuredString
?g_lpszDummyPassword@@3PEBGEB
?GetIUsrAccount@@YAHPEBGPEAVCWnd@@AEAVCString@@@Z
?CopyTo@CStrPassword@@QEAAXAEAVCString@@@Z
??0CError@@QEAA@K@Z
?VerifyUserPassword@CComAuthInfo@@SAKPEBG0@Z
??1CError@@QEAA@XZ
?MessageBoxOnFailure@CError@@QEBAHPEAUHWND__@@II@Z
ConvertDoubleNullListToStringList
?IsMasterInstance@CMetabasePath@@SAHPEBG@Z
??4CError@@QEAAAEBV0@J@Z
??0CError@@QEAA@XZ
?GetServicePath@CMetabasePath@@SAPEBGPEBGAEAVCString@@PEAV2@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@PEBGKK@Z
??1CMetaKey@@UEAA@XZ
?QueryResult@CMetaKey@@UEBAJXZ
?QueryValue@CMetaKey@@QEAAJKAEAKPEAHPEBGPEAK@Z
??0CStrPassword@@QEAA@XZ
??1CStringListEx@@UEAA@XZ
?SetValue@CMetaKey@@QEAAJKHPEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKKPEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCString@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBG@Z
?DeleteValue@CMetaKey@@QEAAJKPEBG@Z
?Close@CMetaKey@@QEAAJXZ
?CheckDescendants@CMetaKey@@QEAAJKPEAVCComAuthInfo@@PEBG@Z
?GetServiceInfoPath@CMetabasePath@@SAPEBGPEBGAEAVCString@@0@Z
DDV_MinMaxBalloon
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAK@Z
PathIsValid
?DDV_ShowBalloonAndFail@@YAXPEAVCDataExchange@@I@Z
??0CStringListEx@@QEAA@H@Z
??4CStringListEx@@QEAAAEAV0@AEBV0@@Z
?GetRootPath@CMetabasePath@@SAPEBGPEBGAEAVCString@@PEAV2@@Z
DDV_FilePath
DDV_FolderPath
LimitInputPath
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAH@Z
??9CStringListEx@@QEAAHAEBVCStringList@@@Z
?Succeeded@CMetaKey@@UEBAHXZ
?ChangeProxyBlanket@CIISInterface@@UEAAJPEBG0@Z
?ApplyProxyBlanket@CMetaInterface@@MEAAJXZ
??0CError@@QEAA@J@Z
?SplitMetaPathAtInstance@CMetabasePath@@SAXPEBGAEAVCString@@1@Z
??0CMetaKey@@QEAA@PEAVCMetaInterface@@PEBGKK@Z
?GetChildPaths@CMetaKey@@QEAAJAEAVCStringListEx@@PEBG@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCString@@PEAHPEBGPEAK@Z
??0CIISAppPool@@QEAA@PEAVCComAuthInfo@@PEBG@Z
?Delete@CIISAppPool@@QEAAJPEBG@Z
??BCError@@QEAAPEBGXZ
?EnumerateApplications@CIISAppPool@@QEAAJAEAVCStringListEx@@@Z
?GetInstanceNumber@CMetabasePath@@SAKPEBG@Z
?CleanMetaPath@CMetabasePath@@SAPEBGAEAVCString@@@Z
?GetLastNodeName@CMetabasePath@@SAPEBGPEBGAEAVCString@@@Z
?Succeeded@CIISAppPool@@UEBAHXZ
?Recycle@CIISAppPool@@QEAAJPEBG@Z
??1CIPAddress@@UEAA@XZ
??1CIISAppPool@@UEAA@XZ
?QueryServerName@CComAuthInfo@@QEBAPEAGXZ
??4CStrPassword@@QEAAAEBV0@PEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCStrPassword@@PEAHPEBG@Z
??4CStrPassword@@QEAAAEBV0@AEAV0@@Z
DDV_MinChars
?Empty@CStrPassword@@QEAAXXZ
??8CStrPassword@@QEAA_NAEAV0@@Z
??0CMetabasePath@@QEAA@HPEBG000@Z
??BCMetabasePath@@QEBAPEBGXZ
?QueryResult@CIISAppPool@@UEBAJXZ
?Create@CIISAppPool@@QEAAJPEBG@Z
?HResult@CError@@SAJJ@Z
??1CMetabasePath@@QEAA@XZ
DDV_MaxCharsBalloon_SecuredString
?QueryUserName@CComAuthInfo@@QEBAPEAGXZ
DDX_Text_SecuredString
DDV_MaxCharsBalloon
??0CGetComputer@@QEAA@XZ
??1CGetComputer@@QEAA@XZ
?GetComputer@CGetComputer@@QEAAHPEAUHWND__@@@Z
??0CComAuthInfo@@QEAA@PEBG00@Z
??1CComAuthInfo@@QEAA@XZ
?MessageBoxW@CError@@QEBAHPEAUHWND__@@II@Z
??4CILong@@QEAAAEAV0@J@Z
??0CILong@@QEAA@XZ
IsFullyQualifiedPath
IsNetworkPath
GetVolumeInformationSystemFlags
DDX_Text
??1CILong@@QEAA@XZ
??0CUpButton@@QEAA@XZ
??1CUpButton@@UEAA@XZ
??0CDownButton@@QEAA@XZ
??1CDownButton@@UEAA@XZ
??0CObjectPlus@@QEAA@XZ
??1CObjectPlus@@UEAA@XZ
?DDX_TextBalloon@@YAXPEAVCDataExchange@@HAEAI@Z
ActivateControl
?Compare@CObjectPlus@@UEBAHPEBV1@@Z
?IsValid@CObjHelper@@UEBAHXZ
?GetSelectedListItem@CRMCListBox@@QEAAPEAXPEAH@Z
?GetNextSelectedItem@CRMCListBox@@QEAAPEAXPEAH@Z
?classCHeaderListBox@CHeaderListBox@@2UCRuntimeClass@@B
??0CHeaderListBox@@QEAA@KPEBG@Z
??1CHeaderListBox@@UEAA@XZ
?DrawBitmap@CODLBox@@IEAAHAEAVCRMCListBoxDrawStruct@@HH@Z
?ColumnText@CODLBox@@IEAAHAEAVCRMCListBoxDrawStruct@@HHPEBG@Z
?Initialize@CHeaderListBox@@UEAAHXZ
?InsertColumn@CHeaderListBox@@IEAAHHHIPEAUHINSTANCE__@@@Z
?DistributeColumns@CHeaderListBox@@IEAAXXZ
??0CMetabasePath@@QEAA@PEBGK00@Z
??0CRMCListBoxResources@@QEAA@HHK@Z
??1CRMCListBoxResources@@QEAA@XZ
??0CObListPlus@@QEAA@H@Z
??1CObListPlus@@UEAA@XZ
?AttachResources@CODLBox@@QEAAXPEBVCRMCListBoxResources@@@Z
??0CObListIter@@QEAA@AEBVCObListPlus@@@Z
?GetCurSel@CRMCListBox@@QEBAHXZ
?Next@CObListIter@@QEAAPEAVCObject@@XZ
?SetCurSel@CRMCListBox@@QEAAHH@Z
?Sort@CObListPlus@@QEAAKP8CObjectPlus@@EBAHPEBV2@@Z@Z
?GetSelCount@CRMCListBox@@QEBAHXZ
?InvalidateSelection@CRMCListBox@@QEAAXH@Z
?GetMessageMap@CHeaderListBox@@MEBAPEBUAFX_MSGMAP@@XZ
?DrawItem@CRMCListBox@@MEAAXPEAUtagDRAWITEMSTRUCT@@@Z
?MeasureItem@CRMCListBox@@MEAAXPEAUtagMEASUREITEMSTRUCT@@@Z
?__GetCount@CRMCListBox@@UEBAHXZ
?__SetItemHeight@CRMCListBox@@UEAAHHI@Z
??1CObListIter@@UEAA@XZ
?RemoveIndex@CObListPlus@@QEAAHH@Z
?GetInstancePath@CMetabasePath@@SAPEBGPEBGAEAVCString@@PEAV2@@Z
FitPathToControl
?EditShowBalloon@@YAXPEAUHWND__@@I@Z
ConvertStringListToSepLine
ConvertSepLineToStringList
BuildIplOblistFromBlob
??0CBlob@@QEAA@XZ
??1CBlob@@QEAA@XZ
BuildIplBlob
?OrderByAddress@CIPAccessDescriptor@@QEBAHPEBVCObjectPlus@@@Z
?EnableWindow@CHeaderListBox@@QEAAHH@Z
??9CBlob@@QEBAHAEBV0@@Z
??4CBlob@@QEAAAEAV0@AEBV0@@Z
?QueryPassword@CComAuthInfo@@QEBAPEAGXZ
??0CIPAddress@@QEAA@XZ
FetchIpAddressFromCombo
PopulateComboWithKnownIpAddresses
??4CIPAddress@@QEAAAEBV0@AEBV0@@Z
?QueryServerName@CIISInterface@@QEBAPEBGXZ
??0CIISWizardSheet@@QEAA@IIKK@Z
??0CIISWizardBookEnd@@QEAA@IIIII@Z
??0CIISWizardBookEnd@@QEAA@PEAJIIIIIII@Z
IsServerLocal
?classCIISWizardPage@CIISWizardPage@@2UCRuntimeClass@@B
??0CIISWizardPage@@QEAA@IIHII@Z
?messageMap@CIISWizardPage@@1UAFX_MSGMAP@@B
?ValidateString@CIISWizardPage@@QEAAHAEAVCEdit@@AEAVCString@@HH@Z
?OnInitDialog@CIISWizardPage@@MEAAHXZ
IsUNCName
MyValidatePath
?Regenerate@CMetaInterface@@QEAAJH@Z
??1CIISWizardPage@@UEAA@XZ
??1CIISWizardBookEnd@@UEAA@XZ
??1CIISWizardSheet@@UEAA@XZ
?SetValue@CBlob@@QEAAXKPEAEH@Z
?SetValue@CMetaKey@@QEAAJKAEAVCBlob@@PEAHPEBG@Z
??0CILong@@QEAA@J@Z
DDV_UNCFolderPath
DoesUNCShareExist
IsDevicePath
??0CRMCListBox@@QEAA@XZ
??1CRMCListBox@@UEAA@XZ
CvtStringToLong
CvtGMTStringToInternal
??_0CILong@@QEAAAEAV0@J@Z
CvtInternalToGMTString
?GetSel@CRMCListBox@@QEBAHH@Z
?DoesPathExist@CMetaKey@@QEAAJPEBG@Z
IsSpecialPath
GetSpecialPathRealPath
MakeUNCPath
?DeleteKey@CMetaKey@@QEAAJPEBG@Z
?UsesImpersonation@CComAuthInfo@@QEBAHXZ
?GetProcessMode@CIISAppPool@@QEAAJPEAK@Z
??0CComAuthInfo@@QEAA@PEAV0@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@@Z
?QueryResult@CIISInterface@@UEBAJXZ
?SetImpersonation@CComAuthInfo@@QEAAXPEBG0@Z
?RemoveImpersonation@CComAuthInfo@@QEAAXXZ
?StorePassword@CComAuthInfo@@QEAAXPEBG@Z
??0CMetaKey@@QEAA@PEAVCMetaInterface@@@Z
??0CIISIMSAdminBaseSink@@QEAA@PEAVCMetaInterface@@PEAVCComAuthInfo@@@Z
??1CIISIMSAdminBaseSink@@UEAA@XZ
?SetCallbackFunctionSink@CIISIMSAdminBaseSink@@QEAAXP6AXKQEAU_MD_CHANGE_OBJECT_W@@@Z@Z
?SetCallbackFunctionShutdown@CIISIMSAdminBaseSink@@QEAAXP6AXPEAX@Z0@Z
?Next@CMetaEnumerator@@QEAAJAEAVCString@@PEBG@Z
?SaveData@CMetaInterface@@QEAAJXZ
??BCError@@QEAAPEAGXZ
?GetSystemChangeNumber@CMetaInterface@@QEAAJPEAK@Z
?Succeeded@CIISInterface@@UEBAHXZ
?ApplyProxyBlanket@CIISIMSAdminBaseSink@@MEAAJXZ
?AddOverride@CError@@QEAAIJI@Z
?ConvertToParentPath@CMetabasePath@@SAPEBGAEAVCString@@@Z
AppendToDevicePath
?GetLastWinError@CError@@QEAAXXZ
?GetDataPaths@CMetaKey@@QEAAJAEAVCStringListEx@@KKPEBG@Z
??0CMetaEnumerator@@QEAA@PEAVCMetaInterface@@PEBGK@Z
LooksLikeIPAddress
??0CIPAddress@@QEAA@AEBVCString@@@Z
MyGetHostName
?Open@CMetaKey@@QEAAJKPEBGK@Z
??1CMetaEnumerator@@UEAA@XZ
?Next@CMetaEnumerator@@QEAAJAEAKAEAVCString@@PEBG@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBGPEAK@Z
??0CIPAddress@@QEAA@KH@Z
??BCIPAddress@@QEBAPEBGXZ
?CompareItem@CIPAddress@@QEBAHAEBV1@@Z
?QueryIPAddress@CIPAddress@@QEBAPEBGAEAVCString@@@Z
ord2
GUIDToCString
??0CMetaKey@@QEAA@HPEAV0@@Z
?GetAllData@CMetaKey@@IEAAJKKKPEAK0PEAPEAEPEBG@Z
?CreatePathFromFailedOpen@CMetaKey@@QEAAJXZ
?QueryMetaPath@CMetabasePath@@QEBAPEBGXZ
??4CIPAddress@@QEAAAEBV0@AEBVCString@@@Z
?CreateSite@CMetaInterface@@QEAAJPEBG000PEAK1@Z
?QueryMetaPath@CMetaKey@@QEBAPEBGXZ
?AddKey@CMetaKey@@QEAAJPEBG@Z
?RenameKey@CMetaKey@@QEAAJPEBG0@Z
??0CEmphasizedDialog@@QEAA@IPEAVCWnd@@@Z
??1CEmphasizedDialog@@UEAA@XZ
?messageMap@CEmphasizedDialog@@1UAFX_MSGMAP@@B
?OnInitDialog@CEmphasizedDialog@@MEAAHXZ
?RemoveAll@CObListPlus@@QEAAXXZ
?GetRuntimeClass@CEmphasizedDialog@@UEBAPEAUCRuntimeClass@@XZ
DDV_MinChars_SecuredString
?Compare@CStrPassword@@QEBAHAEAV1@@Z
??0CMetaBack@@QEAA@PEAVCComAuthInfo@@@Z
?QueryResult@CMetaBack@@UEBAJXZ
?BackupWithPassword@CMetaBack@@QEAAJPEBG0@Z
?Backup@CMetaBack@@QEAAJPEBG@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 487KB - Virtual size: 486KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/infocomm.dll
.dll windows:10 windows x64

c4bf03b6f8b38d4dbe0b5c267d578c43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
memmove
_purecall
memset
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler3
wcsstr
_mbsicmp
_mbslen
_mbsrchr
__C_specific_handler
qsort
tolower
strrchr
_mbsupr
_memicmp
memcpy_s
malloc
free
time
_snwprintf_s
strncpy_s
wcscat_s
wcsncpy_s
_mbspbrk
_strlwr
swprintf_s
strstr
strtoul
_strnicmp
strcat_s
strtol
_stricmp
_mbschr
strchr
strcpy_s
sprintf_s
memcmp
strcmp

rpcrt4

RpcServerUseProtseqW
RpcServerInqBindings
RpcEpRegisterA
RpcEpUnregister
RpcBindingVectorFree
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
RpcServerRegisterAuthInfoA
RpcServerRegisterIf
RpcServerUseProtseqEpW
RpcStringFreeA
RpcBindingToStringBindingA

advapi32

SetSecurityDescriptorSacl
DestroyPrivateObjectSecurity
CreatePrivateObjectSecurity
GetSecurityDescriptorLength
RegOpenKeyA
RegCreateKeyExA
RegDeleteKeyA
AddAce
GetAce
GetAclInformation
SetKernelObjectSecurity
MakeAbsoluteSD
GetKernelObjectSecurity
RegEnumValueA
RegSetValueExA
CopySid
AccessCheckAndAuditAlarmW
AccessCheck
EqualSid
GetTokenInformation
LogonUserA
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
FreeSid
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetServiceStatus
RegisterServiceCtrlHandlerA
CryptReleaseContext
CreateProcessAsUserA
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
GetUserNameA
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExA

kernel32

CreateEventA
SetLastError
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
DisableThreadLibraryCalls
DeleteCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
lstrcmpiA
DebugBreak
GlobalMemoryStatus
GlobalMemoryStatusEx
HeapDestroy
HeapAlloc
HeapFree
HeapCreate
GetFileAttributesW
CreateFileW
GetFileInformationByHandle
GetTickCount
lstrcmpA
FindNextFileA
FindClose
FindFirstFileA
CreateIoCompletionPort
PostQueuedCompletionStatus
GetVolumeInformationA
lstrlenW
GetOverlappedResult
ExpandEnvironmentStringsA
WideCharToMultiByte
GetCurrentProcessId
LocalAlloc
GetModuleHandleA
GetSystemDefaultLangID
GetCurrentThreadId
ReadFile
WaitForSingleObject
WriteFile
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateThread
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDefaultLCID
SetEvent
Sleep
GetCurrentThread
GetComputerNameA
CloseHandle
MultiByteToWideChar
LocalFree
GetLastError

user32

DispatchMessageA
PeekMessageA
MsgWaitForMultipleObjects
AdjustWindowRectEx
CharLowerA
CharPrevA
CharNextA

ws2_32

inet_addr
send
recv
__WSAFDIsSet
select
WSAGetLastError

crypt32

CertFreeCertificateChain
CertGetPublicKeyLength
CertGetNameStringA
CertCloseStore
CertDuplicateStore
CertControlStore
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateContext
CertFindCTLInStore
CertAddCTLContextToStore
CertFreeCTLContext
CryptMsgGetAndVerifySigner
CertDuplicateCertificateContext
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertCreateCertificateChainEngine
CertGetIssuerCertificateFromStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertGetCertificateChain
CertGetEnhancedKeyUsage

isatq

AtqTerminate
AtqSetInfo
AtqEndpointSetInfo
AtqStopEndpoint
AtqCreateEndpoint
AtqStartEndpoint
AtqCloseEndpoint
AtqFreeBandwidthInfo
AtqCreateBandwidthInfo
AtqBandwidthSetInfo
AtqCloseFileHandle
?Cleanup@CDirMonitor@@QEAAHXZ
?Monitor@CDirMonitor@@QEAAHPEAVCDirMonitorEntry@@PEBDHK@Z
?FindEntry@CDirMonitor@@QEAAPEAVCDirMonitorEntry@@PEBD@Z
??1CDirMonitor@@QEAA@XZ
??0CDirMonitor@@QEAA@XZ
?Init@CDirMonitorEntry@@UEAAHK@Z
??1CDirMonitorEntry@@UEAA@XZ
??0CDirMonitorEntry@@QEAA@XZ
?Release@CDirMonitorEntry@@UEAAHXZ
?AddRef@CDirMonitorEntry@@UEAAXXZ
AtqInitialize

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

odbc32

ord18
ord8
ord4
ord13
ord61
ord2
ord1
ord7
ord12
ord14
ord15
ord3
ord50
ord10
ord45
ord20
ord16
ord72
ord11
ord19
ord9

ntdll

RtlRegisterWait
RtlDeregisterWait
DbgPrint

netapi32

NetApiBufferFree
NetGetJoinInformation

iisrtl

??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
IISstrncpy
?Append@STR@@QEAAXD@Z
?GetStatistics@CLKRHashTable@@QEBA?AVCLKRHashTableStats@@XZ
IISstrupr
??0CLKRHashTableStats@@QEAA@XZ
?Copy@STR@@QEAAHPEBDK@Z
IISstrrchr
?CloseIterator@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEAVCIterator@1@@Z
?IncrementIterator@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEAVCIterator@1@@Z
GetCurrentTimeInSeconds
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
??4TS_RESOURCE@@QEAAAEAV0@AEBV0@@Z
??1EVENT_LOG@@QEAA@XZ
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBDK@Z
?InitializeIterator@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEAVCIterator@1@@Z
?Clear@CLKRHashTable@@QEAAXXZ
IISstricmp
?RecalcLen@MULTISZ@@QEAAXXZ
PuDeleteDebugPrintsObject
PuDbgPrint
TerminateIISRTL
MIDL_user_allocate
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
IisCalloc
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??1CLKRHashTable@@QEAA@XZ
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
IisFree
?Unhash@STR@@QEAAXXZ
?Clone@STR@@QEBAHPEAV1@@Z
?Append@STR@@QEAAHPEBD@Z
??0MULTISZ@@QEAA@XZ
?First@MULTISZ@@QEBAPEBDXZ
??0TS_RESOURCE@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
ZapRegistryKey
?LoadStringA@STR@@QEAAHKPEAUHINSTANCE__@@@Z
?LoadStringA@STR@@QEAAHKPEBDK@Z
InitializeIISRTL
??0EVENT_LOG@@QEAA@PEBD@Z
RemoveWorkItem
ScheduleWorkItem
??0TS_RESOURCE@@QEAA@AEBV0@@Z
?Unlock@TS_RESOURCE@@QEAAXXZ
?Convert@TS_RESOURCE@@QEAAXW4TSRES_CONV_TYPE@@@Z
?Lock@TS_RESOURCE@@QEAAXW4TSRES_LOCK_TYPE@@@Z
??1TS_RESOURCE@@QEAA@XZ
?Copy@STR@@QEAAHPEBD@Z
??0STR@@QEAA@AEBV0@@Z
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
IISInitializeCriticalSection
??0STR@@QEAA@PEADKH@Z
?Copy@STR@@QEAAHAEBV1@@Z
??1STR@@QEAA@XZ
??0STR@@QEAA@PEBD@Z
MIDL_user_free
??0BUFFER@@QEAA@XZ
??1BUFFER@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z
??0STR@@QEAA@XZ
?Clear@STR@@QEAAXXZ
?SetLen@STR@@QEAAHK@Z

Exports

Exports

??0COMMON_METADATA@@QEAA@XZ
??0IIS_CTL@@QEAA@AEBV0@@Z
??0IIS_CTL@@QEAA@PEAUIMDCOM@@PEAD@Z
??0IIS_SERVER_BINDING@@QEAA@KGPEBDPEAVIIS_ENDPOINT@@@Z
??0IIS_SERVER_CERT@@QEAA@AEBV0@@Z
??0IIS_SERVER_CERT@@QEAA@PEAUIMDCOM@@PEAD@Z
??0IIS_SERVER_INSTANCE@@QEAA@PEAVIIS_SERVICE@@KGPEBDPEAG2H@Z
??0IIS_SERVICE@@QEAA@AEBV0@@Z
??0IIS_SERVICE@@QEAA@PEBD00K_KHKP6AX1PEAUsockaddr_in@@PEAX3@ZP6AX3KKPEAU_OVERLAPPED@@@Z6@Z
??0IIS_SSL_INFO@@QEAA@AEBV0@@Z
??0IIS_SSL_INFO@@QEAA@PEADPEAUIMDCOM@@@Z
??0IIS_VROOT_TABLE@@QEAA@XZ
??0INET_PARSER@@QEAA@PEAD@Z
??0LOGGING@@QEAA@AEBV0@@Z
??0LOGGING@@QEAA@XZ
??0MB@@QEAA@PEAUIMDCOM@@@Z
??0ODBC_CONNECTION@@QEAA@XZ
??0ODBC_PARAMETER@@QEAA@GFFFK@Z
??0RefBlob@@QEAA@XZ
??0STORE_CHANGE_NOTIFIER@@QEAA@XZ
??0TCP_AUTHENT@@QEAA@K@Z
??1COMMON_METADATA@@UEAA@XZ
??1IIS_CTL@@QEAA@XZ
??1IIS_ENDPOINT@@QEAA@XZ
??1IIS_SERVER_BINDING@@QEAA@XZ
??1IIS_SERVER_CERT@@QEAA@XZ
??1IIS_SERVER_INSTANCE@@UEAA@XZ
??1IIS_SERVICE@@MEAA@XZ
??1IIS_SSL_INFO@@QEAA@XZ
??1IIS_VROOT_TABLE@@QEAA@XZ
??1INET_PARSER@@QEAA@XZ
??1LOGGING@@QEAA@XZ
??1MB@@QEAA@XZ
??1ODBC_CONNECTION@@QEAA@XZ
??1ODBC_PARAMETER@@QEAA@XZ
??1ODBC_STATEMENT@@QEAA@XZ
??1RefBlob@@QEAA@XZ
??1STORE_CHANGE_NOTIFIER@@QEAA@XZ
??1TCP_AUTHENT@@QEAA@XZ
??4IIS_CTL@@QEAAAEAV0@AEBV0@@Z
??4IIS_SERVER_CERT@@QEAAAEAV0@AEBV0@@Z
??4IIS_SERVICE@@QEAAAEAV0@AEBV0@@Z
??4IIS_SSL_INFO@@QEAAAEAV0@AEBV0@@Z
??4LOGGING@@QEAAAEAV0@AEBV0@@Z
??4TSVC_CACHE@@QEAAAEAV0@$$QEAV0@@Z
??4TSVC_CACHE@@QEAAAEAV0@AEBV0@@Z
??YINET_PARSER@@QEAAXH@Z
??_7IIS_SERVER_INSTANCE@@6B@
??_7IIS_SERVICE@@6B@
?AccessCheck@TS_OPEN_FILE_INFO@@QEAAHPEAXH@Z
?AcquireFastLock@IIS_SERVER_INSTANCE@@QEAAXXZ
?AcquireGlobalLock@IIS_SERVICE@@CAXXZ
?AcquireServiceLock@IIS_SERVICE@@QEAAXH@Z
?ActOnChange@LOGGING@@AEAAXXZ
?ActivateLogging@LOGGING@@QEAAHPEBDK0PEAX@Z
?AddInstanceInfoHelper@IIS_SERVICE@@IEAAHPEAVIIS_SERVER_INSTANCE@@@Z
?AddObject@MB@@QEAAHPEBD@Z
?AddRef@RefBlob@@QEAAXXZ
?AddRefRecord@IIS_VROOT_TABLE@@CAXPEBXH@Z
?AddServerInstance@IIS_SERVICE@@QEAAHPEAVIIS_SERVER_INSTANCE@@@Z
?AddVirtualRoot@IIS_VROOT_TABLE@@QEAAHPEAD0K0PEAXKH@Z
?AdvertiseServiceInformationInMB@IIS_SERVICE@@QEAAXXZ
?AllocStatement@ODBC_CONNECTION@@QEAAPEAVODBC_STATEMENT@@XZ
?AppendToEOL@INET_PARSER@@QEAAHPEAVSTR@@H@Z
?AssociateInstance@IIS_SERVICE@@QEAAHPEAVIIS_SERVER_INSTANCE@@@Z
?AuxEatNonWhite@INET_PARSER@@IEAAPEADD@Z
?AuxEatWhite@INET_PARSER@@IEAAPEADXZ
?AuxSkipTo@INET_PARSER@@IEAAPEADD@Z
?Bind@ODBC_PARAMETER@@QEAAFPEAX@Z
?BindInstance@IIS_SERVER_INSTANCE@@QEAAKXZ
?BindParameter@ODBC_STATEMENT@@QEAAHPEAVODBC_PARAMETER@@@Z
?BuildApplPhysicalPath@COMMON_METADATA@@QEBAHPEAVMB@@PEAVSTR@@@Z
?BuildPhysicalPath@COMMON_METADATA@@QEAAHPEADPEAVSTR@@@Z
?BuildPhysicalPathWithAltRoot@COMMON_METADATA@@QEAAHPEADPEAVSTR@@PEBD@Z
?CTLContainsCert@IIS_SSL_INFO@@QEAAHPEBU_CERT_CONTEXT@@PEAH@Z
?CalcKeyHash@IIS_VROOT_TABLE@@CAK_K@Z
?CheckAndReference@IIS_SERVICE@@QEAAHXZ
?CheckCAPIInfo@IIS_SSL_INFO@@AEAAHPEAH0PEADPEAKK@Z
?CheckSignature@IIS_SSL_INFO@@AEAAHXZ
?Cleanup@IIS_SERVER_INSTANCE@@SAXXZ
?CleanupAfterConstructorFailure@IIS_SERVER_INSTANCE@@QEAAXXZ
?CleanupMetabaseComObject@IIS_SERVICE@@SAHXZ
?CleanupServiceInfo@IIS_SERVICE@@SAXXZ
?CleanupServiceRpc@IIS_SERVICE@@SAHXZ
?CleanupSockets@IIS_SERVICE@@QEAAKXZ
?CleanupThis@TS_DIRECTORY_INFO@@QEAAXXZ
?ClearInstanceStatistics@IIS_SERVICE@@QEAAHK@Z
?ClearTextLogon@TCP_AUTHENT@@QEAAHPEAD0PEAH1PEAVIIS_SERVER_INSTANCE@@PEAVTCP_AUTHENT_INFO@@0@Z
?Close@MB@@QEAAHXZ
?Close@ODBC_CONNECTION@@QEAAHXZ
?CloseHandle@TS_OPEN_FILE_INFO@@QEAAXXZ
?CloseInstance@IIS_SERVER_INSTANCE@@UEAAHXZ
?CloseService@IIS_SERVICE@@QEAAXXZ
?Compare@IIS_SERVER_BINDING@@QEAAHKGPEBD@Z
?Compare@IIS_SERVER_BINDING@@QEAAKPEBDPEAH@Z
?ContinueInstance@IIS_SERVER_INSTANCE@@UEAAKXZ
?ContinueService@IIS_SERVICE@@AEAAXXZ
?Converse@TCP_AUTHENT@@QEAAHPEAXKPEAVBUFFER@@PEAKPEAHPEAVTCP_AUTHENT_INFO@@PEAD55PEAVIIS_SERVER_INSTANCE@@@Z
?ConverseEx@TCP_AUTHENT@@QEAAHPEAU_SecBufferDesc@@PEAVBUFFER@@1PEAKPEAHPEAVTCP_AUTHENT_INFO@@PEAD55PEAVIIS_SERVER_INSTANCE@@@Z
?CopyToEOL@INET_PARSER@@QEAAHPEAVSTR@@H@Z
?CopyToken@INET_PARSER@@QEAAHPEAVSTR@@H@Z
?CopyValue@ODBC_PARAMETER@@QEAAHK@Z
?CopyValue@ODBC_PARAMETER@@QEAAHPEAU_SYSTEMTIME@@@Z
?CopyValue@ODBC_PARAMETER@@QEAAHPEAXJ@Z
?CopyValue@ODBC_PARAMETER@@QEAAHPEBD@Z
?CopyValue@ODBC_PARAMETER@@QEAAHPEBG@Z
?CreateEngineRootStore@IIS_SSL_INFO@@AEAAHXZ
?CreateEngineTrustStore@IIS_SSL_INFO@@AEAAHXZ
?CreateNewBinding@IIS_SERVER_INSTANCE@@AEAAKKGPEBDHHPEAPEAVIIS_SERVER_BINDING@@@Z
?CreateSSLInfo@IIS_SSL_INFO@@SAPEAV1@PEADPEAUIMDCOM@@@Z
?DecrementCurrentConnections@IIS_SERVER_INSTANCE@@QEAAXXZ
?DeferredGlobalConfig@IIS_SERVICE@@SAXKQEAU_MD_CHANGE_OBJECT_A@@@Z
?DeferredMDChangeNotify@IIS_SERVICE@@SAXKQEAU_MD_CHANGE_OBJECT_A@@@Z
?DelayCurrentServiceCtrlOperation@IIS_SERVICE@@QEAAKK@Z
?DeleteCachedTokenOnReset@TCP_AUTHENT@@QEAAHXZ
?DeleteData@MB@@QEAAHPEBDKKK@Z
?DeleteInstanceInfo@IIS_SERVICE@@QEAAHK@Z
?DeleteObject@MB@@QEAAHPEBD@Z
?DeleteVRootEntry@IIS_VROOT_TABLE@@AEAAXPEAX@Z
?Dereference@IIS_ENDPOINT@@QEAAXXZ
?Dereference@IIS_SERVER_INSTANCE@@QEAAXXZ
?Dereference@IIS_SERVICE@@QEAAXXZ
?DestroyAllServerInstances@IIS_SERVICE@@QEAAXXZ
?DisassociateInstance@IIS_SERVICE@@QEAAHPEAVIIS_SERVER_INSTANCE@@@Z
?DisconnectInstanceUser@IIS_SERVICE@@QEAAHKK@Z
?DisplaySize@ODBC_CONNECTION@@SAKFK@Z
?DoServerNameCheck@IIS_SERVER_INSTANCE@@QEBAHXZ
?DoStartInstance@IIS_SERVER_INSTANCE@@QEAAKXZ
?EatNonWhite@INET_PARSER@@QEAAPEADXZ
?EatWhite@INET_PARSER@@QEAAPEADXZ
?EnumAuthPackages@TCP_AUTHENT@@QEAAHPEAVBUFFER@@@Z
?EnumObjects@MB@@QEAAHPEBDPEADK@Z
?EnumServiceInstances@IIS_SERVICE@@QEAAHPEAX0P6AH00PEAVIIS_SERVER_INSTANCE@@@Z@Z
?EnumerateInstanceUsers@IIS_SERVICE@@QEAAHKPEAKPEAPEAD@Z
?EqualKeys@IIS_VROOT_TABLE@@CA_N_K0@Z
?ExecDirect@ODBC_STATEMENT@@QEAAHPEBDK@Z
?ExecDirect@ODBC_STATEMENT@@QEAAHPEBGK@Z
?ExecuteStatement@ODBC_STATEMENT@@QEAAHXZ
?ExtractKey@IIS_VROOT_TABLE@@CA?B_KPEBX@Z
?FilterFiles@TS_DIRECTORY_INFO@@QEAAHP6AHPEBU_WIN32_FIND_DATAA@@PEAX@Z1@Z
?FindAndReferenceEndpoint@IIS_SERVICE@@QEAAPEAVIIS_ENDPOINT@@GKHHH@Z
?FindAndReferenceInstance@IIS_ENDPOINT@@QEAAPEAVIIS_SERVER_INSTANCE@@PEBDKPEAH@Z
?FindFromServiceInfoList@IIS_SERVICE@@SAPEAV1@K@Z
?FindIISInstance@IIS_SERVICE@@QEAAPEAVIIS_SERVER_INSTANCE@@K@Z
?FindTopOfChain@IIS_SSL_INFO@@AEAAHPEBU_CERT_CONTEXT@@PEAPEBU2@@Z
?FinishPrivateProperties@COMMON_METADATA@@UEAAHPEAVBUFFER@@KH@Z
?FreeColumnMemory@ODBC_STATEMENT@@QEAAXXZ
?FreeMdTag@COMMON_METADATA@@QEAAXK@Z
?GetAll@MB@@QEAAHPEBDKKPEAVBUFFER@@PEAK2@Z
?GetCTL@IIS_SSL_INFO@@QEAAPEAVIIS_CTL@@XZ
?GetCertChainEngine@IIS_SSL_INFO@@QEAAHPEAPEAX@Z
?GetCertificate@IIS_SSL_INFO@@QEAAPEAVIIS_SERVER_CERT@@XZ
?GetClientCertBlob@TCP_AUTHENT@@QEAAHKPEAKPEAE00@Z
?GetCommonConfig@IIS_SERVER_INSTANCE@@QEAAHPEADK@Z
?GetConfig@LOGGING@@QEAAKPEAU_INETLOG_CONFIGURATIONA@@@Z
?GetContainedCertificates@IIS_CTL@@QEAAHPEAPEAPEBU_CERT_CONTEXT@@PEAK1@Z
?GetData@MB@@QEAAHPEBDKKKPEAXPEAKK@Z
?GetDataPaths@MB@@QEAAHPEBDKKPEAVBUFFER@@@Z
?GetDataSetNumber@MB@@QEAAHPEBDPEAK@Z
?GetDirectoryListingA@TS_DIRECTORY_INFO@@QEAAHPEBDPEAX@Z
?GetGlobalStatistics@IIS_SERVICE@@UEAAHKPEAPEAD@Z
?GetInfo@ODBC_CONNECTION@@QEAAHKPEAXKPEAK@Z
?GetInstanceConfiguration@IIS_SERVICE@@AEAAHKKHPEAKPEAPEAU_INET_INFO_CONFIG_INFO@@@Z
?GetInstanceId@TSVC_CACHE@@QEBAKXZ
?GetInstanceStatistics@IIS_SERVICE@@QEAAHKKPEAPEAD@Z
?GetLastErrorText@ODBC_CONNECTION@@QEBAHPEAVSTR@@PEAXF@Z
?GetLastErrorTextAsHtml@ODBC_CONNECTION@@QEBAHPEAVSTR@@PEAXF@Z
?GetMDInstancePath@IIS_SERVICE@@QEAAXKPEAD@Z
?GetMemoryStore@IIS_CTL@@QEAAPEAXXZ
?GetMultisz@MB@@QEAAHPEBDKKPEAVMULTISZ@@K@Z
?GetNewInstanceId@IIS_SERVICE@@QEAAKXZ
?GetRootStoreCertificates@IIS_SSL_INFO@@AEAAHPEAPEAPEBU_CERT_CONTEXT@@PEAK@Z
?GetServerInstance@TSVC_CACHE@@QEBAPEAXXZ
?GetServiceAdminInfo@IIS_SERVICE@@SAHKKKHPEAKPEAPEAU_INET_INFO_CONFIG_INFO@@@Z
?GetServiceConfigInfoSize@IIS_SERVICE@@EEAAKK@Z
?GetServiceId@TSVC_CACHE@@QEBAKXZ
?GetServiceSiteInfo@IIS_SERVICE@@SAHKPEAPEAU_INET_INFO_SITE_LIST@@@Z
?GetStr@MB@@QEAAHPEBDKKPEAVSTR@@K0@Z
?GetSystemChangeNumber@MB@@QEAAHPEAK@Z
?GetToken@TCP_AUTHENT@@QEBAPEAVCACHED_TOKEN@@XZ
?GetTrustedIssuerCerts@IIS_SSL_INFO@@QEAAHPEAPEAPEBU_CERT_CONTEXT@@PEAK@Z
?GetTrustedIssuerStore@IIS_SSL_INFO@@QEAAHPEAPEAX@Z
?GetTsvcCache@IIS_SERVER_INSTANCE@@QEAAAEAVTSVC_CACHE@@XZ
?GetUserHandle@TCP_AUTHENT@@QEAAPEAXXZ
?HandlePrivateProperty@COMMON_METADATA@@UEAAHPEADPEAVIIS_SERVER_INSTANCE@@PEAU_METADATA_GETALL_INTERNAL_RECORD@@PEAXPEAVBUFFER@@PEAKPEAU_METADATA_ERROR_INFO@@@Z
?HasCTL@IIS_SSL_INFO@@AEAAHPEAH0@Z
?HasCertificate@IIS_SSL_INFO@@AEAAHPEAH0@Z
?HasNormalBindings@IIS_SERVER_INSTANCE@@QEBAHXZ
?HasSecureBindings@IIS_SERVER_INSTANCE@@QEBAHXZ
?Impersonate@TCP_AUTHENT@@QEAAHXZ
?IncrementCurrentConnections@IIS_SERVER_INSTANCE@@QEAAXXZ
?IndicateShutdownComplete@IIS_SERVICE@@QEAAXXZ
?Init@RefBlob@@QEAAHPEAXKP6AX0@Z@Z
?Initialize@IIS_SERVER_INSTANCE@@SAHXZ
?Initialize@LOGGING@@SAKXZ
?InitializeDiscovery@IIS_SERVICE@@QEAAKXZ
?InitializeMetabaseComObject@IIS_SERVICE@@SAHXZ
?InitializeServiceInfo@IIS_SERVICE@@SAHXZ
?InitializeServiceRpc@IIS_SERVICE@@SAHPEBDPEAX@Z
?InitializeSockets@IIS_SERVICE@@QEAAKXZ
?InterrogateService@IIS_SERVICE@@AEAAXXZ
?IsActive@IIS_SERVICE@@QEBAHXZ
?IsAutoStart@IIS_SERVER_INSTANCE@@QEBAHXZ
?IsBindingInMultiSz@IIS_SERVER_INSTANCE@@AEAAHPEAVIIS_SERVER_BINDING@@AEBVMULTISZ@@@Z
?IsClusterEnabled@IIS_SERVER_INSTANCE@@QEBAHXZ
?IsDefaultCTL@IIS_SSL_INFO@@AEAAHXZ
?IsDefaultCertificate@IIS_SSL_INFO@@QEAAHXZ
?IsDownLevelInstance@IIS_SERVER_INSTANCE@@QEBAHXZ
?IsFortezzaCert@IIS_SERVER_CERT@@QEAAHXZ
?IsForwardable@TCP_AUTHENT@@QEBAHXZ
?IsGuest@TCP_AUTHENT@@QEAAHH@Z
?IsInCurrentBindingList@IIS_SERVER_INSTANCE@@AEAAHPEAU_LIST_ENTRY@@KGPEBD@Z
?IsLoggingEnabledA@IIS_SERVER_INSTANCE@@QEBAHXZ
?IsMultiInstance@IIS_SERVICE@@QEBAHXZ
?IsRequiredExtraLoggingFields@LOGGING@@QEAAHXZ
?IsService@IIS_SERVICE@@QEAAHXZ
?IsSslCertPresent@TCP_AUTHENT@@QEAAHXZ
?IsStoreRegisteredForChange@STORE_CHANGE_NOTIFIER@@QEAAHPEADP6AXPEAX@Z1@Z
?IsSystemDBCS@IIS_SERVICE@@QEBAHXZ
?IsTrustedRoot@IIS_SSL_INFO@@AEAAHPEBU_CERT_CONTEXT@@PEAH@Z
?IsValid@IIS_CTL@@QEAAHXZ
?IsValid@IIS_SERVER_CERT@@QEAAHXZ
?IsValid@ODBC_CONNECTION@@QEBAHXZ
?IsValid@ODBC_STATEMENT@@QEBAHXZ
?IsValid@TS_OPEN_FILE_INFO@@QEBAHXZ
?LoadStr@IIS_SERVER_INSTANCE@@QEBAHAEAVSTR@@KH@Z
?LoadStr@IIS_SERVICE@@QEBAHAEAVSTR@@KH@Z
?Lock@IIS_SSL_INFO@@QEAAXXZ
?LockConvertExclusive@IIS_VROOT_TABLE@@QEAAXXZ
?LockExclusive@IIS_VROOT_TABLE@@QEAAXXZ
?LockExclusive@LOGGING@@AEAAXXZ
?LockShared@IIS_VROOT_TABLE@@QEAAXXZ
?LockShared@LOGGING@@AEAAXXZ
?LockThisForRead@IIS_SERVER_INSTANCE@@QEAAXXZ
?LockThisForWrite@IIS_SERVER_INSTANCE@@QEAAXXZ
?LogCustomInformation@LOGGING@@QEAAKKPEAU_CUSTOM_LOG_DATA@@PEAD@Z
?LogEvent@IIS_SERVICE@@QEAAXKGQEAPEBDK@Z
?LogInformation@LOGGING@@QEAAKPEBU_INETLOG_INFORMATION@@@Z
?LookupVirtualRoot@IIS_VROOT_TABLE@@QEAAHPEBDPEADPEAK222PEAPEAX2@Z
?MDChangeNotify@IIS_SERVER_INSTANCE@@UEAAXPEAU_MD_CHANGE_OBJECT_A@@@Z
?MDChangeNotify@IIS_SERVICE@@MEAAXPEAU_MD_CHANGE_OBJECT_A@@@Z
?MDChangeNotify@IIS_SERVICE@@SAXKQEAU_MD_CHANGE_OBJECT_A@@@Z
?MDMirrorVirtualRoots@IIS_SERVER_INSTANCE@@QEAAXXZ
?MoreResults@ODBC_STATEMENT@@QEAAHPEAH@Z
?MoveMDVroots2Registry@IIS_SERVER_INSTANCE@@QEAAHXZ
?MoveVrootFromRegToMD@IIS_SERVER_INSTANCE@@QEAAHXZ
?NextItem@INET_PARSER@@QEAAPEADXZ
?NextLine@INET_PARSER@@QEAAPEADXZ
?NextParam@INET_PARSER@@QEAAPEADXZ
?NextToken@INET_PARSER@@QEAAPEADD@Z
?NextToken@INET_PARSER@@QEAAPEADXZ
?NotifFncCaller@STORE_CHANGE_NOTIFIER@@SAXPEAXE@Z
?NotifyChange@LOGGING@@QEAAHK@Z
?Open@MB@@QEAAHKPEBDK@Z
?Open@ODBC_CONNECTION@@QEAAHPEBD00@Z
?Open@ODBC_CONNECTION@@QEAAHPEBG00@Z
?PackageSupportsEncoding@TCP_AUTHENT@@QEAAHPEAD@Z
?ParseDescriptor@IIS_SERVER_BINDING@@SAKPEBDPEAKPEAGPEAPEBD@Z
?PauseInstance@IIS_SERVER_INSTANCE@@UEAAKXZ
?PauseService@IIS_SERVICE@@AEAAXXZ
?PerformClusterModeChange@IIS_SERVER_INSTANCE@@QEAAKXZ
?PerformStateChange@IIS_SERVER_INSTANCE@@QEAAKXZ
?PrepareStatement@ODBC_STATEMENT@@QEAAHPEBD@Z
?PrepareStatement@ODBC_STATEMENT@@QEAAHPEBG@Z
?Print@TS_OPEN_FILE_INFO@@QEBAXXZ
?QueryAcceptExOutstanding@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryAcceptExTimeout@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryAndReferenceSSLInfoObj@IIS_SERVER_INSTANCE@@UEAAPEAVIIS_SSL_INFO@@XZ
?QueryAttributes@TS_OPEN_FILE_INFO@@QEBAKXZ
?QueryBandwidthInfo@IIS_SERVER_INSTANCE@@QEBAPEAXXZ
?QueryCTL@IIS_SSL_INFO@@QEAAPEAVIIS_CTL@@XZ
?QueryCTLContext@IIS_CTL@@QEAAPEBU_CTL_CONTEXT@@XZ
?QueryCType@ODBC_PARAMETER@@QEBAFXZ
?QueryCbValue@ODBC_PARAMETER@@QEBA_JXZ
?QueryCbValueRef@ODBC_PARAMETER@@QEAAAEA_JXZ
?QueryCertContext@IIS_SERVER_CERT@@QEAAPEBU_CERT_CONTEXT@@XZ
?QueryCertContextAddr@IIS_SERVER_CERT@@QEAAPEAPEBU_CERT_CONTEXT@@XZ
?QueryCertValidity@IIS_SSL_INFO@@QEAAHPEAK@Z
?QueryCertificate@IIS_SSL_INFO@@QEAAPEAVIIS_SERVER_CERT@@XZ
?QueryCertificateFlags@TCP_AUTHENT@@QEAAHPEAKPEAH@Z
?QueryCertificateIssuer@TCP_AUTHENT@@QEAAHPEADKPEAH@Z
?QueryCertificateSerialNumber@TCP_AUTHENT@@QEAAHPEAPEAEPEAKPEAH@Z
?QueryCertificateSubject@TCP_AUTHENT@@QEAAHPEADKPEAH@Z
?QueryColNames@ODBC_STATEMENT@@QEAAHPEAPEAVSTR@@PEAKKPEAH@Z
?QueryConnectionTimeout@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryContainer@IIS_SERVER_CERT@@QEAAPEADXZ
?QueryContext@TS_OPEN_FILE_INFO@@QEBAPEAXXZ
?QueryCredHandle@TCP_AUTHENT@@QEAAPEAU_SecHandle@@XZ
?QueryCtxtHandle@TCP_AUTHENT@@QEAAPEAU_SecHandle@@XZ
?QueryCurrentConnections@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryCurrentServiceError@IIS_SERVICE@@QEBAKXZ
?QueryCurrentServiceState@IIS_SERVICE@@QEBAKXZ
?QueryDefaultPort@IIS_SERVER_INSTANCE@@QEBAGXZ
?QueryDownLevelInstance@IIS_SERVICE@@QEBAKXZ
?QueryEncryptionKeySize@TCP_AUTHENT@@QEAAHPEAKPEAH@Z
?QueryEncryptionServerPrivateKeySize@TCP_AUTHENT@@QEAAHPEAKPEAH@Z
?QueryEndpoint@IIS_SERVER_BINDING@@QEAAPEAVIIS_ENDPOINT@@XZ
?QueryErrorCode@ODBC_CONNECTION@@QEBAFXZ
?QueryErrorCode@ODBC_STATEMENT@@QEBAFXZ
?QueryEventLog@IIS_SERVICE@@QEAAPEAVEVENT_LOG@@XZ
?QueryExpiry@TCP_AUTHENT@@QEAAHPEAT_LARGE_INTEGER@@@Z
?QueryExtraLoggingFields@LOGGING@@QEAAPEADXZ
?QueryFileHandle@TS_OPEN_FILE_INFO@@QEAAPEAXXZ
?QueryFullyQualifiedUserName@TCP_AUTHENT@@QEAAHPEADPEAVSTR@@PEAVIIS_SERVER_INSTANCE@@PEAVTCP_AUTHENT_INFO@@@Z
?QueryHostName@IIS_SERVER_BINDING@@QEAAPEBDXZ
?QueryImpersonationToken@TCP_AUTHENT@@QEAAPEAXXZ
?QueryInetInfoRpc@IIS_SERVICE@@SAPEAVISRPC@@XZ
?QueryInstanceCount@IIS_SERVICE@@QEBAKXZ
?QueryInstanceId@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryIpAddress@IIS_SERVER_BINDING@@QEAAKXZ
?QueryIpPort@IIS_SERVER_BINDING@@QEAAGXZ
?QueryLastWriteTime@TS_OPEN_FILE_INFO@@QEBAHPEAU_FILETIME@@@Z
?QueryLine@INET_PARSER@@QEAAPEADXZ
?QueryListIdentifier@IIS_CTL@@QEAAPEAGXZ
?QueryLogAnonymous@IIS_SERVER_INSTANCE@@QEBAHXZ
?QueryLogNonAnonymous@IIS_SERVER_INSTANCE@@QEBAHXZ
?QueryMBPath@IIS_CTL@@QEAAPEADXZ
?QueryMBPath@IIS_SERVER_CERT@@QEAAPEADXZ
?QueryMDNseObject@IIS_SERVICE@@QEAAPEAUIUnknown@@XZ
?QueryMDObject@IIS_SERVICE@@SAPEAUIUnknown@@XZ
?QueryMDPath@IIS_SERVER_INSTANCE@@QEBAPEBDXZ
?QueryMDPath@IIS_SERVICE@@QEBAPEBDXZ
?QueryMDPathLen@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryMDVRPath@IIS_SERVER_INSTANCE@@QEBAPEBDXZ
?QueryMDVRPathLen@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryMaxCbValue@ODBC_PARAMETER@@QEBA_JXZ
?QueryMaxConnections@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryMaxEndpointConnections@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryModuleName@IIS_SERVICE@@QEBAPEBDXZ
?QueryOpenFlags@IIS_SERVER_CERT@@QEAAKXZ
?QueryOriginalStore@IIS_CTL@@QEAAPEAXXZ
?QueryParamNumber@ODBC_PARAMETER@@QEBAGXZ
?QueryParamType@ODBC_PARAMETER@@QEBAFXZ
?QueryPos@INET_PARSER@@QEAAPEADXZ
?QueryPrecision@ODBC_PARAMETER@@QEBAKXZ
?QueryPrimaryToken@TCP_AUTHENT@@QEAAPEAXXZ
?QueryProviderName@IIS_SERVER_CERT@@QEAAPEADXZ
?QueryProviderType@IIS_SERVER_CERT@@QEAAKXZ
?QueryPtr@RefBlob@@QEAAPEAXXZ
?QueryRefCount@RefBlob@@QEAAPEAJXZ
?QueryRegParamKey@IIS_SERVER_INSTANCE@@QEBAPEBDXZ
?QueryRegParamKey@IIS_SERVICE@@QEBAPEBDXZ
?QueryRoot@IIS_SERVER_INSTANCE@@QEBAPEADXZ
?QueryRowCount@ODBC_STATEMENT@@QEAAHPEA_J@Z
?QuerySavedState@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryScale@ODBC_PARAMETER@@QEBAFXZ
?QueryServerCertificateIssuer@TCP_AUTHENT@@QEAAHPEAPEADPEAH@Z
?QueryServerCertificateSubject@TCP_AUTHENT@@QEAAHPEAPEADPEAH@Z
?QueryServerSize@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryServerState@IIS_SERVER_INSTANCE@@QEBAKXZ
?QueryServiceComment@IIS_SERVICE@@QEBAPEBDXZ
?QueryServiceId@IIS_SERVICE@@QEBAKXZ
?QueryServiceName@IIS_SERVICE@@QEBAPEBDXZ
?QueryServiceSpecificExitCode@IIS_SERVICE@@QEBAKXZ
?QueryShutdownScheduleId@IIS_SERVICE@@QEBAKXZ
?QuerySignerCert@IIS_CTL@@QEAAHPEAPEBU_CERT_CONTEXT@@@Z
?QuerySiteName@IIS_SERVER_INSTANCE@@QEBAPEBDXZ
?QuerySize@RefBlob@@QEAAKXZ
?QuerySize@TS_OPEN_FILE_INFO@@QEBAHAEAT_LARGE_INTEGER@@@Z
?QuerySize@TS_OPEN_FILE_INFO@@QEBAHPEAK0@Z
?QuerySqlType@ODBC_PARAMETER@@QEBAFXZ
?QuerySslCtxtHandle@TCP_AUTHENT@@QEAAPEAU_SecHandle@@XZ
?QueryStatus@IIS_CTL@@QEAAKXZ
?QueryStoreHandle@IIS_SERVER_CERT@@QEAAPEAXXZ
?QueryStoreName@IIS_CTL@@QEAAPEADXZ
?QueryStoreName@IIS_SERVER_CERT@@QEAAPEADXZ
?QueryToken@INET_PARSER@@QEAAPEADXZ
?QueryUserName@TCP_AUTHENT@@QEAAHPEAVSTR@@H@Z
?QueryValue@ODBC_PARAMETER@@QEBAPEAXXZ
?QueryValuesAsStr@ODBC_STATEMENT@@QEAAHPEAPEAVSTR@@PEAPEAKPEAH@Z
?QueryVrootCount@IIS_VROOT_TABLE@@QEAAKXZ
?QueryVrootTable@IIS_SERVER_INSTANCE@@QEAAPEAVIIS_VROOT_TABLE@@XZ
?ReadMetaData@COMMON_METADATA@@QEAAHPEAVIIS_SERVER_INSTANCE@@PEAVMB@@PEADPEAU_METADATA_ERROR_INFO@@@Z
?RecordInstanceStart@IIS_SERVICE@@QEAAHXZ
?RecordInstanceStop@IIS_SERVICE@@QEAAXXZ
?Reference@IIS_ENDPOINT@@QEAAXXZ
?Reference@IIS_SERVER_INSTANCE@@QEAAXXZ
?Reference@IIS_SSL_INFO@@QEAAKXZ
?ReferenceData@MB@@QEAAHPEBDKKKPEAPEAXPEAK2K@Z
?RegReadCommonParams@IIS_SERVER_INSTANCE@@QEAAHHH@Z
?RegisterStoreForChange@STORE_CHANGE_NOTIFIER@@QEAAHPEADPEAXP6AX1@Z1@Z
?Release@IIS_SSL_INFO@@SAKPEAX@Z
?Release@RefBlob@@QEAAXXZ
?ReleaseFastLock@IIS_SERVER_INSTANCE@@QEAAXXZ
?ReleaseGlobalLock@IIS_SERVICE@@CAXXZ
?ReleaseReferenceData@MB@@QEAAHK@Z
?ReleaseRegisteredStores@STORE_CHANGE_NOTIFIER@@QEAAXXZ
?ReleaseServiceLock@IIS_SERVICE@@QEAAXH@Z
?RemoveNormalBindings@IIS_SERVER_INSTANCE@@QEAAKXZ
?RemoveSecureBindings@IIS_SERVER_INSTANCE@@QEAAKXZ
?RemoveServerInstance@IIS_SERVICE@@QEAAHPEAVIIS_SERVER_INSTANCE@@@Z
?RemoveVirtualRoot@IIS_VROOT_TABLE@@QEAAHPEAD@Z
?RemoveVirtualRoots@IIS_VROOT_TABLE@@QEAAHXZ
?ReportServiceStatus@IIS_SERVICE@@AEAAKXZ
?Reset@TCP_AUTHENT@@QEAAHH@Z
?RestoreBuffer@INET_PARSER@@QEAAXXZ
?RestoreLine@INET_PARSER@@IEAAXXZ
?RestoreToken@INET_PARSER@@IEAAXXZ
?RevertToSelf@TCP_AUTHENT@@QEAAHXZ
?Save@MB@@QEAAHXZ
?SaveServerState@IIS_SERVER_INSTANCE@@QEAAXXZ
?ServiceCtrlHandler@IIS_SERVICE@@QEAAXK@Z
?SetAccessPerms@COMMON_METADATA@@QEAAXK@Z
?SetAccessToken@TCP_AUTHENT@@QEAAHPEAX0@Z
?SetBandwidthThrottle@IIS_SERVER_INSTANCE@@QEAAHPEAVMB@@@Z
?SetBandwidthThrottleMaxBlocked@IIS_SERVER_INSTANCE@@QEAAHPEAVMB@@@Z
?SetCommonConfig@IIS_SERVER_INSTANCE@@QEAAHPEAU_INET_INFO_CONFIG_INFO@@H@Z
?SetConfig@LOGGING@@QEAAKPEAU_INETLOG_CONFIGURATIONA@@@Z
?SetConnectOption@ODBC_CONNECTION@@QEAAHGK@Z
?SetContext@TS_OPEN_FILE_INFO@@QEAAHPEAXP6AH0@Z@Z
?SetData@MB@@QEAAHPEBDKKKPEAXKK@Z
?SetInstanceConfiguration@IIS_SERVICE@@AEAAHKKHPEAU_INET_INFO_CONFIG_INFO@@@Z
?SetListMode@INET_PARSER@@QEAAXH@Z
?SetParameters@TSVC_CACHE@@QEAAXKKPEAX@Z
?SetPtr@INET_PARSER@@QEAAXPEAD@Z
?SetSecurityContextToken@TCP_AUTHENT@@QEAAHPEAU_SecHandle@@PEAXP6AH01@Z1PEAVIIS_SSL_INFO@@@Z
?SetServerState@IIS_SERVER_INSTANCE@@QEAAXKK@Z
?SetServiceAdminInfo@IIS_SERVICE@@SAHKKKHPEAU_INET_INFO_CONFIG_INFO@@@Z
?SetServiceComment@IIS_SERVICE@@QEAAXPEAD@Z
?SetServiceSpecificExitCode@IIS_SERVICE@@QEAAXK@Z
?SetTargetName@TCP_AUTHENT@@QEAAHPEAD@Z
?SetValueBuffer@ODBC_PARAMETER@@QEAAHJJ@Z
?SetWin32Error@IIS_SERVER_INSTANCE@@QEAAXK@Z
?SetZapRegKey@IIS_SERVER_INSTANCE@@QEAAXXZ
?ShutdownLogging@LOGGING@@QEAAHXZ
?ShutdownScheduleCallback@IIS_SERVICE@@QEAAKXZ
?ShutdownService@IIS_SERVICE@@QEAAHXZ
?SkipTo@INET_PARSER@@QEAAPEADD@Z
?SortFileInfoPointers@TS_DIRECTORY_INFO@@QEAAHP6AHPEBX0@Z@Z
?StartInstance@IIS_SERVER_INSTANCE@@UEAAKXZ
?StartProcessAsUser@TCP_AUTHENT@@QEAAHPEBDPEADHKPEAX0PEAU_STARTUPINFOA@@PEAU_PROCESS_INFORMATION@@@Z
?StartServiceOperation@IIS_SERVICE@@QEAAKP6AXK@ZP6AKPEAX@Z2@Z
?StartUpIndicateClientActivity@IIS_SERVICE@@QEAAXXZ
?Status@IIS_SERVER_CERT@@QEAAKXZ
?StopEndpoints@IIS_SERVER_INSTANCE@@QEAAHXZ
?StopEndpointsHelper@IIS_SERVER_INSTANCE@@AEAAHPEAU_LIST_ENTRY@@@Z
?StopInstance@IIS_SERVER_INSTANCE@@UEAAKXZ
?StopInstanceProcs@IIS_SERVICE@@UEAAXPEAVIIS_SERVER_INSTANCE@@@Z
?StopService@IIS_SERVICE@@AEAAXXZ
?Success@ODBC_CONNECTION@@SAHF@Z
?Terminate@LOGGING@@SAKXZ
?TerminateDiscovery@IIS_SERVICE@@QEAAKXZ
?TerminateLine@INET_PARSER@@IEAAXXZ
?TerminateToken@INET_PARSER@@IEAAXD@Z
?TsEnumVirtualRoots@IIS_SERVER_INSTANCE@@QEAAHP6AHPEAXPEAVMB@@PEAU_VIRTUAL_ROOT@@@Z01@Z
?TsMirrorVirtualRoots@IIS_SERVER_INSTANCE@@QEAAXPEAU_INET_INFO_CONFIG_INFO@@@Z
?TsReadVirtualRoots@IIS_SERVER_INSTANCE@@QEAAHPEAU_MD_CHANGE_OBJECT_A@@@Z
?TsRecursiveEnumVirtualRoots@IIS_SERVER_INSTANCE@@QEAAHP6AHPEAXPEAVMB@@PEAU_VIRTUAL_ROOT@@@Z0PEADK0H@Z
?TsSetVirtualRoots@IIS_SERVER_INSTANCE@@QEAAHPEAU_INET_INFO_CONFIG_INFO@@@Z
?UnbindHelper@IIS_SERVER_INSTANCE@@AEAAKPEAU_LIST_ENTRY@@@Z
?UnbindInstance@IIS_SERVER_INSTANCE@@QEAAKXZ
?Unlock@IIS_SSL_INFO@@QEAAXXZ
?Unlock@IIS_VROOT_TABLE@@QEAAXXZ
?Unlock@LOGGING@@AEAAXXZ
?UnlockThis@IIS_SERVER_INSTANCE@@QEAAXXZ
?UnregisterStore@STORE_CHANGE_NOTIFIER@@QEAAXPEADP6AXPEAX@Z1@Z
?UpdateBindingsHelper@IIS_SERVER_INSTANCE@@AEAAKH@Z
?UpdateClientCertFlags@TCP_AUTHENT@@QEAAHKPEAHPEAEK@Z
?UpdateNormalBindings@IIS_SERVER_INSTANCE@@QEAAKXZ
?UpdateSecureBindings@IIS_SERVER_INSTANCE@@QEAAKXZ
?UpdateServiceStatus@IIS_SERVICE@@QEAAKKKKK@Z
?UseDSMapper@IIS_SSL_INFO@@QEAAHXZ
?UseProgrammaticPINEntry@IIS_SERVER_CERT@@AEAAHPEAVMB@@@Z
?VerifySignature@IIS_CTL@@QEAAHPEAPEAXKPEAH@Z
?ZapInstanceMBTree@IIS_SERVER_INSTANCE@@QEAAXXZ
?m_ComLogCustomInformation@LOGGING@@0P6AKPEAXKPEAU_CUSTOM_LOG_DATA@@PEAD@ZEA
?m_ComLogDllCleanUp@LOGGING@@0P6AKXZEA
?m_ComLogDllStartup@LOGGING@@0P6AKXZEA
?m_ComLogGetConfig@LOGGING@@0P6AKPEAXPEAU_INETLOG_CONFIGURATIONA@@@ZEA
?m_ComLogInitializeLog@LOGGING@@0P6APEAXPEBD0PEAX@ZEA
?m_ComLogLogInformation@LOGGING@@0P6AKPEAXPEBU_INETLOG_INFORMATION@@@ZEA
?m_ComLogNotifyChange@LOGGING@@0P6AKPEAX@ZEA
?m_ComLogQueryExtraLogFields@LOGGING@@0P6AKPEAXPEADPEAK@ZEA
?m_ComLogSetConfig@LOGGING@@0P6AKPEAXPEBU_INETLOG_CONFIGURATIONA@@@ZEA
?m_ComLogTerminateLog@LOGGING@@0P6AKPEAX@ZEA
?m_hComLogDLL@LOGGING@@0PEAUHINSTANCE__@@EA
?sm_MDNseObject@IIS_SERVICE@@0PEAUIUnknown@@EA
?sm_MDObject@IIS_SERVICE@@0PEAUIUnknown@@EA
?sm_ServiceInfoListHead@IIS_SERVICE@@0U_LIST_ENTRY@@A
?sm_csLock@IIS_SERVICE@@0U_RTL_CRITICAL_SECTION@@A
?sm_fInitialized@IIS_SERVICE@@0HA
?sm_isrpc@IIS_SERVICE@@0PEAVISRPC@@EA
?sm_pDbgRefTraceLog@IIS_SERVER_INSTANCE@@2PEAU_TRACE_LOG@@EA
?sm_pDbgRefTraceLog@IIS_SERVICE@@2PEAU_TRACE_LOG@@EA
BuildAnonymousAcctDesc
CheckIfShortFileName
ConvertStringToRpc
ConvertUnicodeToAnsi
DoSynchronousReadFile
FreeRpcString
IISDuplicateTokenEx
InetNtoa
InitCommonDlls
IsNameInRegExpressionA
KludgeMultiSz
NullCloseLocator
NullDeReferenceMapper
NullGetAccessToken
NullGetChallenge
NullGetIssuerList

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iprestr.dll
.dll windows:10 windows x64

1ebdc839e99dd1b85cf1e162f9e8de5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
strchr
strpbrk
isspace
malloc
free
_wtoi
_wcsicmp
strrchr
_onexit
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount

ws2_32

WSACleanup
WSAStartup
WSAStringToAddressA
WSAGetLastError
GetNameInfoW
GetAddrInfoW
htonl
FreeAddrInfoW

api-ms-win-core-localization-l1-2-0

IdnToAscii

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

iisutil

?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?Copy@STRU@@QEAAJPEBGK@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?Resize@STRU@@QEAAJK@Z
??0STRU@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??1STRA@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
??1STRU@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
PuDbgPrint
??0BUFFER@@QEAA@XZ
??1CLKRHashTable@@QEAA@XZ
??0STRA@@QEAA@XZ
?Copy@STRA@@QEAAJPEBDK@Z
?Resize@BUFFER@@QEAA_NK@Z
?Copy@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z

w3tp

?CreateThreadPool@THREAD_POOL@@SAHPEAPEAV1@PEAUTHREAD_POOL_CONFIG@@@Z

Exports

Exports

RegisterModule

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/isapi.dll
.dll windows:10 windows x64

4ed881e00d2280f85a86971cc16a9549

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_wcsupr
wcschr
wcsncpy_s
_wcsicmp
memcpy
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
isspace
strpbrk
wcspbrk
isdigit
atoi
_wcsnicmp
strchr
strstr
strncmp
strtoul
_errno
_stricmp
wcsncmp
_vsnprintf
_strnicmp
??1type_info@@UEAA@XZ
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
OpenProcessToken
OpenThreadToken
SetThreadToken
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-security-base-l1-1-0

RevertToSelf
DuplicateTokenEx
EqualSid
GetTokenInformation
GetKernelObjectSecurity
AccessCheck
GetLengthSid
GetFileSecurityW

api-ms-win-core-file-l1-1-0

GetFileAttributesW
GetFileSizeEx

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetSystemTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

iisutil

??1CReaderWriterLock3@@QEAA@XZ
??1CSmallSpinLock@@QEAA@XZ
?WriteLock@CSmallSpinLock@@QEAAXXZ
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
??0EVENT_LOG@@QEAA@PEBG@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?IsEmpty@STRA@@QEBA_NXZ
?QueryStr@STRA@@QEAAPEADXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QueryCB@STRA@@QEBAKXZ
PuDbgPrint
??1STRA@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
??0STRA@@QEAA@XZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
??1STRU@@QEAA@XZ
WriteRefTraceLog
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
DisableTokenBackupPrivilege
??1CLKRHashTable@@QEAA@XZ
?QueryStr@STRU@@QEBAPEBGXZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
TerminateIISUtil
PuDeleteDebugPrintsObject
?CopyBinary@STRA@@QEAAJPEAXK@Z
?Copy@STRA@@QEAAJPEBD@Z
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
DestroyRefTraceLog
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
MakePathCanonicalizationProof
?QuerySize@BUFFER@@QEBAKXZ
?Resize@BUFFER@@QEAA_NK@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
IISInitializeCriticalSection
??0BUFFER@@QEAA@XZ
??0STRU@@QEAA@XZ
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
CreateRefTraceLog
??0BUFFER@@QEAA@PEAEK@Z
??0STRU@@QEAA@PEAGK@Z
?CopyA@STRU@@QEAAJPEBD@Z
?QueryCCH@STRU@@QEBAKXZ
NormalizeUrl
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?Resize@STRU@@QEAAJK@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?CopyToBuffer@STRU@@QEBAJPEAGPEAK@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBG@Z
?QueryCB@STRU@@QEBAKXZ
?Append@STRU@@QEAAJPEBGK@Z
?SetLen@STRU@@QEAA_NK@Z
?QueryCCH@STRA@@QEBAKXZ
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
StringTimeToFileTime
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
?Append@STRA@@QEAAJPEBDK@Z
IISGetCurrentTime
SystemTimeToGMT
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
??0CSmallSpinLock@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@XZ
?QueryStr@STRU@@QEAAPEAGXZ
InitializeIISUtil
PuCreateDebugPrintsObject

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-security-logon-l1-1-0

LogonUserExW

ntdll

RtlNtStatusToDosError

cryptsp

CryptDestroyHash
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptReleaseContext

api-ms-win-security-lsapolicy-l1-1-0

LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
LsaOpenPolicy

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/isatq.dll
.dll windows:10 windows x64

ace4ee979e9fdb1bbe4881483272da74

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
__C_specific_handler
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
_purecall
realloc
malloc
_stricmp
free
_CxxThrowException
memset

advapi32

TraceEvent
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
UnregisterTraceGuids
GetTraceLoggerHandle
RegisterTraceGuidsW

kernel32

GetModuleHandleExA
ReadFile
LocalAlloc
WriteFile
GlobalMemoryStatus
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
OutputDebugStringA
LocalFree
GetCurrentThread
LoadLibraryA
GetProcAddress
DisableThreadLibraryCalls
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FreeLibrary
TerminateProcess
CreateThread
WaitForSingleObject
SetEvent
GetLastError
CreateEventA
Sleep
SetLastError
CloseHandle
CreateFileA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetSystemInfo
GetCurrentProcess

user32

AdjustWindowRectEx

ws2_32

WSASend
WSASocketW
WSAIoctl
WSASocketA
listen
WSAAccept
WSAStartup
WSACleanup
getsockopt
sendto
shutdown
connect
setsockopt
bind
htons
htonl
socket
closesocket
WSAGetLastError
recvfrom
WSARecv
__WSAFDIsSet
select

ntdll

NtQueryInformationThread

iisrtl

??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
??1CLKRHashTable_Iterator@@QEAA@XZ
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?FindRecord@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
PuDeleteDebugPrintsObject
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
ScheduleWorkItem
RemoveWorkItem
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
ScheduleAdjustTime
??1CLKRHashTable@@QEAA@XZ
PuDbgPrint
IISInitializeCriticalSection
?Size@CLKRHashTable@@QEBAKXZ
?EqualRange@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@1@Z
?Find@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@0@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@@Z
?Insert@CLKRHashTable@@QEAA_NPEBXAEAVCLKRHashTable_Iterator@@_N@Z
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z

Exports

Exports

??0?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA@PEBDNKK_N@Z
??0CDirMonitor@@QEAA@XZ
??0CDirMonitorEntry@@QEAA@AEBV0@@Z
??0CDirMonitorEntry@@QEAA@XZ
??1?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA@XZ
??1CDirMonitor@@QEAA@XZ
??1CDirMonitorEntry@@UEAA@XZ
??4CDirMonitorEntry@@QEAAAEAV0@AEBV0@@Z
??_7CDirMonitorEntry@@6B@
?AddRef@CDirMonitor@@QEAAJXZ
?AddRef@CDirMonitorEntry@@UEAAXXZ
?AddRefRecord@CDirMonitor@@SAXPEAVCDirMonitorEntry@@H@Z
?Apply@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAAKP6A?AW4LK_ACTION@@PEAVCDirMonitorEntry@@PEAX@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVCDirMonitorEntry@@PEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?CalcKeyHash@CDirMonitor@@SAKPEBD@Z
?Cleanup@CDirMonitor@@QEAAHXZ
?Cleanup@CDirMonitorEntry@@IEAAHXZ
?DeleteIf@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVCDirMonitorEntry@@PEAX@Z1@Z
?DeleteKey@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@QEBD@Z
?DeleteRecord@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVCDirMonitorEntry@@@Z
?DirMonitorCompletionFunction@CDirMonitor@@SAXPEAXKKPEAU_OVERLAPPED@@@Z
?EqualKeys@CDirMonitor@@SA_NPEBD0@Z
?EqualRange@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA_NQEBDAEAViterator@1@1@Z
?Erase@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA_NAEAViterator@1@0@Z
?Erase@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA_NAEAViterator@1@@Z
?ExtractKey@CDirMonitor@@SAPEBDPEBVCDirMonitorEntry@@@Z
?Find@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA_NQEBDAEAViterator@1@@Z
?FindEntry@CDirMonitor@@QEAAPEAVCDirMonitorEntry@@PEBD@Z
?FindKey@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@QEBDPEAPEAVCDirMonitorEntry@@@Z
?FindRecord@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@PEBVCDirMonitorEntry@@@Z
?GetBufferSize@CDirMonitorEntry@@IEAAKXZ
?IOAddRef@CDirMonitorEntry@@IEAAXXZ
?IORelease@CDirMonitorEntry@@IEAAHXZ
?Init@CDirMonitorEntry@@UEAAHK@Z
?Insert@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA_NPEBVCDirMonitorEntry@@AEAViterator@1@_N@Z
?InsertEntry@CDirMonitor@@QEAA?AW4LK_RETCODE@@PEAVCDirMonitorEntry@@@Z
?InsertRecord@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVCDirMonitorEntry@@_N@Z
?Lock@CDirMonitor@@QEAAXXZ
?Monitor@CDirMonitor@@QEAAHPEAVCDirMonitorEntry@@PEBDHK@Z
?Release@CDirMonitor@@QEAAJXZ
?Release@CDirMonitorEntry@@UEAAHXZ
?RemoveEntry@CDirMonitor@@QEAA?AW4LK_RETCODE@@PEAVCDirMonitorEntry@@@Z
?RequestNotification@CDirMonitorEntry@@IEAAHXZ
?ResetDirectoryHandle@CDirMonitorEntry@@IEAAHXZ
?SerialComplLock@CDirMonitor@@AEAAXXZ
?SerialComplUnlock@CDirMonitor@@AEAAXXZ
?SetBufferSize@CDirMonitorEntry@@IEAAHK@Z
?Unlock@CDirMonitor@@QEAAXXZ
?_Action@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@CA?AW4LK_ACTION@@PEBXPEAX@Z
?_AddRefRecord@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@CAXPEBXH@Z
?_CalcKeyHash@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@CAK_K@Z
?_EqualKeys@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@CA_N_K0@Z
?_ExtractKey@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@CA?B_KPEBX@Z
?_Pred@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@CA?AW4LK_PREDICATE@@PEBXPEAX@Z
?begin@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA?AViterator@1@XZ
?end@?$CTypedHashTable@VCDirMonitor@@VCDirMonitorEntry@@PEBDVCLKRHashTable@@@@QEAA?AViterator@1@XZ
AtqAddAsyncHandle
AtqBandwidthGetInfo
AtqBandwidthSetInfo
AtqClearStatistics
AtqCloseEndpoint
AtqCloseFileHandle
AtqCloseSocket
AtqContextSetInfo
AtqCreateBandwidthInfo
AtqCreateEndpoint
AtqEndpointGetInfo
AtqEndpointSetInfo
AtqFreeBandwidthInfo
AtqFreeContext
AtqGetAcceptExAddrs
AtqGetCapTraceInfo
AtqGetCompletionPort
AtqGetInfo
AtqGetStatistics
AtqInitialize
AtqPostCompletionStatus
AtqReadDirChanges
AtqReadFile
AtqReadSocket
AtqSetInfo
AtqSetSocketOption
AtqStartEndpoint
AtqStopAndCloseEndpoint
AtqStopEndpoint
AtqSyncWsaSend
AtqTerminate
AtqTransmitFile
AtqTransmitFileEx
AtqWriteFile
AtqWriteSocket
GetIISCapTraceFlag
GetIISCapTraceLoggerHandle
IISInitializeCapTrace
SetIISCapTraceFlag

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/iscomlog.dll
.dll regsvr32 windows:10 windows x64

c8698be3d32b3a86119c6c339a00adc8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
__C_specific_handler
_initterm
_amsg_exit
strchr
free
_callnewh
malloc
strncpy_s
strcpy_s
mbstowcs
_stricmp
wcscat_s
_XcptFilter
memset

kernel32

SetLastError
LeaveCriticalSection
LocalAlloc
LocalFree
GetComputerNameA
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EnterCriticalSection
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
OutputDebugStringA
LoadLibraryExW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
DeleteCriticalSection
GetLastError
UnhandledExceptionFilter
GetSystemDirectoryW

ole32

CLSIDFromString
CoCreateInstance

iisrtl

?Unlock@TS_RESOURCE@@QEAAXXZ
??1STR@@QEAA@XZ
?Copy@STR@@QEAAHPEBD@Z
??0TS_RESOURCE@@QEAA@XZ
??0STR@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z
??1BUFFER@@QEAA@XZ
PuDeleteDebugPrintsObject
IISInitializeCriticalSection
IISGetPlatformType
PuDbgPrint
PuLoadDebugFlagsFromRegStr
PuCreateDebugPrintsObject
??0STR@@QEAA@AEBV0@@Z
??4TS_RESOURCE@@QEAAAEAV0@AEBV0@@Z
?Lock@TS_RESOURCE@@QEAAXW4TSRES_LOCK_TYPE@@@Z
??1TS_RESOURCE@@QEAA@XZ
??0TS_RESOURCE@@QEAA@AEBV0@@Z

Exports

Exports

??0LOGGING@@QEAA@AEBV0@@Z
??4LOGGING@@QEAAAEAV0@AEBV0@@Z
?LockExclusive@LOGGING@@AEAAXXZ
?LockShared@LOGGING@@AEAAXXZ
?Unlock@LOGGING@@AEAAXXZ
ComLogCustomInformation
ComLogDllCleanUp
ComLogDllStartup
ComLogGetConfig
ComLogInitializeLog
ComLogLogInformation
ComLogNotifyChange
ComLogQueryExtraLogFields
ComLogSetConfig
ComLogTerminateLog
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/it-IT/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

93:1c:29:3f:4e:df:07:6d:d4:32:2d:f5:4c:2d:14:41:fa:ca:e7:11
Signer

Actual PE Digest

93:1c:29:3f:4e:df:07:6d:d4:32:2d:f5:4c:2d:14:41:fa:ca:e7:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/ja-JP/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

cc:91:7d:ca:9f:2b:53:87:91:40:de:c1:d3:39:80:50:af:7c:d9:8a
Signer

Actual PE Digest

cc:91:7d:ca:9f:2b:53:87:91:40:de:c1:d3:39:80:50:af:7c:d9:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/ko-KR/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

07:26:48:b0:01:a6:d7:75:ef:4a:43:38:f1:76:9e:22:1a:58:be:a7
Signer

Actual PE Digest

07:26:48:b0:01:a6:d7:75:ef:4a:43:38:f1:76:9e:22:1a:58:be:a7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/logcust.dll
.dll windows:10 windows x64

52a3ed48e78320ec5c3462da72ac316d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memcpy
free
_ultoa_s
_vsnprintf
_wcsicmp
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoCreateInstance

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExA
GetTickCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

iisutil

?Append@STRU@@QEAAJPEBGK@Z
?Copy@STRA@@QEAAJPEBD@Z
??1STRA@@QEAA@XZ
??1MULTISZA@@QEAA@XZ
??1STRU@@QEAA@XZ
?Resize@BUFFER@@QEAA_NKK@Z
?Copy@STRA@@QEAAJPEBDK@Z
??0STRA@@QEAA@PEADK@Z
??0BUFFER@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0STRA@@QEAA@XZ
??0MULTISZA@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
?Copy@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
PuDbgPrint
?Resize@BUFFER@@QEAA_NK@Z
?RecalcLen@MULTISZA@@QEAAXXZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/loghttp.dll
.dll windows:10 windows x64

ddb05a51f0496be261e1aed7899c4bf2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_ultow_s
_ultoa_s
_wcsicmp
_strtoui64
free
memcpy
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
_onexit
__dllonexit
_unlock
__C_specific_handler
wcsncpy_s
_strupr
_vsnprintf_s
_lock
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExA
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
GetCurrentProcess

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

iisutil

?DestroyIpmMessagePipe@IPM2_MESSAGE_PIPE@@QEAAXXZ
FreeTokenUserSID
GetTokenUserSID
?Append@STRU@@QEAAJPEBGK@Z
GenerateNameWithGUID
?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SAJPEAVIPM2_MESSAGE_ACCEPTOR@@PEBGHHKPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@PEAH@Z
?Append@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBG@Z
?WriteMessage@IPM2_MESSAGE_PIPE@@QEAAJW4IPM2_OPCODE@@KPEAX@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?QueryCB@MULTISZ@@QEBAIXZ
?WriteMessage@IPM2_MESSAGE_PIPE@@QEAAJW4IPM2_OPCODE@@KKPEAXK1@Z
?Append@MULTISZ@@QEAAHPEBG@Z
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
??0EVENT_LOG@@QEAA@PEBG@Z
??1STRA@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
??1STRU@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
IISInitializeCriticalSection
?Reset@MULTISZ@@QEAAXXZ
??1MULTISZ@@QEAA@XZ
?IsEmpty@STRA@@QEBA_NXZ
?QueryCCH@STRA@@QEBAKXZ
?QueryStr@STRA@@QEBAPEBDXZ
??0STRU@@QEAA@XZ
??0STRA@@QEAA@XZ
PuDbgPrint
?QueryStr@MULTISZ@@QEBAPEAGXZ
??0MULTISZ@@QEAA@XZ
?QueryStr@STRU@@QEAAPEAGXZ
?Reset@STRA@@QEAAXXZ
?AppendW@STRA@@QEAAJPEBG@Z
?QueryCB@STRA@@QEBAKXZ
?Reset@STRU@@QEAAXXZ
?Append@STRU@@QEAAJG@Z
?AppendA@STRU@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0STRU@@QEAA@PEAGK@Z
?Copy@STRA@@QEAAJPEBDK@Z
?QuerySize@STRA@@QEBAKXZ
?SyncWithBuffer@STRA@@QEAAXXZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/logscrpt.dll
.dll regsvr32 windows:10 windows x64

2426cab2b1deae19a4ebd65d3e16879c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_ltow
wcscat_s
__CxxFrameHandler3
wcscpy_s
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
memmove_s
memcpy_s
malloc
free
__C_specific_handler
_wcsicmp
memset

atl

ord15
ord32
ord21
ord16
ord23

iisrtl

PuDeleteDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuCreateDebugPrintsObject

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-com-l1-1-0

CoCreateInstance
CLSIDFromString

oleaut32

LoadRegTypeLi
SysAllocString
SetErrorInfo

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls

api-ms-win-core-file-l1-1-0

FindFirstFileW
CompareFileTime
FindNextFileW
FindClose
GetFileAttributesW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/logtemp.sql
inetsrv/logui.ocx
.dll regsvr32 windows:10 windows x64

df16a9d72f9a9ddadff4a0b37a85d989

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mfc42u

ord5702
ord4752
ord1777
ord6437
ord2517
ord5077
ord5406
ord4721
ord5687
ord6440
ord1778
ord5712
ord4770
ord665
ord6880
ord626
ord1040
ord6886
ord1906
ord549
ord999
ord3531
ord3911
ord1056
ord408
ord904
ord2329
ord4582
ord1463
ord2902
ord6418
ord3397
ord3413
ord6386
ord1483
ord4699
ord4860
ord5227
ord5709
ord5246
ord4722
ord5352
ord5382
ord5114
ord5304
ord5583
ord5585
ord5584
ord2781
ord3830
ord4741
ord3535
ord822
ord2586
ord3743
ord2975
ord1122
ord3774
ord867
ord3892
ord1033
ord3894
ord1035
ord1126
ord2384
ord2328
ord2371
ord2379
ord2661
ord6050
ord1286
ord1259
ord4436
ord1284
ord4473
ord6632
ord5887
ord3761
ord6614
ord6832
ord5815
ord2876
ord2121
ord6821
ord5804
ord2629
ord6351
ord971
ord659
ord1063
ord624
ord4521
ord2783
ord4213
ord2751
ord287
ord6787
ord1263
ord3837
ord4983
ord3534
ord6053
ord5711
ord5730
ord5065
ord4368
ord5724
ord5722
ord3468
ord2412
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord1287
ord2408
ord493
ord1514
ord1527
ord311
ord827
ord1803
ord1506
ord1524
ord559
ord1003
ord1365
ord2532
ord3850
ord3484
ord3384
ord5868
ord4822
ord6800
ord3447
ord6799
ord6021
ord1427
ord1426
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord5245
ord6767
ord4557
ord337
ord852
ord1498
ord4988
ord4371
ord3164
ord4077
ord4083
ord4082
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord4771
ord5699
ord2140
ord2457
ord5683
ord1736
ord5484
ord3933
ord6814
ord2060
ord2670
ord4789
ord5229
ord4017
ord4694
ord6812
ord5586
ord2399
ord5663
ord4365
ord4131
ord6887

msvcrt

??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler3
_wcsicmp
??0exception@@QEAA@AEBV0@@Z
memcpy_s
free
_wcsdup
malloc
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
_lock
_unlock
__dllonexit
_onexit
wcscpy_s
??1type_info@@UEAA@XZ
memset

iisui

?AddKey@CMetaKey@@QEAAJPEBG@Z
??0CMetabasePath@@QEAA@HPEBG000@Z
?Next@CMetaEnumerator@@QEAAJAEAVCString@@PEBG@Z
??0CMetaEnumerator@@QEAA@HPEAVCMetaKey@@@Z
?Succeeded@CMetaKey@@UEBAHXZ
??1CMetaKey@@UEAA@XZ
ord2
??0CComAuthInfo@@QEAA@PEBG00@Z
?CopyTo@CStrPassword@@QEAAXAEAVCString@@@Z
?QueryValue@CMetaKey@@QEAAJKAEAKPEAHPEBGPEAK@Z
?Compare@CStrPassword@@QEBAHAEAV1@@Z
DDX_Text_SecuredString
??4CStrPassword@@QEAAAEBV0@PEBG@Z
??1CStrPassword@@QEAA@XZ
??0CStrPassword@@QEAA@XZ
?CopyTo@CStrPassword@@QEAAXAEAV1@@Z
??0CError@@QEAA@XZ
?QueryValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBGPEAK@Z
??0CError@@QEAA@J@Z
??4CError@@QEAAAEBV0@J@Z
?SetValue@CMetaKey@@QEAAJKHPEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCString@@PEAHPEBG@Z
??1CInheritanceDlg@@UEAA@XZ
?DoModal@CInheritanceDlg@@UEAA_JXZ
??0CInheritanceDlg@@QEAA@KHPEAVCComAuthInfo@@PEBG1PEAVCWnd@@@Z
PathIsValid
LimitInputPath
?QueryValue@CMetaKey@@QEAAJKAEAVCString@@PEAHPEBGPEAK@Z
?QueryResult@CMetaKey@@UEBAJXZ
?GetServiceInfoPath@CMetabasePath@@SAPEBGPEBGAEAVCString@@0@Z
??1CError@@QEAA@XZ
DDV_MinMaxBalloon
DDV_FolderPath
DDV_UNCFolderPath
??0CStringListEx@@QEAA@H@Z
??1CStringListEx@@UEAA@XZ
??BCMetabasePath@@QEBAPEBGXZ
??1CComAuthInfo@@QEAA@XZ
?SetValue@CMetaKey@@QEAAJKKPEAHPEBG@Z
??1CMetaEnumerator@@UEAA@XZ
??1CMetabasePath@@QEAA@XZ
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@PEBGKK@Z

kernel32

GetSystemTimeAsFileTime
GetTickCount
GetCurrentThreadId
LocalAlloc
GetComputerNameW
GetDriveTypeW
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LocalFree
Sleep
LoadLibraryExA
ExpandEnvironmentStringsA
GetProcAddress
GetFileAttributesW
ExpandEnvironmentStringsW

advapi32

RegOpenKeyW
RegOpenKeyExA
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegQueryValueExA

comctl32

ImageList_Add
ImageList_Destroy
ImageList_LoadImageW
ImageList_Create

shell32

SHGetFolderLocation
SHGetFolderPathW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW

user32

SendMessageW
GetMessagePos
MapWindowPoints
LoadStringW
GetWindowLongPtrW
InvalidateRect
EnableWindow
SetWindowTextW
GetDlgItem

gdi32

CreateCompatibleDC
SelectObject
DeleteObject
DeleteDC
CreateDIBSection

ole32

CoUninitialize
CoInitialize
StringFromCLSID
CoTaskMemFree

shlwapi

PathCommonPrefixW
PathIsRelativeW
PathRemoveFileSpecW
PathIsRootW
PathGetDriveNumberW
PathBuildRootW
ord165
ord197
PathIsDirectoryW
ord437
StrDupW
PathIsUNCServerShareW
PathIsNetworkPathW

uxtheme

OpenThemeData
CloseThemeData
ord47

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/metadata.dll
.dll regsvr32 windows:10 windows x64

2b4e7871b6fa70e2e5f12d316bb4bc1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memset
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
memcpy
_XcptFilter
_callnewh
memchr
strchr
wcscat_s
strncpy_s
_mbsstr
_stricmp
_ultoa
_amsg_exit
memcmp
_snwprintf_s
toupper
_ultow
free
_ismbcprint
_mbscspn
_mbslen
iswprint
wcscspn
_strdup
setlocale
strcat_s
strrchr
isdigit
_purecall
atol
_mbschr
strcpy_s
wcscpy_s
_strnicmp
wcschr
_wcsnicmp
malloc
_wcsicmp
qsort
swscanf
wcsrchr
wcsstr
towupper
wcscmp

user32

CharNextExA

advapi32

SetNamedSecurityInfoW
GetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorA
CryptDecrypt
CryptEncrypt
CryptGetUserKey
CryptGenRandom
CryptImportKey
CryptVerifySignatureA
CryptExportKey
CryptDestroyKey
CryptGenKey
CryptDeriveKey
SetThreadToken
OpenThreadToken
CryptSignHashA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptSetProvParam
CryptReleaseContext
CryptAcquireContextA
LsaClose
LsaFreeMemory
CopySid
LsaQueryInformationPolicy
LsaOpenPolicy
CreateWellKnownSid
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
IsWellKnownSid
GetSecurityInfo
GetLengthSid
LookupAccountNameW
AllocateAndInitializeSid
FreeSid
GetSecurityDescriptorLength
MakeSelfRelativeSD
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
AddAccessAllowedAce
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
InitializeSecurityDescriptor
InitializeAcl

ole32

CoTaskMemAlloc
CoRevertToSelf
CoImpersonateClient
CoUninitialize
CoInitializeEx
CoTaskMemFree

kernel32

WideCharToMultiByte
GetSystemDirectoryW
GetTickCount
GetCurrentThreadId
GetVersionExA
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
SetFileAttributesA
SetFileAttributesW
CreateDirectoryW
MoveFileW
GetModuleHandleA
GetModuleFileNameA
MoveFileA
CreateDirectoryA
GetFileAttributesA
IsDBCSLeadByte
CreateEventA
CreateSemaphoreA
ReadFile
WriteFile
CompareStringW
DisableThreadLibraryCalls
OutputDebugStringA
CreateFileW
DeleteFileA
FindNextFileA
SetFileTime
CreateFileA
CopyFileA
OpenFile
PulseEvent
WaitForMultipleObjects
GetCurrentProcess
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetFileAttributesW
LocalFree
GlobalFree
GlobalAlloc
LocalAlloc
SetEvent
ResetEvent
CloseHandle
WaitForSingleObject
CreateEventW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CopyFileW
Sleep
MoveFileExW
lstrlenW
FindClose
FindNextFileW
FindFirstFileW
ReleaseSemaphore
DeleteFileW
UnregisterWaitEx
RegisterWaitForSingleObject
FindFirstChangeNotificationW
FindNextChangeNotification
LeaveCriticalSection
EnterCriticalSection
CompareFileTime
GetLastError
GetFileAttributesExW
FindCloseChangeNotification
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
FlushFileBuffers
SetEndOfFile
GetCurrentThread
FindFirstFileA
GetCurrentProcessId

mpr

WNetAddConnection2W
WNetCancelConnection2W

oleaut32

GetErrorInfo

ntdll

RtlValidRelativeSecurityDescriptor
RtlNtStatusToDosError

iisrtl

?FreeMemory@BUFFER@@QEAAXXZ
?Copy@STRU@@QEAAJPEBV1@@Z
?QueryCCH@STRU@@QEBAKXZ
?Append@STRU@@QEAAJPEBG@Z
??0STRAU@@QEAA@PEBDH@Z
?ReadOrWriteLock@CReaderWriterLock3@@QEAA_NXZ
??0MLSZAU@@QEAA@QEAGK@Z
??0MLSZAU@@QEAA@QEADK@Z
?QueryStr@MLSZAU@@QEAAPEADH@Z
?QueryCB@MLSZAU@@QEAAIH@Z
??1MLSZAU@@QEAA@XZ
PuCreateDebugPrintsObject
?Append@STRAU@@QEAAHPEBGK@Z
?Append@STRAU@@QEAAHPEBDK@Z
?IsValid@MLSZAU@@QEAAHXZ
?QueryStrA@STR@@QEBAPEADXZ
PuLoadDebugFlagsFromRegStr
PuDeleteDebugPrintsObject
??0MLSZAU@@QEAA@QEADHK@Z
?Append@STR@@QEAAHPEBD@Z
?SetLen@STR@@QEAAHK@Z
??1CReaderWriterLock3@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@XZ
??1STR@@QEAA@XZ
??0STR@@QEAA@AEBV0@@Z
?SetLen@STRAU@@QEAAHK@Z
?Append@STRAU@@QEAAHPEBG@Z
?Append@STRAU@@QEAAHPEBD@Z
?Copy@STRAU@@QEAAHPEBD@Z
?QueryStr@STR@@QEBAPEADXZ
?ConvertExclusiveToShared@CReaderWriterLock3@@QEAAXXZ
?ReadOrWriteUnlock@CReaderWriterLock3@@QEAAX_N@Z
?WriteUnlock@CLKRHashTable@@QEBAXXZ
?WriteLock@CLKRHashTable@@QEAAXXZ
?TryReadOrWriteLock@CReaderWriterLock3@@QEAA_NAEA_N@Z
?ConvertSharedToExclusive@CReaderWriterLock3@@QEAAXXZ
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?SafeCopy@STRAU@@QEAAHPEBD@Z
?SafeCopy@STRAU@@QEAAHPEBG@Z
??0STRAU@@QEAA@PEBG@Z
??0STRAU@@QEAA@PEBD@Z
?Clear@CLKRHashTable@@QEAAXXZ
?QueryCBA@STRAU@@QEAAIXZ
?QueryCBW@STRAU@@QEAAIXZ
?Copy@STRAU@@QEAAHPEBG@Z
?QueryCCH@STRAU@@QEAAIXZ
?Copy@STRAU@@QEAAHPEBGK@Z
?QueryStrW@STRAU@@QEAAPEAGXZ
?QueryStrA@STRAU@@QEAAPEADXZ
?IsEmpty@STRAU@@QEAAHXZ
??0STRAU@@QEAA@XZ
??1STRAU@@QEAA@XZ
?Resize@BUFFER@@QEAA_NKK@Z
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?IsValid@STRAU@@QEAAHXZ
?QueryCB@STRAU@@QEAAIH@Z
?QueryStr@STRAU@@QEAAPEADH@Z
ScheduleWorkItem
RemoveWorkItem
??1STRU@@QEAA@XZ
?Reset@STRU@@QEAAXXZ
IISInitializeCriticalSection
?Resize@BUFFER@@QEAA_NK@Z
?QuerySize@BUFFER@@QEBAKXZ
?Copy@STRU@@QEAAJAEBV1@@Z
?IsEmpty@STRU@@QEBA_NXZ
?Copy@STRU@@QEAAJPEBGK@Z
PuDbgPrint
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?Copy@STRU@@QEAAJPEBG@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
??0BUFFER@@QEAA@PEAEK@Z
??0STRU@@QEAA@PEAGK@Z
?QueryStr@STRU@@QEAAPEAGXZ
PuDbgPrintW
??0STRU@@QEAA@XZ
??4CLKRHashTable_Iterator@@QEAAAEAV0@AEBV0@@Z
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@@Z
??0CLKRHashTable_Iterator@@QEAA@XZ
??1CLKRHashTable_Iterator@@QEAA@XZ
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
?Record@CLKRHashTable_Iterator@@QEBAPEBXXZ
??1CLKRHashTable@@QEAA@XZ
?IsValid@STR@@QEBAHXZ
?QueryCB@STR@@QEBAIXZ
?TryWriteLock@CReaderWriterLock3@@QEAA_NXZ
??0STR@@QEAA@PEBD@Z
??0BUFFER@@QEAA@XZ
??1BUFFER@@QEAA@XZ
?QueryPtr@BUFFER@@QEBAPEAXXZ

iiscfg

DllGetSimpleObjectByIDEx

iisutil

?EtwTraceEvent@CEtwTracer@@QEAAKPEBU_GUID@@KZZ

iisadmin

RetrieveTracingHandle

Exports

Exports

??0CBIN@@QEAA@AEBV0@@Z
??0CBIN@@QEAA@KQEAX@Z
??0CBIN@@QEAA@XZ
?Append@CBIN@@QEAAHAEBV1@@Z
?Append@CBIN@@QEAAHKQEAX@Z
?Clone@CBIN@@QEBAHPEAV1@@Z
?Copy@CBIN@@QEAAHAEBV1@@Z
?Copy@CBIN@@QEAAHKQEAX@Z
?IsEmpty@CBIN@@QEBAHXZ
?IsValid@CBIN@@QEBAHXZ
?QueryBuf@CBIN@@QEBAPEAXXZ
?QueryCB@CBIN@@QEBAIXZ
?Resize@CBIN@@QEAAHI@Z
?SetCB@CBIN@@QEAAXI@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/modrqflt.dll
.dll windows:10 windows x64

bb66344b12034a743f61ceae2743b796

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_strlwr
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
wcscspn
_errno
strtoul
_wcsicmp
wcsrchr
wcschr
wcsstr
_stricmp
iswxdigit
_wcslwr

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

iisutil

?Reset@MULTISZ@@QEAAXXZ
?Reset@MULTISZA@@QEAAXXZ
??0MULTISZ@@QEAA@XZ
??1STRA@@QEAA@XZ
?First@MULTISZ@@QEBAPEBGXZ
?Next@MULTISZ@@QEBAPEBGPEBG@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?Next@MULTISZA@@QEBAPEBDPEBD@Z
?Copy@STRU@@QEAAJPEBGK@Z
?FindString@MULTISZ@@QEAAHPEBG@Z
??1MULTISZA@@QEAA@XZ
?CopyW@STRA@@QEAAJPEBG@Z
??0STRA@@QEAA@XZ
?Append@MULTISZA@@QEAAHPEBD@Z
QueryLocalizedResourceString
?IsEmpty@MULTISZA@@QEBAHXZ
?Unescape@STRU@@QEAAJXZ
?IsEmpty@MULTISZ@@QEBAHXZ
?QueryStr@STRA@@QEAAPEADXZ
??1MULTISZ@@QEAA@XZ
??0MULTISZA@@QEAA@XZ
?CopyA@STRU@@QEAAJPEBD@Z
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuDbgPrint
PuDeleteDebugPrintsObject
??0STRU@@QEAA@XZ
??1STRU@@QEAA@XZ
?QueryStr@STRU@@QEAAPEAGXZ
?Copy@STRU@@QEAAJPEBG@Z
?First@MULTISZA@@QEBAPEBDXZ

Exports

Exports

RegisterModule

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/nativerd.dll
.dll regsvr32 windows:10 windows x64

51659c43cc310b916b4d2632c5012802

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsrchr
_vsnprintf
wcschr
wcsncmp
wcspbrk
memcpy_s
_ultow
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
_lock
_unlock
_purecall
__dllonexit
_onexit
wcsstr
_ultow_s
_wcsicmp
memset
iswspace
iswdigit
_errno
wcstol
_ui64tow_s
_i64tow_s
wcstoul
_wcstoi64
memmove
_itow_s
_wcstoui64
memcmp
memcpy
_wcsnicmp
_wcsupr
free
_wcsdup
_vsnwprintf
wcscmp

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-file-l1-1-0

SetFilePointerEx
CompareFileTime
FindFirstFileExW
GetFileAttributesExW
SetEndOfFile
WriteFile
FindFirstFileW
ReadFile
CreateFileW
FindClose
GetFileAttributesW
GetFileTime
FindNextFileW
GetFileSize

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-com-l1-1-0

CLSIDFromString
CLSIDFromProgID
CoCreateInstance

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
DisableThreadLibraryCalls
LoadLibraryExW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyExW
RegCloseKey

api-ms-win-core-synch-l1-2-0

Sleep

ncrypt

NCryptOpenStorageProvider
NCryptOpenKey
NCryptKeyDerivation
NCryptFreeObject

bcrypt

BCryptEncrypt
BCryptCreateHash
BCryptHashData
BCryptDestroyKey
BCryptGenRandom
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptDecrypt
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptGetProperty

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
SetThreadToken
GetCurrentProcess
GetCurrentThread
CreateThread
OpenThreadToken
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetTickCount

api-ms-win-security-base-l1-1-0

DuplicateToken
GetFileSecurityW
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWork
SubmitThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup

api-ms-win-core-file-l2-1-0

ReadDirectoryChangesW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileTransactedW

api-ms-win-core-kernel32-legacy-l1-1-1

GetFileAttributesTransactedW

kernelbase

WTSGetServiceSessionId

ntdll

EtwEventUnregister
EtwEventWriteTransfer
RtlInitUnicodeString
NtQueryFullAttributesFile
EtwEventRegister

iisutil

?IsEmpty@MULTISZ@@QEBAHXZ
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?Equals@STRA@@QEBA_NAEBV1@@Z
??0CSmallSpinLock@@QEAA@XZ
?Append@STRU@@QEAAJG@Z
SAFE_snwprintf
?Copy@STRU@@QEAAJPEBV1@@Z
MakePathCanonicalizationProofNt
PuDbgPrintError
?CopyW@STRA@@QEAAJPEBG@Z
?CopyA@STRU@@QEAAJPEBD@Z
?SetLen@STRA@@QEAA_NK@Z
uuencode
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
??1CSmallSpinLock@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
uudecode
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?WriteLock@CSmallSpinLock@@QEAAXXZ
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?Resize@STRA@@QEAAJK@Z
?Resize@STRU@@QEAAJK@Z
?QuerySizeCCH@STRU@@QEBAKXZ
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
??1STRA@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
?Append@STRU@@QEAAJPEBGK@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
?QueryStringCount@MULTISZ@@QEBAKXZ
?Reset@MULTISZ@@QEAAXXZ
?Equals@STRU@@QEBA_NPEBG@Z
?CopyToBuffer@STRU@@QEBAJPEAGPEAK@Z
?Next@MULTISZ@@QEBAPEBGPEBG@Z
?First@MULTISZ@@QEBAPEBGXZ
??1STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
?QueryStr@STRU@@QEAAPEAGXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
WriteRefTraceLog
DestroyRefTraceLog
??0STRU@@QEAA@PEAGK@Z
??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?QueryCCH@STRU@@QEBAKXZ
??1CLKRHashTable@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
IsStringEqualOrdinalIgnoreCase
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CReaderWriterLock3@@QEAA@XZ
??1CReaderWriterLock3@@QEAA@XZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
?Copy@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBG@Z
?QueryCB@STRU@@QEBAKXZ
?QueryStr@STRU@@QEBAPEBGXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?Clear@CLKRHashTable@@QEAAXXZ
?Terminate@BIG_REF_TRACE@@QEAAJXZ
PuDeleteDebugPrintsObject
??1BIG_REF_TRACE@@QEAA@XZ
?TraceDelete@BIG_REF_TRACE@@QEAAJPEAX@Z
?TraceDereference@BIG_REF_TRACE@@QEAAJPEAX@Z
?TraceReference@BIG_REF_TRACE@@QEAAJPEAX@Z
?TraceCreate@BIG_REF_TRACE@@QEAAJPEAX@Z
?Record@CLKRHashTable_Iterator@@QEBAPEBXXZ
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
?Increment@CLKRHashTable_Iterator@@QEAA_NXZ
??1CLKRHashTable_Iterator@@QEAA@XZ
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?Size@CLKRHashTable@@QEBAKXZ
?IsEmpty@STRU@@QEBA_NXZ
?QuerySize@BUFFER@@QEBAKXZ
??0STRU@@QEAA@XZ
?FindString@MULTISZ@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
PuDbgPrint
MakePathCanonicalizationProof
?SetLen@STRU@@QEAA_NK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Reset@STRU@@QEAAXXZ
?Append@STRU@@QEAAJAEBV1@@Z
??0MULTISZ@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
SplitCommaDelimitedString

xmllite

CreateXmlReader
CreateXmlWriter
CreateXmlWriterOutputWithEncodingName

ktmw32

CommitTransaction
CreateTransaction

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateNativeConfigurationSystem
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetDefaultNativeConfigurationSystem
InitializeNativeConfiguration
TerminateNativeConfiguration

Sections

.text
Size: 361KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/protsup.dll
.dll windows:10 windows x64

845acea9b9f8bf2541728b2060d20a5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_XcptFilter
__C_specific_handler
_initterm
_amsg_exit
_callnewh
malloc
free
strncmp
strchr
_ultoa_s
_itoa_s

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

iisutil

??1STRA@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
?CopyW@STRA@@QEAAJPEBG@Z
?Append@MULTISZA@@QEAAHAEAVSTRA@@@Z
?Next@MULTISZA@@QEBAPEBDPEBD@Z
?First@MULTISZA@@QEBAPEBDXZ
??0MULTISZA@@QEAA@XZ
??0STRA@@QEAA@XZ
?Copy@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
??1MULTISZA@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
?QueryCCH@STRA@@QEBAKXZ
?QueryStr@STRA@@QEBAPEBDXZ
?Reset@STRA@@QEAAXXZ

Exports

Exports

RegisterModule

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/redirect.dll
.dll windows:10 windows x64

06f516f98e13c1847b869eefda8592af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcschr
iswdigit
towupper
_wcsnicmp
malloc
_callnewh
_XcptFilter
_amsg_exit
free
__C_specific_handler
_initterm
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

iisutil

?Copy@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJAEBV1@@Z
??1STRA@@QEAA@XZ
?Escape@STRA@@QEAAJ_N0@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z
??0STRA@@QEAA@PEADK@Z
?Copy@STRU@@QEAAJPEBG@Z
?SetLen@STRU@@QEAA_NK@Z
??0STRU@@QEAA@XZ
?Copy@STRU@@QEAAJAEBV1@@Z
??0STRU@@QEAA@PEAGK@Z
??1STRU@@QEAA@XZ

Exports

Exports

RegisterModule

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/rewrite.dll
.dll windows:6 windows x64

f984ceb371ef1d55e77002a1690c3651

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

69:88:b5:45:47:aa:a1:6b:94:0d:69:52:55:90:a8:5f:17:fd:3e:18
Signer

Actual PE Digest

69:88:b5:45:47:aa:a1:6b:94:0d:69:52:55:90:a8:5f:17:fd:3e:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

DebugBreak
GetProcessHeap
HeapFree
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
HeapAlloc
CloseHandle
CreateEventW
GetLastError
VirtualAlloc
VirtualFree
GetCurrentThreadId
FlsSetValue
GetCommandLineA
DecodePointer
EncodePointer
RtlUnwindEx
FlsGetValue
FlsFree
SetLastError
FlsAlloc
Sleep
GetProcAddress
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
GetSystemInfo
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WriteFile
GetModuleFileNameW
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LCMapStringW
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
FreeLibrary
LoadLibraryW
RaiseException
RtlPcToFileHeader
MultiByteToWideChar
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
InitializeCriticalSection
LocalFree
FormatMessageW
HeapCreate
GetModuleHandleW
FlushFileBuffers
CreateFileW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
ReadFile
GetOverlappedResult
GetProcessId
CompareStringOrdinal
LoadLibraryExW
lstrlenW
SetFilePointer

user32

LoadStringW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

oleaut32

SysFreeString
SysStringLen
CreateErrorInfo
SetErrorInfo
GetErrorInfo
SafeArrayCreate
SysAllocString
SafeArrayPutElement
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayAccessData
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType

Exports

Exports

CreateCoreLogic
EvaluateInput
RegisterModule

Sections

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/rewrite_license.rtf
.rtf
inetsrv/rewrite_readme.htm
inetsrv/rpcref.dll
.dll windows:10 windows x64

57dbd733b600218d295563c556bac07a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_XcptFilter
_initterm
__C_specific_handler
free
_amsg_exit

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId

rpcrt4

RpcMgmtWaitServerListen
RpcServerListen
RpcMgmtStopServerListening

iisrtl

IISInitializeCriticalSection

Exports

Exports

InetinfoStartRpcServerListen
InetinfoStopRpcServerListen

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/rsca.dll
.dll regsvr32 windows:10 windows x64

9c213b3c635060314a48bf8a2e888cd2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_callnewh
__C_specific_handler
_initterm
memcpy
free
_wtoi
_XcptFilter
_amsg_exit
wcscat_s
malloc
_itow
_wcsicmp
memset

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstanceEx

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

iisutil

??0BUFFER@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
??1BUFFER@@QEAA@XZ
??1STRU@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
PuDbgPrint
PuDbgPrintError
??0STRU@@QEAA@XZ

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/rscaext.dll
.dll regsvr32 windows:10 windows x64

80d35913afc052b7aa38953f9133ab77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_itoa_s
_aligned_malloc
_aligned_free
sprintf_s
strnlen
strrchr
_vsnprintf_s
memset
_onexit
_wcslwr_s
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
isdigit
wcstoul
wcschr
wcsnlen
memcpy
wcscmp

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
DeleteCriticalSection
ReleaseSRWLockExclusive

api-ms-win-core-registry-l1-1-0

RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegCreateKeyExA

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-file-l1-1-0

WriteFile

ws2_32

WSACleanup
WSAGetLastError
WSAStringToAddressW
WSAStartup
htons

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

httpapi

HttpDeleteServiceConfiguration
HttpQueryServiceConfiguration
HttpTerminate
HttpSetServiceConfiguration
HttpInitialize

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLangID

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InitializeSListHead
QueryDepthSList

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource

ntdll

RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlGetCurrentPeb
RtlUpcaseUnicodeChar

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/ru-RU/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

5c:e1:ba:e8:e3:79:f0:f9:05:c4:ff:42:ab:37:00:f6:be:d1:ee:85
Signer

Actual PE Digest

5c:e1:ba:e8:e3:79:f0:f9:05:c4:ff:42:ab:37:00:f6:be:d1:ee:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/static.dll
.dll windows:10 windows x64

5579521aad21ecabd3884b03ec6cd99e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_callnewh
_XcptFilter
_amsg_exit
_initterm
wcsncmp
_wcsicmp
wcschr
isspace
_vsnprintf
_wcsupr
wcsrchr
_stricmp
strstr
strchr
malloc
__C_specific_handler
memset
free
wcscmp

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

iisutil

?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?QueryStr@MULTISZA@@QEBAPEADXZ
?QueryStr@STRU@@QEBAPEBGXZ
??1MULTISZA@@QEAA@XZ
?Resize@STRU@@QEAAJK@Z
?QueryCCH@STRU@@QEBAKXZ
SAFE_snwprintf
StringTimeToFileTime
?AppendW@MULTISZA@@QEAAHPEBGK@Z
?CopyW@STRA@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?GetString@LANG_STRING@@QEAAJPEBDKIPEAPEBGPEAK@Z
??0STRA@@QEAA@XZ
?IsEmpty@STRA@@QEBA_NXZ
?QueryStr@STRU@@QEAAPEAGXZ
?Terminate@LANG_STRING@@QEAAJXZ
?Append@STRA@@QEAAJPEBD@Z
?Copy@STRU@@QEAAJPEBG@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?CopyWTruncate@STRA@@QEAAJPEBG@Z
??0MULTISZA@@QEAA@XZ
??0LANG_STRING@@QEAA@XZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRA@@QEAAJPEBD@Z
??0STRA@@QEAA@PEADK@Z
??1STRA@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
?SetLen@STRA@@QEAA_NK@Z
?QuerySize@BUFFER@@QEBAKXZ
?QueryCCH@STRA@@QEBAKXZ
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?QueryStr@STRA@@QEBAPEBDXZ
??0STRU@@QEAA@PEAGK@Z
??1STRU@@QEAA@XZ

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

Exports

Exports

RegisterModule

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/svcext.dll
.dll regsvr32 windows:10 windows x64

f989547a1b55d4794c972795cc339cac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_unlock
_lock
wcscat_s
_onexit
__dllonexit
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnprintf
_wcsnicmp
memset

advapi32

RegDeleteKeyW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerW
OpenServiceW
StartServiceW
CloseServiceHandle

ole32

CoCreateInstance

kernel32

GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryExW
TerminateProcess
SetUnhandledExceptionFilter
GetSystemDirectoryW
OutputDebugStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetLastError
WideCharToMultiByte
CreateProcessA
UnhandledExceptionFilter
GetCurrentProcess
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
CloseHandle

iisrtl

?Resize@BUFFER@@QEAA_NK@Z
??0BUFFER@@QEAA@XZ
PuDbgPrint
PuLoadDebugFlagsFromRegStr
??1BUFFER@@QEAA@XZ
PuCreateDebugPrintsObject
PuDbgPrintW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/uihelper.dll
.dll windows:10 windows x64

2189a2bda3b94248130a5a5f553c31b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_purecall
??0exception@@QEAA@XZ
memcpy
memmove
wcsncmp
swprintf_s
_wcsicmp
wcscoll
towupper
towlower
iswspace
_vsnwprintf_s
_wcsnicmp
memcmp
__CxxFrameHandler3
iswdigit
_wtol
_ltow
_wtoi
wcscpy_s
wcscat_s
malloc
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
free
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
memset
wcscmp

atl

ord45
ord21
ord44
ord43
ord16

kernel32

UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
SetUnhandledExceptionFilter
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
VirtualAlloc
VirtualFree
GetDriveTypeW
GetFileAttributesW
TerminateProcess
GetCurrentProcessId
InterlockedPopEntrySList
GetCurrentThreadId
Sleep
QueryPerformanceCounter
GetLastError
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
DisableThreadLibraryCalls
LoadLibraryExA
GetProcAddress
FreeLibrary
GetSystemTimeAsFileTime
GetModuleHandleA
GetUserDefaultUILanguage
GetLocaleInfoW
ExpandEnvironmentStringsW
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
LoadLibraryExW
FormatMessageW
MultiByteToWideChar
LocalFree
GetCurrentProcess
CloseHandle
GetComputerNameW
lstrcmpiW
GetVolumeInformationW
LocalAlloc
GetCurrentDirectoryW
FindFirstFileW
FindClose

user32

GetWindowRect
ReleaseDC
SetFocus
CharNextW
MessageBoxW
GetFocus
LoadStringW
SetWindowTextW
EndDialog
GetActiveWindow
DialogBoxParamW
GetWindowTextW
GetParent
GetClientRect
DefWindowProcW
GetCaretPos
GetDC
SetTimer
UpdateWindow
InvalidateRect
IsWindow
KillTimer
GetWindowThreadProcessId
GetAncestor
SendMessageW
GetDlgItem
CreateWindowExW
GetWindowLongPtrW
SetWindowLongPtrW
DestroyWindow
CallWindowProcW
RedrawWindow

gdi32

GetTextMetricsW

advapi32

RegQueryValueExW
AdjustTokenPrivileges
LogonUserW
RegOpenKeyW
OpenProcessToken
RegCloseKey
LookupPrivilegeValueW

shell32

DoEnvironmentSubstW
SHGetFolderLocation
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW

ole32

CoCreateInstanceEx
CoSetProxyBlanket
CoQueryProxyBlanket
CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysStringLen
SysAllocStringLen
SysFreeString

shlwapi

PathAddBackslashW
PathFindExtensionW
PathCompactPathW
PathMakePrettyW
PathRemoveArgsW
PathIsRootW
PathAppendW
PathRemoveFileSpecW
SHAutoComplete
PathUnquoteSpacesW
StrPBrkW
PathGetArgsW
PathIsNetworkPathW
PathGetDriveNumberW
PathBuildRootW
StrCmpIW
PathAddExtensionW
StrChrW
PathFindFileNameW
PathQuoteSpacesW
PathGetCharTypeW
PathIsUNCServerShareW
PathIsUNCServerW
PathIsRelativeW
PathIsUNCW
PathIsDirectoryW
PathFileExistsW
StrDupW

crypt32

CryptProtectMemory
CryptUnprotectMemory

comdlg32

GetOpenFileNameW
GetSaveFileNameW

comctl32

ord410
ord413
ord412

Exports

Exports

??0?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAA@AEBV01@@Z
??0?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAA@XZ
??0?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA@AEBV01@@Z
??0?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA@XZ
??0?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA@AEBV01@@Z
??0?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA@XZ
??0?$_List_nod@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@IEAA@V?$allocator@VCString@IIS@@@1@@Z
??0?$_List_nod@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV01@@Z
??0?$_List_ptr@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@IEAA@V?$allocator@VCString@IIS@@@1@@Z
??0?$_List_ptr@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV01@@Z
??0?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV01@@Z
??0?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@V?$allocator@VCString@IIS@@@1@@Z
??0?$_String_val@GV?$allocator@G@std@@@std@@IEAA@V?$allocator@G@1@@Z
??0?$_String_val@GV?$allocator@G@std@@@std@@QEAA@AEBV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@AEBV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@AEBV01@_K1@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@AEBV01@_K1AEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@AEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBG0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBGAEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBG_K@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBG_KAEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@1@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@_KG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@_KGAEBV?$allocator@G@1@@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV01@@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV?$allocator@VCString@IIS@@@1@@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@XZ
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@_K@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@_KAEBVCString@IIS@@@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@_KAEBVCString@IIS@@AEBV?$allocator@VCString@IIS@@@1@@Z
??0CBlob@@QEAA@AEBV0@@Z
??0CBlob@@QEAA@KPEAEH@Z
??0CBlob@@QEAA@XZ
??0CComAuthInfo@@QEAA@AEAV0@@Z
??0CComAuthInfo@@QEAA@PEAV0@@Z
??0CComAuthInfo@@QEAA@PEBG00@Z
??0CError@@QEAA@AEBV0@@Z
??0CError@@QEAA@J@Z
??0CError@@QEAA@K@Z
??0CError@@QEAA@XZ
??0CFileChooser@@QEAA@AEBV0@@Z
??0CFileChooser@@QEAA@XZ
??0CIISApplication@@QEAA@$$QEAV0@@Z
??0CIISApplication@@QEAA@AEAV0@@Z
??0CIISApplication@@QEAA@PEAVCComAuthInfo@@PEBG@Z
??0CIISInterface@@QEAA@AEAV0@@Z
??0CIISInterface@@QEAA@PEAVCComAuthInfo@@J@Z
??0CIISSvcControl@@QEAA@AEAV0@@Z
??0CIISSvcControl@@QEAA@PEAV0@@Z
??0CIISSvcControl@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetaBack@@QEAA@$$QEAV0@@Z
??0CMetaBack@@QEAA@AEAV0@@Z
??0CMetaBack@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetaEnumerator@@QEAA@$$QEAV0@@Z
??0CMetaEnumerator@@QEAA@AEAV0@@Z
??0CMetaEnumerator@@QEAA@HPEAVCMetaKey@@@Z
??0CMetaEnumerator@@QEAA@PEAVCComAuthInfo@@PEBGK@Z
??0CMetaEnumerator@@QEAA@PEAVCMetaInterface@@PEBGK@Z
??0CMetaInterface@@IEAA@PEAV0@@Z
??0CMetaInterface@@IEAA@PEAVCComAuthInfo@@@Z
??0CMetaInterface@@QEAA@AEAV0@@Z
??0CMetaKey@@QEAA@AEAV0@@Z
??0CMetaKey@@QEAA@HPEAV0@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@PEBGKK@Z
??0CMetaKey@@QEAA@PEAVCMetaInterface@@@Z
??0CMetaKey@@QEAA@PEAVCMetaInterface@@PEBGKK@Z
??0CMetabasePath@@QEAA@$$QEAV0@@Z
??0CMetabasePath@@QEAA@AEBV0@@Z
??0CMetabasePath@@QEAA@HPEBG000@Z
??0CMetabasePath@@QEAA@PEBGK00@Z
??0CStrPassword@@QEAA@AEAV0@@Z
??0CStrPassword@@QEAA@PEAG@Z
??0CStrPassword@@QEAA@PEBG@Z
??0CStrPassword@@QEAA@XZ
??0CString@IIS@@QEAA@AEBV01@@Z
??0CString@IIS@@QEAA@AEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@@Z
??0CString@IIS@@QEAA@AEBVCComBSTR@ATL@@@Z
??0CString@IIS@@QEAA@GH@Z
??0CString@IIS@@QEAA@PEBD@Z
??0CString@IIS@@QEAA@PEBG@Z
??0CString@IIS@@QEAA@XZ
??0CStringListEx@@QEAA@AEBV0@@Z
??0CStringListEx@@QEAA@XZ
??0CWamInterface@@IEAA@PEAV0@@Z
??0CWamInterface@@IEAA@PEAVCComAuthInfo@@@Z
??0CWamInterface@@QEAA@AEAV0@@Z
??1?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAA@XZ
??1?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA@XZ
??1?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@XZ
??1?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@XZ
??1CBlob@@QEAA@XZ
??1CComAuthInfo@@QEAA@XZ
??1CError@@QEAA@XZ
??1CFileChooser@@QEAA@XZ
??1CIISApplication@@UEAA@XZ
??1CIISInterface@@QEAA@XZ
??1CIISSvcControl@@UEAA@XZ
??1CMetaBack@@UEAA@XZ
??1CMetaEnumerator@@UEAA@XZ
??1CMetaInterface@@UEAA@XZ
??1CMetaKey@@UEAA@XZ
??1CMetabasePath@@QEAA@XZ
??1CStrPassword@@QEAA@XZ
??1CString@IIS@@QEAA@XZ
??1CStringListEx@@QEAA@XZ
??1CWamInterface@@UEAA@XZ
??2CComAuthInfo@@SAPEAX_K@Z
??3CComAuthInfo@@SAXPEAX@Z
??4?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAAAEAV01@$$QEAV01@@Z
??4?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAAEAV01@$$QEAV01@@Z
??4?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$_List_nod@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_List_nod@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$_List_ptr@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_List_ptr@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$_String_val@GV?$allocator@G@std@@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_String_val@GV?$allocator@G@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@G@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@PEBG@Z
??4?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4CBlob@@QEAAAEAV0@AEBV0@@Z
??4CComAuthInfo@@QEAAAEAV0@AEAV0@@Z
??4CComAuthInfo@@QEAAAEAV0@PEAV0@@Z
??4CComAuthInfo@@QEAAAEAV0@PEBG@Z
??4CError@@QEAAAEBV0@AEBV0@@Z
??4CError@@QEAAAEBV0@J@Z
??4CFileChooser@@QEAAAEAV0@AEBV0@@Z
??4CIISApplication@@QEAAAEAV0@$$QEAV0@@Z
??4CIISApplication@@QEAAAEAV0@AEAV0@@Z
??4CIISInterface@@QEAAAEAV0@AEAV0@@Z
??4CIISSvcControl@@QEAAAEAV0@AEAV0@@Z
??4CMetaBack@@QEAAAEAV0@$$QEAV0@@Z
??4CMetaBack@@QEAAAEAV0@AEAV0@@Z
??4CMetaEnumerator@@QEAAAEAV0@$$QEAV0@@Z
??4CMetaEnumerator@@QEAAAEAV0@AEAV0@@Z
??4CMetaInterface@@QEAAAEAV0@AEAV0@@Z
??4CMetaKey@@QEAAAEAV0@AEAV0@@Z
??4CMetabasePath@@QEAAAEAV0@$$QEAV0@@Z
??4CMetabasePath@@QEAAAEAV0@AEBV0@@Z
??4CStrPassword@@QEAAAEBV0@AEAV0@@Z
??4CStrPassword@@QEAAAEBV0@PEBG@Z
??4CString@IIS@@QEAAAEBV01@AEBV01@@Z
??4CString@IIS@@QEAAAEBV01@D@Z
??4CString@IIS@@QEAAAEBV01@G@Z
??4CString@IIS@@QEAAAEBV01@PEBE@Z
??4CString@IIS@@QEAAAEBV01@PEBG@Z
??4CStringListEx@@QEAAAEAV0@AEBV0@@Z
??4CWamInterface@@QEAAAEAV0@AEAV0@@Z
??8CBlob@@QEBAHAEBV0@@Z
??8CError@@QEAA?BHAEAV0@@Z
??8CError@@QEAA?BHJ@Z
??8CStrPassword@@QEAA_NAEAV0@@Z
??9CBlob@@QEBAHAEBV0@@Z
??9CError@@QEAA?BHAEAV0@@Z
??9CError@@QEAA?BHJ@Z
??9CStrPassword@@QEAA_NAEAV0@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAG_K@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEBAAEBG_K@Z
??ACString@IIS@@QEBAGH@Z
??BCComAuthInfo@@QEAAPEAGXZ
??BCComAuthInfo@@QEAAPEAV0@XZ
??BCError@@QEAAPEBGXZ
??BCError@@QEBA?BHXZ
??BCError@@QEBA?BJXZ
??BCError@@QEBA?BKXZ
??BCIISInterface@@QEBAHXZ
??BCIISInterface@@QEBAJXZ
??BCMetaKey@@QEBAHXZ
??BCMetaKey@@QEBAKXZ
??BCMetaKey@@QEBAPEBGXZ
??BCMetabasePath@@QEBAPEBGXZ
??BCStrPassword@@QEAA?AVCString@IIS@@XZ
??BCString@IIS@@QEBAPEBGXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@AEBV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@PEBG@Z
??YCString@IIS@@QEAAAEBV01@AEBV01@@Z
??YCString@IIS@@QEAAAEBV01@D@Z
??YCString@IIS@@QEAAAEBV01@G@Z
??YCString@IIS@@QEAAAEBV01@PEBG@Z
??_7CFileChooser@@6B@
??_7CIISApplication@@6BCMetaKey@@@
??_7CIISApplication@@6BCWamInterface@@@
??_7CIISInterface@@6B@
??_7CIISSvcControl@@6B@
??_7CMetaBack@@6BCMetaInterface@@@
??_7CMetaBack@@6BCWamInterface@@@
??_7CMetaEnumerator@@6B@
??_7CMetaInterface@@6B@
??_7CMetaKey@@6B@
??_7CWamInterface@@6B@
??_F?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAXXZ
??_F?$_String_val@GV?$allocator@G@std@@@std@@QEAAXXZ
??_FCComAuthInfo@@QEAAXXZ
??_FCMetabasePath@@QEAAXXZ
?AddExtension@CFileChooser@@QEAAXPEAUHINSTANCE__@@II@Z
?AddExtension@CFileChooser@@QEAAXPEBG0@Z
?AddKey@CMetaInterface@@IEAAJKPEBG@Z
?AddKey@CMetaKey@@QEAAJPEBG@Z
?AddOverride@CError@@QEAAIJI@Z
?AddStyle@CFileChooser@@QEAAXK@Z
?AllocateStatics@CError@@KAHXZ
?AppCreate@CWamInterface@@IEAAJPEBGK@Z
?AppDelete@CWamInterface@@IEAAJPEBGH@Z
?AppDeleteRecoverable@CWamInterface@@IEAAJPEBGH@Z
?AppGetStatus@CWamInterface@@IEAAJPEBGPEAK@Z
?AppRecover@CWamInterface@@IEAAJPEBGH@Z
?AppUnLoad@CWamInterface@@IEAAJPEBGH@Z
?AppendPath@CMetabasePath@@IEAAXK@Z
?AppendPath@CMetabasePath@@IEAAXPEBG@Z
?ApplyProxyBlanket@CComAuthInfo@@QEAAJPEAUIUnknown@@@Z
?ApplyProxyBlanket@CComAuthInfo@@QEAAJPEAUIUnknown@@K@Z
?ApplyProxyBlanket@CIISSvcControl@@MEAAJXZ
?ApplyProxyBlanket@CMetaBack@@MEAAJXZ
?ApplyProxyBlanket@CMetaInterface@@MEAAJXZ
?ApplyProxyBlanket@CWamInterface@@MEAAJXZ
?AreStaticsAllocated@CError@@KAHXZ
?Backup@CMetaBack@@QEAAJPEBG@Z
?Backup@CMetaInterface@@IEAAJPEBGKK@Z
?BrowseForFile@CFileChooser@@IEAAHAEAVCString@IIS@@0@Z
?BrowseForFolder@CFileChooser@@IEAAHAEAVCString@IIS@@@Z
?BrowseForFolderCallback@CFileChooser@@QEAAHPEAUHWND__@@I_J@Z
?BuildMetaPath@CMetabasePath@@IEAAXPEBG000@Z
?BuildMetaPath@CMetabasePath@@IEAAXPEBGK00@Z
?ChangeProxyBlanket@CIISInterface@@UEAAJPEBG0@Z
?CheckDescendants@CMetaKey@@QEAAJKPEAVCComAuthInfo@@PEBG@Z
?CleanMetaPath@CMetabasePath@@SAPEBGAEAV1@@Z
?CleanMetaPath@CMetabasePath@@SAPEBGAEAVCString@IIS@@@Z
?CleanUp@CBlob@@QEAAXXZ
?Clear@CStringListEx@@QEAAXXZ
?ClearPasswordBuffers@CStrPassword@@AEAAXXZ
?Close@CMetaKey@@QEAAJXZ
?CloseKey@CMetaInterface@@IEAAJK@Z
?Collate@CString@IIS@@QEBAHPEBG@Z
?CommonConstruct@CIISApplication@@IEAAXXZ
?Compare@CStrPassword@@QEBAHAEAV1@@Z
?Compare@CStrPassword@@QEBAHAEAVCString@IIS@@@Z
?Compare@CStrPassword@@QEBAHPEBG@Z
?Compare@CString@IIS@@QEBAHPEBG@Z
?CompareNoCase@CString@IIS@@QEBAHPEBG@Z
?Construct@CError@@IEAAAEBV1@AEBV1@@Z
?Construct@CError@@IEAAAEBV1@J@Z
?ConvertFromDoubleNullList@CStringListEx@@QEAAKPEBGH@Z
?ConvertToDoubleNullList@CStringListEx@@QEAAKAEAKAEAPEAG@Z
?ConvertToParentPath@CMetaKey@@QEAAJH@Z
?ConvertToParentPath@CMetabasePath@@SAPEBGAEAV1@@Z
?ConvertToParentPath@CMetabasePath@@SAPEBGAEAVCString@IIS@@@Z
?CopyData@CMetaInterface@@IEAAJKPEBGK0KKKH@Z
?CopyKey@CMetaInterface@@IEAAJKPEBGK0HH@Z
?CopyTo@CStrPassword@@QEAAXAEAV1@@Z
?CopyTo@CStrPassword@@QEAAXAEAVCString@IIS@@@Z
?Create@?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAAPEAUHWND__@@PEAU3@AEAUtagRECT@@PEBGKKIPEAX@Z
?Create@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAPEAUHWND__@@PEAU3@AEAUtagRECT@@PEBGKKIGPEAX@Z
?Create@CIISApplication@@QEAAJPEBGK@Z
?Create@CIISInterface@@IEAAJHQEBU_GUID@@0PEAHPEAPEAUIUnknown@@@Z
?Create@CIISSvcControl@@IEAAJXZ
?Create@CMetaInterface@@IEAAJXZ
?Create@CWamInterface@@IEAAJXZ
?CreateAuthInfoForAuthnLevel@CComAuthInfo@@QEBAJPEAU_COSERVERINFO@@K@Z
?CreateDefaultPathForRead@CFileChooser@@IEAAXXZ
?CreateFilter@CFileChooser@@IEAAXAEAVCString@IIS@@0@Z
?CreatePathFromFailedOpen@CMetaKey@@QEAAJXZ
?CreateServerInfoStruct@CComAuthInfo@@QEBAPEAU_COSERVERINFO@@K@Z
?CreateServerInfoStruct@CComAuthInfo@@QEBAPEAU_COSERVERINFO@@XZ
?CvtToInternalFormat@CError@@KAJJ@Z
?DeAllocateStatics@CError@@KAXXZ
?DefWindowProcW@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA_JI_K_J@Z
?DefWindowProcW@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA_JXZ
?DefaultReflectionHandler@?$CWindowImplRoot@VCWindow@ATL@@@ATL@@SAHPEAUHWND__@@I_K_JAEA_J@Z
?Delete@CIISApplication@@QEAAJH@Z
?Delete@CMetaBack@@QEAAJPEBGK@Z
?DeleteAllData@CMetaInterface@@IEAAJKPEBGKK@Z
?DeleteBackup@CMetaInterface@@IEAAJPEBGK@Z
?DeleteChildKeys@CMetaInterface@@IEAAJKPEBG@Z
?DeleteData@CMetaInterface@@IEAAJKPEBGKK@Z
?DeleteKey@CMetaInterface@@IEAAJKPEBG@Z
?DeleteKey@CMetaKey@@QEAAJPEBG@Z
?DeleteRecoverable@CIISApplication@@QEAAJH@Z
?DeleteValue@CMetaKey@@QEAAJKPEBG@Z
?DestroyClearTextPassword@CStrPassword@@QEBAXPEAG@Z
?DestroyWindow@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAHXZ
?DoesPathExist@CMetaKey@@QEAAJPEBG@Z
?EditShowBalloon@@YAXPEAUHWND__@@PEAUHINSTANCE__@@I@Z
?EditShowBalloon@@YAXPEAUHWND__@@PEBG@Z
?Empty@CStrPassword@@QEAAXXZ
?Empty@CString@IIS@@QEAAXXZ
?EnumBackups@CMetaInterface@@IEAAJPEAGPEAKPEAU_FILETIME@@K@Z
?EnumData@CMetaInterface@@IEAAJKPEBGPEAU_METADATA_RECORD@@KPEAK@Z
?EnumKeys@CMetaInterface@@IEAAJKPEBGPEAGK@Z
?ExpandEscapeCode@CError@@IEBAHPEAGKAEAPEAGAEAVCString@IIS@@AEAJ@Z
?ExtractArgs@CFileChooser@@IEAAHPEAG@Z
?ExtractPath@CFileChooser@@IEAAHPEAG@Z
?Failed@CError@@QEBAHXZ
?Failed@CError@@SAHJ@Z
?Find@CString@IIS@@QEBAHG@Z
?Find@CString@IIS@@QEBAHPEBG@Z
?FindFacility@CError@@KAPEBGK@Z
?FindOneOf@CString@IIS@@QEBAHPEBG@Z
?Format@CString@IIS@@QEAAXPEAUHINSTANCE__@@IZZ
?Format@CString@IIS@@QEAAXPEBGZZ
?FormatMessageW@CString@IIS@@QEAAHPEAUHINSTANCE__@@IZZ
?FormatMessageW@CString@IIS@@QEAAHPEBGZZ
?FormatV@CString@IIS@@QEAAXPEBGPEAD@Z
?FreeServerInfoStruct@CComAuthInfo@@QEBAXPEAU_COSERVERINFO@@@Z
?GenerateRegistryKey@@YAPEBGAEAVCString@IIS@@PEBG@Z
?GetAdminInterface2@CMetaInterface@@QEAAJPEAPEAUIMSAdminBase2W@@@Z
?GetAllData@CMetaInterface@@IEAAJKPEBGKKKPEAK1KPEAE1@Z
?GetAllData@CMetaKey@@IEAAJKKKPEAK0PEAPEAEPEBG@Z
?GetAt@CString@IIS@@QEBAGH@Z
?GetBase@CMetaKey@@QEBAKXZ
?GetByteLength@CStrPassword@@QEBAHXZ
?GetClearTextPassword@CStrPassword@@QEAAPEAGXZ
?GetCurrentMessage@?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEBAPEBUtagMSG@@XZ
?GetData@CBlob@@QEAAPEAEXZ
?GetData@CMetaInterface@@IEAAJKPEBGPEAU_METADATA_RECORD@@PEAK@Z
?GetDataPaths@CMetaInterface@@IEAAJKPEBGKKKPEAGPEAK@Z
?GetDataPaths@CMetaKey@@QEAAJAEAVCStringListEx@@KKPEBG@Z
?GetFileName@CFileChooser@@QEAAKAEAVCString@IIS@@@Z
?GetFilterIndex@CFileChooser@@IEAAHAEBVCString@IIS@@@Z
?GetHandle@CMetaKey@@QEBAKXZ
?GetIndex@CMetaEnumerator@@QEAAKXZ
?GetInstanceNumber@CMetabasePath@@SAKPEBG@Z
?GetInstancePath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@PEAV23@@Z
?GetInterface@CMetaInterface@@QEAAPEAUIMSAdminBaseW@@XZ
?GetLastChangeTime@CMetaInterface@@IEAAJKPEBGPEAU_FILETIME@@H@Z
?GetLastNodeName@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@@Z
?GetLastWinError@CError@@QEAAXXZ
?GetLength@CStrPassword@@QEBAHXZ
?GetLength@CString@IIS@@QEBAHXZ
?GetMDFieldDef@CMetaKey@@SAHKAEAK000@Z
?GetMachinePath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@PEAV23@@Z
?GetOfnFlags@CFileChooser@@QEAAKXZ
?GetPropertyDescription@CMetaKey@@SAHKAEAVCString@IIS@@@Z
?GetPropertyValue@CMetaKey@@IEAAJKAEAKAEAPEAXPEAKPEAHPEBG2@Z
?GetRootPath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@PEAV23@@Z
?GetServiceInfoPath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@0@Z
?GetServicePath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@PEAV23@@Z
?GetSize@CBlob@@QEBAKXZ
?GetSpecialPathRealPath@@YAHAEBVCString@IIS@@AEAV12@@Z
?GetStyle@CFileChooser@@QEBAKXZ
?GetText@CFileChooser@@IEAAXPEAG@Z
?GetWindowProc@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@UEAAP6A_JPEAUHWND__@@I_K_J@ZXZ
?GetWndClassInfo@?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@SAAEAU_ATL_WNDCLASSINFOW@@XZ
?GetWndExStyle@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@SAKK@Z
?GetWndStyle@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@SAKK@Z
?HResult@CError@@QEBAJXZ
?HResult@CError@@SAJJ@Z
?HasEditFocus@CFileChooser@@IEAAHXZ
?HasInterface@CIISSvcControl@@IEBAHXZ
?HasInterface@CMetaInterface@@IEBAHXZ
?HasInterface@CWamInterface@@IEBAHXZ
?HasOverride@CError@@IEBAHPEAI@Z
?Init@CFileChooser@@QEAAHPEAVCWindow@ATL@@KII@Z
?IsDevicePath@@YAHAEBVCString@IIS@@@Z
?IsEmpty@CBlob@@QEBAHXZ
?IsEmpty@CStrPassword@@QEBAHXZ
?IsEmpty@CString@IIS@@QEBA_NXZ
?IsEnabledApplication@CIISApplication@@QEBAHXZ
?IsHomeDirectoryPath@CMetaKey@@QEBAHXZ
?IsHomeDirectoryPath@CMetabasePath@@QEBAHXZ
?IsHomeDirectoryPath@CMetabasePath@@SAHPEBG@Z
?IsInproc@CIISApplication@@QEBAHXZ
?IsLocal@CComAuthInfo@@QEBAHXZ
?IsLocal@CIISInterface@@QEBAHXZ
?IsMasterInstance@CMetabasePath@@SAHPEBG@Z
?IsOpen@CMetaKey@@QEBAHXZ
?IsOutOfProc@CIISApplication@@QEBAHXZ
?IsPooledProc@CIISApplication@@QEBAHXZ
?IsPropertyInheritable@CMetaKey@@SAHK@Z
?IsSeparator@CMetabasePath@@SAHG@Z
?IsSpecialPath@@YAHAEBVCString@IIS@@H@Z
?IsValidChar@CFileChooser@@IEAAHIH@Z
?IsValidPath@@YAHPEBG@Z
?IsValidPath@CFileChooser@@IEAAHPEBG@Z
?Kill@CIISSvcControl@@QEAAJXZ
?Left@CString@IIS@@QEBA?AV12@H@Z
?LoadStringW@CString@IIS@@QEAAHPEAUHINSTANCE__@@I@Z
?MakeLower@CString@IIS@@QEAAXXZ
?MakeReverse@CString@IIS@@QEAAXXZ
?MakeUpper@CString@IIS@@QEAAXXZ
?MapMDIDToTableIndex@CMetaKey@@SAHK@Z
?MessageBoxFormat@CError@@QEBAHPEAUHINSTANCE__@@IIIZZ
?MessageBoxOnFailure@CError@@QEBAHII@Z
?MessageBoxW@CError@@QEBAHII@Z
?Mid@CString@IIS@@QEBA?AV12@H@Z
?Mid@CString@IIS@@QEBA?AV12@HH@Z
?Next@CMetaBack@@QEAAJPEAKPEAGPEAU_FILETIME@@@Z
?Next@CMetaEnumerator@@QEAAJAEAKAEAVCString@IIS@@PEBG@Z
?Next@CMetaEnumerator@@QEAAJAEAVCString@IIS@@PEBG@Z
?OnBrowseBtn@CFileChooser@@IEAAXXZ
?OnEditChange@CFileChooser@@QEAAXXZ
?OnEditChar@CFileChooser@@IEAA_JI_K_JAEAH@Z
?OnEditKillFocus@CFileChooser@@IEAA_JI_K_JAEAH@Z
?OnEditSetFocus@CFileChooser@@IEAA_JI_K_JAEAH@Z
?OnFinalMessage@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@UEAAXPEAUHWND__@@@Z
?OnPaste@CFileChooser@@QEAAXXZ
?OnSetBrowseState@CFileChooser@@IEAA_JI_K_JAEAH@Z
?Open@CMetaKey@@QEAAJKPEBGK@Z
?OpenForRead@CFileChooser@@QEAAHXZ
?OpenKey@CMetaInterface@@IEAAJKPEBGKPEAK@Z
?Pop@CMetaEnumerator@@QEAAXXZ
?ProcessWindowMessage@CFileChooser@@UEAAHPEAUHWND__@@I_K_JAEA_JK@Z
?Push@CMetaEnumerator@@QEAAXXZ
?PushBack@CStringListEx@@QEAAXPEBG@Z
?QueryAppState@CIISApplication@@QEBAKXZ
?QueryAuthInfo@CIISInterface@@QEAAPEAVCComAuthInfo@@XZ
?QueryFlags@CMetaKey@@QEBAKXZ
?QueryMetaPath@CMetaKey@@QEBAPEBGXZ
?QueryMetaPath@CMetabasePath@@QEBAPEBGXZ
?QueryPassword@CComAuthInfo@@QEBAPEAGXZ
?QueryResult@CIISApplication@@UEBAJXZ
?QueryResult@CIISInterface@@UEBAJXZ
?QueryResult@CMetaBack@@UEBAJXZ
?QueryResult@CMetaKey@@UEBAJXZ
?QueryServerName@CComAuthInfo@@QEBAPEAGXZ
?QueryServerName@CIISInterface@@QEBAPEBGXZ
?QueryUserName@CComAuthInfo@@QEBAPEAGXZ
?QueryValue@CMetaKey@@QEAAJKAEAHPEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAKPEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCBlob@@PEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCComBSTR@ATL@@PEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCStrPassword@@PEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCString@IIS@@PEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBGPEAK@Z
?QueryWamPath@CIISApplication@@QEBAPEBGXZ
?ReOpen@CMetaKey@@QEAAJK@Z
?ReOpen@CMetaKey@@QEAAJXZ
?Reboot@CIISSvcControl@@QEAAJKH@Z
?Recover@CIISApplication@@QEAAJH@Z
?ReflectNotifications@?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA_JI_K_JAEAH@Z
?RefreshAppState@CIISApplication@@QEAAJXZ
?Regenerate@CMetaInterface@@QEAAJXZ
?RegisterFacility@CError@@SAXKPEBD@Z
?RemoveAllOverrides@CError@@QEAAXXZ
?RemoveImpersonation@CComAuthInfo@@QEAAXXZ
?RemoveOverride@CError@@QEAAXJ@Z
?RemoveStyle@CFileChooser@@QEAAXK@Z
?RenameKey@CMetaInterface@@IEAAJKPEBG0@Z
?RenameKey@CMetaKey@@QEAAJPEBG0@Z
?Reset@CError@@QEAAXXZ
?Reset@CMetaBack@@QEAAXXZ
?Reset@CMetaEnumerator@@QEAAXK@Z
?Restore@CMetaBack@@QEAAJPEBGK@Z
?Restore@CMetaInterface@@IEAAJPEBGKK@Z
?ReverseFind@CString@IIS@@QEBAHG@Z
?Right@CString@IIS@@QEBA?AV12@H@Z
?SaveData@CMetaInterface@@QEAAJXZ
?SetAt@CString@IIS@@QEAAXHG@Z
?SetCompactedPath@CFileChooser@@IEAAXPEBG@Z
?SetComputerNameW@CComAuthInfo@@IEAAXPEBG@Z
?SetData@CMetaInterface@@IEAAJKPEBGPEAU_METADATA_RECORD@@@Z
?SetDialogTitle@CFileChooser@@QEAAXPEBG@Z
?SetImpersonation@CComAuthInfo@@QEAAXPEBG0@Z
?SetLastChangeTime@CMetaInterface@@IEAAJKPEBGPEAU_FILETIME@@H@Z
?SetLastWinError@CError@@QEBAXXZ
?SetOfnFlags@CFileChooser@@QEAAXK@Z
?SetPath@CFileChooser@@QEAAXAEBVCString@IIS@@@Z
?SetPathToEdit@CFileChooser@@IEAAXPEBG@Z
?SetPropertyValue@CMetaKey@@IEAAJKKPEAXPEAHPEBG@Z
?SetStyle@CFileChooser@@QEAAKK@Z
?SetValue@CBlob@@QEAAXKPEAEH@Z
?SetValue@CMetaKey@@QEAAJKAEAVCBlob@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCStrPassword@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCString@IIS@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKHPEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKKPEAHPEBG@Z
?SpanExcluding@CString@IIS@@QEBA?AV12@PEBG@Z
?SpanIncluding@CString@IIS@@QEBA?AV12@PEBG@Z
?SplitMetaPathAtInstance@CMetabasePath@@SAXPEBGAEAVCString@IIS@@1@Z
?SplitUserNameAndDomain@CComAuthInfo@@SAHAEAVCString@IIS@@0@Z
?Start@CIISSvcControl@@QEAAJK@Z
?StartWindowProc@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@SA_JPEAUHWND__@@I_K_J@Z
?Status@CIISSvcControl@@QEAAJKPEAEPEAK1@Z
?Stop@CIISSvcControl@@QEAAJKH@Z
?StorePassword@CComAuthInfo@@QEAAXPEBG@Z
?StyleBitSet@CFileChooser@@QEAAHK@Z
?SubclassWindow@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAHPEAUHWND__@@@Z
?Succeeded@CError@@QEBAHXZ
?Succeeded@CError@@SAHJ@Z
?Succeeded@CIISApplication@@UEBAHXZ
?Succeeded@CIISInterface@@UEBAHXZ
?Succeeded@CMetaBack@@UEBAHXZ
?Succeeded@CMetaKey@@UEBAHXZ
?SupportsPooledProc@CWamInterface@@QEBAHXZ
?TextFromHRESULT@CError@@QEBAJAEAVCString@IIS@@@Z
?TextFromHRESULT@CError@@QEBAJPEAGK@Z
?TextFromHRESULTExpand@CError@@QEBAPEBGAEAVCString@IIS@@@Z
?TextFromHRESULTExpand@CError@@QEBAPEBGPEAGKPEAJ@Z
?TrimLeft@CString@IIS@@QEAAXXZ

Sections

.text
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/urlauthz.dll
.dll windows:10 windows x64

5453054e050aaed803f6e5e9c9375b99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_wcsicmp
free
malloc
_callnewh
_XcptFilter
_amsg_exit
memcpy
__C_specific_handler
_initterm
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-security-base-l1-1-0

CheckTokenMembership
GetTokenInformation
EqualSid

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

iisutil

?Resize@BUFFER@@QEAA_NK@Z
??0STRA@@QEAA@XZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
??0STRU@@QEAA@XZ
PuDbgPrintError
?Copy@STRU@@QEAAJPEBGK@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
PuDeleteDebugPrintsObject
??1STRA@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1STRU@@QEAA@XZ
??0BUFFER@@QEAA@XZ

Exports

Exports

RegisterModule

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/validcfg.dll
.dll windows:10 windows x64

3f4aff98f6ac04bd53beb68b29eb3303

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_XcptFilter
_callnewh
free
_amsg_exit
_initterm
__C_specific_handler
malloc
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

iisutil

?SyncWithBuffer@STRU@@QEAAXXZ
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?QuerySize@BUFFER@@QEBAKXZ
??0STRU@@QEAA@PEAGK@Z
?QueryStr@STRU@@QEAAPEAGXZ
?Resize@STRU@@QEAAJK@Z
??1STRU@@QEAA@XZ

Exports

Exports

RegisterModule

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/w3core.mof
inetsrv/w3ctrlps.dll
.dll regsvr32 windows:10 windows x64

2824690c342a92b3beb8e42dbd775e23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__C_specific_handler
malloc
_amsg_exit
_initterm
free
_XcptFilter

rpcrt4

CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrOleAllocate
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_DebugServerRelease

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient13
ObjectStublessClient5
ObjectStublessClient3
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient12
ObjectStublessClient10
ObjectStublessClient4
ObjectStublessClient6
ObjectStublessClient15
ObjectStublessClient16

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/w3ctrs.dll
.dll windows:10 windows x64

bc89580fa6d684621d4c4bfcaaca478a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_initterm
_amsg_exit
_XcptFilter
wcsncmp
__C_specific_handler
_callnewh
malloc
free
_vsnwprintf
memcpy
memset

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
CreateEventA
SetEvent
LeaveCriticalSection
OpenEventW
EnterCriticalSection
InitializeCriticalSection

dnsapi

GetCurrentTimeInSeconds

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

iisutil

PuLoadDebugFlagsFromRegStr
PuDeleteDebugPrintsObject
??1STRU@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
PuCreateDebugPrintsObject
PuDbgPrintError
PuDbgPrint
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0EVENT_LOG@@QEAA@PEBG@Z
??0STRU@@QEAA@XZ

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-processthreads-l1-1-1

OpenProcess

Exports

Exports

CloseW3PerformanceData
CollectW3PerformanceData
OpenW3PerformanceData

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/w3dt.dll
.dll windows:10 windows x64

b18d120c17689c99cd56b9def9ef4c48

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__C_specific_handler
_initterm
memset
memcpy
_ultow_s
_XcptFilter
_callnewh
malloc
free
_aligned_malloc
_aligned_free
wcstoul
_wcsicmp
wcschr
_amsg_exit
wcscmp

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoCreateGuid

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockExclusive

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
GetProcAddress
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-io-l1-1-0

CancelIoEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-core-normalization-l1-1-0

IdnToNameprepUnicode

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

ntdll

NtSetInformationFile
RtlVerifyVersionInfo

httpapi

HttpShutdownRequestQueue
HttpCreateUrlGroup
HttpAddUrlToUrlGroup
HttpCreateServerSession
HttpSetUrlGroupProperty
HttpCloseServerSession
HttpCloseUrlGroup
HttpSetServerSessionProperty
HttpSetRequestQueueProperty
HttpCreateRequestQueue
HttpCloseRequestQueue
HttpReceiveHttpRequest
HttpReceiveClientCertificate
HttpReadFragmentFromCache
HttpAddFragmentToCache
HttpFlushResponseCache
HttpSendHttpResponse
HttpSendResponseEntityBody
HttpReceiveRequestEntityBody
HttpWaitForDisconnectEx
HttpCancelHttpRequest
HttpWaitForDisconnect
HttpInitialize
HttpTerminate

w3tp

ThreadPoolPostCompletion
ThreadPoolMapErrorCodeIfNecessary
ThreadPoolBindIoCompletionCallback

iisutil

PuDeleteDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuCreateDebugPrintsObject
IISGetPlatformType
?QueryStr@STRA@@QEAAPEADXZ
?IsEmpty@STRA@@QEBA_NXZ
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
??0STRA@@QEAA@XZ
?DisableFreeList@ALLOC_CACHE_HANDLER@@QEAAXXZ
??0STRU@@QEAA@XZ
??1STRU@@QEAA@XZ
PuDbgPrintError
??1STRA@@QEAA@XZ
?Append@STRU@@QEAAJPEBG@Z
PuDbgPrint
?QueryStr@STRU@@QEAAPEAGXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@XZ
?QueryStr@STRU@@QEBAPEBGXZ
??0STRU@@QEAA@PEAGK@Z
?QuerySizeCCH@STRU@@QEBAKXZ
?QuerySize@BUFFER@@QEBAKXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?Append@MULTISZ@@QEAAHPEBG@Z
?Reset@STRU@@QEAAXXZ
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?QueryCCH@STRU@@QEBAKXZ
?Resize@BUFFER@@QEAA_NK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
?Append@STRU@@QEAAJPEBGK@Z
?First@MULTISZ@@QEBAPEBGXZ
?Next@MULTISZ@@QEBAPEBGPEBG@Z
??1MULTISZ@@QEAA@XZ
??0MULTISZ@@QEAA@XZ
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?QueryOutstandingAllocationCount@ALLOC_CACHE_HANDLER@@QEBAKXZ
?CleanupLookaside@ALLOC_CACHE_HANDLER@@QEAAXH@Z
?Copy@STRU@@QEAAJPEBG@Z

nativerd

GetDefaultNativeConfigurationSystem

Exports

Exports

?QueryState@HTTP_WRAPPER@@QEBA?AW4HTTP_WRAPPER_STATE@@XZ
UlAtqAddFragmentToCache
UlAtqAllocateMainContext
UlAtqCancelIo
UlAtqCancelRequest
UlAtqDuplicateRequestQueueHandle
UlAtqFlushUlCache
UlAtqFreeContext
UlAtqGetContextProperty
UlAtqInitialize
UlAtqPushPromise
UlAtqReadFragmentFromCache
UlAtqReceiveChannelBindingToken
UlAtqReceiveClientCertificate
UlAtqReceiveEntityBody
UlAtqRemoveFragmentFromCache
UlAtqSendEntityBody
UlAtqSendHttpResponse
UlAtqSetContextProperty
UlAtqStartListen
UlAtqStopListen
UlAtqTerminate
UlAtqWaitForDisconnect

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/w3isapi.mof
inetsrv/w3logsvc.dll
.dll windows:10 windows x64

1b2ab2b0e69bb50fecd8965c97a22f28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsstr
_itow_s
wcsnlen
_ui64tow_s
_wcsupr_s
wcscpy_s
_ultow
_vsnwprintf_s
swprintf_s
_ultow_s
strncpy_s
strtoul
memchr
_strnicmp
memcpy_s
free
malloc
_callnewh
_wcsicmp
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler3
_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_purecall
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteTimerQueueEx
RtlVirtualUnwind
RtlCreateTimer
RtlCreateTimerQueue
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlDeleteTimer

api-ms-win-service-core-l1-1-0

SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetExitCodeThread
GetCurrentProcess
GetCurrentProcessId
SetThreadPriority
CreateThread
GetCurrentThreadId

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockShared
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
EnterCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount64

api-ms-win-core-file-l1-1-0

WriteFile
CreateFileW
GetFileAttributesExW
GetFileSizeEx
CreateDirectoryW
GetFileAttributesW
GetFileTime

api-ms-win-security-base-l1-1-0

FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
AllocateAndInitializeSid

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-core-datetime-l1-1-0

GetDateFormatW

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx

ws2_32

ntohs

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

oleaut32

SysAllocString
VariantChangeType
VariantClear
SysFreeString
VariantInit

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
CloseThreadpool
SetThreadpoolTimer
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
TrySubmitThreadpoolCallback
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
CreateThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW
StopTraceW

api-ms-win-eventing-consumer-l1-1-0

CloseTrace
OpenTraceW
ProcessTrace

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaFreeMemory
LsaOpenPolicy
LsaLookupNames2

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetEntriesInAclW

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

iisutil

DestroyRefTraceLog
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?QueryOutstandingAllocationCount@ALLOC_CACHE_HANDLER@@QEBAKXZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?WriteMessage@IPM2_MESSAGE_PIPE@@QEAAJW4IPM2_OPCODE@@HKKPEAXK1@Z
?CleanupLookaside@ALLOC_CACHE_HANDLER@@QEAAXH@Z
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?CopyA@STRU@@QEAAJPEBD@Z
??1BUFFER@@QEAA@XZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?Equals@MULTISZ@@QEAAHPEAV1@@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
?DestroyIpmMessagePipe@IPM2_MESSAGE_PIPE@@QEAAXXZ
?Resize@STRU@@QEAAJK@Z
?AppendA@STRU@@QEAAJPEBDK@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
?Copy@STRU@@QEAAJPEBGK@Z
?CopyA@STRU@@QEAAJPEBDK@Z
?SetLen@STRU@@QEAA_NK@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z
??0MULTISZ@@QEAA@PEBG@Z
?Resize@BUFFER@@QEAA_NK@Z
IsStringEqualOrdinalIgnoreCase
??0EVENT_LOG@@QEAA@PEBG@Z
ReadDwordParameterValueFromAnyService
TerminateIISUtil
IISInitializeCriticalSection
WriteRefTraceLog
?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SAJPEAVIPM2_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuDbgPrint
PuDbgPrintError
PuDeleteDebugPrintsObject
??0STRU@@QEAA@XZ
??1STRU@@QEAA@XZ
??0STRA@@QEAA@XZ
??1STRA@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
??0STRU@@QEAA@PEAGK@Z
?Resize@STRA@@QEAAJK@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRU@@QEAAJPEBG@Z
??1MULTISZ@@QEAA@XZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@STRU@@QEAAJAEBV1@@Z
??0MULTISZ@@QEAA@XZ
?ExpandEnvironmentVariables@STRU@@SAJPEBGPEAV1@@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJG@Z
?Append@STRU@@QEAAJAEBV1@@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?AppendWSimple@STRA@@QEAAJPEBGK@Z
?Copy@STRA@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJPEBGK@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
InitializeIISUtil

Exports

Exports

ServiceMain

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/w3tp.dll
.dll windows:10 windows x64

4d3824af3034e59b6de94931999cfa7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
free
memset

api-ms-win-core-systemtopology-l1-1-0

GetNumaNodeProcessorMaskEx
GetNumaHighestNodeNumber

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
UpdateProcThreadAttribute
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
CreateThread
DeleteProcThreadAttributeList
GetCurrentThread
CreateRemoteThreadEx
InitializeProcThreadAttributeList

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-synch-l1-1-0

CreateEventW
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjectsEx
SetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FreeLibraryAndExitThread
DisableThreadLibraryCalls
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetLogicalProcessorInformationEx
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-io-l1-1-0

PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-kernel32-legacy-l1-1-0

GlobalMemoryStatus
BindIoCompletionCallback

ntdll

NtQuerySystemInformation
NtQueryInformationThread
RtlNtStatusToDosError

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer

iisutil

PuDbgPrint
IISGetPlatformType
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
PuCreateDebugPrintsObject
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
PuDeleteDebugPrintsObject

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask

Exports

Exports

??0THREAD_POOL@@AEAA@XZ
??1THREAD_POOL@@AEAA@XZ
?BindIoCompletionCallback@THREAD_POOL@@QEAAHPEAXP6AXKKPEAU_OVERLAPPED@@@ZK@Z
?CreateThreadPool@THREAD_POOL@@SAHPEAPEAV1@PEAUTHREAD_POOL_CONFIG@@@Z
?InitializeCounters@THREAD_POOL@@QEAAJXZ
?PostCompletion@THREAD_POOL@@QEAAHKP6AXKKPEAU_OVERLAPPED@@@Z0@Z
?SetInfo@THREAD_POOL@@QEAA_KW4THREAD_POOL_INFO@@_K@Z
?TerminateThreadPool@THREAD_POOL@@QEAAXXZ
?UninitializeCounters@THREAD_POOL@@QEAAXXZ
DllMain
InitializeThreadPoolConfigWithDefaults
OverrideThreadPoolConfigWithRegistry
ThreadPoolBindIoCompletionCallback
ThreadPoolInitialize
ThreadPoolMapErrorCodeIfNecessary
ThreadPoolPostCompletion
ThreadPoolSetInfo
ThreadPoolSetupCounters
ThreadPoolTerminate

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/w3wp.exe
.exe windows:10 windows x64

6e62e5f087316547aab36ed54a5e50b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_amsg_exit
_XcptFilter
__set_app_type
_wcsicmp
wcstoul
swprintf_s
_wsetlocale
printf
_ultow
towupper
_getwch
wprintf
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
__wgetmainargs
_vsnwprintf
memset

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetErrorMode

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
ExitProcess
GetCurrentProcess
OpenThreadToken
SetThreadToken

api-ms-win-core-com-l1-1-0

CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoUninitialize

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-console-l2-2-0

SetConsoleTitleW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
LoadStringW
GetProcAddress
GetModuleHandleW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

GetFullPathNameW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
GetConsoleOutputCP

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-perfcounters-l1-1-0

PerfStopProvider
PerfStartProvider
PerfSetCounterSetInfo

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask

ntdll

NtQuerySystemTime
RtlSystemTimeToLocalTime
RtlTimeToTimeFields

iisutil

InitializeSdFromProcessToken
?Append@STRU@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ
PuDbgPrintError
PuLoadDebugFlagsFromRegStr
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBG@Z
MakePathCanonicalizationProof
??1STRU@@QEAA@XZ
?Resize@STRU@@QEAAJK@Z
PuDbgPrint
??0STRU@@QEAA@PEAGK@Z

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/w3wphost.dll
.dll windows:10 windows x64

30b9551bce80033c595499a6e9455f95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memmove
wcschr
_purecall
_wcsicmp
_ultow
swprintf_s
wcsrchr
_wcsupr
wcsstr
wcscpy_s
_wtoi
wcsncpy_s
memcpy_s
iswspace
iswdigit
_vsnwprintf
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memset
memcpy
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
EnterCriticalSection
CreateEventA

oleaut32

VariantClear
VariantInit
SysAllocString

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

FindClose
FindFirstFileW
GetFileAttributesW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-psapi-l1-1-0

K32EmptyWorkingSet

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-perfcounters-l1-1-0

PerfSetCounterRefValue
PerfSetULongLongCounterValue
PerfCreateInstance
PerfDeleteInstance

ntdll

NtQuerySystemInformation

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueueTimer
CreateTimerQueue
QueueUserWorkItem

iisutil

?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?Clear@CLKRHashTable@@QEAAXXZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??1CLKRHashTable@@QEAA@XZ
??1STRA@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
?CopyW@STRA@@QEAAJPEBG@Z
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?Resize@BUFFER@@QEAA_NK@Z
??0BUFFER@@QEAA@XZ
?WriteMessage@IPM_MESSAGE_PIPE@@QEAAJW4IPM_OPCODE@@KPEAX@Z
?GetStringizedIpmOpcode@IPM_MESSAGE_PIPE@@SAPEBGW4IPM_OPCODE@@@Z
?DestroyIpmMessagePipe@IPM_MESSAGE_PIPE@@QEAAXXZ
?CreateIpmMessagePipe@IPM_MESSAGE_PIPE@@SAJPEAVIPM_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
??0STRA@@QEAA@PEADK@Z
??1IPM_MESSAGE_PIPE@@EEAA@XZ
??4CReaderWriterLock3@@QEAAAEAV0@AEBV0@@Z
??0CReaderWriterLock3@@QEAA@AEBV0@@Z
??1CReaderWriterLock3@@QEAA@XZ
?Resize@STRU@@QEAAJK@Z
?QuerySizeCCH@STRU@@QEBAKXZ
?QuerySize@BUFFER@@QEBAKXZ
?QueryStr@STRU@@QEAAPEAGXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?Append@STRU@@QEAAJPEBG@Z
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
PuDbgPrint
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0EVENT_LOG@@QEAA@PEBG@Z
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
??0BUFFER@@QEAA@PEAEK@Z
PuDbgPrintError
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
??0STRU_PATH@@QEAA@G@Z
??1STRU_PATH@@QEAA@XZ
?ExpandEnvironmentVariables@STRU_PATH@@QEAAJPEAG@Z
?Reset@STRU@@QEAAXXZ
?Copy@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJG@Z
?SetLen@STRU@@QEAA_NK@Z
?QueryCCH@STRU@@QEBAKXZ
?IsEmpty@STRU@@QEBA_NXZ
SkipTo
?Copy@STRU@@QEAAJPEBGK@Z
??1STRU@@QEAA@XZ

nativerd

GetDefaultNativeConfigurationSystem
InitializeNativeConfiguration
TerminateNativeConfiguration

Exports

Exports

??0IPM_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??4IPM_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??_7IPM_MESSAGE_PIPE@@6B@
AppHostInitialize
HostedSetMetadata
HostedW3SVCStart
HostedW3SVCStop
IncrementMessageCount

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/wamreg.dll
.dll regsvr32 windows:10 windows x64

e8eeb24b344aca48158cc9c43ffa8c75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
wcscat_s
wcscpy_s
strncpy_s
strncat_s
wcsncpy_s
_wcsnicmp
_itow
_wtoi
_wcsicmp
memset

advapi32

RegCloseKey
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA

ole32

ProgIDFromCLSID
CLSIDFromString
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject
CoRevertToSelf
CoImpersonateClient
CoCreateInstance

oleaut32

SysFreeString
SysStringLen
SysAllocStringLen

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetTickCount
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
GetLastError
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsA
WaitForSingleObject
GetCurrentThreadId
SetEvent
CloseHandle
ResetEvent
OutputDebugStringA
DeleteCriticalSection
SetUnhandledExceptionFilter
LoadLibraryExW
FreeLibrary
GetProcAddress
GetSystemDirectoryW
DisableThreadLibraryCalls
CreateEventA
WideCharToMultiByte

iisutil

??0MULTISZ@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBG@Z
IISInitializeCriticalSection
PuCreateDebugPrintsObject
PuDeleteDebugPrintsObject
IISGetPlatformType
PuDbgPrint
?CopyToBuffer@MULTISZ@@QEBAHPEAGPEAK@Z
IsSSLReportingBackwardCompatibilityMode
??1MULTISZ@@QEAA@XZ
??1STRU@@QEAA@XZ
??0STRU@@QEAA@PEAGK@Z
?Append@MULTISZ@@QEAAHPEBG@Z

Exports

Exports

CreateCOMPlusApplication
CreateIISPackage
DeleteIISPackage
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WamReg_RegisterSinkNotify
WamReg_UnRegisterSinkNotify

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/warmup.dll
.dll windows:10 windows x64

cfa7ff074a61c0de6bf0e2cb12db2670

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcstoul
_wcsnicmp
_wcsicmp
wcscat_s
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
wcsstr
wcschr
memset

ntdll

RtlCaptureContext
RtlIpv4StringToAddressExA
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

oleaut32

VariantChangeType
SysFreeString
SysAllocString
VariantClear
VariantInit

api-ms-win-core-synch-l1-1-0

SetEvent
LeaveCriticalSection
WaitForSingleObject
ResetEvent
DeleteCriticalSection
EnterCriticalSection
CreateEventW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

iisutil

IISInitializeCriticalSection
?AppendW@STRA@@QEAAJPEBG@Z
?CopyW@STRA@@QEAAJPEBG@Z
??0STRA@@QEAA@XZ
?SyncWithBuffer@STRU@@QEAAXXZ
NormalizeUrlW
?Append@STRU@@QEAAJPEBG@Z
??1STRU@@QEAA@XZ
??0STRU@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
PuDbgPrint
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
PuLoadDebugFlagsFromRegStr
??1STRA@@QEAA@XZ

Exports

Exports

RegisterModule

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/wbhst_pm.dll
.dll windows:10 windows x64

e12f0b56957393313852abcc19fb08e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memset
_vsnwprintf
_ultow
wcspbrk
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memcpy
wcscmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
LoadLibraryExW
GetProcAddress

oleaut32

SysStringLen
SysFreeString
SysAllocString

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-security-logon-l1-1-1

LogonUserW

iisutil

?SetLen@STRU@@QEAA_NK@Z
SkipTo
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?Copy@STRU@@QEAAJPEBG@Z
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
??1BUFFER@@QEAA@XZ
?Append@STRU@@QEAAJPEBG@Z
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?SyncWithBuffer@STRU@@QEAAXXZ
??1STRU@@QEAA@XZ
??0STRU@@QEAA@XZ
PuDbgPrint
PuDbgPrintError
?Resize@BUFFER@@QEAA_NK@Z
??0STRU@@QEAA@PEAGK@Z
?Resize@STRU@@QEAAJK@Z

Exports

Exports

GetProtocolManager

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/wbhstipm.dll
.dll windows:10 windows x64

af27a38b7aba4cec64e55f28291d4433

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memset

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-1-0

SetEvent
ResetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateEventW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegQueryValueExW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

iisutil

ReadStringParameterValueFromAnyService
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJPEBG@Z
?Resize@BUFFER@@QEAA_NK@Z
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
?DestroyIpmMessagePipe@IPM_MESSAGE_PIPE@@QEAAXXZ
??0BUFFER@@QEAA@XZ
?WriteMessage@IPM_MESSAGE_PIPE@@QEAAJW4IPM_OPCODE@@KPEAX@Z
?Copy@STRU@@QEAAJPEBG@Z
?CreateIpmMessagePipe@IPM_MESSAGE_PIPE@@SAJPEAVIPM_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
PuLoadDebugFlagsFromRegStr
??1BUFFER@@QEAA@XZ
??1IPM_MESSAGE_PIPE@@EEAA@XZ
PuCreateDebugPrintsObject
PuDbgPrint
PuDbgPrintError
??0EVENT_LOG@@QEAA@PEBG@Z
PuDeleteDebugPrintsObject
??1STRU@@QEAA@XZ
??0STRU@@QEAA@XZ
IsStringEqualOrdinalIgnoreCase

Exports

Exports

??0IPM_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??4IPM_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??_7IPM_MESSAGE_PIPE@@6B@
WebhostCloseAllListenerChannelInstances
WebhostGetVersion
WebhostOpenListenerChannelInstance
WebhostRegisterProtocol
WebhostUnregisterProtocol

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/webdav.dll
.dll windows:10 windows x64

99c4ea93ecb75ebdab2d1c5b3ce52ef1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_vsnprintf_s
_wcsnicmp
wcsncmp
wcschr
_vsnprintf
_wcsupr
_stricmp
strstr
isspace
wcspbrk
wcsncpy_s
??1type_info@@UEAA@XZ
_vscprintf
_wcslwr
memcpy
memset
qsort
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_aligned_malloc
_aligned_free
wcsrchr
strrchr
strncmp
_strtoui64
strchr
_purecall
_wcsicmp
strcmp
wcscmp

api-ms-win-security-base-l1-1-0

RevertToSelf
CheckTokenMembership
EqualSid
SetKernelObjectSecurity
GetKernelObjectSecurity
GetTokenInformation
DuplicateTokenEx

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW

api-ms-win-core-file-l1-1-0

GetFullPathNameW
RemoveDirectoryW
CreateDirectoryW
GetLongPathNameW
GetFileSizeEx
GetFileAttributesW
FindFirstFileExW
FindNextFileW
FindClose
DeleteFileW
WriteFile
SetEndOfFile
SetFilePointerEx
GetFileInformationByHandle
GetFileAttributesExW
CreateFileW
SetFileAttributesW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
SetThreadToken

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
ExpandEnvironmentStringsW

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

xmllite

CreateXmlReader

ntdll

WinSqmAddToStreamEx
RtlNtStatusToDosError

kernelbase

WTSGetServiceSessionId

iisutil

??0MULTISZ@@QEAA@XZ
?First@MULTISZ@@QEBAPEBGXZ
??1MULTISZ@@QEAA@XZ
?Append@STRU@@QEAAJAEBV1@@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?Append@STRA@@QEAAJAEBV1@@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?Append@STRU@@QEAAJPEBGK@Z
UlCleanAndCopyUrl
?Append@MULTISZ@@QEAAHPEBGK@Z
?Reset@MULTISZ@@QEAAXXZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?UnescapeOnly@STRU@@QEAAJXZ
MakePathCanonicalizationProof
??1CLKRHashTable@@QEAA@XZ
?Resize@STRA@@QEAAJK@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRA@@QEAAJPEBD@Z
??1STRA@@QEAA@XZ
SAFE_snwprintf
PuDbgPrint
SystemTimeToGMT
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
??0STRU@@QEAA@PEAGK@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?CopyA@STRU@@QEAAJPEBDK@Z
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?AppendA@STRU@@QEAAJPEBD@Z
?Resize@BUFFER@@QEAA_NK@Z
?Terminate@LANG_STRING@@QEAAJXZ
PuDbgPrintError
?Copy@STRU@@QEAAJPEBG@Z
??0BUFFER@@QEAA@XZ
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1STRU@@QEAA@XZ
?CopyW@STRA@@QEAAJPEBG@Z
?SyncWithBuffer@STRA@@QEAAXXZ
??0MULTISZA@@QEAA@XZ
??1MULTISZA@@QEAA@XZ
?Append@STRU@@QEAAJPEBG@Z
?SetLen@STRU@@QEAA_NK@Z
?Append@STRA@@QEAAJPEBD@Z
?Copy@STRU@@QEAAJPEBGK@Z
?EqualsNoCase@STRA@@QEBA_NPEBD@Z
?CopyA@STRU@@QEAAJPEBD@Z
PuLoadDebugFlagsFromRegStr
DisableTokenBackupPrivilege
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
?WriteLock@CSmallSpinLock@@QEAAXXZ
??0STRA@@QEAA@XZ
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
?AppendW@MULTISZA@@QEAAHPEBGK@Z
?Resize@STRU@@QEAAJK@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
StringTimeToFileTime
??0LANG_STRING@@QEAA@XZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
??0STRA@@QEAA@PEADK@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?GetString@LANG_STRING@@QEAAJPEBDKIPEAPEBGPEAK@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
AcquireSRWLockShared
AcquireSRWLockExclusive

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-file-l2-1-0

CreateSymbolicLinkW
MoveFileWithProgressW
CreateDirectoryExW
CreateHardLinkW
CopyFileExW

api-ms-win-core-file-l1-2-1

GetCompressedFileSizeW

api-ms-win-core-file-l1-2-2

FindFirstFileNameW
FindFirstStreamW

kernel32

DeleteFileTransactedW
FindFirstFileTransactedW
CreateSymbolicLinkTransactedW
GetCompressedFileSizeTransactedW
MoveFileTransactedW
CreateHardLinkTransactedW
FindFirstStreamTransactedW
FindFirstFileNameTransactedW
CopyFileTransactedW
GetFileAttributesTransactedW
SetFileAttributesTransactedW
CreateFileTransactedW
GetFullPathNameTransactedW
RemoveDirectoryTransactedW
CreateDirectoryTransactedW
GetLongPathNameTransactedW

ktmw32

CreateTransaction
CommitTransaction
RollbackTransaction

sspicli

LsaFreeReturnBuffer

advapi32

CryptHashData
LsaClose
LsaOpenPolicy
CryptGetHashParam
LsaQueryInformationPolicy
CryptDestroyHash
CryptCreateHash
LogonUserExW
LsaFreeMemory
CryptAcquireContextW
CryptReleaseContext

secur32

SeciFreeCallContext

Exports

Exports

RegisterModule

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/webdav_simple_lock.dll
.dll windows:10 windows x64

d5f876e5a956c050be18495c9e4330fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_callnewh
_purecall
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
malloc
_wcsnicmp
wcschr
free
_wcsicmp
wcstoul
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

iisutil

?CopyA@STRU@@QEAAJPEBD@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
??1STRU@@QEAA@XZ
SAFE_snwprintf
?Copy@STRU@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RegisterLockStore

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/webdav_simple_prop.dll
.dll windows:10 windows x64

5d5bf02061bf28e43d9b4e9f6fadaa2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsrchr
_wcsicmp
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
wcschr
_purecall

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

iisutil

?Unescape@STRU@@QEAAJXZ
??0STRU@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
??1STRU@@QEAA@XZ
??0MULTISZ@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
?SyncWithBuffer@STRU@@QEAAXXZ
?Append@STRU@@QEAAJPEBG@Z
?Escape@STRU@@QEAAJXZ
?Reset@MULTISZ@@QEAAXXZ
?Resize@BUFFER@@QEAA_NK@Z
?RecalcLen@MULTISZ@@QEAAXXZ
?Resize@STRU@@QEAAJK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJAEBV1@@Z

api-ms-win-core-file-l1-1-0

WriteFile
CreateFileW
SetFileAttributesW
GetFileAttributesExW
DeleteFileW
GetFileAttributesW

api-ms-win-core-handle-l1-1-0

CloseHandle

kernel32

GetPrivateProfileSectionW
WritePrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileStringW

Exports

Exports

RegisterPropertyStore

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/wmi-appserver.dll
.dll regsvr32 windows:10 windows x64

11557f9b22a55bb20aff1ebd47759a6f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsrchr
_vscwprintf
vswprintf_s
_wtoi
__CxxFrameHandler3
_itoa_s
calloc
wcsspn
wcscspn
swscanf
wcscat_s
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
wcsstr
wcschr
wcscpy_s
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
_i64tow
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_wcsdup
_vsnwprintf
malloc
towupper
free
memmove_s
_purecall
_wcsicmp
memcpy_s
__C_specific_handler
memset
wcscmp

kernel32

GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
Sleep
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetModuleHandleW
GetProcAddress
RaiseException
SetThreadLocale
GetThreadLocale
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceExW
CompareStringOrdinal
lstrlenW
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryW
GetLastError
LoadLibraryExW
MultiByteToWideChar
LocalFree
LocalAlloc
WideCharToMultiByte
RtlCaptureContext

user32

LoadStringW
CharLowerBuffW
UnregisterClassA

oleaut32

GetErrorInfo
VarBstrCmp
SafeArrayGetElement
SafeArrayCreateVector
SafeArrayPutElement
VarCmp
VariantChangeType
SafeArrayRedim
VariantCopyInd
SafeArrayCreate
SafeArrayLock
SafeArrayCopy
SafeArrayGetVartype
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
CreateErrorInfo
SetErrorInfo
VariantCopy
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantInit
SysAllocStringLen
SysAllocString
VariantClear
SysFreeString
SafeArrayUnlock

ole32

ProgIDFromCLSID
CoRevertToSelf
CLSIDFromString
CoTaskMemFree
StringFromGUID2
CoImpersonateClient
CoCreateInstance

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey

crypt32

CryptStringToBinaryW

httpapi

HttpQueryServiceConfiguration
HttpTerminate
HttpSetServiceConfiguration
HttpDeleteServiceConfiguration
HttpInitialize

ws2_32

WSACleanup
WSAGetLastError
freeaddrinfo
WSAStartup
getaddrinfo
WSAAddressToStringW

nativerd

CreateNativeConfigurationSystem
TerminateNativeConfiguration
GetDefaultNativeConfigurationSystem
InitializeNativeConfiguration

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/wmsvc.exe.config
inetsrv/zh-CN/AppHostNavigators.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/Cnfgprts.ocx.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/IISUiObj.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/Inetmgr.exe.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/WebAdministration.mfl
inetsrv/zh-CN/XPath.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/appcmd.exe.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/appobj.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/asp.mfl
inetsrv/zh-CN/browscap.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/iis.msc
.xml
inetsrv/zh-CN/iis6.msc
.xml
inetsrv/zh-CN/iiscertprovider.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/iiscfg.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/iisfcgi.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/iislog.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/iisres.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/iissetup.exe.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/iisui.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/inetmgr.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/inetmgr6.exe.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/infocomm.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/iscomlog.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/logui.ocx.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/metadata.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

62:40:cc:b3:89:84:3c:37:52:3e:90:c4:b7:27:ae:19:47:87:51:92
Signer

Actual PE Digest

62:40:cc:b3:89:84:3c:37:52:3e:90:c4:b7:27:ae:19:47:87:51:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/uihelper.dll.mui
.dll windows:10 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inetsrv/zh-CN/w3core.mfl
inetsrv/zh-CN/w3isapi.mfl
inetsrv/zh-HANS/iisual.resources.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inetsrv/zh-TW/rewrite.dll.mui
.dll windows:6 windows x64

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

d1:d9:a1:68:72:7e:f7:bf:51:f4:e6:11:28:c5:46:70:26:b1:a1:59
Signer

Actual PE Digest

d1:d9:a1:68:72:7e:f7:bf:51:f4:e6:11:28:c5:46:70:26:b1:a1:59

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc3f4381a9427787cd132be43ef36b84

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

ole32

oleaut32

rpcrt4

user32

Exports

Exports

Sections

.text Size: 93KB - Virtual size: 92KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 8KB - Virtual size: 9KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 22KB - Virtual size: 21KB

.reloc Size: 2KB - Virtual size: 2KB

82739e596e84c7dba7318b635064696f

Headers

DLL Characteristics

File Characteristics

Imports

mfc42u

msvcrt

iisui

kernel32

advapi32

comctl32

shell32

shlwapi

user32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 3KB - Virtual size: 13KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 3KB - Virtual size: 2KB

011baa9f7cbe90757d4d6101d43ceabe

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

kernel32

user32

advapi32

shell32

ole32

oleaut32

netapi32

ntdll

uihelper

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 196B

4853459dd64f0064e49f07916078eed5

Headers

DLL Characteristics

File Characteristics

.text
Size: 93KB - Virtual size: 92KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 8KB - Virtual size: 9KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 22KB - Virtual size: 21KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 41KB - Virtual size: 40KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 3KB - Virtual size: 13KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 50KB - Virtual size: 49KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 196B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 276B

.rsrc
Size: 111KB - Virtual size: 111KB

.reloc
Size: 512B - Virtual size: 32B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 300B

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 512B - Virtual size: 32B

.text
Size: 132KB - Virtual size: 130KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 1016KB - Virtual size: 1014KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 300B

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 512B - Virtual size: 32B