Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Overview
overview
3Static
static
3新建文�...32.exe
windows7-x64
新建文�...32.exe
windows10-2004-x64
新建文�...64.exe
windows7-x64
新建文�...64.exe
windows10-2004-x64
新建文�...er.exe
windows7-x64
新建文�...er.exe
windows10-2004-x64
新建文�...ub.exe
windows7-x64
新建文�...ub.exe
windows10-2004-x64
新建文�...32.exe
windows7-x64
新建文�...32.exe
windows10-2004-x64
新建文�...al.exe
windows7-x64
新建文�...al.exe
windows10-2004-x64
新建文�...al.exe
windows7-x64
新建文�...al.exe
windows10-2004-x64
新建文�...32.exe
windows7-x64
新建文�...32.exe
windows10-2004-x64
新建文�...al.mod
ubuntu-18.04-amd64
新建文�...al.mod
debian-9-armhf
新建文�...al.mod
debian-9-mips
新建文�...al.mod
debian-9-mipsel
新建文�...ug.ps1
windows7-x64
新建文�...ug.ps1
windows10-2004-x64
1新建文�...ub.vbs
windows7-x64
1新建文�...ub.vbs
windows10-2004-x64
1新建文�...fo.vbs
windows7-x64
1新建文�...fo.vbs
windows10-2004-x64
1新建文�...32.mod
ubuntu-18.04-amd64
新建文�...fs.mod
ubuntu-18.04-amd64
新建文�...fs.mod
ubuntu-18.04-amd64
新建文�...ci.mod
ubuntu-18.04-amd64
新建文�...ut.mod
ubuntu-18.04-amd64
新建文�...dr.mod
ubuntu-18.04-amd64
Static task
static1
Behavioral task
behavioral1
Sample
新建文件夹/EFI/BOOT/BOOTIA32.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
新建文件夹/EFI/BOOT/BOOTIA32.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
新建文件夹/EFI/BOOT/BOOTX64.exe
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
新建文件夹/EFI/BOOT/BOOTX64.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
新建文件夹/EFI/BOOT/MokManager.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
新建文件夹/EFI/BOOT/MokManager.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
新建文件夹/EFI/BOOT/grub.exe
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
新建文件夹/EFI/BOOT/grub.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
新建文件夹/EFI/BOOT/grubia32.exe
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
新建文件夹/EFI/BOOT/grubia32.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
新建文件夹/EFI/BOOT/grubia32_real.exe
Resource
win7-20231020-en
Behavioral task
behavioral12
Sample
新建文件夹/EFI/BOOT/grubia32_real.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
新建文件夹/EFI/BOOT/grubx64_real.exe
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
新建文件夹/EFI/BOOT/grubx64_real.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
新建文件夹/EFI/BOOT/mmia32.exe
Resource
win7-20231020-en
Behavioral task
behavioral16
Sample
新建文件夹/EFI/BOOT/mmia32.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
新建文件夹/grub/arm64-efi/normal.mod
Resource
ubuntu1804-amd64-20231020-en
Behavioral task
behavioral18
Sample
新建文件夹/grub/arm64-efi/normal.mod
Resource
debian9-armhf-20231020-en
Behavioral task
behavioral19
Sample
新建文件夹/grub/arm64-efi/normal.mod
Resource
debian9-mipsbe-20231020-en
Behavioral task
behavioral20
Sample
新建文件夹/grub/arm64-efi/normal.mod
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
新建文件夹/grub/debug.ps1
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
新建文件夹/grub/debug.ps1
Resource
win10v2004-20231020-en
Behavioral task
behavioral23
Sample
新建文件夹/grub/grub.vbs
Resource
win7-20231020-en
Behavioral task
behavioral24
Sample
新建文件夹/grub/grub.vbs
Resource
win10v2004-20231020-en
Behavioral task
behavioral25
Sample
新建文件夹/grub/hwinfo.vbs
Resource
win7-20231020-en
Behavioral task
behavioral26
Sample
新建文件夹/grub/hwinfo.vbs
Resource
win10v2004-20231020-en
Behavioral task
behavioral27
Sample
新建文件夹/grub/i386-efi/adler32.mod
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral28
Sample
新建文件夹/grub/i386-efi/affs.mod
Resource
ubuntu1804-amd64-20231020-en
Behavioral task
behavioral29
Sample
新建文件夹/grub/i386-efi/afs.mod
Resource
ubuntu1804-amd64-20231020-en
Behavioral task
behavioral30
Sample
新建文件夹/grub/i386-efi/ahci.mod
Resource
ubuntu1804-amd64-20231020-en
Behavioral task
behavioral31
Sample
新建文件夹/grub/i386-efi/aout.mod
Resource
ubuntu1804-amd64-20231020-en
Behavioral task
behavioral32
Sample
新建文件夹/grub/i386-efi/appleldr.mod
Resource
ubuntu1804-amd64-20231020-en
Target
678bba3fe9f9d37912941091783d956aba9c4e2031574633212ee1310a20caee
Size
15.6MB
MD5
2adcf5e1c1cd541176ba976e7e6a4b62
SHA1
6a9f1ee227e38742a9fa9816a9c20b36290e87ee
SHA256
678bba3fe9f9d37912941091783d956aba9c4e2031574633212ee1310a20caee
SHA512
d543d172c5e71ddfc1adf2c609c0e3b474e754404b4b969a95cd27b43e71ac0cbb61aa4901d3e835e60d713015d4ca52101f9c8f089910c71e5647b050f4f4b1
SSDEEP
393216:ErsvXZA4ij/XBtwTs2+BnE6euYJVC8ljXliCo1krL4uTeU3g5fYu:Eo+LLHwngn8uYJ4m87wLqnFB
Checks for missing Authenticode signature.
resource |
---|
unpack001/新建文件夹/EFI/BOOT/BOOTIA32.EFI |
unpack001/新建文件夹/EFI/BOOT/BOOTX64.EFI |
unpack001/新建文件夹/EFI/BOOT/grubia32_real.efi |
unpack001/新建文件夹/EFI/BOOT/grubx64_real.efi |
unpack001/新建文件夹/ventoy/iso9660_ia32.efi |
unpack001/新建文件夹/ventoy/iso9660_x64.efi |
unpack001/新建文件夹/ventoy/udf_ia32.efi |
unpack001/新建文件夹/ventoy/udf_x64.efi |
unpack001/新建文件夹/ventoy/ventoy_ia32.efi |
unpack001/新建文件夹/ventoy/ventoy_x64.efi |
unpack001/新建文件夹/ventoy/vtoyjump32.exe |
unpack001/新建文件夹/ventoy/vtoyjump64.exe |
unpack001/新建文件夹/ventoy/vtoyutil_ia32.efi |
unpack001/新建文件夹/ventoy/vtoyutil_x64.efi |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
ExtKeyUsageCodeSigning
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_fgetwchar
_iob
fprintf
fflush
_fgetchar
toupper
strchr
??2@YAPAXI@Z
_beginthreadex
wcsncat
??3@YAXPAX@Z
fwprintf
towupper
wcstok
wcstod
malloc
free
memcpy
wcsncmp
wcschr
memset
wcsncpy
wcsrchr
_wcsicmp
_snwprintf
wcstoul
GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
SetEvent
WaitForSingleObject
GetTickCount
DeleteFileW
GetVolumeInformationW
HeapReAlloc
WaitForMultipleObjects
QueryDosDeviceW
GetDriveTypeA
SetCurrentDirectoryW
MultiByteToWideChar
VirtualAlloc
WriteFile
VirtualFree
WaitNamedPipeW
Sleep
LocalAlloc
CreateEventW
GetFileSize
SetEndOfFile
FlushFileBuffers
GetLogicalDrives
GetVersion
DefineDosDeviceW
CreateFileW
GetProcessHeap
HeapAlloc
DeviceIoControl
CloseHandle
HeapFree
SetLastError
SetFilePointer
ReadFile
GetLastError
LocalFree
FormatMessageW
RegCloseKey
StartServiceW
CloseServiceHandle
OpenServiceW
RegOpenKeyW
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
QueryServiceStatus
RegDeleteValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegDeleteKeyW
OpenSCManagerW
DispatchMessageW
IsDialogMessageW
GetDlgItemInt
GetMenu
EnableMenuItem
DrawMenuBar
MapWindowPoints
GetSubMenu
TrackPopupMenu
GetAsyncKeyState
LoadIconW
SetClassLongW
GetSystemMetrics
SendMessageW
PostMessageW
GetParent
GetWindowTextLengthW
EnableWindow
TranslateMessage
SetDlgItemInt
SendDlgItemMessageW
CheckDlgButton
SetFocus
IsDlgButtonChecked
EndDialog
SetDlgItemTextW
GetDlgItemTextW
CreateDialogParamW
DestroyWindow
DialogBoxParamW
SetWindowTextW
SendMessageTimeoutW
MessageBoxW
GetPropW
ShowWindow
SetPropW
GetDlgItem
RemovePropW
PeekMessageW
SHFormatDrive
ShellExecuteW
SHChangeNotify
ImageList_Create
ImageList_ReplaceIcon
GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW
NtOpenFile
RtlInitUnicodeString
NtClose
RtlFreeUnicodeString
RtlDosPathNameToNtPathName_U
RtlCreateUnicodeString
RtlNtStatusToDosError
CPlApplet
ImDiskAdjustImageFileSize
ImDiskAllocPrintF
ImDiskBuildMBR
ImDiskChangeFlags
ImDiskCheckDriverVersion
ImDiskConsoleMessageA
ImDiskConsoleMessageW
ImDiskConvertCHSToLBA
ImDiskConvertLBAToCHS
ImDiskCreateDevice
ImDiskCreateDeviceEx
ImDiskCreateMountPoint
ImDiskExtendDevice
ImDiskFindFreeDriveLetter
ImDiskFlushWindowMessages
ImDiskForceRemoveDevice
ImDiskGetAPIFlags
ImDiskGetDeviceList
ImDiskGetDeviceListEx
ImDiskGetFormattedGeometry
ImDiskGetFormattedGeometryIndirect
ImDiskGetOffsetByFileExt
ImDiskGetPartitionInfoIndirect
ImDiskGetPartitionInfoIndirectEx
ImDiskGetPartitionInformation
ImDiskGetPartitionInformationEx
ImDiskGetPartitionTypeName
ImDiskGetRegistryAutoLoadDevices
ImDiskGetSinglePartitionInfoIndirect
ImDiskGetSinglePartitionInformation
ImDiskGetVersion
ImDiskGetVolumeSize
ImDiskImageContainsISOFS
ImDiskImageContainsISOFSIndirect
ImDiskMsgBoxPrintF
ImDiskNativePathToWin32
ImDiskNotifyRemovePending
ImDiskNotifyShellDriveLetter
ImDiskOpenDeviceByMountPoint
ImDiskOpenDeviceByName
ImDiskOpenDeviceByNumber
ImDiskOpenRefreshEvent
ImDiskQueryDevice
ImDiskReadFileHandle
ImDiskRemoveDevice
ImDiskRemoveMountPoint
ImDiskRemoveRegistrySettings
ImDiskSaveImageFile
ImDiskSaveImageFileInteractive
ImDiskSaveRegistrySettings
ImDiskSetAPIFlags
ImDiskStartService
RunDLL_MountFile
RunDLL_MountFileW
RunDLL_RemoveDevice
RunDLL_SaveImageFile
_CPlApplet@16
_ImDiskAdjustImageFileSize@8
_ImDiskBuildMBR@20
_ImDiskChangeFlags@20
_ImDiskCheckDriverVersion@4
_ImDiskConsoleMessageA@16
_ImDiskConsoleMessageW@16
_ImDiskConvertCHSToLBA@8
_ImDiskConvertLBAToCHS@8
_ImDiskCreateDevice@28
_ImDiskCreateDeviceEx@32
_ImDiskCreateMountPoint@8
_ImDiskExtendDevice@12
_ImDiskFindFreeDriveLetter@0
_ImDiskFlushWindowMessages@4
_ImDiskForceRemoveDevice@8
_ImDiskGetAPIFlags@0
_ImDiskGetDeviceList@0
_ImDiskGetDeviceListEx@8
_ImDiskGetFormattedGeometry@12
_ImDiskGetFormattedGeometryIndirect@16
_ImDiskGetOffsetByFileExt@8
_ImDiskGetPartitionInfoIndirect@20
_ImDiskGetPartitionInfoIndirectEx@24
_ImDiskGetPartitionInformation@16
_ImDiskGetPartitionInformationEx@20
_ImDiskGetPartitionTypeName@12
_ImDiskGetRegistryAutoLoadDevices@4
_ImDiskGetSinglePartitionInfoIndirect@24
_ImDiskGetSinglePartitionInformation@20
_ImDiskGetVersion@8
_ImDiskGetVolumeSize@8
_ImDiskImageContainsISOFS@8
_ImDiskImageContainsISOFSIndirect@12
_ImDiskNativePathToWin32@4
_ImDiskNotifyRemovePending@8
_ImDiskNotifyShellDriveLetter@8
_ImDiskOpenDeviceByMountPoint@8
_ImDiskOpenDeviceByName@8
_ImDiskOpenDeviceByNumber@8
_ImDiskOpenRefreshEvent@4
_ImDiskQueryDevice@12
_ImDiskReadFileHandle@24
_ImDiskRemoveDevice@12
_ImDiskRemoveMountPoint@4
_ImDiskRemoveRegistrySettings@4
_ImDiskSaveImageFile@16
_ImDiskSaveImageFileInteractive@16
_ImDiskSaveRegistrySettings@4
_ImDiskSetAPIFlags@8
_ImDiskStartService@4
_RunDLL_MountFile@16
_RunDLL_MountFileW@16
_RunDLL_RemoveDevice@16
_RunDLL_SaveImageFile@16
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
LocalFree
FormatMessageA
GetLastError
RaiseException
DeviceIoControl
QueryDosDeviceW
CreateProcessW
DefineDosDeviceW
ReleaseMutex
CloseHandle
WaitForSingleObject
CreateMutexW
GetVersion
CreateFileW
WaitNamedPipeW
Sleep
FlushFileBuffers
HeapFree
HeapAlloc
GetProcessHeap
GlobalMemoryStatus
ExitProcess
GetCommandLineW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
printf
exit
fputs
_iob
fprintf
wcstok
swscanf
iswctype
wcstoul
_wcsupr
malloc
free
memcpy
puts
_snwprintf
memset
CharToOemA
MessageBoxA
CommandLineToArgvW
RtlInitUnicodeString
NtClose
RtlCreateUnicodeString
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
RtlUnwind
_ImDiskRemoveRegistrySettings@4
_ImDiskRemoveMountPoint@4
_ImDiskOpenDeviceByName@8
_ImDiskStartService@4
_ImDiskOpenDeviceByMountPoint@8
_ImDiskSaveRegistrySettings@4
_ImDiskFindFreeDriveLetter@0
_ImDiskGetSinglePartitionInformation@20
_ImDiskGetOffsetByFileExt@8
_ImDiskNotifyRemovePending@8
_ImDiskOpenDeviceByNumber@8
_ImDiskForceRemoveDevice@8
_ImDiskCreateMountPoint@8
_ImDiskNotifyShellDriveLetter@8
_ImDiskGetDeviceListEx@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
_snwprintf
ExFreePool
ExAllocatePoolWithTag
KeDelayExecutionThread
memcpy
memset
IoCreateUnprotectedSymbolicLink
IoDeleteSymbolicLink
KeSetEvent
KeWaitForSingleObject
KeInitializeEvent
ObReferenceObjectByPointer
IoDeleteDevice
ObfDereferenceObject
KePulseEvent
DbgPrint
ObReferenceObjectByHandle
ExEventObjectType
ZwCreateEvent
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
IoCreateDevice
ZwOpenKey
RtlAppendUnicodeToString
RtlCopyUnicodeString
ZwReadFile
IoCancelIrp
KeReadStateEvent
KeWaitForMultipleObjects
IofCallDriver
KeClearEvent
IoBuildSynchronousFsdRequest
IoGetRelatedDeviceObject
ZwWaitForSingleObject
RtlInitUnicodeString
ZwQueryInformationFile
KeGetCurrentThread
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
IoFileObjectType
ZwMapViewOfSection
ZwSetInformationFile
ZwFsControlFile
ZwCreateFile
ZwOpenSection
RtlAppendUnicodeStringToString
SeTokenType
SeImpersonateClient
SeCreateClientSecurity
_wcsnicmp
MmMapLockedPages
NtReadFile
NtWriteFile
NtFsControlFile
IoBuildDeviceIoControlRequest
IofCompleteRequest
ExfInterlockedRemoveHeadList
PsTerminateSystemThread
KeSetPriorityThread
ExfInterlockedInsertTailList
SeSinglePrivilegeCheck
IoFreeIrp
MmUnlockPages
IoFreeMdl
memmove
IoAllocateIrp
ZwUnmapViewOfSection
ZwOpenEvent
ZwQueryValueKey
PsCreateSystemThread
ZwDeviceIoControlFile
ZwClose
KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
toupper
_iob
fprintf
fflush
_fgetchar
strchr
_XcptFilter
fwprintf
??2@YAPEAX_K@Z
wcstok
towupper
wcstod
??3@YAXPEAX@Z
_beginthreadex
wcsncat
wcstoul
malloc
free
wcsncmp
wcsrchr
_initterm
_amsg_exit
__C_specific_handler
memcpy
memset
wcschr
wcsncpy
_snwprintf
_wcsicmp
_fgetwchar
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetVolumeInformationW
DeleteFileW
WaitForMultipleObjects
QueryDosDeviceW
GetTickCount
SetEvent
WaitForSingleObject
HeapReAlloc
GetWindowsDirectoryW
SetCurrentDirectoryW
MultiByteToWideChar
GetDriveTypeA
LocalFree
DeviceIoControl
CreateEventW
LocalAlloc
DefineDosDeviceW
VirtualAlloc
SetLastError
GetLastError
FlushFileBuffers
CreateFileW
ReadFile
FormatMessageW
Sleep
WriteFile
WaitNamedPipeW
GetProcessHeap
VirtualFree
GetLogicalDrives
HeapFree
HeapAlloc
SetEndOfFile
SetFilePointer
GetFileSize
StartServiceW
OpenSCManagerW
OpenServiceW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
QueryServiceStatus
CloseServiceHandle
SetSecurityDescriptorDacl
RegDeleteKeyW
InitializeSecurityDescriptor
RegOpenKeyW
RegQueryValueExW
SetWindowTextW
GetPropW
CheckDlgButton
GetWindowTextLengthW
GetDlgItemInt
TrackPopupMenu
PostMessageW
GetSubMenu
GetParent
SetFocus
SetDlgItemInt
GetMenu
LoadIconW
GetAsyncKeyState
SetClassLongPtrW
EnableMenuItem
EndDialog
SendDlgItemMessageW
DispatchMessageW
IsDlgButtonChecked
DrawMenuBar
GetSystemMetrics
GetDlgItemTextW
SetDlgItemTextW
SendMessageW
MapWindowPoints
EnableWindow
DestroyWindow
DialogBoxParamW
CreateDialogParamW
RemovePropW
SetPropW
TranslateMessage
IsDialogMessageW
PeekMessageW
GetDlgItem
ShowWindow
SendMessageTimeoutW
MessageBoxW
SHFormatDrive
ShellExecuteW
SHChangeNotify
ImageList_Create
ImageList_ReplaceIcon
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
RtlInitUnicodeString
RtlFreeUnicodeString
RtlNtStatusToDosError
NtClose
NtOpenFile
RtlDosPathNameToNtPathName_U
RtlCreateUnicodeString
CPlApplet
ImDiskAdjustImageFileSize
ImDiskAllocPrintF
ImDiskBuildMBR
ImDiskChangeFlags
ImDiskCheckDriverVersion
ImDiskConsoleMessageA
ImDiskConsoleMessageW
ImDiskConvertCHSToLBA
ImDiskConvertLBAToCHS
ImDiskCreateDevice
ImDiskCreateDeviceEx
ImDiskCreateMountPoint
ImDiskExtendDevice
ImDiskFindFreeDriveLetter
ImDiskFlushWindowMessages
ImDiskForceRemoveDevice
ImDiskGetAPIFlags
ImDiskGetDeviceList
ImDiskGetDeviceListEx
ImDiskGetFormattedGeometry
ImDiskGetFormattedGeometryIndirect
ImDiskGetOffsetByFileExt
ImDiskGetPartitionInfoIndirect
ImDiskGetPartitionInfoIndirectEx
ImDiskGetPartitionInformation
ImDiskGetPartitionInformationEx
ImDiskGetPartitionTypeName
ImDiskGetRegistryAutoLoadDevices
ImDiskGetSinglePartitionInfoIndirect
ImDiskGetSinglePartitionInformation
ImDiskGetVersion
ImDiskGetVolumeSize
ImDiskImageContainsISOFS
ImDiskImageContainsISOFSIndirect
ImDiskMsgBoxPrintF
ImDiskNativePathToWin32
ImDiskNotifyRemovePending
ImDiskNotifyShellDriveLetter
ImDiskOpenDeviceByMountPoint
ImDiskOpenDeviceByName
ImDiskOpenDeviceByNumber
ImDiskOpenRefreshEvent
ImDiskQueryDevice
ImDiskReadFileHandle
ImDiskRemoveDevice
ImDiskRemoveMountPoint
ImDiskRemoveRegistrySettings
ImDiskSaveImageFile
ImDiskSaveImageFileInteractive
ImDiskSaveRegistrySettings
ImDiskSetAPIFlags
ImDiskStartService
RunDLL_MountFile
RunDLL_MountFileW
RunDLL_RemoveDevice
RunDLL_SaveImageFile
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
ExitProcess
GetCommandLineW
CreateMutexW
GlobalMemoryStatus
CreateProcessW
HeapAlloc
HeapFree
WaitForSingleObject
GetProcessHeap
FormatMessageA
WaitNamedPipeW
Sleep
CreateFileW
FlushFileBuffers
RaiseException
GetLastError
DefineDosDeviceW
QueryDosDeviceW
DeviceIoControl
ReleaseMutex
CloseHandle
LocalFree
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
memset
malloc
memcpy
swscanf
wcstoul
_snwprintf
free
exit
wcstok
puts
_wcsupr
_iob
iswctype
fprintf
printf
fputs
CharToOemA
MessageBoxA
CommandLineToArgvW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlDosPathNameToNtPathName_U
NtClose
RtlFreeUnicodeString
RtlInitUnicodeString
RtlCreateUnicodeString
ImDiskOpenDeviceByNumber
ImDiskNotifyRemovePending
ImDiskRemoveMountPoint
ImDiskNotifyShellDriveLetter
ImDiskCreateMountPoint
ImDiskFindFreeDriveLetter
ImDiskStartService
ImDiskOpenDeviceByMountPoint
ImDiskOpenDeviceByName
ImDiskForceRemoveDevice
ImDiskSaveRegistrySettings
ImDiskGetOffsetByFileExt
ImDiskGetSinglePartitionInformation
ImDiskGetDeviceListEx
ImDiskRemoveRegistrySettings
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
ExAllocatePoolWithTag
ZwCreateEvent
IoDeleteSymbolicLink
ExFreePoolWithTag
_snwprintf
RtlSetDaclSecurityDescriptor
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
RtlAppendUnicodeToString
KeInitializeEvent
KeDelayExecutionThread
PsCreateSystemThread
ZwQueryValueKey
IoCreateUnprotectedSymbolicLink
ExEventObjectType
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDevice
ObReferenceObjectByPointer
DbgPrint
RtlCreateSecurityDescriptor
KePulseEvent
ZwOpenKey
KeClearEvent
KeReadStateEvent
IoBuildSynchronousFsdRequest
ZwReadFile
IoGetRelatedDeviceObject
IoCancelIrp
KeWaitForMultipleObjects
IofCallDriver
ZwFsControlFile
KeReleaseInStackQueuedSpinLock
_wcsnicmp
ZwMapViewOfSection
KeAcquireInStackQueuedSpinLock
ZwSetInformationFile
SeCreateClientSecurity
IoFileObjectType
ZwWaitForSingleObject
ZwCreateFile
SeImpersonateClient
ZwFreeVirtualMemory
RtlAppendUnicodeStringToString
ZwDeviceIoControlFile
ZwQueryInformationFile
ZwOpenSection
SeTokenType
ZwAllocateVirtualMemory
IoBuildDeviceIoControlRequest
NtWriteFile
KeSetPriorityThread
NtFsControlFile
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
IofCompleteRequest
NtReadFile
SeSinglePrivilegeCheck
IoFreeMdl
IoFreeIrp
IoAllocateIrp
MmUnlockPages
ZwOpenEvent
ZwUnmapViewOfSection
KeBugCheckEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
AttachVirtualDisk
OpenVirtualDisk
GetLastError
LoadLibraryA
LockResource
FindNextFileA
GetFileTime
CloseHandle
GetSystemTime
CreateThread
SetFilePointer
CreateProcessW
DeleteVolumeMountPointA
VerSetConditionMask
SetFilePointerEx
WaitForSingleObject
WriteFile
WideCharToMultiByte
GetVolumeInformationA
GetFileAttributesA
GetFileAttributesW
CreateProcessA
ReadFile
FindFirstFileA
MultiByteToWideChar
GetStartupInfoW
VerifyVersionInfoW
CreateDirectoryA
GetStartupInfoA
CopyFileA
GetLocalTime
MoveFileA
DeviceIoControl
GetModuleFileNameA
CreateMutexA
GetCurrentDirectoryA
ReleaseMutex
GetCurrentProcessId
DeleteFileA
LCMapStringW
Sleep
GetLogicalDrives
GetCurrentProcess
SystemTimeToFileTime
LoadResource
FreeLibrary
FindResourceA
CreateFileA
ReadConsoleW
SetStdHandle
WriteConsoleW
RaiseException
FlushFileBuffers
HeapReAlloc
HeapSize
SetEndOfFile
CreateFileW
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
EncodePointer
DecodePointer
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetFileType
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetConsoleCP
GetConsoleMode
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
OutputDebugStringW
GetStringTypeW
EnumWindows
GetWindowTextW
EnumChildWindows
RegQueryValueExA
OpenSCManagerA
RegOpenKeyExA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenServiceA
RegCloseKey
AdjustTokenPrivileges
RegFlushKey
RegLoadKeyA
RegCreateKeyExA
LookupPrivilegeValueA
RegSetValueExA
RegUnLoadKeyA
OpenProcessToken
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
SetFilePointer
CreateProcessW
DeleteVolumeMountPointA
VerSetConditionMask
SetFilePointerEx
WaitForSingleObject
WriteFile
WideCharToMultiByte
GetVolumeInformationA
GetFileAttributesA
GetFileAttributesW
CreateProcessA
ReadFile
CreateFileW
MultiByteToWideChar
GetStartupInfoW
VerifyVersionInfoW
CreateThread
GetStartupInfoA
CopyFileA
GetLocalTime
MoveFileA
DeviceIoControl
GetModuleFileNameA
CreateMutexA
GetCurrentDirectoryA
ReleaseMutex
GetCurrentProcessId
DeleteFileA
HeapSize
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetSystemTime
CloseHandle
GetFileTime
FindNextFileA
LockResource
LoadLibraryA
GetLastError
FindFirstFileA
Sleep
GetLogicalDrives
GetCurrentProcess
SystemTimeToFileTime
LoadResource
FreeLibrary
FindResourceA
CreateDirectoryA
CreateFileA
RaiseException
GetProcAddress
LoadLibraryExA
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
EncodePointer
DecodePointer
GetProcessHeap
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
RtlUnwindEx
GetFileType
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetConsoleCP
GetConsoleMode
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
OutputDebugStringW
GetStringTypeW
LCMapStringW
ReadConsoleW
SetStdHandle
SetEndOfFile
GetWindowTextW
EnumChildWindows
EnumWindows
RegOpenKeyExA
StartServiceA
CreateServiceA
RegQueryValueExA
CloseServiceHandle
OpenServiceA
RegCloseKey
AdjustTokenPrivileges
RegFlushKey
RegLoadKeyA
RegCreateKeyExA
LookupPrivilegeValueA
RegSetValueExA
RegUnLoadKeyA
OpenProcessToken
OpenSCManagerA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ