Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
AliWorkbench.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
AliWorkbench.exe
Resource
win10v2004-20231020-en
Target
AliProtect.rar
Size
1.2MB
MD5
6c2fc4f7c78c759e47ccde3d66e6a35b
SHA1
4e6c3addbd0d1097f3f0f9ebbf240ff755a5217a
SHA256
2c4e308c5aac3db31f704c3e5a887da9223999080d900ad14ed0dd08b66f6fde
SHA512
3cc63718e25fe975ac1cf5debd835e909ca36504ffd6a067979df9a2453c8132753cccd8e3e8d362e089ed6ef6d88b9b1cc93f2a020c5f25f2fb9d0ce43408f3
SSDEEP
24576:zUYlvG9cU62QcLbuUHYmx0IbX8/jFax5xAbcfUGhUT5Qlz8UHn0i:YYA9cJ2NbfHYmv8bFOUbc8POIUUi
Checks for missing Authenticode signature.
resource |
---|
unpack001/AliProtect.dll |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
?UnInitPrgIPCEnvironment@@YAXXZ
?InitPrgIPCEnvironment@@YAXXZ
?UnInitializeGateway@gw@@YAXXZ
?InitializeGateway@gw@@YAXXZ
GetI18N
GetUICore
?GenBinXmls@@YAHPA_W@Z
UIGlobalProperty
InitCommonControlsEx
GetModuleFileNameExW
EnumProcesses
?QNCU_IsBindShopProcess@@YAHXZ
?QNCU_GetCurrentServerTime@@YA_KH@Z
?CheckUpdate@CUpdateWrapper@@QAE?AW4Update_Error@UpdateAssist@@ABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAW4tag_APP_UPDATE_STATE@@@Z
??0CUpdateWrapper@@QAE@XZ
??1CUpdateWrapper@@UAE@XZ
?CreateXParam@@YAJPAPAVIXParam@prg@@@Z
?SysWideToUTF8@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?SysUTF8ToWide@base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z
?NumberToString@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?UTF8ToWide@base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z
??4FilePath@base@@QAEAAV01@$$QAV01@@Z
??0FilePath@base@@QAE@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@1@@Z
??1FilePath@base@@QAE@XZ
?CreateFromHere@Location@base@@SA?AV12@PBD0H@Z
?DeleteFileW@base@@YA_NABVFilePath@1@_N@Z
?NumberToString@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J@Z
??1LockImpl@internal@base@@QAE@XZ
??0LockImpl@internal@base@@QAE@XZ
?DirName@FilePath@base@@QBE?AV12@XZ
?BaseName@FilePath@base@@QBE?AV12@XZ
?Extension@FilePath@base@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??0FilePath@base@@QAE@ABV01@@Z
??0BindStateBase@internal@base@@AAE@P6AXXZP6AXPBV012@@Z@Z
??1WaitableEvent@base@@QAE@XZ
??1TraceResultBuffer@trace_event@base@@QAE@XZ
?Destruct@TaskRunnerTraits@base@@SAXPBVTaskRunner@2@@Z
?CompleteLazyInstance@internal@base@@YAXPAHHP6AXPAX@Z1@Z
?NeedsLazyInstance@internal@base@@YA_NPAH@Z
??0CallbackBase@internal@base@@QAE@$$QAVCallbackBaseCopyable@12@@Z
?Stop@Thread@base@@QAEXXZ
?Finish@TraceResultBuffer@trace_event@base@@QAEXXZ
?Wait@WaitableEvent@base@@QAEXXZ
?PostTask@TaskRunner@base@@QAE_NABVLocation@2@V?$OnceCallback@$$A6AXXZ@2@@Z
?StartWithOptions@Thread@base@@QAE_NABUOptions@12@@Z
??1Options@Thread@base@@QAE@XZ
??0Options@Thread@base@@QAE@XZ
??1Thread@base@@UAE@XZ
??0Thread@base@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0WaitableEvent@base@@QAE@W4ResetPolicy@01@W4InitialState@01@@Z
?Start@TraceResultBuffer@trace_event@base@@QAEXXZ
?SetOutputCallback@TraceResultBuffer@trace_event@base@@QAEXABV?$RepeatingCallback@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z@3@@Z
??0TraceResultBuffer@trace_event@base@@QAE@XZ
?Flush@TraceLog@trace_event@base@@QAEXABV?$RepeatingCallback@$$A6AXABV?$scoped_refptr@VRefCountedString@base@@@@_N@Z@3@_N@Z
?SetDisabled@TraceLog@trace_event@base@@QAEXXZ
?SetEnabled@TraceLog@trace_event@base@@QAEXABVTraceConfig@23@E@Z
??1TraceConfig@trace_event@base@@QAE@XZ
??0TraceConfig@trace_event@base@@QAE@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@0@Z
?SetTraceEventCallbackBreak@TraceLog@trace_event@base@@QAEX_N@Z
?AsWStringUnsafe@FilePath@base@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??0CallbackBaseCopyable@internal@base@@QAE@ABV012@@Z
?SetTraceEventCallback@TraceLog@trace_event@base@@QAEXV?$RepeatingCallback@$$A6AXEABVTimeTicks@base@@ABUTraceEventData@TraceLog@trace_event@2@@Z@3@@Z
?Signal@WaitableEvent@base@@QAEXXZ
?AddFragment@TraceResultBuffer@trace_event@base@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1CallbackBase@internal@base@@IAE@XZ
??0CallbackBase@internal@base@@IAE@PAVBindStateBase@12@@Z
?Unlock@LockImpl@internal@base@@QAEXXZ
?Lock@LockImpl@internal@base@@QAEXXZ
?GetSwitchValueNative@CommandLine@base@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?GetInstance@Pinyin@prg@@SAPAV12@XZ
?InitPinyin@Pinyin@prg@@QAE_NABVFilePath@base@@@Z
?GetCategoryGroupEnabled@TraceLog@trace_event@base@@SAPBEPBD@Z
?CreateAndStartWithDefaultParams@TaskScheduler@base@@SAXV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?GetInstance@ThreadIdNameManager@base@@SAPAV12@XZ
?SetName@ThreadIdNameManager@base@@QAEXKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?InitUIMessageLoop@base@@YA_NXZ
??1AtExitManager@base@@QAE@XZ
??0AtExitManager@base@@QAE@XZ
?GetSwitchValueASCII@CommandLine@base@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?SysNativeMBToWide@base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z
?HasSwitch@CommandLine@base@@QBE_NQBD@Z
?ForCurrentProcess@CommandLine@base@@SAPAV12@XZ
?Init@CommandLine@base@@SA_NHPBQBD@Z
?ReadFile@base@@YAHABVFilePath@1@PADH@Z
?GetFileSize@base@@YA_NABVFilePath@1@PA_J@Z
?Base64Encode@base@@YAXABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0FilePath@base@@QAE@XZ
?GetInstance@TraceLog@trace_event@base@@SAPAV123@XZ
?AddTraceEventWithThreadIdAndTimestamp@TraceLog@trace_event@base@@QAE?AUTraceEventHandle@23@DPBEPBD1_K2HABVTimeTicks@3@HPBQBD0PB_KPAV?$unique_ptr@VConvertableToTraceFormat@trace_event@base@@U?$default_delete@VConvertableToTraceFormat@trace_event@base@@@std@@@std@@I@Z
?Now@TimeTicks@base@@SA?AV12@XZ
?StringPrintV@base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_WPAD@Z
?InitAsycLoggingHandler@@YAHABVFilePath@base@@0@Z
?Append@FilePath@base@@QBE?AV12@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@Z
?CurrentId@PlatformThread@base@@SAKXZ
?GetErrorMsg@net@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?GetStatusText@HttpResponseHeaders@net@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetDataInUnicode@HttpResponse@net@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??0HttpResponse@net@@QAE@XZ
??0HttpRequest@net@@QAE@XZ
??1HttpResponse@net@@QAE@XZ
??1HttpRequest@net@@QAE@XZ
?SendRequest@net@@YAXABUHttpRequest@1@HAAVHttpResponse@1@@Z
?GetPrgCOM@@YAJPAPAVIPrgCOM@prg@@@Z
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
WaitForSingleObjectEx
SetEvent
OutputDebugStringW
IsDebuggerPresent
CreateEventW
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
GetFileSize
FlushFileBuffers
SetFilePointer
WriteFile
CreateFileW
GetFileAttributesW
WaitForSingleObject
RemoveDirectoryW
GetProcessId
OpenProcess
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
GetVersionExW
SetLastError
CloseHandle
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetProcessShutdownParameters
GetProcessShutdownParameters
SetUnhandledExceptionFilter
LockResource
SizeofResource
FindResourceExW
LoadResource
FindResourceW
MulDiv
RaiseException
WritePrivateProfileStringW
GetCurrentThreadId
Sleep
InterlockedCompareExchange
LoadLibraryExW
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
GetCurrentThread
lstrlenW
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetPrivateProfileStringW
FindNextFileW
FindClose
FindFirstFileW
DeleteFileW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
GetLastError
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
InterlockedDecrement
GetSystemDefaultLangID
InitializeCriticalSection
DeleteCriticalSection
FlashWindowEx
GetDC
ReleaseDC
MessageBoxW
FlashWindow
GetDeviceCaps
GetAclInformation
EqualSid
FreeSid
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CryptAcquireContextW
CryptImportKey
CryptSetKeyParam
CryptEncrypt
CryptDestroyKey
InitializeAcl
IsValidSid
OpenThreadToken
OpenProcessToken
CheckTokenMembership
GetTokenInformation
GetAce
AddAce
CryptReleaseContext
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
GetLengthSid
RegCreateKeyExW
RegSetValueExW
CopySid
SHCreateDirectoryExW
SHFileOperationW
CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
OleInitialize
StringFromGUID2
CoCreateGuid
OleUninitialize
CoUninitialize
CoInitialize
VariantInit
SysFreeString
VariantClear
SysAllocString
StrCmpW
PathCanonicalizeW
PathFileExistsW
PathFindFileNameW
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??1codecvt_base@std@@UAE@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??1facet@locale@std@@MAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
??1_Facet_base@std@@UAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
_Wcscoll
_Wcsxfrm
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xlength_error@std@@YAXPBD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Xout_of_range@std@@YAXPBD@Z
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@
??_7codecvt_base@std@@6B@
?_Xbad_alloc@std@@YAXXZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?uncaught_exception@std@@YA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
GetRvCore
GetArphaCrashDump
GetArphaApp
GetArphaService
GdiplusStartup
UnloadUserProfile
__CxxFrameHandler3
__RTDynamicCast
memcpy
__std_type_info_destroy_list
_CxxThrowException
_except_handler4_common
_purecall
strchr
memmove
memchr
memcmp
__std_exception_destroy
__std_exception_copy
wcsrchr
wcsstr
memset
strlen
_wcsicmp
wcslen
wcscat_s
isspace
wcsnlen
wcscpy_s
wmemcpy_s
wcscmp
_recalloc
realloc
_callnewh
malloc
free
calloc
_resetstkoflw
_seh_filter_dll
_crt_atexit
_invalid_parameter_noinfo_noreturn
_errno
_configure_narrow_argv
_initterm_e
_initterm
_execute_onexit_table
_invalid_parameter_noinfo
_register_onexit_function
_cexit
terminate
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_wfopen_s
fwrite
ftell
fread
fgetc
fputc
ungetc
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
__stdio_common_vfprintf
__acrt_iob_func
_get_stream_buffer_pointers
fclose
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf
fseek
_wtoi
_itow
_wputenv_s
_lock_file
_unlock_file
_time64
rand
srand
_except1
AliEntry
ChromeTracingFilePath
ChromeTracingFlowStepDrop
ChromeTracingIsRuning
ChromeTracingStart
ChromeTracingStop
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetTimeZoneInformation
GetStringTypeW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
OutputDebugStringW
GetACP
LCMapStringW
WriteConsoleW
SetEnvironmentVariableA
IsValidCodePage
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStartupInfoW
GetStdHandle
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
VirtualQuery
VirtualAlloc
GetSystemInfo
IsProcessorFeaturePresent
GetFileSize
IsDebuggerPresent
HeapQueryInformation
GetModuleHandleExW
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
FindResourceExW
VirtualProtect
SearchPathW
GetProfileIntW
GetTickCount
Sleep
GetTempPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
lstrcpyW
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalGetAtomNameW
lstrcmpiW
GetCPInfo
ExitProcess
GetOEMCP
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
DeleteFileW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
CopyFileW
FormatMessageW
GlobalSize
MulDiv
GlobalFlags
GlobalFindAtomW
LoadLibraryA
FreeResource
GetSystemDirectoryW
EncodePointer
SetErrorMode
LocalFree
LocalReAlloc
LocalAlloc
GlobalFree
GlobalUnlock
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LoadLibraryW
GetModuleHandleA
SetLastError
OutputDebugStringA
GetCurrentProcessId
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
GetVersionExW
GetCurrentThread
ResumeThread
SetThreadPriority
GetCurrentThreadId
WaitForSingleObject
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
CreateFileA
GetModuleFileNameA
ReadFile
GetWindowRgn
DrawIcon
SetParent
SetRect
SetCursorPos
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetSystemMenu
IsZoomed
GetComboBoxInfo
TrackMouseEvent
GetKeyNameTextW
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
MonitorFromPoint
UpdateLayeredWindow
IsMenu
UnionRect
SetWindowRgn
DrawFrameControl
DrawEdge
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadMenuW
MapVirtualKeyW
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
GetAsyncKeyState
MessageBeep
GetIconInfo
DrawIconEx
LoadImageW
IsRectEmpty
OffsetRect
SetRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
EndDialog
CreateDialogIndirectParamW
IntersectRect
SendDlgItemMessageA
InflateRect
GetMenuItemInfoW
DestroyMenu
CharUpperW
DestroyIcon
IsIconic
FillRect
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
DestroyCursor
KillTimer
SetTimer
DeleteMenu
SystemParametersInfoW
CopyImage
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuState
GetMenuStringW
LoadCursorW
GetSysColorBrush
ReleaseDC
GetDC
GetSystemMetrics
RealChildWindowFromPoint
GetDesktopWindow
ClientToScreen
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MapDialogRect
CreateMenu
SubtractRect
GetUpdateRect
IsClipboardFormatAvailable
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
FrameRect
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
SetMenuDefaultItem
CopyIcon
GetDoubleClickTime
SetClassLongW
InvalidateRect
LockWindowUpdate
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
UnhookWindowsHookEx
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongW
MessageBoxW
IsWindowEnabled
EnableWindow
SetCursor
ShowOwnedPopups
PostQuitMessage
PostMessageW
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadBitmapW
GetParent
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
SendMessageW
UnregisterClassW
GetNextDlgTabItem
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextExtentPoint32W
CombineRgn
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
GetTextMetricsW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
MoveToEx
Polyline
Rectangle
EnumFontFamiliesExW
GetRgnBox
OffsetRgn
CreateRoundRectRgn
RoundRect
FrameRgn
PtInRegion
SetPixelV
ExtFloodFill
SetPaletteEntries
FillRgn
GetBoundsRect
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
GetTextFaceW
SetROP2
SetPolyFillMode
GetLayout
Polygon
CreateBitmap
SetLayout
SetMapMode
SetBkMode
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
CreateDCW
CopyMetaFileW
GetDeviceCaps
DeleteObject
GetObjectW
SetTextColor
SetBkColor
SetTextAlign
AlphaBlend
TransparentBlt
ClosePrinter
OpenPrinterW
DocumentPropertiesW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragQueryFileW
SHAppBarMessage
DragFinish
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
PathRemoveFileSpecA
StrFormatKBSizeW
CloseThemeData
GetThemePartSize
GetWindowTheme
GetThemeSysColor
DrawThemeText
DrawThemeParentBackground
OpenThemeData
IsThemeBackgroundPartiallyTransparent
IsAppThemed
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
SysAllocString
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
PlaySoundW
Execute
OutputOperatorFileLog
SetupAPIHook
SureOperatorFileBegin
SureOperatorFileEnd
UnhookAPIHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CreateFileW
ReadFile
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
CopyFileW
DeleteFileW
FindFirstFileW
FindClose
LocalAlloc
lstrcmpA
GetFileSize
CreateProcessW
WaitForSingleObject
GetModuleHandleW
WriteFile
SetFilePointer
FlushFileBuffers
GetLocalTime
HeapSize
GetCurrentProcessId
OpenProcess
GlobalAlloc
GlobalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LoadLibraryW
FreeLibrary
Sleep
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
HeapDestroy
SetCurrentDirectoryW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
SetEnvironmentVariableW
GetLastError
GetEnvironmentVariableW
GetVersionExW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
WriteConsoleW
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
EnumSystemLocalesW
LocalFree
GetPrivateProfileStringW
GetFileAttributesW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MoveFileExW
InitializeCriticalSection
IsDebuggerPresent
OutputDebugStringW
EncodePointer
SetLastError
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlUnwind
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
MessageBoxW
CheckTokenMembership
FreeSid
OpenProcessToken
GetTokenInformation
LookupAccountSidW
GetUserNameW
DuplicateTokenEx
AllocateAndInitializeSid
ShellExecuteExW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetSpecialFolderPathW
CoInitialize
CoInitializeSecurity
VariantTimeToSystemTime
VarUdateFromDate
SystemTimeToVariantTime
PathCanonicalizeW
PathFileExistsW
WinVerifyTrust
CryptMsgGetParam
CryptDecodeObject
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptQueryObject
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ