Ex_PE_v3[.]1[.]9[.]zip

Resubmissions

18-02-2024 02:30

240218-cy78bscf9t 10

18-02-2024 02:21

240218-cszc8sdc32 3

Sharing

Copy URL

Twitter E-mail

General

Target

Ex_PE_v3.1.9.zip
Size

128.5MB
MD5

b2472c40ed0110fc179dee0e57e73663
SHA1

b1e37cb35d595fc1a0d004fbad0c04cf187af8b2
SHA256

cbe17de1e099ae2cb4de0388d30c4015795c78a9157740a885141bdb9939d4fc
SHA512

ff302b0d37bcf27787ab4c9e5cc8d6729b28a13334cd7d92ad35d2812d547114281a172bc372a2c5919cad518b7b6f908d205a09361a44aa0f62a3dfc2a1d73b
SSDEEP

3145728:ycyOlIjW8p/AhOejnv540UZBbtVZgcRurgzwEcKg0a+8eJ:TIHp/ATjnQBbPrR6ljeN

Score

3^/10

Malware Config

Signatures

Unsigned PE 187 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ex_PE_v3.1.9/CMap/Locals/x64/AdonisUI.ClassicTheme.dll
unpack001/Ex_PE_v3.1.9/CMap/Locals/x64/AdonisUI.dll
unpack001/Ex_PE_v3.1.9/CMap/MahApps.Metro.IconPacks.Codicons.dll
unpack001/Ex_PE_v3.1.9/CMap/MahApps.Metro.IconPacks.Coolicons.dll
unpack001/Ex_PE_v3.1.9/CMap/Xceed.Wpf.AvalonDock.Themes.Metro.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WLanHC.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WMNetMgr.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WMPDMC.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/WMPhoto.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WMSPDMOD.DLL
unpack001/Ex_PE_v3.1.9/CMap/libs/WMSPDMOE.DLL
unpack001/Ex_PE_v3.1.9/CMap/libs/WMVSENCD.DLL
unpack001/Ex_PE_v3.1.9/CMap/libs/WMVXENCD.DLL
unpack001/Ex_PE_v3.1.9/CMap/libs/WPDShServiceObj.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WPDShextAutoplay.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/WPDSp.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WPTaskScheduler.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WSClient.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WSCollect.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/WSDApi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WSDPrintProxy.DLL
unpack001/Ex_PE_v3.1.9/CMap/libs/WSDScanProxy.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WSHTCPIP.DLL
unpack001/Ex_PE_v3.1.9/CMap/libs/WSManHTTPConfig.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/WSManMigrationPlugin.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WSReset.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/WSTPager.ax
unpack001/Ex_PE_v3.1.9/CMap/libs/WUDFCoinstaller.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WUDFHost.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/WUDFx.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WWanHC.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WlanMediaManager.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WmpDui.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WofTasks.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WofUtil.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WordBreakers.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WorkFolders.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/WorkFoldersGPExt.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WorkFoldersRes.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WorkFoldersShell.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WorkfoldersControl.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WpAXHolder.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WpPortingLibrary.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/Wpc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WpcApi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WpcDesktopMonSvc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WpcProxyStubs.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WpcRefreshTask.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WpcTok.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/WpcWebFilter.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WpnUserService.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WppRecorderUM.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WsdProviderUtil.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WsmAgent.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WsmAuto.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WsmRes.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WsmSvc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WsmWmiPl.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WudfSMCClassExt.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WwaApi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WwaExt.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/WwanRadioManager.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/Wwanpref.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XAudio2_8.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XAudio2_9.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XInput1_4.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XInput9_1_0.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XInputUap.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XamlTileRender.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XblAuthManager.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XblAuthManagerProxy.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XblAuthTokenBrokerExt.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XblGameSave.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XblGameSaveExt.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XblGameSaveProxy.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XblGameSaveTask.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/XboxGipRadioManager.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XboxNetApiSvc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XpsDocumentTargetPrint.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XpsGdiConverter.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/XpsPrint.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wkspbrokerAx.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wksprt.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wksprtPS.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wkssvc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlandlg.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlanext.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wlangpui.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlanhlp.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlgpclnt.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlidcli.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlidcredprov.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlidfdp.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlidnsp.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlidprov.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlidres.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wlidsvc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmcodecdspps.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmdmlog.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmdmps.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmdrmsdk.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmerror.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmiclnt.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmidcom.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmidx.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmiprop.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmitomi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmp.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmpdxm.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmploc.DLL
unpack001/Ex_PE_v3.1.9/CMap/libs/wmpshell.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmsgapi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wmvdspa.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wosc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wowreg32.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wpbcreds.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpd_ci.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpdbusenum.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpdshext.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpnapps.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpnclient.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpncore.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpninprc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpnpinst.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wpnprv.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpnservice.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpnsruprov.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wpr.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/write.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/ws2help.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wscadminui.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wscinterop.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wscisvif.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wscproxystub.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wscript.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wscui.cpl
unpack001/Ex_PE_v3.1.9/CMap/libs/wsdchngr.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wsecedit.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wsepno.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wshbth.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wshcon.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wshelper.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wshext.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wship6.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wshom.ocx
unpack001/Ex_PE_v3.1.9/CMap/libs/wshqos.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wshrm.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wsl.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wslapi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wsmplpxy.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wsmprovhost.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wsnmp32.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wsock32.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wsplib.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wsqmcons.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wuapi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wuapihost.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wuaueng.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wuceffects.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wudriver.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wups.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wups2.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wusa.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/wuuhext.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wuuhosdeployment.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wvc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wwancfg.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wwanconn.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wwanmm.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wwanprotdim.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/wwansvc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/xboxgipsvc.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/xboxgipsynthetic.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/xcopy.exe
unpack001/Ex_PE_v3.1.9/CMap/libs/xmlfilter.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/xmlprovi.dll
unpack001/Ex_PE_v3.1.9/CMap/libs/xolehlp.dll
unpack001/Ex_PE_v3.1.9/CMap/starksoft.aspen.dll
unpack001/Ex_PE_v3.1.9/CMap/wmcodecdspps.dll
unpack001/Ex_PE_v3.1.9/CMap/wmdrmsdk.dll
unpack001/Ex_PE_v3.1.9/Portable/MahApps.Metro.IconPacks.FeatherIcons.dll
unpack001/Ex_PE_v3.1.9/Xceed.Wpf.AvalonDock.Themes.VS2010.dll
unpack001/Ex_PE_v3.1.9/Xceed.Wpf.Toolkit.dll
unpack001/Ex_PE_v3.1.9/demux/Xceed.Wpf.AvalonDock.dll
unpack001/Ex_PE_v3.1.9/demux/wmerror.dll
unpack001/Ex_PE_v3.1.9/wmidx.dll

Files

Ex_PE_v3.1.9.zip
.zip

Password: infected
Ex_PE_v3.1.9/AppXRuntime.admx
.xml
Ex_PE_v3.1.9/CMap/ActiveXInstallService.admx
Ex_PE_v3.1.9/CMap/AddRemovePrograms.admx
Ex_PE_v3.1.9/CMap/AppCompat.admx
Ex_PE_v3.1.9/CMap/Locals/am.pak
Ex_PE_v3.1.9/CMap/Locals/ar.pak
Ex_PE_v3.1.9/CMap/Locals/fi.pak
Ex_PE_v3.1.9/CMap/Locals/fr.pak
Ex_PE_v3.1.9/CMap/Locals/gu.pak
Ex_PE_v3.1.9/CMap/Locals/he.pak
Ex_PE_v3.1.9/CMap/Locals/hi.pak
Ex_PE_v3.1.9/CMap/Locals/hr.pak
Ex_PE_v3.1.9/CMap/Locals/x64/AdonisUI.ClassicTheme.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\src\AdonisUI.ClassicTheme\obj\Release\net45\AdonisUI.ClassicTheme.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/Locals/x64/AdonisUI.ClassicTheme.xml
.xml
Ex_PE_v3.1.9/CMap/Locals/x64/AdonisUI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\src\AdonisUI\obj\Release\net45\AdonisUI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/Locals/x64/AdonisUI.xml
.xml
Ex_PE_v3.1.9/CMap/Locals/x64/SQLite.Interop.dll
.dll windows:6 windows x64 arch:x64

a42f73521c784fa06f1d886fcbcefcba

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01-10-2021 00:00

Not After

12-12-2024 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01-10-2021 00:00

Not After

12-12-2024 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30
Signer

Actual PE Digest

cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30

Digest Algorithm

sha512

PE Digest Matches

true

3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd
Signer

Actual PE Digest

3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

Imports

mscoree

StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo

wintrust

WinVerifyTrust

kernel32

TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
WriteConsoleW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
AreFileApisANSI
SetEnvironmentVariableA
RaiseException
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
lstrcmpiW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW

user32

wsprintfW

advapi32

CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey

Exports

Exports

SI00b5de0dbe05adc8
SI00f2097672333949
SI013768ea228eaf06
SI03ee1370ff2172fd
SI050169b0f137dcac
SI061f9351f6b79d40
SI066df4a47deb7b95
SI075258fe7332f5c9
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0b65268e19d3b81d
SI0e7c9abcb195c68c
SI0f556a49067bf550
SI0fe7fecb92f1b44b
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI15d5f41c81892f13
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI24f5c83eaddd65e8
SI252aeb4a9d3dc2ff
SI2b074e8cf29cb472
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI349980d776ee39ac
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3974af1f94b94613
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI57335d3e329eea8d
SI5887bf867911838d
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI64119fb980b7e962
SI6479b9cf07b87f67
SI674c3bc07fc17979
SI6901b186cfd089f2
SI690ffdcfd9cda629
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI6e6c544c028b2de9
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI72b05b1ad5f34d61
SI75fe921d50a95fe0
SI768767362ea03a94
SI77ffe3fede90bfbb
SI783104ea11038afc
SI79f6c64948ab63d2
SI7a4943591207dd14
SI7b97ee05aa1e64c7
SI7c373366af3ee2f7
SI7cd7250399b1ea60
SI7da3b9691a73b4a2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8dd2c969f2a6a31e
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9bf461db9bf83c22
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SI9ea49276dcf9849f
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa1d7e21a548b910c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIa8e1a742a358dc07
SIa9b758d3ae2e9aea
SIab3ed5feb3c43f0c
SIada7f27769d7f95b
SIae9562605f0b7c06
SIb391996b7b633820
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIb84ee16d149e7562
SIb94a6bc97d77e69f
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc0bb4eab77f5a999
SIc21d402df09e0c69
SIc26100c97b176329
SIc28b5d2d1f102994
SIc2d8715ee8c9e908
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIc5d5610a73781fac
SIc8c63d94dd03040b
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd2334250b08e199
SIcd6b4ac0aeff7202
SId00f524badf4f5cf
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdbbe1b52f304f379
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIdca7c218fe9393fb
SIde347320a2d725fa
SIdeb28053ce71d5b4
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe2cb515ade8c0235
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIeea5cda6d9846aa5
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8090240c1414098
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfcfad09d1b0a60ec
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/Locals/x86/BouncyCastle.Crypto.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-03-2020 00:00

Not After

23-03-2023 12:00

Subject

SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Signer

Actual PE Digest

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

BouncyCastle.Crypto.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/Locals/x86/BouncyCastle.Crypto.xml
.xml
Ex_PE_v3.1.9/CMap/Locals/x86/SQLite.Interop.dll
.dll windows:6 windows x86 arch:x86

39ace63b362beb47a2a7a8202a5c4f2d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01-10-2021 00:00

Not After

12-12-2024 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01-10-2021 00:00

Not After

12-12-2024 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61
Signer

Actual PE Digest

3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61

Digest Algorithm

sha512

PE Digest Matches

true

18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df
Signer

Actual PE Digest

18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

Imports

mscoree

StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo

wintrust

WinVerifyTrust

kernel32

TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
WriteConsoleW
lstrcmpiW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SetEnvironmentVariableA
AreFileApisANSI
DecodePointer
SetStdHandle
RaiseException
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
MapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

wsprintfW

advapi32

CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey

Exports

Exports

SI00b5de0dbe05adc8
SI00f2097672333949
SI03ee1370ff2172fd
SI066df4a47deb7b95
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0e7c9abcb195c68c
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI252aeb4a9d3dc2ff
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI674c3bc07fc17979
SI6901b186cfd089f2
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI75fe921d50a95fe0
SI768767362ea03a94
SI783104ea11038afc
SI79f6c64948ab63d2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIae9562605f0b7c06
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc26100c97b176329
SIc28b5d2d1f102994
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd6b4ac0aeff7202
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIde347320a2d725fa
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
_SI013768ea228eaf06@8
_SI050169b0f137dcac@12
_SI061f9351f6b79d40@8
_SI075258fe7332f5c9@0
_SI0b65268e19d3b81d@12
_SI0f556a49067bf550@8
_SI0fe7fecb92f1b44b@12
_SI15d5f41c81892f13@8
_SI24f5c83eaddd65e8@4
_SI2b074e8cf29cb472@16
_SI349980d776ee39ac@12
_SI3974af1f94b94613@12
_SI57335d3e329eea8d@12
_SI5887bf867911838d@12
_SI64119fb980b7e962@12
_SI6479b9cf07b87f67@8
_SI690ffdcfd9cda629@8
_SI6e6c544c028b2de9@4
_SI72b05b1ad5f34d61@12
_SI77ffe3fede90bfbb@32
_SI7a4943591207dd14@4
_SI7b97ee05aa1e64c7@12
_SI7c373366af3ee2f7@4
_SI7cd7250399b1ea60@4
_SI7da3b9691a73b4a2@12
_SI8dd2c969f2a6a31e@12
_SI9bf461db9bf83c22@8
_SI9ea49276dcf9849f@12
_SIa1d7e21a548b910c@4
_SIa8e1a742a358dc07@8
_SIa9b758d3ae2e9aea@12
_SIab3ed5feb3c43f0c@0
_SIada7f27769d7f95b@4
_SIb391996b7b633820@36
_SIb84ee16d149e7562@12
_SIb94a6bc97d77e69f@8
_SIc0bb4eab77f5a999@20
_SIc21d402df09e0c69@8
_SIc2d8715ee8c9e908@4
_SIc5d5610a73781fac@12
_SIc8c63d94dd03040b@44
_SIcd2334250b08e199@112
_SId00f524badf4f5cf@20
_SIdbbe1b52f304f379@4
_SIdca7c218fe9393fb@24
_SIdeb28053ce71d5b4@12
_SIe2cb515ade8c0235@12
_SIeea5cda6d9846aa5@12
_SIf8090240c1414098@4
_SIfcfad09d1b0a60ec@20
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/MahApps.Metro.IconPacks.Codicons.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Codicons\net47\MahApps.Metro.IconPacks.Codicons.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 557KB - Virtual size: 556KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/MahApps.Metro.IconPacks.Coolicons.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Coolicons\net47\MahApps.Metro.IconPacks.Coolicons.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 449KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/WMASF.DLL
.dll windows:10 windows x64 arch:x64

d1d6dbece47d1975c05fa7b6643389ba

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d6:ad:27:52:9c:01:7e:70:f6:cf:65:26:7a:2d:95:3e:c9:1b:66:4a:cb:e7:47:80:53:16:ed:f0:b6:cd:fa:5b
Signer

Actual PE Digest

d6:ad:27:52:9c:01:7e:70:f6:cf:65:26:7a:2d:95:3e:c9:1b:66:4a:cb:e7:47:80:53:16:ed:f0:b6:cd:fa:5b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMASF.pdb

Imports

msvcrt

__C_specific_handler
_initterm
_XcptFilter
_callnewh
malloc
free
_wcsicmp
memmove
_amsg_exit
_purecall
memcpy
memset

kernel32

ReadFile
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
DisableThreadLibraryCalls
HeapFree
GetProcessHeap
HeapAlloc
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
MulDiv
SetFilePointer
FlushFileBuffers
WriteFile
GetLastError
CreateFileA
CloseHandle
WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoCreateGuid

Exports

Exports

ASFAddPresDelta
ASFAddSendDelta
ASFCalculatePresDelta
ASFCreateBitrateTracker
ASFCreateIOMonitor
ASFCreateIndexMaker
ASFCreateIndexMakerFileSink
ASFCreateLibrary
ASFCreateMediaObjectIndexMaker
ASFCreateStreamSelector
ASFFindHeaderObject
ASFFindRootObject
ASFFindStreamPropertiesObject
ASFGUIDFromCodecID
ASFGUIDToCodecID
ASFGetDataUnitInfo
ASFGetHeaderObject
ASFGetRootObject
ASFGetStreamPropertiesObject
ASFGetTimeBase
ASFPresDeltaTimeToTime
ASFPresDeltaToFull
ASFPresFullToDelta
ASFPresTimeToSendTime
ASFPresTimeToTime
ASFReadHeaderFromFile
ASFReadHeaderFromFileHandle
ASFSendTimeToPresTime
ASFSendTimeToTime
ASFSetDataUnitInfo
ASFTimeToPresDeltaTime
ASFTimeToPresTime
ASFTimeToSendTime
ASFWriteHeaderToFile
CreateAsfCellPoolAllocator

Sections

.text
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/WindowsFirewall.admx
Ex_PE_v3.1.9/CMap/WindowsMail.admx
Ex_PE_v3.1.9/CMap/WordWheel.admx
Ex_PE_v3.1.9/CMap/Xceed.Wpf.AvalonDock.Themes.Metro.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Metro\obj\Release\Xceed.Wpf.AvalonDock.Themes.Metro.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WLanHC.dll
.dll regsvr32 windows:10 windows x64 arch:x64

bfe10295f4d720077faa62cefb3777be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WLanHC.pdb

Imports

msvcrt

wcsnlen
_vscwprintf
vswprintf_s
toupper
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
memmove
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_lock
_callnewh
_XcptFilter
_amsg_exit
_purecall
wcsstr
memset
memmove_s
_wcsupr
_vsnwprintf
wcsncmp
wcscat_s
wcscpy_s
memcpy_s
_initterm
memcmp
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
_onexit
_errno
free
malloc
wcsncpy_s
__C_specific_handler
__dllonexit
??_V@YAXPEAX@Z
realloc
__CxxFrameHandler3
_unlock
wcscmp

ntdll

NtOpenFile
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

oleaut32

SysFreeString
RegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
VarUI4FromStr
UnRegisterTypeLi

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoSetProxyBlanket
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree
StringFromCLSID

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
FindResourceExW
GetProcAddress
LockResource
GetModuleFileNameW
GetModuleFileNameA
DisableThreadLibraryCalls
LoadResource
LoadLibraryExW
LoadStringW
GetModuleHandleW
FreeLibrary

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegGetValueW
RegQueryValueExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadLocale
GetThreadLocale

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
HeapSize
HeapReAlloc

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
StartServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
ChangeServiceConfigW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

Sleep

rpcrt4

RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetOption
RpcExceptionFilter
NdrClientCall3
RpcEpResolveBinding
RpcBindingFree
UuidFromStringW
RpcStringFreeW
UuidToStringW
RpcMgmtInqServerPrincNameW

dhcpcsvc

DhcpGetFallbackParams
DhcpIsEnabled

iphlpapi

ConvertInterfaceLuidToAlias
ConvertInterfaceGuidToLuid

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme
PowerWriteACValueIndex
PowerWriteDCValueIndex

powrprof

PowerReadACValueIndex
PowerReadDCValueIndex

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

setupapi

SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventProviderEnabled
EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMADMOD.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

a377d0f8d91dcb1cd12d7040c76fc36f

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:29

Not After

02-12-2021 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:d8:73:62:5e:a5:ae:9b:7c:5d:ed:44:66:b2:12:12:12:bb:a9:1b:a9:81:8d:f2:04:ce:90:6b:c6:87:d0:40
Signer

Actual PE Digest

c5:d8:73:62:5e:a5:ae:9b:7c:5d:ed:44:66:b2:12:12:12:bb:a9:1b:a9:81:8d:f2:04:ce:90:6b:c6:87:d0:40

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMADMOD.pdb

Imports

msvcrt

?what@exception@@UEBAPEBDXZ
strnlen
wcsnlen
fclose
vfprintf
fopen
_control87
_clearfp
??0exception@@QEAA@AEBQEBDH@Z
srand
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
wcstombs
??1type_info@@UEAA@XZ
_swab
_onexit
__dllonexit
_unlock
_lock
sinf
sqrt
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
_vsnwprintf
__C_specific_handler
time
sin
_purecall
rand
iswspace
swscanf
printf
_CxxThrowException
atan2f
cos
cosf
exp
floor
log
log10
memcmp
memcpy
memmove
memset
pow
powf
wcscmp

oleaut32

SafeArrayGetLBound
SafeArrayCreate
VariantInit
SafeArrayAccessData
SafeArrayDestroy
SysFreeString
SafeArrayGetDim
SysAllocString
SafeArrayGetUBound
SafeArrayUnaccessData
SysStringLen

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
FreeLibrary

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExA
RegDeleteTreeW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetVersionExW
GlobalMemoryStatusEx
GetLocalTime
GetVersion
GetTickCount

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualFree
VirtualAlloc
VirtualQuery

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlAddFunctionTable
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlDeleteFunctionTable

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l2-1-0

RegSetValueA
RegCreateKeyW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

msdmo

DMORegister
DMOUnregister
MoCopyMediaType
MoInitMediaType
MoFreeMediaType

mfperfhelper

ord34
ord35
ord28
ord46
ord26
ord8
ord43
ord42
ord1
ord41
ord29
ord47
ord38

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
PropVariantClear
CoTaskMemFree
CoCreateInstance

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

ws2_32

htonl

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsA
GetEnvironmentStringsW
FreeEnvironmentStringsW

ntdll

RtlGetPersistedStateLocation

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 537KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.no_bbt
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMADMOE.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

1c9876c340c2140f9358584835603bf2

Code Sign

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:30

Not After

03-03-2021 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ce:b1:e0:1b:78:83:ab:81:8b:a1:80:36:db:c1:16:f2:a2:a4:0c:d6:95:7c:41:c9:98:d0:d9:92:4c:de:ea:b8
Signer

Actual PE Digest

ce:b1:e0:1b:78:83:ab:81:8b:a1:80:36:db:c1:16:f2:a2:a4:0c:d6:95:7c:41:c9:98:d0:d9:92:4c:de:ea:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMADMOE.pdb

Imports

msvcrt

_amsg_exit
sinf
_vsnwprintf
_XcptFilter
_initterm
_callnewh
malloc
_purecall
swscanf
free
__C_specific_handler
_clearfp
_control87
fflush
rand
sscanf_s
realloc
__iob_func
atan2
atan2f
atanf
cos
cosf
exp
expf
log
log10
log10f
logf
memcmp
memcpy
memmove
memset
pow
powf
sin
wcscmp

mfperfhelper

ord1
ord28
ord34
ord38
ord42
ord47
ord41
ord35
ord29
ord46
ord26
ord8
ord43

oleaut32

SafeArrayAccessData
SafeArrayGetDim
VariantInit
SafeArrayGetUBound
SysAllocString
SafeArrayUnaccessData
SysFreeString

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
LoadLibraryExA

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-registry-l2-1-0

RegCreateKeyW
RegSetValueA

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExA
RegDeleteTreeW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoTaskMemFree
PropVariantClear
CoTaskMemAlloc

api-ms-win-core-com-l2-1-1

StgCreateDocfile
StgCreateStorageEx

msdmo

DMOUnregister
DMORegister
MoFreeMediaType
MoInitMediaType
MoCopyMediaType

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 563KB - Virtual size: 562KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMALFXGFXDSP.dll
.dll regsvr32 windows:10 windows x64 arch:x64

25336282d9d258037be9133a41066680

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:30

Not After

03-03-2021 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fc:12:46:a6:66:bb:0d:05:42:41:db:5b:65:6b:7a:c1:12:22:8b:37:b1:3f:a8:e9:3b:ca:46:e3:d9:6e:4b:07
Signer

Actual PE Digest

fc:12:46:a6:66:bb:0d:05:42:41:db:5b:65:6b:7a:c1:12:22:8b:37:b1:3f:a8:e9:3b:ca:46:e3:d9:6e:4b:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMALFXGFXDSP.pdb

Imports

msvcrt

_purecall
__C_specific_handler
memcpy_s
_vsnwprintf
wcscat_s
powf
_amsg_exit
_XcptFilter
free
_lock
_onexit
_initterm
_callnewh
__dllonexit
malloc
_wcsicmp
swprintf_s
_unlock
sqrt
memset
cos
sin
cosf
exp
floor
memcmp
memcpy
memmove
pow
sinf

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegDeleteKeyExW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceBeginInitialize

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-synch-l1-1-0

CreateMutexExW
InitializeCriticalSection
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreExW
WaitForSingleObject
ReleaseMutex
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection
SetEvent

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMASF.DLL
.dll windows:10 windows x64 arch:x64

d1d6dbece47d1975c05fa7b6643389ba

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d6:ad:27:52:9c:01:7e:70:f6:cf:65:26:7a:2d:95:3e:c9:1b:66:4a:cb:e7:47:80:53:16:ed:f0:b6:cd:fa:5b
Signer

Actual PE Digest

d6:ad:27:52:9c:01:7e:70:f6:cf:65:26:7a:2d:95:3e:c9:1b:66:4a:cb:e7:47:80:53:16:ed:f0:b6:cd:fa:5b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMASF.pdb

Imports

msvcrt

__C_specific_handler
_initterm
_XcptFilter
_callnewh
malloc
free
_wcsicmp
memmove
_amsg_exit
_purecall
memcpy
memset

kernel32

ReadFile
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
DisableThreadLibraryCalls
HeapFree
GetProcessHeap
HeapAlloc
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
MulDiv
SetFilePointer
FlushFileBuffers
WriteFile
GetLastError
CreateFileA
CloseHandle
WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoCreateGuid

Exports

Exports

ASFAddPresDelta
ASFAddSendDelta
ASFCalculatePresDelta
ASFCreateBitrateTracker
ASFCreateIOMonitor
ASFCreateIndexMaker
ASFCreateIndexMakerFileSink
ASFCreateLibrary
ASFCreateMediaObjectIndexMaker
ASFCreateStreamSelector
ASFFindHeaderObject
ASFFindRootObject
ASFFindStreamPropertiesObject
ASFGUIDFromCodecID
ASFGUIDToCodecID
ASFGetDataUnitInfo
ASFGetHeaderObject
ASFGetRootObject
ASFGetStreamPropertiesObject
ASFGetTimeBase
ASFPresDeltaTimeToTime
ASFPresDeltaToFull
ASFPresFullToDelta
ASFPresTimeToSendTime
ASFPresTimeToTime
ASFReadHeaderFromFile
ASFReadHeaderFromFileHandle
ASFSendTimeToPresTime
ASFSendTimeToTime
ASFSetDataUnitInfo
ASFTimeToPresDeltaTime
ASFTimeToPresTime
ASFTimeToSendTime
ASFWriteHeaderToFile
CreateAsfCellPoolAllocator

Sections

.text
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMNetMgr.dll
.dll regsvr32 windows:10 windows x64 arch:x64

c49142990a0d45855d693c35e67ccd54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMNetMgr.pdb

Imports

msvcrt

_ui64tow_s
calloc
strncpy_s
strtoul
strcpy_s
strcat_s
strchr
sprintf_s
_beginthreadex
_vsnprintf
qsort
srand
wcsrchr
wcstok
wcspbrk
iswcntrl
wcsstr
_ltow
wcstoul
_ultow
_ultow_s
swscanf
_ltoa_s
_ultoa_s
strncmp
_strnicmp
tolower
towlower
_wtoi
sscanf_s
strstr
isspace
strpbrk
_atoi64
rand
iswspace
wcsftime
time
gmtime
wcsncmp
_stricmp
iswxdigit
isdigit
isalpha
iswdigit
iswalpha
isxdigit
strnlen
memchr
memcmp
memcpy
memmove
memset
wcstol
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
_vsnwprintf
_wcsicmp
toupper
towupper
wcschr
_wcsnicmp
_purecall
wcscpy_s
realloc
wcscat_s
malloc
free
__C_specific_handler
__CxxFrameHandler3
_i64tow_s
_strlwr
_strupr
iswupper
strrchr
atoi
strcspn
strspn
_ui64tow
_ltow_s
wcscmp

wmasf

ord7
ord5
ASFSendTimeToTime
ord11
ord9
ASFGetTimeBase

kernel32

LoadLibraryExW
GetModuleHandleW
lstrcmpiW
lstrcpynW
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
LoadLibraryW
DisableThreadLibraryCalls
HeapDestroy
lstrcpyW
CreateEventW
CloseHandle
WaitForSingleObject
GetTickCount
Sleep
ResetEvent
GetCurrentThreadId
SetEvent
HeapFree
GetProcessHeap
HeapAlloc
WideCharToMultiByte
OpenMutexW
CreateDirectoryW
DeleteFileW
FindResourceW
LockResource
CreateFileW
WriteFile
FreeResource
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetLastError
GetSystemTimeAsFileTime
LoadLibraryA
GetSystemDirectoryA
GetVersionExA
SetThreadPriority
FreeLibraryAndExitThread
GetModuleHandleA
GetCurrentThread
CreateEventA
VirtualFree
ReleaseSemaphore
HeapSize
WaitForSingleObjectEx
CreateSemaphoreA
TlsAlloc
TlsFree
TlsGetValue
SetThreadAffinityMask
TlsSetValue
GetExitCodeThread
GetSystemDefaultLCID
LocalFree
FormatMessageW
GetVersionExW
SetLastError
CreateFileA
DeleteFileA
CopyFileA
CopyFileW
SetFilePointer
SetEndOfFile
GetStdHandle
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
GetFileSize
ReadFile
GetLocalTime
SystemTimeToFileTime
GetComputerNameW
lstrlenW
OpenProcess
GetExitCodeProcess
QueryPerformanceFrequency
GetThreadLocale
FileTimeToSystemTime
GetModuleHandleExA
LocalAlloc
LoadLibraryExA
GetVersion
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetProcAddress
InitializeCriticalSection
IsDebuggerPresent
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
RaiseException
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
WaitForMultipleObjects
CreateThread
GetSystemTime
GetLocaleInfoA
GetWindowsDirectoryW
CompareFileTime
SearchPathW
GetTempPathW
GetFileAttributesW
ExpandEnvironmentStringsW
GetTempFileNameW
OutputDebugStringW
GetCurrentProcessId

user32

GetMessageA
DispatchMessageA
DestroyWindow
PostMessageA
RegisterClassA
DefWindowProcA
CreateWindowExA
GetWindowLongPtrA
PostQuitMessage
CharNextW
CharPrevW
SetWindowLongPtrA

advapi32

RegEnumKeyW
RegDeleteKeyA
RegEnumKeyA
IsTextUnicode
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegisterEventSourceW
ReportEventW
DeregisterEventSource
TraceEvent
RegDeleteKeyW
UnregisterTraceGuids
RegCreateKeyExA
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW

ole32

CLSIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoCreateGuid
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMPDMC.exe
.exe windows:10 windows x64 arch:x64

4104cf876c2e2570afb2ff65c56dd170

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WMPDMC.pdb

Imports

advapi32

EventWriteTransfer
TraceMessage
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
EventRegister
EventUnregister
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
TraceEvent

kernel32

GetCurrentThreadId
HeapSetInformation
RegisterApplicationRestart
GlobalLock
WakeAllConditionVariable
MultiByteToWideChar
GetModuleHandleW
LoadLibraryExW
CreateMutexW
LocalFree
FormatMessageW
FreeLibrary
SetErrorMode
GlobalFree
GlobalAlloc
WaitForMultipleObjects
OutputDebugStringA
QueryActCtxW
GetModuleHandleExW
GetModuleFileNameW
CreateActCtxW
FindActCtxSectionStringW
ActivateActCtx
GetProcAddress
SetLastError
LoadLibraryW
DeactivateActCtx
lstrcmpiW
ResetEvent
PowerSetRequest
PowerCreateRequest
CreateThread
GetCurrentProcess
DuplicateHandle
Sleep
SetEvent
CompareStringOrdinal
OpenEventW
CreateEventW
PowerClearRequest
FindResourceExW
LoadResource
LockResource
SizeofResource
GetTickCount
TryEnterCriticalSection
GetLastError
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
RaiseException
HeapFree
HeapAlloc
GetProcessHeap
LeaveCriticalSection
DelayLoadFailureHook
ResolveDelayLoadedAPI
EnterCriticalSection
DebugBreak
IsDebuggerPresent
VirtualQuery
GlobalUnlock
WaitForSingleObjectEx
ReleaseSemaphore
UnmapViewOfFile
MapViewOfFile
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetModuleFileNameA
VirtualQueryEx
SetThreadPreferredUILanguages
InitOnceExecuteOnce
GetThreadPreferredUILanguages
InitializeCriticalSectionEx
LCIDToLocaleName
GetTickCount64
QueryPerformanceFrequency
LocalAlloc
InitializeCriticalSectionAndSpinCount
CreateEventExW
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeSRWLock
TlsSetValue
TlsFree
TlsAlloc
GetVersion
GetSystemDirectoryW
FindAtomW
SetProcessWorkingSetSizeEx
GetLocaleInfoW
GetUserDefaultUILanguage
GetThreadUILanguage
GetThreadLocale
FreeLibraryAndExitThread
GetAtomNameW
DeleteAtom
AddAtomW
TlsGetValue
RegGetValueW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDurationFormatEx
FindResourceW
GetVersionExW
lstrlenA
lstrlenW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
CompareStringW
HeapDestroy
HeapReAlloc
HeapSize
ReleaseActCtx
MulDiv
CreateSemaphoreW
SleepConditionVariableSRW

gdi32

GetPixel
DeleteEnhMetaFile
CreateRectRgn
GetClipRgn
IntersectClipRect
SelectClipRgn
GetLayout
SetTextAlign
GetTextAlign
GetCurrentObject
SetTextColor
SetBkColor
SetBkMode
PatBlt
StretchDIBits
GetStockObject
SetDCBrushColor
CreateSolidBrush
SetStretchBltMode
PlayEnhMetaFile
GdiGradientFill
ExtTextOutW
GetTextColor
GdiTransparentBlt
SetPixel
CreatePatternBrush
GetTextExtentPoint32W
CreateHalftonePalette
SelectPalette
RealizePalette
GetBrushOrgEx
SetBrushOrgEx
GetDIBits
GetBkMode
OffsetWindowOrgEx
SetWindowOrgEx
RectVisible
GetRegionData
ExtCreateRegion
CombineRgn
OffsetRgn
GetRgnBox
CreateFontIndirectW
CreateDIBPatternBrushPt
SetLayout
LPtoDP
GetBkColor
GetTextMetricsW
GetDCBrushColor
GetTextExtentPointW
StretchBlt
CreateBitmap
CreateCompatibleBitmap
GetDeviceCaps
Polyline
CreatePen
DeleteDC
GdiAlphaBlend
DeleteObject
GetObjectW
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt

user32

MoveWindow
GetDpiForWindow
LoadStringW
SetScrollInfo
GetScrollInfo
EnableWindow
RedrawWindow
SetWindowsHookExW
GetWindowRgnBox
UpdateWindow
GetClassLongW
SetParent
CallWindowProcW
GetPropW
GetAncestor
IsChild
UnregisterPowerSettingNotification
GetFocus
SetFocus
RegisterWindowMessageW
IsProcessDPIAware
UnhookWindowsHookEx
CallNextHookEx
RemovePropW
SetPropW
GetActiveWindow
GetDC
EnumChildWindows
MonitorFromWindow
SetWindowLongW
DrawFocusRect
DrawIconEx
GetKeyNameTextW
MapVirtualKeyW
SubtractRect
GetKeyState
UnionRect
SetWindowRgn
IsCharAlphaNumericW
DrawFrameControl
InflateRect
DrawTextW
IntersectRect
NotifyWinEvent
GetGUIThreadInfo
CreateIconIndirect
DestroyIcon
GetIconInfo
SetRect
GetWindowTextLengthW
GetWindowTextW
CharUpperW
CharUpperA
UnregisterClassA
ReleaseDC
RegisterClipboardFormatW
GetDoubleClickTime
GetCursorPos
FillRect
GetSysColorBrush
FrameRect
GetSysColor
SetRectEmpty
PostMessageW
SetCursor
LoadCursorW
ClientToScreen
SetTimer
KillTimer
GetWindowRect
PtInRect
IsWindow
PostThreadMessageW
GetSystemMetrics
IsRectEmpty
LoadImageW
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetClassInfoExW
TranslateAcceleratorW
PeekMessageW
LoadAcceleratorsW
ChangeWindowMessageFilterEx
SetProcessDPIAware
SendMessageTimeoutW
FindWindowW
CharNextW
IsIconic
GetClassNameW
GetDesktopWindow
GetWindowThreadProcessId
IsWindowVisible
GetWindow
SystemParametersInfoW
SetWindowLongPtrW
GetWindowLongPtrW
MapWindowPoints
PostQuitMessage
DestroyWindow
GetParent
SetWindowPos
GetWindowLongW
AdjustWindowRectEx
GetClientRect
GetMonitorInfoW
MonitorFromRect
BringWindowToTop
mouse_event
GetForegroundWindow
SetForegroundWindow
SetWindowTextW
DispatchMessageW
TranslateMessage
IsDialogMessageW
SendMessageW
ShowWindow
CreateDialogParamW
DestroyMenu
TrackPopupMenu
GetSubMenu
EnableMenuItem
LoadMenuW
ScreenToClient
CopyRect
EqualRect
InvalidateRect
OffsetRect

msvcrt

_cexit
memmove
memcpy
memcmp
floorf
floor
_exit
expf
cosf
ceilf
_vsnwprintf
iswspace
iswdigit
wcspbrk
iswalpha
wcschr
wcsstr
wcsspn
_wcsnicmp
_wtol
wcsncmp
_wcstoui64
_wcsicmp
wcstol
_wcsdup
qsort
wcstok_s
_vsnprintf
_isnan
_snwscanf_s
_wtof
iswalnum
swprintf_s
strncpy_s
strnlen
_CxxThrowException
wcscmp
realloc
_errno
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
exit
__set_app_type
__wgetmainargs
_amsg_exit
_wcmdln
_initterm
memset
powf
sin
sqrt
_XcptFilter
_callnewh
wcsncpy_s
vswprintf_s
_vscwprintf
calloc
memmove_s
memcpy_s
free
malloc
__C_specific_handler
_purecall
__CxxFrameHandler3
__setusermatherr

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

oleaut32

SafeArrayGetVartype
SafeArrayGetDim
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocString
VariantInit
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VarUI4FromStr
VarBstrCmp
VariantCopy
SysFreeString
VariantClear

ole32

OleUninitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
RevokeDragDrop
CoDisconnectObject
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoWaitForMultipleHandles
CoUninitialize
CoInitializeEx
PropVariantClear
CoTaskMemAlloc
CoCreateInstance
ReleaseStgMedium
CLSIDFromString
RegisterDragDrop
CoGetApartmentType
OleInitialize

gdiplus

GdipCreateImageAttributes
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipSetImageAttributesWrapMode
GdipDrawImageRectRectI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHICON
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdiplusStartup

uxtheme

BufferedPaintInit
CloseThemeData
OpenThemeData
GetThemeMargins
GetThemeFont
GetThemeColor
GetThemeMetric
GetThemeAppProperties
GetThemePartSize
DrawThemeTextEx
ord47
EndBufferedPaint
BufferedPaintClear
GetBufferedPaintBits
BeginBufferedPaint
GetThemeAnimationProperty
GetThemeBackgroundExtent
GetThemeAnimationTransform
BufferedPaintUnInit
IsAppThemed

wmpdui

InvalidateLayeredDescendants
LookupGadgetTicket
GetStdColorBrushI
GetStdColorI
GetDUserModule
FindStdColor
InitGadgets
DUserFlushMessages
DUserFlushDeferredMessages
SetWindowResizeFlag
GadgetTransCompositionChanged
SetGadgetBufferInfo
GetGadget
AttachWndProcW
ForwardGadgetMessage
DetachWndProc
GetGadgetRgn
CreateAction
EnsureGadgetTransInitialized
GetGadgetLayerInfo
DetachGadgetVisuals
SetGadgetRootInfo
ReleaseDetachedObjects
ReleaseLayeredRef
AddLayeredRef
SetGadgetFlags
GetGadgetVisual
SetGadgetOrder
SetTransitionVisualProperties
DestroyPendingDCVisuals
ChangeCurrentAnimationScenario
GetGadgetRootInfo
GetCachedDWriteRenderTarget
CacheDWriteRenderTarget
ReleaseMouseCapture
AdjustClipInsideRef
DUserStopPVLAnimation
UtilDrawBlendRect
GetGadgetFlags
MapGadgetPoints
GetGadgetTicket
FindGadgetFromPoint
CustomGadgetHitTestQuery
GetGadgetStyle
SetGadgetFocusEx
GetGadgetAnimation
GetGadgetSize
BuildAnimation
BuildInterpolation
SetGadgetFocus
GetGadgetFocus
GetGadgetRect
DUserPostEvent
DUserSendEvent
CreateGadget
DeleteHandle
InvalidateGadget
SetGadgetRect
SetGadgetMessageFilter
SetGadgetStyle
GetMessageExW
DisableContainerHwnd
SetGadgetParent
SetGadgetLayerInfo

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateString
WindowsGetStringLen
WindowsDuplicateString
WindowsGetStringRawBuffer

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError

api-ms-win-core-path-l1-1-0

PathCchAppend

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow
GetRoleTextW
ObjectFromLresult

dwmapi

DwmRenderGesture
DwmTetherContact
DwmIsCompositionEnabled

windowscodecs

WICCreateImagingFactory_Proxy

api-ms-win-shcore-scaling-l1-1-0

GetScaleFactorForDevice
RevokeScaleChangeNotifications
RegisterScaleChangeNotifications

api-ms-win-shcore-scaling-l1-1-1

GetScaleFactorForMonitor

Sections

.text
Size: 933KB - Virtual size: 932KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMPhoto.dll
.dll regsvr32 windows:10 windows x64 arch:x64

88f5154f08c0260aa3931986fb2a730f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmphoto.pdb

Imports

msvcrt

_callnewh
_CxxThrowException
memcpy
memmove
_XcptFilter
_aligned_malloc
_amsg_exit
_aligned_free
_initterm
??_V@YAXPEAX@Z
__C_specific_handler
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
_unlock
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
ftell
calloc
fopen
fclose
fseek
fwrite
feof
fread
strstr
printf
_purecall
??0exception@@QEAA@AEBQEBDH@Z
_onexit
??0exception@@QEAA@AEBQEBD@Z
_lock
malloc
free
??3@YAXPEAX@Z
_vsnwprintf
__CxxFrameHandler3
__dllonexit
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
StringFromIID

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegCreateKeyExW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

ReadFile
SetFilePointer
CreateFileA
DeleteFileA
GetTempFileNameW
WriteFile

oleaut32

VariantClear
VariantInit

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMSPDMOD.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

7502985c9af0ef42511c4b212ec21952

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMSPDMOD.pdb

Imports

msdmo

DMORegister
MoCopyMediaType
MoFreeMediaType
DMOUnregister
MoInitMediaType

msvcrt

wcsnlen
sin
cos
memset
sqrt
_onexit
__dllonexit
_unlock
_lock
powf
pow
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
_vsnwprintf
__C_specific_handler
time
_purecall
rand
srand
memmove
strnlen
cosf
exp
expf
log
logf
memcmp
memcpy
sinf

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExA
GetProcAddress
LoadLibraryExW
GetModuleHandleW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualProtect
VirtualAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlAddFunctionTable
RtlDeleteFunctionTable
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l2-1-0

RegSetValueA
RegCreateKeyW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegDeleteTreeW
RegSetValueExA
RegQueryValueExW
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetLocalTime

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree

ws2_32

htonl

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW

ntdll

RtlGetPersistedStateLocation

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 755KB - Virtual size: 754KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.no_bbt
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMSPDMOE.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

7a20bf746064537020ac528ff45cbda6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMSPDMOE.pdb

Imports

msvcrt

_clearfp
_control87
realloc
sscanf_s
_wcsicmp
fflush
rand
printf
srand
_wtol
sinf
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
__iob_func
free
_callnewh
malloc
_vsnwprintf
_purecall
memmove_s
atan2
atan2f
atanf
cos
cosf
exp
expf
log
log10
log10f
logf
memcpy
memmove
memset
pow
powf
sin
wcscmp

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadLibraryExA
GetProcAddress

oleaut32

SysAllocString
VariantInit

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-registry-l2-1-0

RegSetValueA
RegCreateKeyW
RegOpenKeyA

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegDeleteTreeW
RegSetValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

msdmo

MoCopyMediaType
DMORegister
DMOUnregister
MoFreeMediaType
MoInitMediaType

mfperfhelper

ord41
ord1
ord28
ord34
ord38
ord35
ord29
ord46
ord26
ord8
ord43
ord42
ord47

api-ms-win-core-com-l2-1-1

StgCreateDocfile
StgCreateStorageEx

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 874KB - Virtual size: 873KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMVCORE.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

57b739220fabd3996afe5fee93ec74a7

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:c5:a7:99:14:07:80:70:9c:a7:c0:1e:01:52:fa:02:cf:a3:da:27:b7:d4:23:df:bb:e1:16:90:29:46:9e:47
Signer

Actual PE Digest

3f:c5:a7:99:14:07:80:70:9c:a7:c0:1e:01:52:fa:02:cf:a3:da:27:b7:d4:23:df:bb:e1:16:90:29:46:9e:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmvcore.pdb

Imports

wmasf

ord24
ASFGetTimeBase
ASFTimeToSendTime
ord5
ASFSetDataUnitInfo
ord10
ord7
ord17
ord18
ord8
ord6
ASFTimeToPresTime
ord9
ASFPresTimeToTime
ASFCreateStreamSelector
ASFSendTimeToTime
ord11

msvcrt

_waccess
swscanf_s
isalpha
toupper
qsort
strncpy_s
strcspn
strspn
isxdigit
wcscspn
wcsspn
iswascii
iswcntrl
_wcsupr
_ltoa_s
_ultow_s
wcsftime
gmtime
perror
printf
wcsncpy_s
_itoa_s
_ui64toa_s
towupper
iswprint
strchr
isdigit
_errno
strtoul
time
wcsnlen
realloc
free
__C_specific_handler
strnlen
malloc
isalnum
_callnewh
isspace
strstr
_XcptFilter
_amsg_exit
_initterm
_ultoa_s
?terminate@@YAXXZ
_stricmp
strncmp
sscanf_s
_wtol
_ultow
_itow
strpbrk
_wcslwr
memset
powf
srand
sin
_unlock
_beginthreadex
??1type_info@@UEAA@XZ
rand
iswdigit
__dllonexit
_onexit
iswspace
_lock
wcstoul
setlocale
swscanf
wcstol
_wtoi
wcsstr
_vsnwprintf
_vsnprintf
_strnicmp
wcsncmp
wcsrchr
wcspbrk
wcschr
_wcsicmp
_set_error_mode
_purecall
__CxxFrameHandler3
_wcsnicmp
ceil
cos
floor
logf
memchr
memcmp
memcpy
memmove
wcscmp

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetModuleHandleExA
LoadLibraryExW
GetProcAddress
LoadLibraryExA
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
SizeofResource
FreeLibrary
LockResource
DisableThreadLibraryCalls
FreeResource

api-ms-win-core-file-l1-1-0

GetFileSizeEx
DeleteFileW
WriteFile
CreateFileW
GetVolumeInformationW
SetFilePointer
CompareFileTime
GetDiskFreeSpaceExW
GetFileSize
ReadFile
GetFileAttributesW
SetFilePointerEx
GetFileTime
SetEndOfFile
GetDiskFreeSpaceW
GetFileType

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GlobalMemoryStatusEx
GetVersionExA
GetLocalTime
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
GetVersion

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

SetHandleInformation
DuplicateHandle
CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualProtect
VirtualQuery
VirtualFree

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetExitCodeThread
GetCurrentThread
GetExitCodeProcess
GetThreadPriority
GetCurrentProcess
SetThreadPriority
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TlsSetValue

api-ms-win-core-rtlsupport-l1-1-0

RtlAddFunctionTable
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteFunctionTable
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-processthreads-l1-1-1

OpenProcess

oleaut32

SysStringByteLen
VariantClear
VariantCopy
VariantInit
SafeArrayCreate
SafeArrayDestroy
VariantChangeType
SafeArrayAccessData
SysAllocStringLen
SafeArrayUnaccessData
SysAllocString
SysFreeString
SysStringLen
VariantTimeToSystemTime

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc
HeapSize

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
WaitForMultipleObjectsEx
SleepEx
ResetEvent
CreateEventW
SetEvent
ReleaseSRWLockExclusive
CreateSemaphoreExW
DeleteCriticalSection
CreateMutexW
AcquireSRWLockExclusive
InitializeCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

TraceEvent

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-com-l1-1-0

CoUninitialize
StringFromCLSID
CoCreateGuid
CoTaskMemFree
CoInitializeEx
CLSIDFromString
CoGetTreatAsClass
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegEnumValueW
RegCreateKeyExW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalAlloc

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
GetUserDefaultLCID
GetSystemDefaultLangID
FormatMessageW

api-ms-win-core-string-l2-1-0

CharUpperW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsA

ntdll

RtlGetPersistedStateLocation

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
RegOpenKeyW
GetUserNameW
RegDeleteKeyW
RegEnumKeyW

kernel32

MulDiv
SetThreadAffinityMask
FindAtomW
GlobalLock
lstrlenW
GetComputerNameW
GetProcessAffinityMask
GlobalMemoryStatus

user32

PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjects
PostThreadMessageW
GetDC
GetDesktopWindow
ReleaseDC

gdi32

GetSystemPaletteEntries

mfperfhelper

ord1
ord95

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-file-l1-2-0

GetTempPathW

Exports

Exports

DllRegisterServer
WMCheckURLExtension
WMCheckURLScheme
WMCreateBackupRestorer
WMCreateBackupRestorerPrivate
WMCreateEditor
WMCreateIndexer
WMCreateLicenseRevocationAgentPrivate
WMCreateProfileManager
WMCreateReader
WMCreateReaderPriv
WMCreateSyncReader
WMCreateSyncReaderPriv
WMCreateWriter
WMCreateWriterFileSink
WMCreateWriterNetworkSink
WMCreateWriterPriv
WMCreateWriterPushSink
WMIsAvailableOffline
WMIsContentProtected
WMValidateData

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 334KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMVDECOD.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

20f5e7b2403f921003d3bec50de8a0e6

Code Sign

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8d
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-05-2022 19:23

Not After

04-05-2023 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:77:2e:91:90:4e:18:aa:da:e5:f3:7c:65:76:fb:2b:b3:93:b5:f8:d3:4f:2c:33:16:8e:8b:c0:1e:ff:85:6c
Signer

Actual PE Digest

bc:77:2e:91:90:4e:18:aa:da:e5:f3:7c:65:76:fb:2b:b3:93:b5:f8:d3:4f:2c:33:16:8e:8b:c0:1e:ff:85:6c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmvdecod.pdb

Imports

msvcrt

sin
sqrt
memset
srand
memmove
_vsnwprintf
tan
malloc
_onexit
memcmp
floor
cos
rand
calloc
time
_callnewh
free
__C_specific_handler
perror
wcsnlen
strnlen
fprintf
asctime
fflush
_wfopen
localtime
fwprintf
memcpy
puts
printf
__CxxFrameHandler3
fclose
fopen
memcpy_s
ceil
asin
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_purecall
_XcptFilter
wcscmp

mfperfhelper

ord96
ord103
ord104
ord105
ord1
ord102

ntdll

RtlNtStatusToDosError
RtlGetPersistedStateLocation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteFunctionTable
RtlAddFunctionTable

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExA
RegSetValueExW
RegDeleteTreeW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSection
ReleaseSRWLockExclusive
CreateEventW
DeleteCriticalSection
AcquireSRWLockExclusive
SetEvent
WaitForSingleObject
WaitForMultipleObjectsEx
ResetEvent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryExA
GetProcAddress
FreeLibrary
LoadLibraryExW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount
GetSystemTime
GetTickCount64
GetLocalTime
GlobalMemoryStatusEx

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWrite
EventWriteTransfer
EventUnregister

oleaut32

SysFreeString
SysAllocString
VariantInit

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-security-cryptoapi-l1-1-0

CryptGenRandom
CryptImportKey
CryptDestroyKey
CryptExportKey
CryptReleaseContext
CryptEncrypt
CryptAcquireContextA
CryptAcquireContextW
CryptGenKey

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc

api-ms-win-core-processthreads-l1-1-0

GetThreadPriority
GetExitCodeThread
GetCurrentThreadId
GetCurrentThread
CreateThread
TerminateProcess
ResumeThread
SetThreadPriority
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceEvent
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameA

api-ms-win-core-debug-l1-1-0

DebugBreak

msdmo

DMOUnregister
DMORegister
MoDuplicateMediaType
MoFreeMediaType
MoInitMediaType
MoDeleteMediaType
MoCreateMediaType
MoCopyMediaType

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetVC1DecoderFunctionTable

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.no_bbt
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMVENCOD.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

17f0741ccaea574389610e1fc95fbcfd

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f5:4b:ea:b2:a9:ef:22:15:91:26:c7:5b:7c:e7:4c:85:e7:78:f3:ec:43:a2:b8:7d:19:69:4f:b1:d9:38:12:34
Signer

Actual PE Digest

f5:4b:ea:b2:a9:ef:22:15:91:26:c7:5b:7c:e7:4c:85:e7:78:f3:ec:43:a2:b8:7d:19:69:4f:b1:d9:38:12:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMVENCOD.pdb

Imports

msvcrt

_amsg_exit
_XcptFilter
_vsnwprintf
malloc
_initterm
srand
fopen
_wremove
fclose
rand
fprintf
wcstombs
_wfopen
printf
fscanf
wprintf
memcpy_s
_resetstkoflw
fwrite
feof
fflush
puts
_vsnprintf_s
perror
wcsncmp
free
swprintf_s
_purecall
wcscpy_s
_callnewh
calloc
sqrt
__C_specific_handler
__iob_func
atanf
ceil
log
log10
memcmp
memcpy
memset
pow
wcscmp

mfperfhelper

ord1
ord96
ord95
ord94

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
EnterCriticalSection

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
GetProcAddress
GetModuleFileNameA
FreeLibrary

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegSetValueExA
RegDeleteTreeW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW

oleaut32

SysFreeString
VariantInit
SysAllocString

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-synch-l1-2-0

Sleep
SignalObjectAndWait

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
CreateThread
ResumeThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetThreadPriority
GetCurrentThread
GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
GetSystemInfo

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

ReadFile
GetTempFileNameW
GetFileSizeEx
WriteFile
CreateFileW

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask
GetProcessAffinityMask

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-3

SetThreadIdealProcessor

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber

msdmo

DMOUnregister
DMORegister
MoCopyMediaType
MoFreeMediaType
MoInitMediaType
MoDeleteMediaType
MoDuplicateMediaType

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMVSDECD.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

5df7e5d90b454fbbf0c0a1171fe68de8

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:73:91:3e:b5:51:0e:96:be:8a:38:7f:89:bd:7e:17:18:af:cc:28:0a:ce:b7:8f:ad:9c:99:3a:31:bf:06:78
Signer

Actual PE Digest

d0:73:91:3e:b5:51:0e:96:be:8a:38:7f:89:bd:7e:17:18:af:cc:28:0a:ce:b7:8f:ad:9c:99:3a:31:bf:06:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMVSDECD.pdb

Imports

msvcrt

abort
printf
_beginthreadex
_lock
__C_specific_handler
_initterm
_unlock
_amsg_exit
__dllonexit
_XcptFilter
free
_callnewh
_onexit
_purecall
malloc
_vsnwprintf
sprintf_s
strcat_s
memcpy
puts
memcmp
memset

mfplat

MFTRegister
MFTUnregister

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadLibraryExW
LoadLibraryExA
FreeLibrary
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-registry-l2-1-0

RegSetValueA
RegOpenKeyW
RegCreateKeyW

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetExitCodeThread
GetCurrentProcess
SetThreadPriority
TerminateProcess
GetThreadPriority
GetCurrentProcessId
GetCurrentThreadId
CreateThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetVersion

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

ws2_32

ntohl
htonl

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateSemaphoreW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

msdmo

DMOUnregister
MoInitMediaType
DMORegister
MoCopyMediaType
MoFreeMediaType

api-ms-win-ntuser-rectangle-l1-1-0

IsRectEmpty

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.no_bbt
Size: 1024B - Virtual size: 633B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMVSENCD.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

4aa0f047964353ebb18903b26da45671

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMVSENCD.pdb

Imports

msvcrt

fprintf
_wfopen
fscanf
exit
fclose
_wremove
calloc
qsort
printf
__C_specific_handler
abort
puts
_initterm
_amsg_exit
_XcptFilter
free
fseek
_purecall
_callnewh
memset
malloc
_vsnwprintf
ftell
__iob_func
ceil
exp
log
memcmp
memcpy
sqrt

mfplat

MFTRegister
MFTUnregister

api-ms-win-mm-time-l1-1-0

timeGetTime

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
GetProcAddress
GetModuleFileNameA

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
PropVariantClear
CoTaskMemFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

oleaut32

SysFreeString
SysAllocString
VariantInit

api-ms-win-core-registry-l2-1-0

RegOpenKeyW
RegCreateKeyW
RegSetValueA

api-ms-win-core-registry-l1-1-0

RegSetValueExA
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteTreeW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
SetThreadPriority
GetCurrentProcessId
GetThreadPriority
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
CreateThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

GetTempFileNameW

api-ms-win-core-handle-l1-1-0

CloseHandle

msdmo

DMOUnregister
MoInitMediaType
MoFreeMediaType
MoCopyMediaType
DMORegister

ws2_32

ntohl
htonl

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 367KB - Virtual size: 367KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WMVXENCD.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

40cb831d239355cddaeac35628f44488

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMVXENCD.pdb

Imports

msvcrt

__C_specific_handler
_initterm
asctime
fflush
fclose
_amsg_exit
_wfopen
time
localtime
fopen
_wremove
fseek
wcstombs
printf
fscanf
exit
ftell
feof
rand
puts
calloc
_XcptFilter
_lock
swprintf_s
_callnewh
malloc
_vsnwprintf
_unlock
free
__iob_func
__dllonexit
_purecall
_onexit
sqrt
fprintf
ceil
exp
log
log10
memcmp
memcpy
memset
wcscmp

mfplat

MFTUnregister
MFTRegister

api-ms-win-core-synch-l1-1-0

ResetEvent
DeleteCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
SetEvent
CreateEventW
LeaveCriticalSection
WaitForSingleObject
WaitForMultipleObjectsEx
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
PropVariantClear

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
GetProcAddress
GetModuleFileNameA

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
SetEnvironmentVariableW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExA
RegDeleteTreeW

oleaut32

SysAllocString
SysFreeString
VariantInit

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-registry-l2-1-0

RegOpenKeyW
RegCreateKeyW
RegSetValueA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetThreadPriority
GetCurrentProcessId
GetCurrentThread
TerminateProcess
GetCurrentProcess
GetExitCodeThread
SetThreadPriority
GetCurrentThreadId
CreateThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetSystemInfo

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
UnregisterTraceGuids
TraceEvent
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameA

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

GetTempFileNameW

api-ms-win-core-handle-l1-1-0

CloseHandle

msdmo

DMOUnregister
DMORegister
MoDuplicateMediaType
MoDeleteMediaType
MoInitMediaType
MoFreeMediaType
MoCopyMediaType

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask
GetProcessAffinityMask

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 498KB - Virtual size: 497KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WPDShServiceObj.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a818543a20f50f3f473480146b3c3606

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WPDShServiceObj.pdb

Imports

msvcrt

wcscpy_s
wcscat_s
_purecall
_vsnwprintf
_wcsicmp
memmove_s
_callnewh
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
memcpy_s
??1type_info@@UEAA@XZ
_errno
realloc
_lock
_unlock
__dllonexit
_onexit
_CxxThrowException
free
malloc
wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

advapi32

RegOpenKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceEvent
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
TraceMessage
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids

kernel32

HeapDestroy
GetProcessHeap
HeapAlloc
DelayLoadFailureHook
ResolveDelayLoadedAPI
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
CreateEventW
CloseHandle
HeapFree
TrySubmitThreadpoolCallback
WaitForSingleObject
SetEvent
HeapSize
HeapReAlloc
CreateFileW

user32

UnregisterClassA
DefWindowProcW
PostQuitMessage
GetWindowLongPtrW
PostMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
SetWindowLongPtrW
CreateWindowExW
RegisterClassW
CharNextW
DestroyWindow

oleaut32

VarUI4FromStr

comctl32

ord332
ord328
ord336
ord334
ord386

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WPDShextAutoplay.exe
.exe windows:10 windows x64 arch:x64

d6e136d4a9e27f31c5602b427d3226e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WPDShextAutoplay.pdb

Imports

advapi32

RegCloseKey
RegQueryValueExW
TraceMessage

kernel32

SetEvent
GetVersion
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetLastError
CompareStringW
CreateProcessW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateEventW
WaitForSingleObject
HeapReAlloc
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
LeaveCriticalSection
EnterCriticalSection
RaiseException
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapSize

user32

SendMessageW
FindWindowW
UnregisterClassA

msvcrt

_vsnwprintf
__CxxFrameHandler3
_wcsicmp
memcpy_s
?terminate@@YAXXZ
_lock
_CxxThrowException
_onexit
__dllonexit
_unlock
??1type_info@@UEAA@XZ
_commode
_fmode
_acmdln
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
__C_specific_handler
_callnewh
malloc
free
wcstok
wcschr
_vscwprintf
vswprintf_s
memmove_s
memset

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

oleaut32

SysFreeString
SysAllocString

shlwapi

StrRStrIW

ole32

CLSIDFromString
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
CoCreateInstance
CoInitializeEx
CreateBindCtx

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiOpenDevRegKey
SetupDiGetDeviceInterfaceAlias
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInterfaceW

shell32

ord155
ShellExecuteExW
SHParseDisplayName

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WPDSp.dll
.dll regsvr32 windows:10 windows x64 arch:x64

cd54509a7db571cf151c5e26fbcce026

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WPDSp.pdb

Imports

msvcrt

memmove_s
iswspace
__C_specific_handler
_wcsicmp
wcsstr
_wcslwr_s
wcsncpy_s
malloc
free
_purecall
calloc
wcscpy_s
wcscat_s
_wtoi
_vscwprintf
vswprintf_s
_callnewh
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
_snwscanf_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
strnlen
wcsnlen
??1type_info@@UEAA@XZ
_errno
realloc
memset
__CxxFrameHandler3
memcpy
memcmp
ceilf
_CxxThrowException
wcscmp

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlGetPersistedStateLocation

advapi32

RegQueryValueExW
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceEvent
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
TraceMessage

kernel32

HeapDestroy
HeapReAlloc
HeapSize
SetThreadLocale
GetThreadLocale
InitOnceComplete
InitOnceBeginInitialize
InitializeCriticalSectionAndSpinCount
ExpandEnvironmentStringsW
CreateFileW
CreateThread
QueryPerformanceFrequency
QueryPerformanceCounter
SetEvent
CreateEventW
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
FreeEnvironmentStringsA
GetEnvironmentStringsW
GlobalMemoryStatusEx
GetLocalTime
FreeEnvironmentStringsW
DeviceIoControl
GetDiskFreeSpaceW
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
K32GetModuleBaseNameW
GetCurrentProcess
GetVersionExW
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
lstrcmpiW
RaiseException
MultiByteToWideChar

user32

UnregisterClassA
LoadImageW
CharNextW

oleaut32

SysFreeString
SysStringLen
SysAllocStringLen
VarUI4FromStr
SafeArrayCreateVector
SafeArrayAccessData
SysAllocString
SafeArrayUnaccessData
SafeArrayDestroy
UnRegisterTypeLi
LoadTypeLi
RegisterTypeLi
SafeArrayGetElemsize
SystemTimeToVariantTime
VariantTimeToSystemTime

shlwapi

StrCmpNW
StrStrW
StrCmpW
StrToIntW

ole32

CoMarshalInterThreadInterfaceInStream
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoTaskMemAlloc
PropVariantClear
CoCreateInstance
CoWaitForMultipleHandles
PropVariantCopy
CLSIDFromString
StringFromCLSID
StringFromGUID2

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDevRegKey
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WPTaskScheduler.dll
.dll windows:10 windows x64 arch:x64

e7a29ee1862ae6fa374da554cd670de2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WPTaskScheduler.pdb

Imports

ubpm

UbpmCloseTriggerConsumer
UbpmOpenTriggerConsumer
UbpmTriggerConsumerUnregister
UbpmTriggerConsumerRegister
UbpmTriggerConsumerControl

msvcrt

?terminate@@YAXXZ
__CxxFrameHandler3
??3@YAXPEAX@Z
free
malloc
??_V@YAXPEAX@Z
_purecall
__C_specific_handler
_callnewh
??1type_info@@UEAA@XZ
memcmp
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
memset

api-ms-win-security-accesshlpr-l1-1-0

QueryTransientObjectSecurityDescriptor
FreeTransientObjectSecurityDescriptor

rpcrt4

RpcServerInqBindings
RpcServerRegisterIf3
MesDecodeBufferHandleCreate
MesHandleFree
RpcServerUseProtseqW
MesEncodeDynBufferHandleCreate
MesBufferHandleReset
NdrServerCall2
NdrMesTypeEncode3
RpcRevertToSelfEx
RpcServerUnregisterIfEx
UuidCreate
RpcStringFreeW
UuidToStringW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingVectorFree
RpcEpRegisterW
NdrMesTypeDecode3
NdrServerCallAll
RpcEpUnregister

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpool
CloseThreadpool
CreateThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMaximum
CreateThreadpoolTimer
IsThreadpoolTimerSet
CloseThreadpoolWork
SubmitThreadpoolWork
SetThreadpoolThreadMinimum

api-ms-win-core-file-l1-1-0

FindClose
FindFirstFileW
CompareFileTime

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegCopyTreeW
RegDeleteTreeW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibrary
GetProcAddress

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTimeEx
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTimeEx
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-security-base-l1-1-0

GetLengthSid
GetTokenInformation

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

ntdll

RtlCreateSecurityDescriptor
RtlCreateAcl
RtlFreeHeap
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlAllocateAndInitializeSid
RtlSetDaclSecurityDescriptor
NtCreateWnfStateName
NtDeleteWnfStateName
RtlSetOwnerSecurityDescriptor
RtlCopySid
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlNtStatusToDosError
RtlLengthSecurityDescriptor

csystemeventsbrokerclient

CSebDeleteEvent
CSebCreatePrivateEvent

eventaggregation

EACreateAggregateEvent
EADeleteAggregateEvent

umpdc

PdcActivationClientUnregister
PdcActivationClientRegister

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

WptsInitialize
WptsTerminate

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSClient.dll
.dll windows:10 windows x64 arch:x64

426cfce131a6dd9993c92992fe5d0824

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WSClient.pdb

Imports

msvcrt

_amsg_exit
__C_specific_handler
_initterm
malloc
free
_XcptFilter

api-ms-win-appmodel-unlock-l1-1-0

IsDeveloperModeEnabled

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AcquireDeveloperLicense
CheckDeveloperLicense
GetApplicationURL
RefreshBannedAppsList
RemoveDeveloperLicense
WSCallServer
WSCheckForConsumable
WSEvaluatePackage
WSGetEvaluatePackageAttempted
WSLicenseCleanUpState
WSLicenseClose
WSLicenseFilterValidAppCategoryIds
WSLicenseGetAllUserTokens
WSLicenseGetAllValidAppCategoryIds
WSLicenseGetDevInstalledApps
WSLicenseGetExtendedUserInfo
WSLicenseGetFeatureLicenseResults
WSLicenseGetLicensesForProducts
WSLicenseGetOAuthServiceTicket
WSLicenseGetProductLicenseResults
WSLicenseInstallLicense
WSLicenseOpen
WSLicenseRefreshLicense
WSLicenseRetrieveMachineID
WSLicenseRevokeLicenses
WSLicenseUninstallLicense
WSNotifyOOBECompletion
WSNotifyPackageInstalled
WSTriggerOOBEFileValidation
WSpTLRW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSCollect.exe
.exe windows:10 windows x64 arch:x64

9f02a366d38804e1f04b39c5385f776c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WSCollect.pdb

Imports

kernel32

HeapFree
CreateEventExW
WriteFile
GetModuleHandleExW
CreateFileW
GetLastError
SetEvent
CloseHandle
RaiseException
HeapAlloc
GetLocalTime
GetProcAddress
GetProcessHeap
GetTickCount

msvcrt

_vsnwprintf
_purecall
_XcptFilter
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
printf

shlwapi

PathAppendW

shell32

SHGetKnownFolderPath

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSDApi.dll
.dll windows:10 windows x64 arch:x64

5ca9adb7529679876d469ace92fd7e2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WSDApi.pdb

Imports

msvcrt

_initterm
_lock
_unlock
vfwprintf_s
__dllonexit
wcsnlen
_onexit
fwprintf_s
strcmp
_wfsopen
_wcserror
_get_errno
memset
fclose
memcpy
_purecall
vswprintf_s
memcmp
memmove_s
_vsnprintf
_XcptFilter
free
_amsg_exit
tolower
_callnewh
memcpy_s
wcstok_s
time
_stricmp
strncmp
__C_specific_handler
iswdigit
wcsstr
_wtol
_vsnwprintf
wcsncmp
towlower
_wcsdup
_localtime64
_time64
_wcsnicmp
wcschr
malloc
_wcsicmp
_strnicmp
wcscmp

ntdll

EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
EtwGetTraceEnableLevel
RtlIpv4StringToAddressExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlIpv6StringToAddressExW
EtwGetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
SubmitThreadpoolWork
SetThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
CancelThreadpoolIo
StartThreadpoolIo
CreateThreadpoolIo
CreateThreadpoolWork
CloseThreadpool
CreateThreadpool
WaitForThreadpoolTimerCallbacks
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMaximum
CloseThreadpoolTimer
CreateThreadpoolCleanupGroup
SetThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolThreadMinimum
TrySubmitThreadpoolCallback

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
WaitForSingleObject
CreateWaitableTimerExW
WaitForMultipleObjectsEx
SetEvent
InitializeCriticalSection
CreateEventW
CancelWaitableTimer
SetWaitableTimer
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
SleepEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateSemaphoreExW
ResetEvent
ReleaseSemaphore
CreateMutexExW
ReleaseMutex
OpenSemaphoreW
AcquireSRWLockShared

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

rpcrt4

UuidFromStringA
UuidCreate

ws2_32

bind
setsockopt
WSASocketW
WSACleanup
WSAStringToAddressW
htons
socket
WSAGetLastError
ntohs
WSAStartup
GetAddrInfoW
FreeAddrInfoW
WSAAddressToStringW
WSASendTo
WSADuplicateSocketW
WSARecvFrom
shutdown
closesocket
getsockname
WSAIoctl

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
CreateThread

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-io-l1-1-0

CancelIoEx

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceComplete
InitOnceBeginInitialize
Sleep
SleepConditionVariableSRW

api-ms-win-core-heap-l2-1-0

GlobalFree

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

iphlpapi

NotifyUnicastIpAddressChange
GetBestRoute2
ConvertInterfaceGuidToLuid
CancelMibChangeNotify2
GetAdaptersAddresses

api-ms-win-core-com-l1-1-0

CoUninitialize
CoCreateInstance
CoInitializeEx
CoWaitForMultipleHandles

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
QueueUserWorkItem

nsi

NsiGetParameter

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

webservices

WsReadChars
WsReadBytes
WsStartWriterCanonicalization
WsEndWriterCanonicalization
WsWriteStartAttribute
WsWriteChars
WsWriteEndAttribute
WsSetWriterPosition
WsGetWriterPosition
WsMoveWriter
WsWriteStartElement
WsWriteBytes
WsWriteEndElement
WsMoveReader
WsStartReaderCanonicalization
WsWriteEndStartElement
WsWriteValue
WsWriteCharsUtf8
WsWriteText
WsReadEndAttribute
WsFreeReader
WsCopyNode
WsGetReaderNode
WsSetOutput
WsCreateWriter
WsSetInputToBuffer
WsCreateReader
WsFreeHeap
WsCreateXmlBuffer
WsCreateHeap
WsFreeWriter
WsEndReaderCanonicalization
WsReadStartAttribute
WsFindAttribute
WsSkipNode
WsReadNode
WsReadEndElement
WsReadStartElement
WsReadToStartElement
WsSetInput
WsSetOutputToBuffer
WsWriteXmlnsAttribute
WsGetWriterProperty

firewallapi

FWGetConfig
FWQueryFirewallRules
IcfChangeNotificationDestroy
IsFirewallInCoExistanceMode
IcfChangeNotificationCreate
FWOpenPolicyStore
IcfAddrChangeNotificationCreate
FWFreeFirewallRules
FWClosePolicyStore
FWGetGlobalConfig
FWResetIndicatedTupleInUse
FWIndicateTupleInUse

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

WSDAddFirewallCheck
WSDAllocateLinkedMemory
WSDAttachLinkedMemory
WSDCancelNetworkChangeNotify
WSDCompareEndpoints
WSDCopyEndpoint
WSDCopyNameList
WSDCreateDeviceHost
WSDCreateDeviceHost2
WSDCreateDeviceHostAdvanced
WSDCreateDeviceProxy
WSDCreateDeviceProxy2
WSDCreateDeviceProxyAdvanced
WSDCreateDiscoveryProvider
WSDCreateDiscoveryProvider2
WSDCreateDiscoveryPublisher
WSDCreateDiscoveryPublisher2
WSDCreateHttpAddress
WSDCreateHttpMessageParameters
WSDCreateHttpTransport
WSDCreateMetadataAgent
WSDCreateOutboundAttachment
WSDCreateUdpAddress
WSDCreateUdpMessageParameters
WSDCreateUdpTransport
WSDDetachLinkedMemory
WSDFreeLinkedMemory
WSDGenerateFault
WSDGenerateFaultEx
WSDGenerateRandomDelay
WSDGetConfigurationOption
WSDNotifyNetworkChange
WSDProcessFault
WSDRemoveFirewallCheck
WSDSetConfigurationOption
WSDUriDecode
WSDUriEncode
WSDXMLAddChild
WSDXMLAddSibling
WSDXMLBuildAnyForSingleElement
WSDXMLCleanupElement
WSDXMLCompareNames
WSDXMLCreateContext
WSDXMLGetNameFromBuiltinNamespace
WSDXMLGetValueFromAny

Sections

.text
Size: 573KB - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSDPrintProxy.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

3475e879c5d585f2dea8fbbebc6bfbbb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WSDPrintProxy.pdb

Imports

msvcrt

_amsg_exit
_callnewh
_initterm
_lock
malloc
_unlock
__dllonexit
_onexit
memcmp
__C_specific_handler
free
wcschr
_vsnwprintf
_XcptFilter
memset

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-core-synch-l1-1-0

CreateEventW
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
DisableThreadLibraryCalls

api-ms-win-core-heap-l1-1-0

HeapDestroy

rpcrt4

UuidCreate

crypt32

CryptStringToBinaryW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-devices-query-l1-1-0

DevFreeObjectProperties
DevGetObjectProperties

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSDScanProxy.dll
.dll regsvr32 windows:10 windows x64 arch:x64

4abc05018326e5cedc30fcbc17edd3df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WSDScanProxy.pdb

Imports

msvcrt

_initterm
_amsg_exit
_XcptFilter
_unlock
malloc
free
_vsnwprintf
_lock
_onexit
__dllonexit
_callnewh
__C_specific_handler
memset

atl

ord21
ord15
ord32
ord16

advapi32

GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlCaptureContext
GetTickCount
Sleep
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
DisableThreadLibraryCalls
WaitForSingleObject
CreateEventW
GetLastError
CloseHandle
GetModuleFileNameW
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection

ole32

PropVariantClear

oleaut32

SysAllocString
SysFreeString

rpcrt4

UuidCreate

wsdapi

WSDFreeLinkedMemory
WSDCreateDeviceProxyAdvanced
WSDXMLCreateContext
WSDSetConfigurationOption
WSDCreateHttpAddress
WSDDetachLinkedMemory

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSHTCPIP.DLL
.dll windows:10 windows x64 arch:x64

81af26da75b32f0cdf22d424213bb9a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshtcpip.pdb

Imports

ntdll

RtlUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlIpv4StringToAddressExW
RtlCaptureContext
RtlAllocateHeap
_wcsicmp
RtlIpv4AddressToStringExW
RtlInitUnicodeString
RtlIntegerToUnicodeString
RtlIpv6AddressToStringExW
NtTerminateProcess
RtlAppendUnicodeStringToString
LdrDisableThreadCalloutsForDll
memmove

ws2_32

ntohs
WSAGetLastError
setsockopt

Exports

Exports

WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSManHTTPConfig.exe
.exe windows:10 windows x64 arch:x64

822dc9ab765edbcd88ef1608a7ba0bb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WSManHTTPConfig.pdb

Imports

msvcrt

_initterm
_commode
_fmode
_cexit
__CxxFrameHandler3
__setusermatherr
__C_specific_handler
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_purecall
_wcsicmp
fwprintf
__iob_func
memset

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW

oleaut32

SysAllocString
SysFreeString

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoInitializeEx

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-service-management-l1-1-0

StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
ChangeServiceConfig2W

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

wsmsvc

UninstallMigration
RemovePluginXmlNewAttrForThresholdOrGreater
??1CErrorContext@@UEAA@XZ
??0CErrorContext@@QEAA@_N@Z
??1OnHTTPInitialize@@QEAA@XZ
??0OnHTTPInitialize@@QEAA@XZ
?GetErrorCode@CErrorContext@@UEBAKXZ
??1?$AutoDeleteVector@E@@QEAA@XZ
??0?$AutoDeleteVector@E@@QEAA@XZ
HandleMigration
MoveSettingsToMigrationKey
WSManError
??1CWSManCriticalSection@@QEAA@XZ
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
?Free@WSManMemory@@SAXPEAXH@Z
??4?$AutoDeleteVector@E@@QEAAAEAV0@PEAE@Z

Exports

Exports

??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSManMigrationPlugin.dll
.dll regsvr32 windows:10 windows x64 arch:x64

99dfd0f3507e515ad5ce304eadf4d576

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

WSManMigrationPlugin.pdb

Imports

msvcrt

wcscat_s
__CxxFrameHandler3
wcsncpy_s
memmove_s
wcsrchr
_vsnwprintf
wcsstr
memcmp
realloc
__C_specific_handler
_ultow_s
_purecall
wcscpy_s
memcpy_s
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
free
malloc
_errno
??0exception@@QEAA@AEBQEBD@Z
memset

oleaut32

SysAllocStringByteLen
GetErrorInfo
LoadRegTypeLi
SysStringLen
LoadTypeLi
SysAllocString
VarUI4FromStr
SysFreeString

api-ms-win-core-libraryloader-l1-1-0

LockResource
DisableThreadLibraryCalls
LoadLibraryExA
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleHandleW

api-ms-win-core-com-l1-1-0

CoCreateInstance
StringFromCLSID
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

GetThreadLocale
SetThreadLocale

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockExclusive

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

wsmsvc

??1CWSManCriticalSection@@QEAA@XZ
?Free@WSManMemory@@SAXPEAXH@Z
WSManError
HandleMigration
??0AutoBstr@@QEAA@PEAG@Z
??1AutoBstr@@QEAA@XZ
??1?$AutoDeleteVector@G@@QEAA@XZ
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
?Error@EventLog@@SAXKGPEAPEBG@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

Exports

Exports

??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSReset.exe
.exe windows:10 windows x64 arch:x64

1fc4cb53a2206655892168907d8c326b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WSReset.pdb

Imports

advapi32

EventUnregister
EventRegister
EventWrite
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey

kernel32

HeapFree
HeapAlloc
GetProcessHeap
FindFirstFileW
CreateEventExW
FindNextFileW
GetModuleHandleExW
RemoveDirectoryW
FindClose
GetLastError
SetEvent
DeleteFileW
CloseHandle
RaiseException
LoadLibraryW
GetProcAddress
FreeLibrary
GetTickCount
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
UnhandledExceptionFilter

msvcrt

_amsg_exit
exit
_exit
wcsrchr
__set_app_type
_XcptFilter
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
printf
_purecall
system
_wcsicmp
_vsnwprintf
__wgetmainargs
_cexit
memset

ole32

CoWaitForMultipleHandles
CoTaskMemFree
CoCreateFreeThreadedMarshaler

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoActivateInstance
RoInitialize

shell32

ShellExecuteExW
SHGetKnownFolderPath

wevtapi

EvtClearLog

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WSTPager.ax
.dll regsvr32 windows:10 windows x64 arch:x64

0c70f95c3f5be2c44400ea334c974799

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WSTPager.pdb

Imports

msvcrt

??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
__C_specific_handler
memcpy_s
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
memmove_s
_purecall
_vsnwprintf_s
free
malloc
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
memcmp
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
memcpy
__CxxFrameHandler3
??0exception@@QEAA@XZ
memset

winmm

timeEndPeriod
timeSetEvent
timeBeginPeriod
timeKillEvent

kernel32

MultiByteToWideChar
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetCurrentThread
GetThreadPriority
GetTickCount
GetProcAddress
GetModuleHandleW
Sleep
WaitForMultipleObjects
GetModuleFileNameA
SetThreadPriority
GetLastError
CreateSemaphoreW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalAlloc
FormatMessageW
LocalFree
DeleteCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
CloseHandle
CreateThread
ResetEvent
DisableThreadLibraryCalls
GetVersionExW
lstrcmpW
GetCurrentThreadId
GetCurrentProcess
WaitForMultipleObjectsEx
ReleaseSemaphore

advapi32

RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW

user32

PostThreadMessageW
TranslateMessage
wsprintfW
GetMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetQueueStatus
RegisterWindowMessageW
DispatchMessageW

ole32

CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoInitializeEx
CoUninitialize
CoFreeUnusedLibraries
CoTaskMemFree

oleaut32

LoadRegTypeLi
SysFreeString
VariantClear

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WUDFCoinstaller.dll
.dll windows:10 windows x64 arch:x64

56856fb796c50832478c516395b89646

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WUDFCoinstaller.pdb

Imports

msvcrt

_amsg_exit
malloc
_initterm
__C_specific_handler
free
_wcsicmp
wcstoul
_vsnwprintf_s
_wcstoui64
_XcptFilter
_callnewh
memset

kernel32

CreateFileW
LocalFree
GetLocalTime
Sleep
CloseHandle
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
RtlCaptureContext
FormatMessageW
GetVersionExW
GetLastError

advapi32

RegCreateKeyExW
RegSetValueExW
RegCloseKey
EventWriteTransfer
RegOpenKeyExW
EventUnregister
EventRegister

setupapi

SetupGetFieldCount
SetupGetMultiSzFieldW
SetupDiGetDeviceInstanceIdW
SetupOpenInfFileW
SetupDiCreateDevRegKeyW
SetupLogErrorW
SetupCloseLog
SetupOpenLog
SetupInstallFromInfSectionW
SetupGetStringFieldW
SetupDiGetSelectedDriverW
SetupDiGetActualSectionToInstallExW
SetupDiGetDriverInfoDetailW
SetupFindFirstLineW
SetupGetIntField
SetupFindNextMatchLineW
SetupGetLineCountW
SetupDiOpenDevRegKey
SetupCloseInfFile
SetupOpenAppendInfFileW

ole32

CLSIDFromString
StringFromGUID2

shlwapi

SHDeleteKeyW

Exports

Exports

CoDeviceInstall

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WUDFCompanionHost.exe
.exe windows:10 windows x64 arch:x64

7b21670fb2afac237d5b032d5e6a35fb

Code Sign

33:00:00:04:0a:87:d0:ea:67:86:e3:6b:07:00:00:00:00:04:0a
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-01-2023 19:22

Not After

15-12-2023 19:22

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:b1:14:f2:24:0b:ca:44:50:48:5b:5e:48:31:4e:45:86:d1:1e:10:fe:37:aa:bb:42:a8:b4:10:bc:77:aa:27
Signer

Actual PE Digest

32:b1:14:f2:24:0b:ca:44:50:48:5b:5e:48:31:4e:45:86:d1:1e:10:fe:37:aa:bb:42:a8:b4:10:bc:77:aa:27

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WUDFCompanionHost.pdb

Imports

api-ms-win-core-crt-l1-1-0

__C_specific_handler
wcsstr
memcpy
_wcsicmp
wcstoul
_wcsnicmp
_wcslwr_s
wcscspn
iswdigit
iswalnum
_vsnwprintf_s
memset
wcsncmp

api-ms-win-core-crt-l2-1-0

exit
_initterm_e
_purecall
wprintf
_initterm
__dllonexit3
_onexit
__wgetmainargs

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExA
LoadLibraryExW
GetModuleHandleExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapSetInformation
GetProcessHeap
HeapAlloc

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW
UuidFromStringW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolThreadMinimum
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolCleanupGroup
CreateThreadpoolWait
CreateThreadpool
CloseThreadpool
SetThreadpoolWait
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMaximum
CloseThreadpoolCleanupGroup

api-ms-win-core-synch-l1-1-0

CreateWaitableTimerExW
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
CreateEventW
WaitForMultipleObjectsEx
ResetEvent
CancelWaitableTimer
SetWaitableTimer

api-ms-win-core-file-l1-1-0

GetFullPathNameW
GetLongPathNameW
WriteFile
CreateFileW
GetFileSizeEx
DeleteFileW

api-ms-win-core-memory-l1-1-0

VirtualProtect
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
VirtualQuery

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetProcessId
TerminateProcess
CreateThread
GetCurrentProcessId
GetCurrentProcess
TlsGetValue
TlsAlloc
TlsFree

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlInitUnicodeString
DbgPrintEx
RtlNtStatusToDosError
AlpcGetMessageAttribute
NtCreateDirectoryObject
NtClose
NtAlpcDeletePortSection
NtAlpcDeleteResourceReserve
NtAlpcConnectPort
NtAlpcCancelMessage
NtAlpcCreateResourceReserve
NtAlpcCreateSectionView
NtAlpcImpersonateClientOfPort
RtlVerifyVersionInfo
NtAlpcDeleteSectionView
NtAlpcAcceptConnectPort
AlpcInitializeMessageAttribute
NtAlpcCreatePort
NtAlpcDeleteSecurityContext
NtAlpcSetInformation
NtAlpcDisconnectPort
NtAlpcSendWaitReceivePort
NtAlpcCreatePortSection
DbgBreakPoint
NtQuerySystemInformation
vDbgPrintEx
LdrEnumerateLoadedModules
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateServiceSid
NtAlpcCreateSecurityContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

Exports

Exports

Microsoft_WDF_UMDF_Version
__ImagePolicyMetadata

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tPolicy
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WUDFHost.exe
.exe windows:10 windows x64 arch:x64

2559053e8a5d36f9eefcdc837074f98e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WUDFHost.pdb

Imports

api-ms-win-core-crt-l1-1-0

memmove_s
memcpy_s
wcscat_s
_vsnprintf_s
wcsstr
wcsncpy_s
__C_specific_handler
_vsnwprintf_s
_wcsicmp
wcstoul
wcsrchr
_wcsnicmp
memset
memcpy
memcmp
wcscpy_s
wcsncmp

api-ms-win-core-crt-l2-1-0

_initterm
__wgetmainargs
_onexit
__dllonexit3
_initterm_e
_purecall
exit

ntdll

DbgPrintEx
VerSetConditionMask
RtlVerifyVersionInfo
RtlNtStatusToDosError
RtlSetIoCompletionCallback
NtQueryInformationFile
NtSetInformationFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
TerminateProcess
TlsFree
CreateThread

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventActivityIdControl
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
LoadLibraryExA
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSetInformation
HeapFree
GetProcessHeap

rpcrt4

UuidFromStringW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetSystemInfo

api-ms-win-core-com-l1-1-0

CoUninitialize
CLSIDFromString
CoInitializeEx

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionEx
OpenSemaphoreW
CreateEventW
CreateMutexExW
CreateSemaphoreExW
WaitForMultipleObjectsEx
AcquireSRWLockExclusive
SetEvent
InitializeCriticalSection
WaitForSingleObject
EnterCriticalSection

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
SetEnvironmentVariableW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CreateThreadpoolWait
CreateThreadpoolCleanupGroup
CreateThreadpool
CloseThreadpool
SetThreadpoolThreadMinimum
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolCleanupGroup
SetThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum

api-ms-win-core-file-l1-1-0

FlushFileBuffers
GetFileSizeEx
ReadFile
WriteFile
CreateFileW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualQuery
VirtualProtect

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW
SetNamedPipeHandleState
TransactNamedPipe

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

devobj

DevObjOpenDevRegKey
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInfo
DevObjGetDeviceInstanceId
DevObjDestroyDeviceInfoList
DevObjGetDeviceRegistryProperty

wudfplatform

GetAndInitializePlatformObject
InitializePlatformLibrary
WdfGetLpcInterface
SetPlatformErrorReportingCallbacks
ShutdownPlatformLibrary
WudfIsKernelDebuggerPresent
WudfIsUserDebuggerPresent
WudfDebugBreakPoint
WudfWaitForDebugger

Exports

Exports

Microsoft_WDF_UMDF_Version

Sections

.text
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WUDFPlatform.dll
.dll windows:10 windows x64 arch:x64

d76c120d2828af548d8d0ef001583b81

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:13:0b:94:77:d5:41:1c:d3:07:ca:47:4d:71:54:de:c0:66:71:4c:17:89:bc:42:bd:18:e0:67:a5:9f:1b:ec
Signer

Actual PE Digest

0f:13:0b:94:77:d5:41:1c:d3:07:ca:47:4d:71:54:de:c0:66:71:4c:17:89:bc:42:bd:18:e0:67:a5:9f:1b:ec

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WUDFPlatform.pdb

Imports

api-ms-win-core-crt-l1-1-0

memcpy
_wcslwr_s
wcscpy_s
_wcsnicmp
iswdigit
wcscspn
iswalnum
_vsnwprintf_s
__C_specific_handler
memset

api-ms-win-core-crt-l2-1-0

wprintf
_purecall
_initterm_e
_initterm

ntdll

DbgPrintEx
NtAlpcSetInformation
NtAlpcDeleteResourceReserve
NtClose
NtAlpcConnectPort
NtQuerySystemInformation
DbgBreakPoint
AlpcGetMessageAttribute
RtlNtStatusToDosError
NtAlpcCancelMessage
RtlAnsiStringToUnicodeString
RtlInitAnsiString
NtAlpcCreateResourceReserve
NtAlpcCreateSectionView
NtAlpcCreateSecurityContext
NtAlpcDeleteSectionView
NtAlpcAcceptConnectPort
AlpcInitializeMessageAttribute
NtAlpcCreatePort
NtAlpcDisconnectPort
NtAlpcSendWaitReceivePort
NtAlpcCreatePortSection
RtlLookupFunctionEntry
RtlCaptureStackBackTrace
RtlCreateServiceSid
RtlInitUnicodeString
RtlSetDaclSecurityDescriptor
NtAlpcImpersonateClientOfPort
NtCancelSynchronousIoFile
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
NtCreateDirectoryObject
NtAlpcDeleteSecurityContext
RtlCreateAcl
RtlLengthSid
RtlVirtualUnwind
LdrEnumerateLoadedModules
NtAlpcDeletePortSection
vDbgPrintEx
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

CreateThread
OpenProcessToken
GetCurrentThreadId
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentProcessId
TerminateProcess
GetProcessId
TlsFree
GetCurrentProcess

api-ms-win-core-file-l1-1-0

WriteFile
DeleteFileW
GetFullPathNameW
GetLongPathNameW
CreateFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CancelWaitableTimer
OpenEventW
CreateEventW
CreateSemaphoreExW
WaitForSingleObject
ReleaseSemaphore
SetWaitableTimer
SetEvent
ResetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
CreateWaitableTimerExW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-io-l1-1-0

CancelIoEx

api-ms-win-security-base-l1-1-0

AllocateLocallyUniqueId
AllocateAndInitializeSid
SetTokenInformation
AddAccessAllowedAce
CreateWellKnownSid
GetTokenInformation
InitializeAcl
AdjustTokenPrivileges

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
LoadLibraryExA
GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

sspicli

GetUserNameExW
LogonUserExExW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-misc-l1-1-0

lstrcmpW
LocalFree
LocalAlloc

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-psapi-obsolete-l1-1-0

K32GetModuleInformation

api-ms-win-eventing-legacy-l1-1-0

EnableTrace

devobj

DevObjGetDeviceRegistryProperty

api-ms-win-downlevel-kernel32-l1-1-0

VirtualProtect
VirtualQuery
ExpandEnvironmentStringsW

Exports

Exports

ClearPlatformTestingCallbacks
DllGetClassObject
DllMain
GetAndInitializePlatformObject
GetPlatformObject
InitializePlatformLibrary
PlatformSimulateUnhandledException
PlatformUnhandledExceptionFilter
SetPlatformErrorReportingCallbacks
SetPlatformTestingCallbacks
ShutdownPlatformLibrary
WdfGetLpcInterface
WudfDebugBreakPoint
WudfIsAnyDebuggerPresent
WudfIsKernelDebuggerPresent
WudfIsUserDebuggerPresent
WudfWaitForDebugger

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WUDFx.dll
.dll windows:10 windows x64 arch:x64

5b6d8445f7726c8386d6d00d1dffb70d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WUDFx.pdb

Imports

msvcrt

wcschr
realloc
_wcsicmp
strchr
wcsncpy_s
_onexit
memmove
memcpy
_callnewh
_XcptFilter
_amsg_exit
_initterm
_errno
_lock
_unlock
_vsnprintf_s
__dllonexit
malloc
free
_purecall
memcpy_s
__C_specific_handler
_vsnwprintf_s
memset

ntdll

RtlInitAnsiString
RtlCompareMemory
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DbgPrint
RtlInitUnicodeString
RtlQueryRegistryValues

kernel32

CreateWaitableTimerA
GetVersionExA
LoadLibraryA
CancelWaitableTimer
RegisterWaitForSingleObject
OutputDebugStringA
GetTickCount
SetLastError
GetModuleHandleA
SleepEx
UnregisterWaitEx
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
HeapFree
GetCurrentThreadId
CloseThreadpoolWait
CreateEventW
GetLastError
WaitForThreadpoolWaitCallbacks
SetEvent
CreateThreadpoolWait
CloseHandle
SetThreadpoolWait
HeapAlloc
GetProcessHeap
DebugBreak
CloseThreadpool
CreateThreadpool
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
GetSystemInfo
ResetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SizeofResource
GetModuleFileNameW
InitializeCriticalSection
MultiByteToWideChar
RaiseException
FindResourceExW
LoadResource
GetProcAddress
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
WaitForSingleObject
GetCurrentThread
GetCurrentProcess
DuplicateHandle
WaitForSingleObjectEx
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetSystemTimeAsFileTime
GetModuleHandleExW
DisableThreadLibraryCalls
ExpandEnvironmentStringsW
Sleep
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
SetWaitableTimer

advapi32

EventUnregister
EventWriteTransfer
TraceMessage
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegEnumValueW
EventRegister
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessageVa
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW

oleaut32

VarUI4FromStr
SysStringLen

user32

CharNextW
UnregisterClassA

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Microsoft_WDF_UMDF_Version

Sections

.text
Size: 433KB - Virtual size: 433KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEWdfV
Size: 512B - Virtual size: 62B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WUDFx02000.dll
.dll windows:10 windows x64 arch:x64

dccafefcd6bba0ee7cd2056c86cd3c65

Code Sign

33:00:00:04:0a:87:d0:ea:67:86:e3:6b:07:00:00:00:00:04:0a
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-01-2023 19:22

Not After

15-12-2023 19:22

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:5d:ab:d6:01:55:58:0f:b4:ae:a2:64:0e:88:30:86:fb:8d:0e:57:15:97:c8:87:2e:7d:54:31:3b:66:b6:ad
Signer

Actual PE Digest

b8:5d:ab:d6:01:55:58:0f:b4:ae:a2:64:0e:88:30:86:fb:8d:0e:57:15:97:c8:87:2e:7d:54:31:3b:66:b6:ad

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Wudfx02000.pdb

Imports

api-ms-win-core-crt-l1-1-0

memcmp
toupper
memcpy
memmove
_vsnwprintf_s
memset
memmove_s
memcpy_s
__C_specific_handler

api-ms-win-core-crt-l2-1-0

_initterm_e
__dllonexit3
_onexit
_purecall
_initterm

ntdll

RtlInitAnsiString
RtlQueryRegistryValues
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString
RtlCompareMemory
ZwDeleteValueKey
DbgBreakPoint
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
RtlCaptureStackBackTrace
ZwQueryKey
RtlPrefixUnicodeString
DbgPrintEx

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-1-0

GetModuleFileNameA
GetModuleHandleW
GetProcAddress
FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-synch-l1-1-0

ReleaseMutex
WaitForSingleObjectEx
ReleaseSRWLockShared
CreateMutexExW
CreateSemaphoreExW
ResetEvent
InitializeCriticalSectionEx
ReleaseSemaphore
AcquireSRWLockShared
ReleaseSRWLockExclusive
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateEventW
SetEvent
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SleepEx
AcquireSRWLockExclusive

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
SetThreadpoolThreadMaximum
CloseThreadpool
CreateThreadpool
SetThreadpoolThreadMinimum
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventProviderEnabled

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessageVa
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

rpcrt4

UuidCreate

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-misc-l1-1-0

LocalAlloc

Exports

Exports

FxFrameworkEntryUm
Microsoft_WDF_UMDF_Version

Sections

.text
Size: 571KB - Virtual size: 571KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEWdfV
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WWAHost.exe
.exe windows:10 windows x64 arch:x64

776d81c69e48c4b5a6d3d63c53c60259

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-09-2021 18:23

Not After

01-09-2022 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:85:6b:ef:e0:d4:b3:65:21:b3:37:52:5b:c8:54:99:ee:b8:da:37:9e:99:83:18:63:84:9f:60:53:e7:e8:42
Signer

Actual PE Digest

2d:85:6b:ef:e0:d4:b3:65:21:b3:37:52:5b:c8:54:99:ee:b8:da:37:9e:99:83:18:63:84:9f:60:53:e7:e8:42

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WWAHost.pdb

Imports

msvcrt

wcsstr
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
toupper
??1type_info@@UEAA@XZ
_exit
exit
__CxxFrameHandler3
_initterm
__set_app_type
strchr
_CxxThrowException
__getmainargs
floorf
memcmp
__C_specific_handler
_fmode
_commode
_vsnwprintf
memset
_lock
_unlock
__dllonexit
_onexit
memmove_s
wcsncmp
_purecall
wcschr
__setusermatherr
_amsg_exit
_XcptFilter
realloc
_itow_s
free
_cexit
memcpy
malloc
memmove
?terminate@@YAXXZ
memcpy_s
_wcsicmp
wcscmp

api-ms-win-appmodel-runtime-internal-l1-1-0

GetCurrentPackageApplicationContext
GetCurrentPackageContext
GetPackageProperty
GetPackagePropertyString
GetPackageOSMaxVersionTested
GetPackageApplicationPropertyString

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
GetProcAddress
LoadStringW
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
ReleaseSemaphore
SleepEx
CreateEventW
InitializeCriticalSection
WaitForMultipleObjectsEx
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexExW
AcquireSRWLockShared
CreateEventExW
SetEvent

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
CreateThread
OpenProcessToken
ExitProcess
GetCurrentProcessId
GetProcessTimes

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage
UnregisterTraceGuids

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventProviderEnabled
EventUnregister
EventRegister

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceInitialize
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegGetValueW

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetTokenInformation

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolWait
CreateThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork

api-ms-win-core-path-l1-1-0

PathCchCombineEx

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileAttributesW
FindClose
FindFirstFileW
WriteFile
GetFileSizeEx

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

profapi

ord104

api-ms-win-shcore-scaling-l1-1-1

ord244

combase

ord87
ord110
ord111
ord157
ord160
ord88
ord90
ord86

iertutil

ord797
CreateUri
CreateIUriBuilder
ord174
ord177
ord792

shcore

SHCreateMemStream
ord246
ord230
ord232
ord233
ord245

ntdll

NtQueryInformationToken
RtlInitUnicodeString
NtQueryInformationProcess
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlGetVersion
NtQuerySystemInformation
RtlFreeHeap
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlConvertSidToUnicodeString
RtlIsCriticalSectionLockedByThread
RtlLeaveCriticalSection
RtlIsCriticalSectionLocked
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlQueryPackageClaims
NtSetInformationProcess

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-ro-typeresolution-l1-1-0

RoResolveNamespace
RoGetMetaDataFile

api-ms-win-security-capability-l1-1-0

CapabilityCheck

Sections

.text
Size: 628KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WWanAPI.dll
.dll windows:10 windows x64 arch:x64

62426dff5b4dd2cfcc29d2b43cc5bd2d

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:30

Not After

03-03-2021 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:67:7c:02:4e:d9:e7:b2:48:5e:3a:67:f5:fe:76:2e:a2:b1:02:b1:af:9f:27:b7:ef:b1:a6:21:40:e9:d7:39
Signer

Actual PE Digest

50:67:7c:02:4e:d9:e7:b2:48:5e:3a:67:f5:fe:76:2e:a2:b1:02:b1:af:9f:27:b7:ef:b1:a6:21:40:e9:d7:39

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wwanapi.pdb

Imports

msvcrt

_onexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_lock
memcmp
memcpy
memmove
__dllonexit
__CxxFrameHandler3
_amsg_exit
_unlock
wcsncmp
??0exception@@QEAA@XZ
_XcptFilter
_CxxThrowException
memmove_s
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
memcpy_s
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
wcscpy_s
calloc
_purecall
__C_specific_handler
?name@type_info@@QEBAPEBDXZ
_wtoi
iswdigit
toupper
memset

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
VariantInit
VariantClear
VariantChangeType
SysAllocString
SafeArrayCreate
SafeArrayCopy
SafeArrayGetLBound
SafeArrayPutElement
SysStringLen
SafeArrayDestroy
SysFreeString
GetRecordInfoFromGuids
SafeArrayCreateEx
SafeArrayGetUBound
SafeArrayRedim

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSection
CreateEventW
LeaveCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventProviderEnabled
EventSetInformation

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

StringFromGUID2
StringFromIID
CoInitializeEx
IIDFromString
CoUninitialize
CoTaskMemFree
CoSetProxyBlanket
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
CreateThread
GetCurrentProcess
OpenThreadToken

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-private-l1-1-0

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications
I_QueryTagInformation

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-handle-l1-1-0

CloseHandle

ntdll

RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryPackageIdentity
RtlIpv6AddressToStringW
RtlSubscribeWnfStateChangeNotification
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
RtlQueryWnfStateData
RtlIpv4AddressToStringW

api-ms-win-security-base-l1-1-0

ImpersonateSelf
RevertToSelf
GetTokenInformation

api-ms-win-appmodel-runtime-l1-1-0

PackageFamilyNameFromFullName

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

wwapi

Wwan2QueryDeviceServiceSupportedCommands
WwanSetProfile
WwanSetSmsConfiguration
WwanSmsDelete
WwanSmsRead
WwanRegister
WwanDisconnect
Wwan2SendDeviceServiceCommand
WwanSetInterface
WwanScan
Wwan2CloseDeviceServiceCommandSession
Wwan2WriteDeviceServiceData
WwanGetProfileIstream
WwanGetProfileList
WwanQueryInterface
WwanEnumerateInterfaces
WwanRegisterNotification
Wwan2OpenDeviceServiceCommandSession
Wwan2CloseHandle
Wwan2SubscribePowerStateEvents
Wwan2RegisterNotification
WwanOpenHandle
WwanCloseHandle
Wwan2CloseDeviceServiceDataSession
Wwan2OpenHandle
Wwan2OpenDeviceServiceDataSession
Wwan2EnumerateDeviceServices
Wwan2QueryInterfaces
WwanSmsSend
WwanConnect
WwanDeleteProfile

crypt32

CryptProtectData
CryptUnprotectData

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WWanHC.dll
.dll windows:10 windows x64 arch:x64

c35b63755b14592ff6b7c81f17517477

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wwanHC.pdb

Imports

msvcrt

memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??1type_info@@UEAA@XZ
_lock
_unlock
??3@YAXPEAX@Z
memmove
_onexit
_XcptFilter
memset
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
_amsg_exit
_initterm
__dllonexit
?terminate@@YAXXZ
wcsnlen
memcpy_s
_vscwprintf
vswprintf_s
wcsstr
toupper
memmove_s
free
malloc
_purecall
__C_specific_handler
__CxxFrameHandler3
wcscmp

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

kernel32

HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
SizeofResource
LockResource
LoadResource
FindResourceExW
FormatMessageW
LocalFree
GetModuleFileNameA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LocalAlloc
HeapSize
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
DisableThreadLibraryCalls
GetLastError
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapReAlloc

advapi32

CloseServiceHandle
EventRegister
EventWriteTransfer
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
EventProviderEnabled
StartServiceW
EventUnregister
EventSetInformation

user32

UnregisterClassA
LoadStringW

wwapi

WwanCloseHandle
WwanQueryInterface
WwanFreeMemory
WwanSetInterface
WwanOpenHandle

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WlanMediaManager.dll
.dll windows:10 windows x64 arch:x64

6787c807ad6a1c7586259da6b9005e1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WlanMediaManager.pdb

Imports

msvcrt

_wsetlocale
__crtLCMapStringW
__crtCompareStringW
_wcsdup
memset
abort
memcmp
calloc
__pctype_func
_ismbblead
___lc_handle_func
___mb_cur_max_func
_errno
___lc_collate_cp_func
setlocale
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
toupper
time
swprintf_s
_wtol
_wgetenv
_wtoi
sprintf_s
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
strchr
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
wcscmp
_wcsicmp
realloc
memmove_s
??_V@YAXPEAX@Z
wcscpy_s
strcmp
??1type_info@@UEAA@XZ
___lc_codepage_func
_onexit
__dllonexit
_unlock
_lock
mbtowc
iswctype
towlower
wcstombs_s
strncmp
mbstowcs_s
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
__CxxFrameHandler3

ntdll

RtlNtStatusToDosError
EtwTraceMessage
NtQueryInformationToken
RtlUnsubscribeWnfStateChangeNotification
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
RtlIpv6AddressToStringExW
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv4AddressToStringExW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
EnterCriticalSection
ReleaseSRWLockShared
CreateEventW
CreateEventExW
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockExclusive
CreateSemaphoreExW
InitializeSRWLock
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
SetEvent
ResetEvent

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

ProcessIdToSessionId
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
CreateThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetLocalTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventActivityIdControl
EventProviderEnabled
EventUnregister
EventSetInformation

rpcrt4

RpcBindingBind
RpcBindingFree
RpcExceptionFilter
NdrClientCall3
RpcBindingCreateW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree
LocalAlloc

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegGetValueW
RegQueryValueExW

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-file-l1-1-0

WriteFile
CreateFileW
CompareFileTime
FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask

api-ms-win-security-accesshlpr-l1-1-0

FreeTransientObjectSecurityDescriptor

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-service-private-l1-1-0

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageId

api-ms-win-core-registry-l2-1-0

RegEnumKeyW

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
CheckTokenMembership
DuplicateToken
GetTokenInformation

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 532KB - Virtual size: 531KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WmiMgmt.msc
.xml
Ex_PE_v3.1.9/CMap/libs/WmpDui.dll
.dll windows:10 windows x64 arch:x64

aa89fff9644c3a9f5ba2213a06bd55d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMPDUI.pdb

Imports

msvcrt

ceil
cosf
floor
log10f
memcpy
memmove
memset
pow
_resetstkoflw
_wcsicmp
_beginthreadex
_purecall
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
qsort
_wcsnicmp
sinf

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

kernel32

TlsSetValue
GetModuleFileNameA
LoadLibraryA
WaitForMultipleObjectsEx
GetExitCodeThread
ResetEvent
InitializeCriticalSection
GetSystemInfo
TlsFree
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
VirtualFree
DelayLoadFailureHook
ResolveDelayLoadedAPI
MulDiv
GetVersionExA
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
TlsGetValue
SetLastError
GetLastError
FreeLibrary
QueryPerformanceFrequency
TlsAlloc
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
FindAtomW
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetAtomNameW
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
SetEvent
CloseHandle
CreateEventA
WaitForSingleObject
InitializeSListHead
InterlockedPushEntrySList
QueryDepthSList
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedPopEntrySList
InterlockedFlushSList
DeleteAtom
AddAtomW

user32

PostThreadMessageA
DrawTextW
WindowFromDC
TranslateMessage
GetKeyboardState
GetParent
EndPaint
BeginPaint
GetPointerType
PostMessageA
GetMessagePos
GetCursorInfo
TrackMouseEvent
SetCapture
InvalidateRect
GetDC
GetWindowLongPtrW
CallWindowProcA
SetWindowLongPtrA
GetWindowDC
ReleaseCapture
ChildWindowFromPointEx
GetCapture
ScreenToClient
GetCursorPos
SetFocus
GetFocus
GetWindowRect
ReleaseDC
GetDoubleClickTime
PtInRect
GetKeyState
GetSystemMetrics
OffsetRect
UnionRect
IsRectEmpty
IntersectRect
MsgWaitForMultipleObjectsEx
FillRect
CallWindowProcW
DefWindowProcA
SetWindowLongPtrW
GetWindowLongPtrA
WaitMessage
PeekMessageW
PeekMessageA
GetMessageW
GetMessageA
SetRectEmpty
SendMessageA
SystemParametersInfoA
GetMonitorInfoW
ClientToScreen
GetClientRect
IsWindow
DispatchMessageA
SendMessageW
GetMessageTime
RegisterWindowMessageA

gdi32

CreateRectRgn
CreateDCA
GetObjectType
GetDIBits
GetSystemPaletteEntries
CombineRgn
CreatePolygonRgn
SelectClipRgn
StretchDIBits
SetViewportOrgEx
GetObjectA
OffsetRgn
GetViewportOrgEx
GetRandomRgn
SetBrushOrgEx
GetBrushOrgEx
GetCurrentObject
GetDeviceCaps
SaveDC
ModifyWorldTransform
GetTextExtentExPointW
GetTextExtentPoint32W
CreateFontIndirectW
ExtTextOutW
TextOutW
GdiFlush
CreateDIBSection
GetClipBox
SetRectRgn
BitBlt
ExtSelectClipRgn
IntersectClipRect
GetClipRgn
GetWorldTransform
RealizePalette
SelectPalette
SetWorldTransform
SetGraphicsMode
GetWindowExtEx
GetViewportExtEx
DeleteDC
PatBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreatePen
CreateSolidBrush
DeleteObject
RestoreDC
GetPixel

advapi32

GetTraceEnableLevel
RegisterTraceGuidsA
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
TraceEvent

Exports

Exports

AddGadgetMessageHandler
AddLayeredRef
AdjustClipInsideRef
AttachWndProcA
AttachWndProcW
AutoTrace
BuildAnimation
BuildDropTarget
BuildInterpolation
CacheDWriteRenderTarget
ChangeCurrentAnimationScenario
ClearPushedOpacitiesFromGadgetTree
ClearTopmostVisual
CreateAction
CreateGadget
CustomGadgetHitTestQuery
DUserBuildGadget
DUserCastClass
DUserCastDirect
DUserCastHandle
DUserDeleteGadget
DUserFindClass
DUserFlushDeferredMessages
DUserFlushMessages
DUserGetAlphaPRID
DUserGetGutsData
DUserGetRectPRID
DUserGetRotatePRID
DUserGetScalePRID
DUserInstanceOf
DUserPostEvent
DUserPostMethod
DUserRegisterGuts
DUserRegisterStub
DUserRegisterSuper
DUserSendEvent
DUserSendMethod
DUserStopAnimation
DUserStopPVLAnimation
DeleteHandle
DestroyPendingDCVisuals
DetachGadgetVisuals
DetachWndProc
DisableContainerHwnd
DllMain
DrawGadgetTree
EnsureAnimationsEnabled
EnsureGadgetTransInitialized
EnumGadgets
FindGadgetFromPoint
FindGadgetMessages
FindStdColor
FireGadgetMessages
ForwardGadgetMessage
FreeGdiDxInteropStagingBuffer
GadgetTransCompositionChanged
GadgetTransSettingChanged
GetActionTimeslice
GetCachedDWriteRenderTarget
GetDUserModule
GetDebug
GetFinalAnimatingPosition
GetGadget
GetGadgetAnimation
GetGadgetBitmap
GetGadgetBufferInfo
GetGadgetCenterPoint
GetGadgetFlags
GetGadgetFocus
GetGadgetLayerInfo
GetGadgetMessageFilter
GetGadgetProperty
GetGadgetRect
GetGadgetRgn
GetGadgetRootInfo
GetGadgetRotation
GetGadgetScale
GetGadgetSize
GetGadgetStyle
GetGadgetTicket
GetGadgetVisual
GetMessageExA
GetMessageExW
GetStdColorBrushF
GetStdColorBrushI
GetStdColorF
GetStdColorI
GetStdColorName
GetStdColorPenF
GetStdColorPenI
GetStdPalette
InitGadgetComponent
InitGadgets
InvalidateGadget
InvalidateLayeredDescendants
IsGadgetParentChainStyle
IsInsideContext
IsStartDelete
LookupGadgetTicket
MapGadgetPoints
PeekMessageExA
PeekMessageExW
RegisterGadgetMessage
RegisterGadgetMessageString
RegisterGadgetProperty
ReleaseDetachedObjects
ReleaseLayeredRef
ReleaseMouseCapture
RemoveClippingImmunityFromVisual
RemoveGadgetMessageHandler
RemoveGadgetProperty
ResetDUserDevice
ScheduleGadgetTransitions
SetActionTimeslice
SetAtlasingHints
SetGadgetBufferInfo
SetGadgetCenterPoint
SetGadgetFillF
SetGadgetFillI
SetGadgetFlags
SetGadgetFocus
SetGadgetFocusEx
SetGadgetLayerInfo
SetGadgetMessageFilter
SetGadgetOrder
SetGadgetParent
SetGadgetProperty
SetGadgetRect
SetGadgetRootInfo
SetGadgetRotation
SetGadgetScale
SetGadgetStyle
SetHardwareDeviceUsage
SetMinimumDCompVersion
SetRestoreCachedLayeredRefFlag
SetTransitionVisualProperties
SetWindowResizeFlag
UnregisterGadgetMessage
UnregisterGadgetMessageString
UnregisterGadgetProperty
UtilBuildFont
UtilDrawBlendRect
UtilDrawOutlineRect
UtilGetColor
UtilSetBackground
WaitMessageEx

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WofTasks.dll
.dll regsvr32 windows:10 windows x64 arch:x64

e8b3c57146cb712698e9b84b63abee03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WofTasks.pdb

Imports

msvcrt

wcscmp
memcpy
memset
wcschr
__C_specific_handler
_initterm
_amsg_exit
_vsnwprintf
_XcptFilter
_callnewh
malloc
free
swprintf_s
memcmp
_wcsdup

kernel32

TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
HeapFree
GetSystemInfo
HeapAlloc
GetProcessHeap
RtlCompareMemory
ReadFile
GetFileSizeEx
WriteFile
DeviceIoControl
SetEndOfFile
CreateFileW
GetLastError
CloseHandle
SetFilePointerEx
FlushFileBuffers
GetModuleHandleExW
SetThreadPriority
WaitForSingleObject
FreeLibraryAndExitThread
ResumeThread
CreateEventW
DisableThreadLibraryCalls
GetCurrentThread
DeleteFileW
CreateThread
GetOverlappedResult
GetWindowsDirectoryW
FreeLibrary
GetCurrentProcess

ntdll

WinSqmSetDWORD
RtlQueryWnfStateData
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification

bcrypt

BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptProcessMultiOperations
BCryptGetProperty
BCryptHashData
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptCreateMultiHash
BCryptCreateHash

fveapi

FveGetStatusW

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegDeleteValueW
RegFlushKey
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW

api-ms-win-eventing-provider-l1-1-0

EventEnabled
EventRegister
EventWrite
EventUnregister

api-ms-win-core-file-l1-1-0

GetVolumePathNameW

api-ms-win-core-io-l1-1-0

CancelIoEx

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WofUtil.dll
.dll windows:10 windows x64 arch:x64

4f543a1c80adae3fec33e95172e09117

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wofutil.pdb

Imports

msvcrt

wcschr
printf
_XcptFilter
_vsnwprintf
__C_specific_handler
_initterm
malloc
free
_amsg_exit
memcpy
memset

ntdll

NtClose
RtlDosPathNameToNtPathName_U
NtQueryVolumeInformationFile
RtlFreeHeap
RtlDecompressBufferEx
RtlCompressBuffer
RtlAcquirePrivilege
NtPowerInformation
RtlGetCompressionWorkSpaceSize
RtlGetNtProductType
RtlInitializeCriticalSection
RtlGetPersistedStateLocation
RtlRandom
RtlAllocateHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtCreateFile
NtQueryInformationFile
RtlNtStatusToDosError
RtlDosPathNameToNtPathName_U_WithStatus
NtSetInformationThread

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest

api-ms-win-core-kernel32-legacy-l1-1-0

LoadLibraryW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentThread
TerminateProcess
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetTickCount

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-file-l1-1-0

FindClose
GetDriveTypeW
GetFinalPathNameByHandleW
GetVolumePathNameW
CreateFileW

api-ms-win-core-synch-l1-1-0

CreateMutexW
CreateEventW
SetEvent
WaitForSingleObject
ReleaseMutex

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetProcAddress

api-ms-win-core-psapi-l1-1-0

K32GetPerformanceInfo

Exports

Exports

WofEnumEntries
WofFileEnumFiles
WofGetDriverVersion
WofIsExternalFile
WofSetFileDataLocation
WofShouldCompressBinaries
WofWimAddEntry
WofWimEnumFiles
WofWimRemoveEntry
WofWimSuspendEntry
WofWimUpdateEntry

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WordBreakers.dll
.dll windows:10 windows x64 arch:x64

ccbdc70f0955a4fe11747b2e0ff68d26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WordBreakers.pdb

Imports

msvcrt

iswalnum
_vsnwprintf
memcpy_s
memcpy
iswspace
_CxxThrowException
?what@exception@@UEBAPEBDXZ
__C_specific_handler
memmove
??1type_info@@UEAA@XZ
??1exception@@UEAA@XZ
_XcptFilter
_amsg_exit
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_initterm
free
??0exception@@QEAA@XZ
_lock
_onexit
_purecall
_unlock
_callnewh
__dllonexit
malloc
??3@YAXPEAX@Z
__CxxFrameHandler3
memset

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-synch-l1-1-0

ReleaseMutex
CreateMutexExW
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSemaphore
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

GetStringTypeExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WorkFolders.exe
.exe windows:10 windows x64 arch:x64

7468ed9a85006965c01f519c0d2c8e9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WorkFolders.pdb

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventUnregister
EventWriteTransfer

msvcrt

?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
_onexit
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
_unlock
??1type_info@@UEAA@XZ
_vsnwprintf
malloc
_wcsicmp
_purecall
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_lock
?what@exception@@UEBAPEBDXZ
__dllonexit
__CxxFrameHandler3
??3@YAXPEAX@Z
__wgetmainargs
memset

shell32

ShellExecuteW

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoCreateInstance

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep

dmenrollengine

ord10
EnrollEngineInitialize

policymanager

PolicyManager_GetPolicyInt

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WorkFoldersGPExt.dll
.dll windows:10 windows x64 arch:x64

f13f4a41a56a598256ecba1123436558

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WorkFoldersGPExt.pdb

Imports

msvcrt

_callnewh
_wcsicmp
??_V@YAXPEAX@Z
__CxxFrameHandler3
_vsnwprintf
_onexit
_unlock
_lock
__C_specific_handler
??3@YAXPEAX@Z
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
__dllonexit
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
memcpy_s
??1type_info@@UEAA@XZ
memset

advapi32

DuplicateTokenEx
RegDeleteValueW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegDeleteTreeW
GetUserNameW
ImpersonateLoggedOnUser
EventWriteTransfer
TraceMessage
RegCreateKeyExW
RegCloseKey
EventRegister
EventUnregister
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RevertToSelf

kernel32

SetUnhandledExceptionFilter
RtlVirtualUnwind
TerminateProcess
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
UnhandledExceptionFilter
CreateThread
HeapAlloc
FreeLibraryAndExitThread
HeapFree
GetProcessHeap
CloseHandle
LoadLibraryExW
GetCurrentProcess
ExpandEnvironmentStringsW
FormatMessageW
GetLastError
FreeLibrary

ole32

CoUninitialize
CoInitializeEx

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
VariantInit
SysAllocStringByteLen
SysAllocString
SysStringLen
SysStringByteLen

userenv

ProcessGroupPolicyCompleted
ExpandEnvironmentStringsForUserW

shell32

SHGetDesktopFolder
ord526
SHChangeNotify

dmenrollengine

EnrollEngineInitialize
ord10

policymanager

PolicyManager_GetPolicyInt

Exports

Exports

ProcessGroupPolicy

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WorkFoldersRes.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WorkFoldersShell.dll
.dll regsvr32 windows:10 windows x64 arch:x64

6b5034df4bd6bee368b3d94897ef6217

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WorkFoldersShell.pdb

Imports

msvcrt

??3@YAXPEAX@Z
_wcsicmp
memcmp
realloc
_errno
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_lock
?terminate@@YAXXZ
_wcsnicmp
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
wcscat_s
wcscpy_s
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
_initterm
_vsnprintf_s
_vsnwprintf
??_V@YAXPEAX@Z
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
_purecall
__CxxFrameHandler3
_unlock
memset

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
RegGetValueW
GlobalUnlock
WakeAllConditionVariable
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
lstrcmpiW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
LeaveCriticalSection
RaiseException
EnterCriticalSection
MultiByteToWideChar
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
FormatMessageW
SleepConditionVariableSRW
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
GetThreadLocale
SetThreadLocale
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GlobalLock
RegNotifyChangeKeyValue
LocalFree
GetTimeFormatEx
GetDateFormatEx
ResumeThread
GetCurrentThreadId
CreateThread
CreateEventW
ResetEvent
SetEvent
SizeofResource
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
FileTimeToLocalFileTime
FileTimeToSystemTime

advapi32

RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
EventRegister
EventUnregister
TraceMessage
RegEnumKeyW

ole32

ReleaseStgMedium
CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoQueryProxyBlanket
CoSetProxyBlanket

oleaut32

SysAllocString
LoadTypeLi
SysFreeString
DispCallFunc
RegisterTypeLi
SysStringLen
VarUI4FromStr
UnRegisterTypeLi
VariantInit
VariantClear
LoadRegTypeLi

user32

DispatchMessageW
LoadStringW
LoadImageW
MsgWaitForMultipleObjects
InsertMenuItemW
GetMenuItemCount
GetMenuItemInfoW
PostThreadMessageW
InsertMenuW
PeekMessageW
CharNextW
UnregisterClassA

gdi32

DeleteObject

shell32

SHGetDesktopFolder
SHGetPathFromIDListW
DragQueryFileW
ord526
SHChangeNotify

propsys

PSCreateMemoryPropertyStore

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WorkfoldersControl.dll
.dll windows:10 windows x64 arch:x64

dc98a6c982a0361be8f4988ca140ef61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WorkfoldersControl.pdb

Imports

msvcrt

_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
memcpy
memmove
setlocale
___lc_collate_cp_func
_errno
_lock
_unlock
??3@YAXPEAX@Z
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ismbblead
__pctype_func
memcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
abort
memset
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
free
realloc
strchr
iswspace
__C_specific_handler
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
_vsnprintf_s
memcpy_s
_wsetlocale
__crtLCMapStringW
__crtCompareStringW
_vsnwprintf
_purecall
wcstod
wcstoul
_wcstoi64
_strnicmp
_vsnprintf
_wcsnicmp
_wcsicmp
__CxxFrameHandler3
?what@exception@@UEBAPEBDXZ
calloc
memmove_s
malloc
??0bad_cast@@QEAA@AEBV0@@Z
swprintf_s
_wcsdup

ntdll

EtwEventUnregister
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwEventRegister
EtwEventSetInformation
EtwEventWriteTransfer
EtwLogTraceEvent
LdrAddRefDll
RtlPcToFileHeader
RtlNtStatusToDosError
RtlLoadString

kernel32

IsDebuggerPresent
GetLastError
GetProcAddress
OutputDebugStringW
GetModuleHandleW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
InitOnceBeginInitialize
ReleaseSRWLockShared
CreateThreadpoolTimer
AcquireSRWLockShared
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
GetProcessHeap
CompareStringOrdinal
LoadLibraryExW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
GetCurrentThreadId
InitOnceComplete
GetExitCodeProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
SetLastError
CloseHandle
ReleaseSemaphore
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
RegGetValueW
GetLocaleInfoEx
GetVersionExW
GetProductInfo
ExpandEnvironmentStringsW
ReleaseMutex
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
InitializeCriticalSectionEx
GetStringTypeW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
WideCharToMultiByte
lstrcmpW
CreateEventExW
InitializeSRWLock
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
RegDeleteValueW
WaitForSingleObjectEx
FormatMessageW
MulDiv
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
GetModuleFileNameW
FindResourceExW
GlobalHandle
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CompareStringW
DeleteAtom
AddAtomW
GetTimeFormatEx
GetDateFormatEx
GetDiskFreeSpaceExW
GetComputerNameExW
LocalFree
CreateThread
CreateEventW
RaiseException
ResetEvent
SetEvent
InitOnceExecuteOnce
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
FreeLibrary
LeaveCriticalSection
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
HeapAlloc

ole32

CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
OleInitialize
CoTaskMemAlloc
OleUninitialize
CoTaskMemFree
CoUninitialize
CoInitializeEx
StringFromGUID2
CoQueryProxyBlanket
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
DispCallFunc
SysStringByteLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarBstrCmp
VariantClear
VariantInit
SysAllocStringLen
SysStringLen

gdi32

BitBlt
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps

user32

UnregisterClassA
GetSystemMetrics
MapDialogRect
SetWindowContextHelpId
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetClassNameW
GetSysColor
CharNextW
RedrawWindow
GetClassInfoExW
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
InvalidateRgn
CallWindowProcW
InvalidateRect
GetDC
ReleaseDC
GetDesktopWindow
DestroyAcceleratorTable
GetWindowLongW
SetWindowLongW
LoadCursorW
RegisterClassExW
DialogBoxIndirectParamW
SetWindowPos
SetWindowsHookExW
SetWindowLongPtrW
EndDialog
GetClientRect
GetWindowRect
IsWindow
DispatchMessageW
SetWindowTextW
SendDlgItemMessageW
GetDlgItem
CallNextHookEx
UnhookWindowsHookEx
CloseClipboard
DestroyWindow
PostThreadMessageW
LoadStringW
SendMessageW
GetWindowLongPtrW
SystemParametersInfoW
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetMessagePos
GetSubMenu
LoadMenuW
DefWindowProcW
GetKeyState
PostMessageW
MsgWaitForMultipleObjects
PeekMessageW
SetForegroundWindow
ShowWindow
GetAncestor
CreateWindowExW
DestroyIcon
CopyIcon
LoadImageW

propsys

PSPropertyBag_ReadInt
PSPropertyBag_ReadDWORD
PSPropertyBag_WriteDWORD
PSPropertyBag_Delete
PSPropertyBag_ReadGUID
PSPropertyBag_ReadStr
PSPropertyBag_ReadBOOL
PSPropertyBag_WriteGUID
PSPropertyBag_WriteStr
PSPropertyBag_WriteBOOL
PSPropertyBag_WriteUnknown
PSPropertyBag_ReadUnknown

advapi32

GetTraceEnableFlags
EventUnregister
EventRegister
EventSetInformation
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
RegEnumKeyW

dui70

?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
??1XProvider@DirectUI@@UEAA@XZ
??0XProvider@DirectUI@@QEAA@XZ
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z
UnInitThread
UnInitProcessPriv
InitThread
InitProcessPriv
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ
?GetUnset@Value@DirectUI@@SAPEAV12@XZ
?SetActive@Element@DirectUI@@QEAAJH@Z
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ
?Register@Element@DirectUI@@SAJXZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?EndDefer@Element@DirectUI@@QEAAXK@Z
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ
?AddRef@XProvider@DirectUI@@UEAAKXZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
??1CritSecLock@DirectUI@@QEAA@XZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??0ClassInfoBase@DirectUI@@QEAA@XZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
??0Element@DirectUI@@QEAA@XZ
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
??1Element@DirectUI@@UEAA@XZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?Release@Value@DirectUI@@QEAAXXZ
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?Click@Button@DirectUI@@SA?AVUID@@XZ
StrToID
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z
?Register@CCListView@DirectUI@@SAJXZ
?Initialize@CCListView@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?GetClassInfoPtr@CCListView@DirectUI@@SAPEAUIClassInfo@2@XZ
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?DefaultAction@CCBase@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?GetContentSize@CCListView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
??1CCListView@DirectUI@@UEAA@XZ
??0CCListView@DirectUI@@QEAA@XZ
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z

shlwapi

ord24
ord514
ord256
ord174
ord204
ord618
ord156
SHStrDupW
ord158
ord165
ord278
ord172
ord176
ord199
ord219

shell32

SHGetDesktopFolder
ord526
SHGetKnownFolderPath
SHChangeNotify
ShellExecuteExW
SHGetKnownFolderIDList
SHCreateItemFromIDList
ord155
ShellExecuteW
ord25
SHBindToObject
SHParseDisplayName
ord18

credui

CredUIPromptForWindowsCredentialsW
CredUnPackAuthenticationBufferW

uxtheme

SetWindowTheme

wininet

InternetSetOptionW

crypt32

CertOpenSystemStoreW
CertFindChainInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertFreeCertificateChain
CertCloseStore

policymanager

PolicyManager_GetPolicyInt

winhttp

WinHttpConnect
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpOpen
WinHttpReadData
WinHttpSetTimeouts
WinHttpSetOption
WinHttpSetCredentials
WinHttpQueryOption
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpCrackUrl

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 434KB - Virtual size: 433KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 255KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpAXHolder.dll
.dll windows:10 windows x64 arch:x64

3714d5e9a3152482648115f98e1a3c60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpaxholder.pdb

Imports

msvcrt

memmove
memcpy
__C_specific_handler
wcschr
_initterm
malloc
free
_amsg_exit
_XcptFilter
_onexit
__dllonexit
_unlock
_lock
memcpy_s
_vsnwprintf
_purecall
__CxxFrameHandler3
memset

chakra

MemProtectHeapRootAlloc
MemProtectHeapCreate
MemProtectHeapUnrootAndZero
MemProtectHeapDestroy
MemProtectHeapRootRealloc
MemProtectHeapDisableCollection

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

kernel32

WaitForMultipleObjectsEx
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetFileSizeEx
SetEndOfFile
SetFilePointer
SetFilePointerEx
WriteFile
ReadFile
DeleteFileW
CompareStringW
EnterCriticalSection
GetCurrentThread
DelayLoadFailureHook
ResolveDelayLoadedAPI
SetThreadDescription
WideCharToMultiByte
UnmapViewOfFile
MapViewOfFile
LoadLibraryW
GlobalSize
SetLastError
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CreateEventExW
GetModuleFileNameA
GetModuleHandleExW
CreateEventW
CloseHandle
GetProcAddress
GetModuleHandleW
DebugBreak
FormatMessageW
OutputDebugStringW
LocalFree
GetProcessHeap
IsDebuggerPresent
GetLastError
HeapSetInformation
RaiseFailFastException
RaiseException
SetUnhandledExceptionFilter
HeapFree
HeapReAlloc
HeapAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
WaitForSingleObjectEx
SetEvent
WaitForSingleObject
CreateThread
ResumeThread
WaitForMultipleObjects
ResetEvent
QueueUserAPC
InitOnceExecuteOnce
CreateJobObjectW
AssignProcessToJobObject
QueryInformationJobObject
SetInformationJobObject
RegisterWaitForSingleObject
UnregisterWaitEx
DuplicateHandle

shlwapi

ord12
ord219

user32

DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
LoadCursorW
CreateWindowExW
DestroyWindow
DefWindowProcW
UnregisterClassW
PostMessageW
GetWindowThreadProcessId
GetPropW
GetWindowRect
PtInRect
GetWindowLongPtrW
SetPropW
SetWindowLongPtrW
RemovePropW
MonitorFromRect
TranslateMessage
RegisterClassW
SetForegroundWindow

iertutil

ord597
ord791
ord795
ord57
ord58
ord700
ord793
ord398
ord594
ord56
ord650

rpcrt4

RpcServerInqBindingsEx
RpcEpRegisterNoReplaceW
RpcBindingVectorFree
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcBindingFree
NdrAsyncServerCall
Ndr64AsyncServerCallAll
RpcBindingCreateW
RpcBindingBind
RpcServerRegisterIf3
RpcServerUseProtseqEpW
I_RpcBindingInqLocalClientPID
RpcServerInqBindingHandle
Ndr64AsyncClientCall
RpcAsyncCancelCall
RpcAsyncCompleteCall
RpcAsyncInitializeHandle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString

Exports

Exports

CallBlockTabForDialogUntilActive
GetFlashShimHandler
RunAsAXHolder

Sections

.text
Size: 234KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpPortingLibrary.dll
.dll windows:10 windows x64 arch:x64

c778066289721a7dc1d6f05948329200

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpPortingLibrary.pdb

Imports

msvcrt

__C_specific_handler
_initterm
malloc
free
_XcptFilter
wcsncmp
wcsrchr
_vsnwprintf
wcschr
swscanf_s
_amsg_exit
memset

api-ms-win-appmodel-runtime-internal-l1-1-2

PackageFullNameFromProductId

api-ms-win-core-com-l1-1-0

CLSIDFromString
StringFromGUID2

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

Exports

Exports

CmAcquireConnection
CmApiDeinit
CmApiInit
CmCloseSession
CmCreateSession
CmGetFirstCandidateConnection
CmReleaseConnection
CmSetDataActivityState
GetAppStorageFolder
GetDeviceUniqueID
GetPhoneBuildInfo
GetStorageDeviceInfo
Is_AppXExecutionServiceReady_Available
Is_BatterySaverState_Available
Is_CmNet_Available
Is_GrantWPNoNetworkingRegistryAccess_Hack_Available
Is_OsBeginPostBootWorkState_Available
Is_ProvisioningCompleteState_Available
Is_ShellReadyInternalState_Available
Is_ShellStartReady_Available
Is_TaskScheduler_Available
Is_VoIPActiveCallState_Available
PackageFullNameFromProductIdAndVersion
PackageFullNameFromProductInfo
ProductInfoFromPackageFullName
QueryPhoneInformation
TaskSchedulerCreateSchedule
TaskSchedulerDeinit
TaskSchedulerDeleteSchedule
TaskSchedulerEnableSchedule
TaskSchedulerFreeSchedule
TaskSchedulerFreeScheduleStatistics
TaskSchedulerGetPublishStateName
TaskSchedulerGetSchedule
TaskSchedulerInit

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/Wpc.dll
.dll regsvr32 windows:10 windows x64 arch:x64

cf2c034b58733cb9d731f181389d0ec5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Wpc.pdb

Imports

msvcp_win

?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
_Cnd_destroy_in_situ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_wait
??0task_continuation_context@Concurrency@@AEAA@XZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?id@?$collate@G@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
_Cnd_init_in_situ
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?tolower@?$ctype@G@std@@QEBAGG@Z
??1_Locinfo@std@@QEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
_Wcscoll
_Wcsxfrm
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?width@ios_base@std@@QEAA_J_J@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?uncaught_exception@std@@YA_NXZ
?flags@ios_base@std@@QEBAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?rdstate@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?width@ios_base@std@@QEBA_JXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
_o__wcstoui64
memmove
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_isspace
_o_iswascii
_o_iswdigit
_o_iswlower
_o_iswxdigit
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__lock_file
_o__itoa_s
_o__fseeki64
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
strchr
wcschr
__std_type_info_compare
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
__RTDynamicCast
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
strncmp

shell32

SHGetFolderPathW
ShellExecuteExW
SHGetKnownFolderPath

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

CreateMutexExW
CreateSemaphoreExW
WaitForSingleObject
OpenSemaphoreW
SleepEx
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CreateEventExW
DeleteCriticalSection

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsDuplicateString
WindowsGetStringLen
WindowsTrimStringStart
WindowsSubstringWithSpecifiedLength
HSTRING_UserSize
HSTRING_UserMarshal
HSTRING_UserFree64
HSTRING_UserSize64
HSTRING_UserFree
HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64

api-ms-win-core-com-l1-1-0

CoCreateInstance
CreateStreamOnHGlobal
CoGetApartmentType
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoGetCallContext
CoGetCallerTID
CoWaitForMultipleHandles
CoTaskMemRealloc
CoTaskMemFree
CoUnmarshalInterface
CoMarshalInterface
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoUninitialize
CoSetProxyBlanket
CoInitializeEx
CLSIDFromString

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
GetRestrictedErrorInfo
RoTransformError
SetRestrictedErrorInfo

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventRegister

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegGetValueW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoActivateInstance
RoUninitialize
RoGetActivationFactory

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

ntdll

EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
EtwEventUnregister
EtwEventRegister

user32

RegisterClassExW
GetWindowLongPtrW
PostThreadMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
PostQuitMessage
TranslateMessage
DispatchMessageW
GetForegroundWindow
SetCursor
LoadCursorW
UnregisterClassW
LoadStringW

kernel32

GetFileTime
GetTickCount
OpenThread
QueueUserAPC
Sleep
ConvertFiberToThread
GetPackageFullName
GetProcessId
GetCurrentThread
WaitForMultipleObjectsEx
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue
SystemTimeToFileTime
GetLocaleInfoEx
FileTimeToSystemTime
CompareFileTime
GetDateFormatW
GetTimeFormatEx
LocalFileTimeToFileTime
FileTimeToLocalFileTime
WideCharToMultiByte
MultiByteToWideChar
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpool
TrySubmitThreadpoolCallback
CallbackMayRunLong
LocalFree
SetEndOfFile
WriteFile
GetFileSizeEx
SetFilePointerEx
OpenEventW
CreateEventW
SetEvent
ResetEvent
GetTickCount64
GetFileAttributesExW
CreateDirectoryW
GetFileAttributesW
FindNextChangeNotification
FindCloseChangeNotification
FindFirstChangeNotificationW
IsWow64Process
GetLongPathNameW
OpenProcess
QueryFullProcessImageNameW
ExpandEnvironmentStringsW
CreateFileW
ReadFile
PackageFamilyNameFromFullName
PackageIdFromFullName
GetPackagePath
GetPackagesByPackageFamily
GetThreadPreferredUILanguages
InitOnceInitialize
GetBinaryTypeW
FreeLibrary
LoadLibraryExW
FindResourceW
SizeofResource
GetPackageFamilyName
InitOnceExecuteOnce

normaliz

IdnToAscii

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled

shlwapi

SHCreateStreamOnFileEx
UrlEscapeW
PathCombineW
PathStripPathW
PathRemoveFileSpecW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

rpcrt4

IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrCStdStubBuffer2_Release
CStdStubBuffer_IsIIDSupported
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
NdrStubForwardingFunction
CStdStubBuffer_Connect
NdrDllUnregisterProxy
NdrOleFree
CStdStubBuffer_AddRef
NdrStubCall3

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient3
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient15
ObjectStublessClient13
ObjectStublessClient4
ObjectStublessClient17
ObjectStublessClient16
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
ObjectStublessClient10
ObjectStublessClient5
ObjectStublessClient7
ObjectStublessClient6

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ole32

HBITMAP_UserSize
HWND_UserUnmarshal
HWND_UserFree
HBITMAP_UserMarshal64
HBITMAP_UserFree
HBITMAP_UserUnmarshal64
HWND_UserUnmarshal64
HWND_UserMarshal64
HWND_UserMarshal
HBITMAP_UserUnmarshal
HWND_UserSize
HBITMAP_UserSize64
HWND_UserSize64
HBITMAP_UserMarshal
HWND_UserFree64
HBITMAP_UserFree64

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WpcTimeRestrictionsCreateLocalOverride

Sections

.text
Size: 796KB - Virtual size: 796KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 450KB - Virtual size: 449KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 248KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpcApi.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a93a4c60dfc824fa3784df60938f67fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpcApi.pdb

Imports

msvcp_win

?is@?$ctype@G@std@@QEBA_NFG@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$collate@G@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ
_Wcscoll
_Wcsxfrm
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Xbad_function_call@std@@YAXXZ
?tolower@?$ctype@G@std@@QEBAGG@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__itoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
_o__wcstoui64
memmove
_o_free
_o_malloc
_o_realloc
_o_towlower
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o__execute_onexit_table
_o__errno
__std_type_info_compare
wcschr
strchr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

wpc

WpcTimeRestrictionsCreateLocalOverride

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseMutex
LeaveCriticalSection
InitializeSRWLock
ReleaseSemaphore
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
EnterCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateSemaphoreExW
OpenSemaphoreW
ReleaseSRWLockShared
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserFree
HSTRING_UserMarshal64
WindowsIsStringEmpty
HSTRING_UserFree64
HSTRING_UserUnmarshal
WindowsDeleteString
WindowsStringHasEmbeddedNull
HSTRING_UserMarshal
HSTRING_UserUnmarshal64
WindowsCreateString
HSTRING_UserSize
WindowsGetStringRawBuffer
HSTRING_UserSize64
WindowsDuplicateString

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-security-base-l1-1-0

CheckTokenMembership

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
RoTransformError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

rpcrt4

CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
CStdStubBuffer_IsIIDSupported
NdrStubCall3
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow

api-ms-win-core-com-midlproxystub-l1-1-0

CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
CStdStubBuffer2_QueryInterface
CStdStubBuffer2_CountRefs
ObjectStublessClient14
NdrProxyForwardingFunction4
ObjectStublessClient15
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16
NdrProxyForwardingFunction3
ObjectStublessClient12
CStdStubBuffer2_Connect
ObjectStublessClient11
ObjectStublessClient3
ObjectStublessClient5
ObjectStublessClient4

oleaut32

BSTR_UserUnmarshal64
BSTR_UserFree
BSTR_UserSize
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserFree64
BSTR_UserSize64
BSTR_UserMarshal64

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation
EventUnregister

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegEnumKeyExW
RegEnumValueW
RegDeleteTreeW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
DuplicateTokenEx
SetTokenInformation
GetSidLengthRequired
CopySid
ConvertSidToStringSidW
ConvertStringSidToSidW
LookupAccountNameW
CreateWellKnownSid
OpenThreadToken
GetTokenInformation

kernel32

CloseThreadpool
SleepConditionVariableSRW
WakeAllConditionVariable
SetEvent
TlsGetValue
TlsAlloc
TlsFree
TlsSetValue
Sleep
QueueUserAPC
OpenThread
GetTickCount
ResetEvent
CompareFileTime
FileTimeToSystemTime
SystemTimeToFileTime
CreateEventW
GetCurrentThread
GetComputerNameW
LocalFree

ole32

CoReleaseMarshalData
CoMarshalInterface
CoRevertToSelf
CoImpersonateClient

user32

PostThreadMessageW

ntdll

EtwTraceMessage

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WpcSetupNotifyHomeSharedAccountChanged

Sections

.text
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpcDesktopMonSvc.dll
.dll windows:10 windows x64 arch:x64

8cde7df87a8c5b0ea2b0650b50758c35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpcDesktopMonSvc.pdb

Imports

msvcp_win

?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
_Wcsxfrm
_Wcscoll
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$collate@G@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Cnd_wait
_Cnd_broadcast
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Throw_C_error@std@@YAXH@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__itoa_s
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
_o__wcstoui64
memmove
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_isspace
_o_iswascii
_o_iswdigit
_o_iswlower
_o_iswxdigit
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_toupper
_o_towlower
_o_towupper
_o_ungetc
_o_ungetwc
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
strchr
wcschr
_o__fseeki64
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_type_info_compare
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
memset

api-ms-win-core-misc-l1-1-0

FormatMessageW

dmenrollengine

ord10
EnrollEngineInitialize

mrmcorer

ResourceManagerQueueGetString
ResourceManagerQueueSetGlobalFlags

bcp47langs

GetUserLanguagesForUser

ntdll

EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceEnableLevel
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
EventProviderEnabled

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
TlsGetValue
TlsAlloc
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
TlsFree
TlsSetValue
QueueUserAPC
OpenThread
OpenThreadToken
CreateProcessAsUserW
CreateThread
GetExitCodeProcess
GetCurrentProcessId

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
InitializeCriticalSection
SleepEx
CreateEventW
ResetEvent
SetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
EnterCriticalSection
WaitForSingleObject
OpenSemaphoreW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
CreateEventExW
CreateSemaphoreExW
CreateMutexExW
InitializeCriticalSectionAndSpinCount

api-ms-win-core-handle-l1-1-0

SetHandleInformation
CloseHandle

api-ms-win-core-com-l1-1-0

StringFromCLSID
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoRevertToSelf
CoImpersonateClient
StringFromGUID2
CoUninitialize
CoResumeClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoDisconnectContext
CLSIDFromString
CoTaskMemFree
CoInitializeEx
CoCreateGuid

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceBeginInitialize
SleepConditionVariableSRW
InitOnceInitialize
Sleep
InitOnceComplete

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
IsThreadpoolTimerSet
CloseThreadpool
CallbackMayRunLong
TrySubmitThreadpoolCallback

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-eventing-consumer-l1-1-0

CloseTrace
OpenTraceW
ProcessTrace

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
EnableTraceEx2
StartTraceW

api-ms-win-eventing-tdh-l1-1-0

TdhGetProperty
TdhGetEventInformation
TdhGetPropertySize

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsGetStringLen
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

api-ms-win-core-winrt-l1-1-0

RoRevokeActivationFactories
RoRegisterActivationFactories
RoInitialize
RoUninitialize
RoGetActivationFactory
RoActivateInstance

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
CreateDirectoryW
CreateFileW
FindNextChangeNotification
SetFilePointerEx
GetFileSizeEx
WriteFile
FindFirstChangeNotificationW
FileTimeToLocalFileTime
LocalFileTimeToFileTime
CompareFileTime
GetFileAttributesW
ReadFile
FindCloseChangeNotification

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-fibers-l2-1-0

ConvertFiberToThread

rpcrt4

UuidCreate

api-ms-win-core-localization-l1-2-0

LocaleNameToLCID
IdnToAscii
GetThreadPreferredUILanguages

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-base-util-l1-1-0

IsTextUnicode

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
RegSetValueExW
RegDeleteValueW
RegDeleteTreeW

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileEx

winhttp

WinHttpAddRequestHeaders
WinHttpConnect
WinHttpReceiveResponse
WinHttpReadData
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpOpen
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpSendRequest

api-ms-win-security-base-l1-1-0

CopySid
GetTokenInformation
CreateWellKnownSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathCombineW
PathRemoveFileSpecW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-shell-shellfolders-l1-1-0

SHGetFolderPathW
SHGetKnownFolderPath

combase

ord67
ord66
ord69
ord68

ext-ms-win-session-usertoken-l1-1-0

QueryUserToken

ext-ms-win-session-wtsapi32-l1-1-0

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

api-ms-win-appmodel-runtime-l1-1-0

GetPackagesByPackageFamily
PackageIdFromFullName
GetPackagePath

api-ms-win-rtcore-ntuser-window-l1-1-0

TranslateMessage
PostQuitMessage
PeekMessageW
PostThreadMessageW
DispatchMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

ext-ms-win-ole32-bindctx-l1-1-0

CoGetObject

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

DllMain
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 1000KB - Virtual size: 999KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 360KB - Virtual size: 359KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 404KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpcMon.exe
.exe windows:10 windows x64 arch:x64

90b627ba14e9505072a4e361848f38b2

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-09-2021 18:23

Not After

01-09-2022 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:75:8b:e7:25:10:92:f3:36:7d:99:4d:a1:b5:b4:0a:41:db:ec:b2:b6:d6:2d:20:1f:8f:e3:3e:4b:14:f9:92
Signer

Actual PE Digest

78:75:8b:e7:25:10:92:f3:36:7d:99:4d:a1:b5:b4:0a:41:db:ec:b2:b6:d6:2d:20:1f:8f:e3:3e:4b:14:f9:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WpcMon.pdb

Imports

advapi32

EventActivityIdControl
QueryServiceStatusEx
GetLengthSid
OpenServiceW
EventUnregister
UnregisterTraceGuids
RegisterTraceGuidsW
StartServiceW
GetTraceEnableLevel
IsValidSid
GetTraceEnableFlags
GetTraceLoggerHandle
EventSetInformation
TraceMessage
OpenSCManagerW
EventRegister
CloseServiceHandle
EventWriteTransfer
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegEnumKeyExW
RegEnumValueW
RegDeleteTreeW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
DuplicateTokenEx
SetTokenInformation
OpenProcessToken
OpenThreadToken
GetTokenInformation
GetSidLengthRequired
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
ConvertSidToStringSidW
ConvertStringSidToSidW
LookupAccountNameW
CreateWellKnownSid
CreateProcessAsUserW
IsTextUnicode

kernel32

DebugBreak
GetTickCount
RegisterApplicationRestart
IsDebuggerPresent
ResolveDelayLoadedAPI
GetModuleHandleW
SleepEx
GetFileSizeEx
SetFilePointerEx
ReadFile
CreateFileW
GetComputerNameW
CreateMutexW
IsWow64Process
GetCurrentThread
CreateEventExW
InitOnceInitialize
InitOnceExecuteOnce
GetCurrentProcessId
GetPackagesByPackageFamily
GetPackagePath
PackageIdFromFullName
FindFirstChangeNotificationW
FindCloseChangeNotification
FindNextChangeNotification
GetFileAttributesW
CreateDirectoryW
GetFileAttributesExW
LocaleNameToLCID
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetDynamicTimeZoneInformation
GetDateFormatEx
GetTimeFormatEx
GetTimeFormatW
GetDateFormatW
CompareFileTime
FileTimeToSystemTime
GetLocaleInfoEx
OpenEventW
IsThreadpoolTimerSet
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CallbackMayRunLong
SetThreadpoolWait
CreateThreadpoolWait
TrySubmitThreadpoolCallback
CloseThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CreateThreadpool
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeConditionVariable
WaitForMultipleObjectsEx
ConvertFiberToThread
QueueUserAPC
OpenThread
MultiByteToWideChar
WideCharToMultiByte
LocalFree
CreateMutexExW
GetProcAddress
GetErrorMode
HeapAlloc
HeapSetInformation
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitOnceComplete
OutputDebugStringW
ReleaseSRWLockExclusive
UpdateProcThreadAttribute
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
SetErrorMode
SetProcessShutdownParameters
InitializeProcThreadAttributeList
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
SetHandleInformation
InitOnceBeginInitialize
GetModuleFileNameA
GetProcessHeap
GetThreadPreferredUILanguages
DelayLoadFailureHook

msvcp_win

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$collate@G@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
_Wcscoll
_Wcsxfrm
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Mtx_unlock
_Cnd_wait
_Mtx_init_in_situ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_XGetLastError@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
??1facet@locale@std@@MEAA@XZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Cnd_init_in_situ
?__ExceptionPtrCreate@@YAXPEAX@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0facet@locale@std@@IEAA@_K@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__get_wide_winmain_command_line
_o__i64tow_s
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
_o__wcstoi64
_o__wcstoui64
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_isspace
_o_iswascii
_o_iswdigit
_o_iswlower
_o_iswspace
_o_iswxdigit
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__fseeki64
_o__exit
_o__errno
wcschr
strchr
__std_type_info_compare
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_name
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__std_terminate
__CxxFrameHandler4
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
memcmp
memcpy
memmove

api-ms-win-crt-string-l1-1-0

strncmp
memset

shlwapi

PathRemoveFileSpecW
SHCreateStreamOnFileEx
SHStrDupW
PathCombineW
UrlEscapeW

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoTaskMemFree
CoUninitialize
CLSIDFromString
PropVariantClear
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-synch-l1-1-0

SetEvent
InitializeCriticalSectionEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateEventW
AcquireSRWLockShared
InitializeSRWLock
ReleaseSRWLockShared
ResetEvent
InitializeCriticalSectionAndSpinCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

CreateThread
TlsFree
TlsGetValue
GetStartupInfoW
TerminateProcess
TlsSetValue
GetCurrentProcess
TlsAlloc

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
GetRestrictedErrorInfo
SetRestrictedErrorInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

ntdll

EtwTraceMessage
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-shcore-scaling-l1-1-2

GetDpiForShellUIComponent

shell32

Shell_NotifyIconW
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteExW

rpcrt4

UuidCreate

api-ms-win-core-localization-l1-2-0

IdnToAscii

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

samcli

NetUserGetInfo

imm32

ImmDisableLegacyIME

api-ms-win-crt-math-l1-1-0

ceilf

Sections

.text
Size: 646KB - Virtual size: 645KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpcProxyStubs.dll
.dll windows:10 windows x64 arch:x64

279451763f4bc185ec473282d3da834c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpcProxyStubs.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__cexit
_o_free
__C_specific_handler
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler4
_CxxThrowException
memcmp

api-ms-win-crt-string-l1-1-0

memset

ntdll

EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwTraceMessage
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
IUnknown_Release_Proxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Invoke
NdrStubForwardingFunction
CStdStubBuffer_AddRef
CStdStubBuffer_IsIIDSupported
NdrStubCall3
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
NdrOleFree

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserMarshal64
HSTRING_UserFree
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal

api-ms-win-core-com-midlproxystub-l1-1-0

CStdStubBuffer2_Disconnect
CStdStubBuffer2_CountRefs
ObjectStublessClient11
NdrProxyForwardingFunction5
CStdStubBuffer2_QueryInterface
ObjectStublessClient12
NdrProxyForwardingFunction3
NdrProxyForwardingFunction4
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient7
ObjectStublessClient6
CStdStubBuffer2_Connect

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
CreateMutexExW
WaitForSingleObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpcRefreshTask.dll
.dll windows:10 windows x64 arch:x64

8af70db4cdbf0c5f8923ed27877a35fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpcRefreshTask.pdb

Imports

msvcp_win

?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_init_in_situ
_Mtx_init_in_situ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Mtx_lock
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Mtx_destroy_in_situ
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
_Cnd_wait
_Cnd_broadcast
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_destroy_in_situ
?_Xbad_alloc@std@@YAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
_Wcsxfrm
_Wcscoll
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$collate@G@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__itoa_s
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
_o__wcstoi64
_o__wcstoui64
memmove
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_isspace
_o_iswascii
_o_iswdigit
_o_iswlower
_o_iswxdigit
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_toupper
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcscpy_s
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o__fseeki64
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
__std_type_info_compare
strchr
wcschr
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
strncmp

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-rtcore-ntuser-window-l1-1-0

TranslateMessage
DispatchMessageW
PostQuitMessage
PeekMessageW
PostThreadMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

propsys

ord435

mrmcorer

ResourceManagerQueueSetGlobalFlags
ResourceManagerQueueGetString

bcp47langs

GetUserLanguagesForUser

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadPreferredUILanguages
IdnToAscii
GetLocaleInfoEx

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
OpenThread
QueueUserAPC
OpenProcessToken
GetCurrentThread
GetCurrentThreadId
SetPriorityClass
TerminateProcess
TlsGetValue
TlsAlloc
CreateProcessAsUserW
GetCurrentProcess
OpenThreadToken
TlsFree
GetExitCodeProcess
TlsSetValue

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadStringW
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle
SetHandleInformation

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreExW
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
AcquireSRWLockShared
CreateMutexExW
OpenSemaphoreW
WaitForMultipleObjectsEx
CreateEventExW
WaitForSingleObject
WaitForSingleObjectEx
SleepEx
InitializeSRWLock
ReleaseMutex
ReleaseSemaphore
InitializeCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventProviderEnabled

api-ms-win-core-com-l1-1-0

CoGetApartmentType
CoWaitForMultipleHandles
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoUninitialize
CoCreateInstance
CoMarshalInterface
CoReleaseMarshalData
CLSIDFromString
CoTaskMemFree

ntdll

EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
NtQueryLicenseValue

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpool
TrySubmitThreadpoolCallback
CallbackMayRunLong
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-security-base-l1-1-0

GetSidLengthRequired
DuplicateTokenEx
CheckTokenMembership
SetTokenInformation
CopySid
GetTokenInformation
CreateWellKnownSid

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceInitialize
Sleep
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW
LookupAccountSidW

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory
RoUninitialize
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-security-lsapolicy-l1-1-0

LsaAddAccountRights
LsaRemoveAccountRights
LsaOpenPolicy
LsaClose

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegGetValueW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegDeleteTreeW

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-fibers-l2-1-0

ConvertFiberToThread

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetFileAttributesW
GetFileAttributesExW
SetEndOfFile
CompareFileTime
WriteFile
SetFilePointerEx
ReadFile
CreateFileW
FileTimeToLocalFileTime
GetFileSizeEx

api-ms-win-core-datetime-l1-1-0

GetDateFormatW

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx

api-ms-win-base-util-l1-1-0

IsTextUnicode

rpcrt4

UuidCreate

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileEx

api-ms-win-core-kernel32-legacy-l1-1-2

GetBinaryTypeW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW
PathCombineW
PathStripPathW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-url-l1-1-0

UrlEscapeW

winhttp

WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpOpen
WinHttpReadData
WinHttpSendRequest
WinHttpConnect

crypt32

CertFreeCertificateContext
CryptQueryObject
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgClose
CertGetNameStringW
CertCloseStore

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-appmodel-runtime-l1-1-0

GetPackagePath
PackageIdFromFullName
PackageFamilyNameFromFullName

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 639KB - Virtual size: 639KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpcTok.exe
.exe windows:10 windows x64 arch:x64

c38ab29a7ad2b3eb7ec98ba5399cec06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wpctok.pdb

Imports

msvcp_win

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$collate@G@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Xbad_function_call@std@@YAXXZ
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
_Wcscoll
_Wcsxfrm
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
_c_exit

api-ms-win-crt-private-l1-1-0

_o__i64tow_s
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__ui64tow_s
_o___stdio_common_vfwprintf
_o__wcstoui64
memmove
_o_exit
_o_free
_o_malloc
_o_realloc
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
__C_specific_handler
_CxxThrowException
_o__get_initial_wide_environment
_o___std_type_info_name
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o__exit
_o__errno
_o___p___argc
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___acrt_iob_func
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vsnprintf_s
memcmp
memcpy
__CxxFrameHandler3
wcschr
__std_type_info_compare
strchr

api-ms-win-crt-string-l1-1-0

memset
wcscmp

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
TlsFree
TerminateProcess
OpenThreadToken
GetCurrentThread

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

SetEvent
EnterCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
SleepEx
CreateMutexExW
LeaveCriticalSection
CreateEventExW
ReleaseSemaphore
ReleaseMutex
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
OpenSemaphoreW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventActivityIdControl
EventUnregister
EventWriteTransfer

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory
RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString

ntdll

EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

InitOnceComplete
SleepConditionVariableSRW
InitOnceBeginInitialize
WakeAllConditionVariable

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW

api-ms-win-security-base-l1-1-0

CopySid
CreateWellKnownSid
GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-threadpool-l1-2-0

CloseThreadpool

Sections

.text
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpcWebFilter.dll
.dll windows:10 windows x64 arch:x64

170370a01a4d51727f12088ba9a74e16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpcWebFilter.pdb

Imports

msvcp_win

?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Cnd_destroy_in_situ
?_XGetLastError@std@@YAXXZ
_Cnd_init_in_situ
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_broadcast
_Cnd_wait
?_Xlength_error@std@@YAXPEBD@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
_Wcsxfrm
_Wcscoll
_Strxfrm
_Strcoll
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?id@?$collate@G@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Throw_C_error@std@@YAXH@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
_o__wcsicmp
_o__wcstoui64
memmove
_o_free
_o_isdigit
_o_islower
_o_iswascii
_o_iswdigit
_o_iswlower
_o_iswxdigit
_o_isxdigit
_o_malloc
_o_realloc
_o_strtol
_o_terminate
_o_tolower
_o_towlower
_o_wcscpy_s
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
_o__crt_atexit
__std_terminate
__CxxFrameHandler4
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__std_type_info_compare
strchr
wcschr
memchr
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
strncmp

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-core-misc-l1-1-0

LocalFree
FormatMessageW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsIsStringEmpty

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoGetCallContext
StringFromCLSID
CLSIDFromString

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

CreateMutexW
OpenSemaphoreW
CreateEventExW
OpenMutexW
CreateMutexExW
ReleaseSemaphore
CreateSemaphoreExW
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
WaitForSingleObject
SleepEx
ReleaseSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSection
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
DeleteCriticalSection
WaitForMultipleObjectsEx
ReleaseSRWLockShared

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException

oleaut32

SysAllocString

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
OpenThread
QueueUserAPC

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister
EventActivityIdControl

ntdll

EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeConditionVariable
Sleep

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage

api-ms-win-core-localization-l1-2-0

IdnToAscii
IdnToUnicode
GetSystemDefaultLCID

winhttp

WinHttpOpen
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpReadData
WinHttpConnect

api-ms-win-core-file-l1-1-0

GetFileAttributesW
FindFirstChangeNotificationW
FindCloseChangeNotification
CreateFileW
CompareFileTime
GetFileAttributesExW
CreateDirectoryW
FindNextChangeNotification
WriteFile
GetFileSizeEx
ReadFile
SetFilePointerEx

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

bcrypt

BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptHashData

api-ms-win-security-base-l1-1-0

GetTokenInformation
CreateWellKnownSid
CopySid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-fibers-l2-1-0

ConvertFiberToThread

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CloseThreadpool
TrySubmitThreadpoolCallback
CreateThreadpool

api-ms-win-base-util-l1-1-0

IsTextUnicode

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteTreeW
RegGetValueW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathCombineW
PathRemoveFileSpecW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

webservices

WsFreeReader
WsFreeWriter
WsGetErrorString
WsCloseServiceProxy
WsCreateServiceProxyFromTemplate
WsCall
WsGetFaultErrorProperty
WsGetErrorProperty
WsCreateWriter
WsWriteXmlBufferToBytes
WsCreateReader
WsSetInputToBuffer
WsGetReaderNode
WsReadNode
WsCreateHeap
WsFreeHeap
WsAlloc
WsCreateError
WsFreeError
WsAbandonCall
WsOpenServiceProxy
WsFreeServiceProxy

api-ms-win-rtcore-ntuser-window-l1-1-0

PostQuitMessage
PostThreadMessageW
TranslateMessage
DispatchMessageW
PeekMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-shell-shellfolders-l1-1-0

SHGetFolderPathW
SHGetKnownFolderPath

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
WpcWebFilterCreate
WpcWebFilterDestroy
WpcWebFilterGet

Sections

.text
Size: 509KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 82KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WpnUserService.dll
.dll windows:10 windows x64 arch:x64

2cd49a0669a99ed7121e02b40b38e579

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpnUserService.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o__crt_atexit
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
ReleaseSemaphore
SetEvent
WaitForSingleObject
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
CreateMutexExW
OpenSemaphoreW
CreateEventExW
ResetEvent

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolWork

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoFreeUnusedLibrariesEx
CoCreateInstance
CoRegisterClassObject
CoRevokeClassObject
CoDisconnectContext

ntdll

RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

combase

ord68
ord154
ord67
ord66

faultrep

ReportCoreHang

iertutil

ord914

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WppRecorderUM.dll
.dll windows:10 windows x64 arch:x64

8e45c3abc52168ea88a370396c6dc9f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WppRecorderUM.pdb

Imports

api-ms-win-core-crt-l1-1-0

strncpy_s
_vsnwprintf_s
memcpy
__C_specific_handler
memset

api-ms-win-core-crt-l2-1-0

_initterm
_initterm_e

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlInitUnicodeString

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

Exports

Exports

WppAutoLogGetDefaultHandle
WppAutoLogStart
WppAutoLogStop
WppAutoLogTrace

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WsdProviderUtil.dll
.dll windows:10 windows x64 arch:x64

efe9ea36c95c2611f0dcb56f8a52643c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WsdProviderUtil.pdb

Imports

msvcrt

malloc
_vsnwprintf
towlower
free
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
memcpy
wcschr
iswxdigit
iswdigit
_wcsicmp
_wcsnicmp
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

winhttp

WinHttpCrackUrl

iphlpapi

ResolveIpNetEntry2
GetIpNetEntry2

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoInitializeEx
CoTaskMemAlloc
PropVariantClear
CoCreateInstance
CoUninitialize
CoTaskMemFree

ws2_32

FreeAddrInfoW
GetAddrInfoW

oleaut32

SysAllocString

bcrypt

BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-url-l1-1-0

UrlCombineW

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WsmAgent.dll
.dll regsvr32 windows:10 windows x64 arch:x64

c29586c5a0afde4431074b280da93d5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsmagent.pdb

Imports

msvcrt

__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_purecall
malloc
free
swprintf_s
memset

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread

api-ms-win-security-base-l1-1-0

CheckTokenMembership

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

wsmsvc

??0?$AutoDelete@U_SID@@@@QEAA@PEAU_SID@@@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
??1CWSManCriticalSection@@QEAA@XZ
?GetSid@CSecurity@@SAPEAXXZ
?IsLocalSystemSid@CSecurity@@SAHPEAX@Z
StringIsBlank
??1?$AutoDelete@U_SID@@@@QEAA@XZ
??1AutoImpersonateUser@@QEAA@XZ
?Free@WSManMemory@@SAXPEAXH@Z
?BeginRevertToSelf@CSecurity@@SAHPEAPEAXK@Z
??0AutoImpersonateUser@@QEAA@XZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
?GetInitError@CWSManCriticalSection@@QEBAKXZ
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WsmAuto.dll
.dll regsvr32 windows:10 windows x64 arch:x64

9b77a948cfa3653ed8c8bd7274d01c29

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WsmAuto.pdb

Imports

msvcrt

memcmp
_onexit
__CxxFrameHandler3
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_vsnwprintf
_scwprintf
_wcsicmp
wcscpy_s
realloc
wcscat_s
malloc
free
__C_specific_handler
_purecall
__dllonexit
__RTDynamicCast
memset

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantClear
VariantChangeTypeEx
VariantInit
SetErrorInfo
CreateErrorInfo
SysAllocStringLen
LoadTypeLi
SysAllocString
SysStringLen
RegisterTypeLi
VarUI4FromStr
SysFreeString

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW
LoadLibraryExW
SizeofResource
GetProcAddress
LoadResource
FindResourceExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegCreateKeyExW

api-ms-win-core-string-l2-1-0

CharNextW
CharPrevW

api-ms-win-core-string-obsolete-l1-1-0

lstrcpynW
lstrcmpiW
lstrcpyW

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW

api-ms-win-core-heap-l1-1-0

HeapDestroy

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

miutils

RtlReleaseFastLockShared
RtlTryAcquireFastLockShared
RtlReleaseFastLockExclusive
RtlInterlockedCompareWait
RtlInterlockedWakeAll
RtlQueueAcquireFastLockShared
RtlTryAcquireFastLockExclusive
RtlQueueAcquireFastLockExclusive

wsmsvc

FwXmlGetAttributeValue
FwXmlFindAttribute
FwXmlCompareElementName
?GetRoot@XmlReader@@QEAAPEAU_FWXML_ELEMENT@@XZ
?Init@XmlReader@@QEAAHPEAVIRequestContext@@PEAUWSMAN_OBJECT@@@Z
??0CWSManSecurityUI@@QEAA@XZ
StringCchEqualsCI
??1XmlReader@@QEAA@XZ
??0XmlReader@@QEAA@XZ
?ClearOptions@CWSManResourceNoResourceUri@@QEAAHXZ
?AddOption@CWSManResourceNoResourceUri@@QEAAHPEBG0HPEAVIRequestContext@@@Z
?ClearKeys@CWSManResourceNoResourceUri@@QEAAHXZ
?AddKey@CWSManResourceNoResourceUri@@QEAAHPEBG0PEAVIRequestContext@@@Z
?GetLocator@CWSManResource@@QEAAPEAU_WSMAN_RESOURCE_LOCATOR@@XZ
?SetFragmentDialect@CWSManResourceNoResourceUri@@QEAAHPEBGPEAVIRequestContext@@@Z
?SetFragmentPath@CWSManResourceNoResourceUri@@QEAAHPEBGPEAVIRequestContext@@@Z
?GetFragmentPath@CWSManResourceNoResourceUri@@QEAAPEBGXZ
??0CWSManCriticalSection@@QEAA@XZ
?SetUri@CWSManResource@@QEAAHPEBGPEAVIRequestContext@@@Z
??1CWSManCriticalSection@@QEAA@XZ
?PrepareToCommitWithSize@BufferFormatter@@UEAAKK@Z
?GetUpdatedSDDL@CWSManSecurityUI@@QEAAPEAGPEAVIRequestContext@@@Z
?GetUri@CWSManResource@@QEAAPEBGXZ
?GrowBuffer@BufferFormatter@@UEAAKK@Z
?GrowBuffer@BufferFormatter@@UEAAKXZ
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataXmlEscape@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataFormatULONGLONG@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataFormatDWORD@@@Z
??6BufferFormatter@@UEAAAEAV0@K@Z
??6BufferFormatter@@UEAAAEAV0@PEAU_FWXML_ELEMENT@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataPUCHAR@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataPCWSTR@@@Z
FwXmlCloseParser
?SetMachineName@CRequestContext@@QEAAKPEBG_K@Z
?RecordXml@CRequestContext@@AEAAHKPEAU_FWXML_ELEMENT@@K@Z
?RecordText@CRequestContext@@AEAAHKPEBG_KK@Z
?GetFaultXMLPrivate@CRequestContext@@AEAAXPEAPEAD0KHKKPEBG11@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
?Free@WSManMemory@@SAXPEAXH@Z
?UpdateKey@CWSManResourceNoResourceUri@@QEAAHPEAVIRequestContext@@PEBG1@Z
?FreeBstr@WSManMemory@@SAXPEAGHH@Z
FwXmlEncodeXmlEscapes
??0PacketFormatter@@QEAA@XZ
?SetCharsetAndBom@PacketFormatter@@QEAAXW4Charset@1@0@Z
?SetCharset@PacketFormatter@@QEAAXW4Charset@1@@Z
?GetFormat@PacketFormatter@@QEBA?AW4Charset@1@XZ
?InternalParse@CWSManResource@@MEAAHPEAVIRequestContext@@@Z
??0CErrorContext@@QEAA@_N@Z
PrintUnregisterWaitTrace
?GetSpaceUsed@CircularBufferFormatter@@UEBAK_N@Z
?GetCalculationSize@CircularBufferFormatter@@UEBAK_N@Z
?GetBuffer@CircularBufferFormatter@@UEAAPEAEXZ
?GrowBuffer@CircularBufferFormatter@@UEAAKK@Z
?GrowBuffer@CircularBufferFormatter@@UEAAKXZ
PrintHandleTrace
?GetKeyValue@CWSManResourceNoResourceUri@@QEAAPEBGPEBG@Z
?Parse@CWSManResource@@SAPEAV1@PEAVIRequestContext@@PEBGH@Z
?Reset@CRequestContext@@UEAAXH@Z
?Uri@CResourceAlias@@QEAAPEBGXZ
??1CResourceAlias@@QEAA@XZ
??0CResourceAlias@@QEAA@PEBG@Z
WSManCloseObjectHandle
??0CWSManResourceNoResourceUri@@QEAA@H@Z
?BuildSelectorSet@CWSManResourceNoResourceUri@@UEAAHAEAVBufferFormatter@@@Z
?RecordFailure@CRequestContext@@UEAAXPEAU_WSMAN_FAULT_OBJECT@@@Z
?BuildFragmentTransfer@CWSManResourceNoResourceUri@@UEAAHAEAVBufferFormatter@@@Z
WSManCloseEnumeratorHandle
WSManEnumeratorNextObject
WSManPull
?IsEPR@CWSManResourceNoResourceUri@@UEAAHXZ
WSManError
?GetString@Locale@@QEAAPEBGXZ
?SetLocale@Locale@@QEAA_NKPEBGPEAVIRequestContext@@@Z
??1CWSManResourceNoResourceUri@@UEAA@XZ
?GetMessageEmpty@Locale@@QEBAPEBGAEAVAutoLocalFree@@K@Z
?AllocBstrLen@WSManMemory@@SAPEAGPEBGIHH@Z
WSManDecodeObject
??0Locale@@QEAA@XZ
WSManCloseEnumerationHandle
??0CRequestContext@@QEAA@XZ
??1CRequestContext@@UEAA@XZ
WSManMemoryOperation
?AllocBstr@WSManMemory@@SAPEAGPEBGHH@Z
PrintReleaseTrace
WSManEncodeObject
WSManGetInternalEx
WSManPutInternalEx
WSManCreateInternalEx
WSManDeleteInternalEx
WSManCloseSessionHandle
WSManCreateSessionInternal
WSManInvokeInternalEx
WSManEnumerateInternalEx
WSManIdentifyInternal
?Init@CWSManSecurityUI@@QEAAHPEAG0PEAVIRequestContext@@@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

??0?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@PEAE@Z
??0?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAA@PEAE@Z
??0?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAA@PEAVCRequestContext@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAA@PEAVCWSManSecurityUI@@@Z
??0?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@XZ
??0?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@XZ
??0?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@PEBU_CERT_CONTEXT@@@Z
??0?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@PEBU_CERT_CHAIN_CONTEXT@@@Z
??0?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@PEAUHINSTANCE__@@@Z
??0?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@XZ
??0?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@PEAU_MI_Class@@@Z
??0?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@XZ
??0?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@PEAU_MI_Instance@@@Z
??0?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@XZ
??0?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@PEAUWSMAN_OBJECT@@@Z
??0?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@PEAUHKEY__@@@Z
??0?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@XZ
??0?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@XZ
??0?$AutoDeleteVector@E@@QEAA@XZ
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
??0?$AutoDeleteVector@G@@QEAA@XZ
??0?$AutoFree@E@@QEAA@PEAE@Z
??0?$AutoRelease@VCRequestContext@@@@QEAA@PEAVCRequestContext@@@Z
??0?$AutoRelease@VCWSManSecurityUI@@@@QEAA@XZ
??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SimpleQueue@T_LARGE_INTEGER@@@@QEAA@XZ
??0AutoBstr@@QEAA@PEAG@Z
??0AutoBstr@@QEAA@XZ
??0AutoBstrNoAlloc@@QEAA@PEAG@Z
??0AutoBstrNoAlloc@@QEAA@XZ
??0AutoCertContext@@QEAA@PEBU_CERT_CONTEXT@@@Z
??0AutoCertContext@@QEAA@XZ
??0AutoChainContext@@QEAA@PEBU_CERT_CHAIN_CONTEXT@@@Z
??0AutoChainContext@@QEAA@XZ
??0AutoCoTaskMemFree@@QEAA@PEAX@Z
??0AutoCoTaskMemFree@@QEAA@XZ
??0AutoFwXmlCloseParser@@QEAA@PEAX@Z
??0AutoFwXmlCloseParser@@QEAA@XZ
??0AutoHandle@@QEAA@PEAX@Z
??0AutoHandle@@QEAA@XZ
??0AutoImpersonateUser@@QEAA@PEAX@Z
??0AutoImpersonateUser@@QEAA@XZ
??0AutoLibrary@@QEAA@PEAUHINSTANCE__@@@Z
??0AutoLibrary@@QEAA@XZ
??0AutoLocalFree@@QEAA@PEAX@Z
??0AutoLocalFree@@QEAA@XZ
??0AutoMIClass@@QEAA@PEAU_MI_Class@@@Z
??0AutoMIClass@@QEAA@XZ
??0AutoMIInstance@@QEAA@PEAU_MI_Instance@@@Z
??0AutoMIInstance@@QEAA@XZ
??0AutoObject@@QEAA@PEAUWSMAN_OBJECT@@@Z
??0AutoObject@@QEAA@XZ
??0AutoRegKey@@QEAA@PEAUHKEY__@@@Z
??0AutoRegKey@@QEAA@XZ
??0AutoSecurityDescriptor@@QEAA@PEAX@Z
??0AutoSecurityDescriptor@@QEAA@XZ
??0AutoWaitHandle@@QEAA@PEAX@Z
??0AutoWaitHandle@@QEAA@XZ
??0BufferFormatter@@QEAA@PEAEK@Z
??0BufferFormatter@@QEAA@XZ
??0CWSManResource@@QEAA@H@Z
??0ChildLifeTimeManager@@QEAA@AEBV0@@Z
??0ChildLifeTimeManager@@QEAA@XZ
??0CircularBufferFormatter@@QEAA@XZ
??0EtwCorrelationHelper@@QEAA@AEBV0@@Z
??0FastLock@@QEAA@XZ
??0ILifeTimeMgmt@@QEAA@AEBV0@@Z
??0ILifeTimeMgmt@@QEAA@XZ
??0IRequestContext@@IEAA@XZ
??0OwnLock@@QEAA@AEAVFastLock@@@Z
??0ShareLock@@QEAA@AEAVFastLock@@@Z
??1?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAA@XZ
??1?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@XZ
??1?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@XZ
??1?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@XZ
??1?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@XZ
??1?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@XZ
??1?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@XZ
??1?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@XZ
??1?$AutoDelete@G@@QEAA@XZ
??1?$AutoDeleteVector@E@@QEAA@XZ
??1?$AutoDeleteVector@G@@QEAA@XZ
??1?$AutoDeleteVector@PEBG@@QEAA@XZ
??1?$AutoDeleteVector@U_WSMAN_OPTION@@@@QEAA@XZ
??1?$AutoFree@E@@QEAA@XZ
??1?$AutoRelease@VCRequestContext@@@@QEAA@XZ
??1?$AutoRelease@VCWSManSecurityUI@@@@QEAA@XZ
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SimpleQueue@T_LARGE_INTEGER@@@@QEAA@XZ
??1AutoBstr@@QEAA@XZ
??1AutoBstrNoAlloc@@QEAA@XZ
??1AutoCertContext@@QEAA@XZ
??1AutoChainContext@@QEAA@XZ
??1AutoCoTaskMemFree@@QEAA@XZ
??1AutoFwXmlCloseParser@@QEAA@XZ
??1AutoHandle@@QEAA@XZ
??1AutoImpersonateUser@@QEAA@XZ
??1AutoLibrary@@QEAA@XZ
??1AutoLocalFree@@QEAA@XZ
??1AutoMIClass@@QEAA@XZ
??1AutoMIInstance@@QEAA@XZ
??1AutoObject@@QEAA@XZ
??1AutoRegKey@@QEAA@XZ
??1AutoSecurityDescriptor@@QEAA@XZ
??1AutoWaitHandle@@QEAA@XZ
??1BufferFormatter@@UEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??1CWSManResource@@UEAA@XZ
??1ChildLifeTimeManager@@QEAA@XZ
??1CircularBufferFormatter@@UEAA@XZ
??1EtwCorrelationHelper@@UEAA@XZ
??1ILifeTimeMgmt@@UEAA@XZ
??1IRequestContext@@UEAA@XZ
??1OwnLock@@QEAA@XZ
??1ShareLock@@QEAA@XZ
??4?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAAEAV?$AutoDeleteVector@G@@PEAG@Z
??4?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAAAEAV?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@Z
??4?$AutoCleanup@VAutoBstr@@PEAG@@QEAAAEAVAutoBstr@@PEAG@Z
??4?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAAEAVAutoBstrNoAlloc@@PEAG@Z
??4?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAAAEAVAutoCertContext@@PEBU_CERT_CONTEXT@@@Z
??4?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAAAEAVAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@Z
??4?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAAAEAVAutoCoTaskMemFree@@PEAX@Z
??4?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAAAEAVAutoFwXmlCloseParser@@PEAX@Z
??4?$AutoCleanup@VAutoHandle@@PEAX@@QEAAAEAVAutoHandle@@PEAX@Z
??4?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAAAEAVAutoImpersonateUser@@PEAX@Z
??4?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAAAEAVAutoLibrary@@PEAUHINSTANCE__@@@Z
??4?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAAEAVAutoLocalFree@@PEAX@Z
??4?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAAAEAVAutoMIClass@@PEAU_MI_Class@@@Z
??4?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAAAEAVAutoMIInstance@@PEAU_MI_Instance@@@Z
??4?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAAAEAVAutoObject@@PEAUWSMAN_OBJECT@@@Z
??4?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAAAEAVAutoRegKey@@PEAUHKEY__@@@Z
??4?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAAAEAVAutoSecurityDescriptor@@PEAX@Z
??4?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAAAEAVAutoWaitHandle@@PEAX@Z
??4?$AutoDeleteVector@G@@QEAAAEAV0@PEAG@Z
??4?$AutoRelease@VCWSManSecurityUI@@@@QEAAAEAV0@PEAVCWSManSecurityUI@@@Z
??4?$SimpleQueue@T_LARGE_INTEGER@@@@QEAAAEAV0@AEBV0@@Z
??4AutoBstr@@QEAAAEAV0@PEAG@Z
??4AutoBstrNoAlloc@@QEAAAEAV0@PEAG@Z
??4AutoCertContext@@QEAAAEAV0@PEBU_CERT_CONTEXT@@@Z
??4AutoChainContext@@QEAAAEAV0@PEBU_CERT_CHAIN_CONTEXT@@@Z
??4AutoCoTaskMemFree@@QEAAAEAV0@PEAX@Z
??4AutoFwXmlCloseParser@@QEAAAEAV0@PEAX@Z
??4AutoHandle@@QEAAAEAV0@PEAX@Z
??4AutoImpersonateUser@@QEAAAEAV0@PEAX@Z
??4AutoLibrary@@QEAAAEAV0@PEAUHINSTANCE__@@@Z
??4AutoLocalFree@@QEAAAEAV0@PEAX@Z
??4AutoMIClass@@QEAAAEAV0@PEAU_MI_Class@@@Z
??4AutoMIInstance@@QEAAAEAV0@PEAU_MI_Instance@@@Z
??4AutoObject@@QEAAAEAV0@PEAUWSMAN_OBJECT@@@Z
??4AutoRegKey@@QEAAAEAV0@PEAUHKEY__@@@Z
??4AutoSecurityDescriptor@@QEAAAEAV0@PEAX@Z
??4AutoWaitHandle@@QEAAAEAV0@PEAX@Z
??4ChildLifeTimeManager@@QEAAAEAV0@AEBV0@@Z
??4EtwCorrelationHelper@@QEAAAEAV0@AEBV0@@Z
??4EventLog@@QEAAAEAV0@$$QEAV0@@Z
??4EventLog@@QEAAAEAV0@AEBV0@@Z
??4FastLock@@QEAAAEAV0@$$QEAV0@@Z
??4FastLock@@QEAAAEAV0@AEBV0@@Z
??4ILifeTimeMgmt@@QEAAAEAV0@AEBV0@@Z
??4PacketFormatter@@QEAAAEAV0@$$QEAV0@@Z
??4PacketFormatter@@QEAAAEAV0@AEBV0@@Z
??7?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEBA_NXZ
??B?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAEXZ
??B?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAAPEAPEBGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAAPEAU_WSMAN_OPTION@@XZ
??B?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAAPEAEXZ
??B?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEBAQEAEXZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAAPEAVCWSManSecurityUI@@XZ
??B?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAPEAXXZ
??C?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAAPEAVCRequestContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAAPEAVCWSManSecurityUI@@XZ
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
??_7BufferFormatter@@6B@
??_7CWSManResource@@6B@
??_7CircularBufferFormatter@@6B@
??_7EtwCorrelationHelper@@6B@
??_7ILifeTimeMgmt@@6B@
??_7IRequestContext@@6B@
??_FCErrorContext@@QEAAXXZ
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?AcquireExclusive@FastLock@@QEAAXXZ
?AcquireShared@FastLock@@QEAAXXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AddRef@ILifeTimeMgmt@@UEAAJXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?Detach@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
?Detach@?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAAPEAEXZ
?Detach@BufferFormatter@@QEAAPEAEXZ
?GetBomIndex@PacketFormatter@@QEBA?AW4Charset@1@XZ
?GetBuffer@BufferFormatter@@UEAAPEAEXZ
?GetBuffer@BufferFormatter@@UEBAPEBEXZ
?GetBuffer@CircularBufferFormatter@@UEBAPEBEXZ
?GetBuffer@XmlReader@@QEAAPEBGXZ
?GetBufferSize@BufferFormatter@@QEBAKXZ
?GetCalculationSize@BufferFormatter@@UEBAK_N@Z
?GetCharset@PacketFormatter@@QEBA?AW4Charset@1@XZ
?GetChildCount@ChildLifeTimeManager@@QEBAJXZ
?GetError@BufferFormatter@@QEBAKXZ
?GetErrorCode@CErrorContext@@UEBAKXZ
?GetFaultXML@CErrorContext@@UEBAPEBGXZ
?GetFaultXML@CRequestContext@@UEBAPEBGXZ
?GetFormatterMode@BufferFormatter@@QEAA?AW4Charset@PacketFormatter@@XZ
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetLCID@Locale@@QEAAKXZ
?GetLength@XmlReader@@QEAA_KXZ
?GetLocale@CRequestContext@@QEAAAEAVLocale@@XZ
?GetLocaleString@CRequestContext@@QEAAPEBGXZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMessageId@CErrorContext@@UEBAKXZ
?GetMessageId@CRequestContext@@UEBAKXZ
?GetOptionCount@CWSManResourceNoResourceUri@@QEAAKXZ
?GetOptionTypes@CWSManResourceNoResourceUri@@QEAAPEAPEBGXZ
?GetOptions@CWSManResourceNoResourceUri@@QEAAPEAU_WSMAN_OPTION@@XZ
?GetOptionsMustUnderstandValue@CWSManResourceNoResourceUri@@QEAAHXZ
?GetParser@XmlReader@@QEAAPEAXXZ
?GetRefCount@ILifeTimeMgmt@@QEAAJXZ
?GetSpaceUsed@BufferFormatter@@UEBAK_N@Z
?HasFaultXML@CRequestContext@@QEBAHXZ
?HasHtmlError@CRequestContext@@AEBAHXZ
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?IsActive@ChildLifeTimeManager@@QEAA_NXZ
?IsCIM_Error@CRequestContext@@QEAAHXZ
?IsGeneratingError@CErrorContext@@UEBA_NXZ
?IsInCommitMode@BufferFormatter@@QEAA_NXZ
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?LogErrorCode@CRequestContext@@QEAAXXZ
?Me@?$AutoCleanup@V?$AutoDelete@G@@PEAG@@AEAAAEAV?$AutoDelete@G@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@AEAAAEAV?$AutoDeleteVector@E@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@AEAAAEAV?$AutoDeleteVector@G@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@AEAAAEAV?$AutoDeleteVector@PEBG@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@AEAAAEAV?$AutoDeleteVector@U_WSMAN_OPTION@@@@XZ
?Me@?$AutoCleanup@V?$AutoFree@E@@PEAE@@AEAAAEAV?$AutoFree@E@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@AEAAAEAV?$AutoRelease@VCRequestContext@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@AEAAAEAV?$AutoRelease@VCWSManSecurityUI@@@@XZ
?Me@?$AutoCleanup@VAutoBstr@@PEAG@@AEAAAEAVAutoBstr@@XZ
?Me@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@AEAAAEAVAutoBstrNoAlloc@@XZ
?Me@?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@AEAAAEAVAutoCertContext@@XZ
?Me@?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@AEAAAEAVAutoChainContext@@XZ
?Me@?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@AEAAAEAVAutoCoTaskMemFree@@XZ
?Me@?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@AEAAAEAVAutoFwXmlCloseParser@@XZ
?Me@?$AutoCleanup@VAutoHandle@@PEAX@@AEAAAEAVAutoHandle@@XZ
?Me@?$AutoCleanup@VAutoImpersonateUser@@PEAX@@AEAAAEAVAutoImpersonateUser@@XZ
?Me@?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@AEAAAEAVAutoLibrary@@XZ
?Me@?$AutoCleanup@VAutoLocalFree@@PEAX@@AEAAAEAVAutoLocalFree@@XZ
?Me@?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@AEAAAEAVAutoMIClass@@XZ
?Me@?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@AEAAAEAVAutoMIInstance@@XZ
?Me@?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@AEAAAEAVAutoObject@@XZ
?Me@?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@AEAAAEAVAutoRegKey@@XZ
?Me@?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@AEAAAEAVAutoSecurityDescriptor@@XZ
?Me@?$AutoCleanup@VAutoWaitHandle@@PEAX@@AEAAAEAVAutoWaitHandle@@XZ
?Passed@CErrorContext@@UEBAHXZ
?PrepareToCommitWithSize@CircularBufferFormatter@@UEAAKK@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_ENUMERATOR_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_EVENTS_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_STATUS@@@Z
?ProviderFailure@CErrorContext@@UEBAHXZ
?RecordAccessDenied@CRequestContext@@UEAAXXZ
?RecordFailure@CRequestContext@@UEAAXK@Z
?RecordHtmlError@CRequestContext@@QEAAHKPEAU_FWXML_ELEMENT@@@Z
?RecordHtmlError@CRequestContext@@QEAAHKPEBGK@Z
?RecordMIFailure@IRequestContext@@QEAAXW4_MI_Result@@K@Z
?RecordOutOfMemory@CRequestContext@@UEAAXXZ
?RecordProviderFailure@CRequestContext@@QEAAXKHPEBG00@Z
?RecordSoapError@CRequestContext@@QEAAHKPEAU_FWXML_ELEMENT@@@Z
?RecordSoapError@CRequestContext@@UEAAHKPEBG@Z
?RegisterChild@ChildLifeTimeManager@@QEAA_NXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Release@ILifeTimeMgmt@@UEAAJP6AXPEAX@Z0@Z
?ReleaseExclusive@FastLock@@QEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@G@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoFree@E@@PEAE@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoBstr@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoHandle@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoImpersonateUser@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoLocalFree@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoWaitHandle@@PEAX@@AEAAXXZ
?ReleaseShared@FastLock@@QEAAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?Reset@BufferFormatter@@UEAAXXZ
?Reset@CircularBufferFormatter@@UEAAXXZ
?SetCIM_Error@CErrorContext@@UEAAXXZ
?SetCIM_Error@CRequestContext@@UEAAXXZ
?SetExtraLogInfo@CErrorContext@@QEAAXPEBG000@Z
?SetFormatterMode@BufferFormatter@@QEAAXW4Charset@PacketFormatter@@0@Z
?SetGeneratingError@CErrorContext@@UEAAXXZ
?SetLocale@CRequestContext@@QEAA_NPEBGK@Z
?SetMachineName@CRequestContext@@QEAAKPEBG@Z
?SetMaxEnvelopeSize@CircularBufferFormatter@@QEAAXK@Z
?SetOptionsMustUnderstandValue@CWSManResourceNoResourceUri@@QEAAXH@Z
?SetUpdateMode@BufferFormatter@@UEAAXW4Mode@1@@Z
?SetUpdateMode@CircularBufferFormatter@@UEAAXW4Mode@BufferFormatter@@@Z
?Shutdown@ChildLifeTimeManager@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ
?UnregisterChild@ChildLifeTimeManager@@QEAAXXZ
?UseDefaultConfig@CErrorContext@@UEBAHXZ
?UsingDefaultLCID@Locale@@QEAA_NXZ
?WaitForAllChildrenToUnregister@ChildLifeTimeManager@@QEAAXK@Z
?WakeAllWaitingOnNoOfChildren@ChildLifeTimeManager@@AEAAXXZ
?empty@?$SimpleQueue@T_LARGE_INTEGER@@@@QEBA_NXZ
?getBufSync@BufferFormatter@@UEAAPEAVCWSManCriticalSection@@XZ
?pop@?$SimpleQueue@T_LARGE_INTEGER@@@@QEAAXXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WsmPty.xsl
.xml
Ex_PE_v3.1.9/CMap/libs/WsmRes.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WsmSvc.dll
.dll windows:10 windows x64 arch:x64

16b60eacc0496ec81fc623368fddba73

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WsmSvc.pdb

Imports

msvcrt

_atoi64
_vsnprintf_s
memcpy_s
strncmp
wcsncmp
_wcsnicmp
_wtof
memset
_wtoi
_strnicmp
iswxdigit
tolower
iswdigit
iswspace
_wtoi64
isspace
_scprintf
_vsnprintf
isdigit
wcsrchr
wcsstr
wcspbrk
wcscspn
wcstoul
_ultow_s
swprintf_s
_itow_s
srand
rand
wcsspn
wcstod
_HUGE
strcmp
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
free
_fpclass
_amsg_exit
_XcptFilter
memmove
ldiv
memcpy
_CxxThrowException
strchr
?what@exception@@UEBAPEBDXZ
memcmp
??1exception@@UEAA@XZ
fopen_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_scwprintf
time
rand_s
__iob_func
fclose
_i64tow_s
wcscpy_s
fwprintf
iswalnum
_wcsrev
swscanf_s
_vsnwprintf
wcschr
_wcsicmp
_purecall
__CxxFrameHandler3
memmove_s
wcscmp

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

oleaut32

GetErrorInfo
VariantClear
SysAllocString
SysAllocStringLen
VariantInit
SysFreeString
SysStringLen
VarCmp

crypt32

CryptDecodeObjectEx
CertFreeCertificateContext
CertGetIntendedKeyUsage
CryptBinaryToStringW
CertGetCertificateContextProperty
CertAddEnhancedKeyUsageIdentifier
CertCreateSelfSignCertificate
CertStrToNameW
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFindExtension
CertGetEnhancedKeyUsage
CryptAcquireCertificatePrivateKey
CertGetNameStringW
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateChain
CryptStringToBinaryW
CertCloseStore
CertCreateCertificateContext
CryptStringToBinaryA

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetKernelObjectSecurity
MakeAbsoluteSD
InitializeSecurityDescriptor
AddAccessAllowedAceEx
MakeSelfRelativeSD
AdjustTokenPrivileges
SetSecurityDescriptorDacl
SetKernelObjectSecurity
IsValidSid
CreateWellKnownSid
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
DuplicateTokenEx
ImpersonateSelf
RevertToSelf
CopySid
GetLengthSid
IsWellKnownSid
EqualSid
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetAce
ImpersonateLoggedOnUser
SetSecurityDescriptorGroup
GetSecurityDescriptorLength
SetSecurityDescriptorSacl
InitializeAcl
AccessCheckAndAuditAlarmW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorOwner
MapGenericMask

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc
GlobalFree

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegDeleteTreeW
RegCopyTreeW
RegNotifyChangeKeyValue
RegQueryValueExW
RegDeleteKeyExW
RegEnumValueW
RegCloseKey
RegSetKeySecurity
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegCreateKeyExW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
WaitForSingleObject
EnterCriticalSection
WaitForMultipleObjectsEx
CreateEventW
SetEvent
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
TryEnterCriticalSection
OpenSemaphoreW
OpenEventW
WaitForSingleObjectEx
InitializeCriticalSectionEx
ResetEvent

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
UnregisterWait

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapDestroy
HeapFree
HeapAlloc
HeapReAlloc
HeapSize

api-ms-win-core-processthreads-l1-1-0

ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
TerminateProcess
CreateThread
GetCurrentThread
SetThreadToken
OpenThreadToken
OpenProcessToken

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount64
GetVersionExW
GetComputerNameExW
GetSystemDirectoryA
GetLocalTime
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

miutils

Instance_InitDynamic
ClassCache_AddClass
OSC_Batch_Destroy
OSC_Batch_Get
MiErrorCategoryFromWindowsError
ClassCache_GetClass
Instance_SetResourceURI
ClassCache_Delete
RtlReleaseFastLockShared
RtlTryAcquireFastLockShared
RtlReleaseFastLockExclusive
RtlInterlockedCompareWait
RtlInterlockedWakeAll
RtlQueueAcquireFastLockShared
RtlTryAcquireFastLockExclusive
RtlQueueAcquireFastLockExclusive
RCClass_New
OSC_Batch_Strdup
Instance_New
Instance_GetResourceURI
ClassCache_New

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW
GetThreadLocale
SetThreadPreferredUILanguages
FindNLSString
GetThreadUILanguage
SetThreadUILanguage

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks
SubmitThreadpoolWork
CreateThreadpoolIo
WaitForThreadpoolIoCallbacks
CloseThreadpoolIo
SetThreadpoolWait
StartThreadpoolIo
CreateThreadpoolWait
CancelThreadpoolIo
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolCleanupGroup

rpcrt4

UuidFromStringW
UuidCreate

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime

dsrole

DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory

api-ms-win-core-localization-obsolete-l1-1-0

GetUserDefaultUILanguage
EnumUILanguagesW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InterlockedFlushSList
QueryDepthSList
InitializeSListHead
InterlockedPushEntrySList

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW
GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-security-lsapolicy-l1-1-0

LsaQueryInformationPolicy
LsaOpenPolicy
LsaAddAccountRights
LsaClose
LsaFreeMemory
LsaRemoveAccountRights

api-ms-win-core-file-l1-1-0

LocalFileTimeToFileTime
CompareFileTime
GetFullPathNameW
CreateFileW

ntdll

NtCompareTokens
RtlInitString
RtlAllocateAndInitializeSid
RtlInitUnicodeString
EtwEventWriteTransfer
RtlFreeSid
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlNtStatusToDosError
EtwEventRegister
NtAllocateLocallyUniqueId
EtwEventUnregister
EtwEventWrite
EtwEventEnabled
EtwEventProviderEnabled

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-security-credentials-l1-1-0

CredDeleteW
CredWriteW
CredFree
CredReadW

api-ms-win-core-job-l2-1-0

QueryInformationJobObject
OpenJobObjectW
AssignProcessToJobObject
CreateJobObjectW
SetInformationJobObject

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-downlevel-advapi32-l4-1-0

LsaManageSidNameMapping

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

pcwum

PerfSetCounterRefValue
PerfCreateInstance
PerfStopProvider
PerfSetCounterSetInfo
PerfStartProvider
PerfDeleteInstance

mi

mi_clientFT_V1
MI_Application_InitializeV1

Exports

Exports

??0?$AutoCleanup@V?$AutoDelete@D@@PEAD@@QEAA@PEAD@Z
??0?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@V?$AutoDelete@UIPRange@CWSManIPFilter@@@@PEAUIPRange@CWSManIPFilter@@@@QEAA@PEAUIPRange@CWSManIPFilter@@@Z
??0?$AutoCleanup@V?$AutoDelete@U_SID@@@@PEAU_SID@@@@QEAA@PEAU_SID@@@Z
??0?$AutoCleanup@V?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@PEAU_WSMAN_STREAM_ID_SET@@@@QEAA@PEAU_WSMAN_STREAM_ID_SET@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$Handle@VISubscription@@@@@@PEAV?$Handle@VISubscription@@@@@@QEAA@PEAV?$Handle@VISubscription@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@QEAA@PEAV?$SafeSet@PEAVCCertMapping@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@QEAA@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@PEAV?$SimpleStack@VCListenerOperation@@@@@@QEAA@PEAV?$SimpleStack@VCListenerOperation@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@PEAV?$SimpleStack@VShellHostEntry@@@@@@QEAA@PEAV?$SimpleStack@VShellHostEntry@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAA@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAA@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAA@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAA@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@Z
??0?$AutoCleanup@V?$AutoDelete@VAdminSid@CSecurity@@@@PEAVAdminSid@CSecurity@@@@QEAA@PEAVAdminSid@CSecurity@@@Z
??0?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@QEAA@PEAVBlockedRecord@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAA@PEAVCBaseConfigCache@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCCertMapping@@@@PEAVCCertMapping@@@@QEAA@PEAVCCertMapping@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@@QEAA@PEAVCConfigChangeSource@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCListenerSettings@@@@PEAVCListenerSettings@@@@QEAA@PEAVCListenerSettings@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCObserverConfigChangeErrors@@@@PEAVCObserverConfigChangeErrors@@@@QEAA@PEAVCObserverConfigChangeErrors@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@QEAA@PEAVCServiceWatcher@CServiceConfigCache@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCShellUriSettings@@@@PEAVCShellUriSettings@@@@QEAA@PEAVCShellUriSettings@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@QEAA@PEAVCertHash@@@Z
??0?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@QEAA@PEAVConfigUpdate@@@Z
??0?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??0?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VEventHandler@WSMan@@@@PEAVEventHandler@WSMan@@@@QEAA@PEAVEventHandler@WSMan@@@Z
??0?$AutoCleanup@V?$AutoDelete@VExpiredOperationIdRecord@@@@PEAVExpiredOperationIdRecord@@@@QEAA@PEAVExpiredOperationIdRecord@@@Z
??0?$AutoCleanup@V?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@@QEAA@PEAVGPApiManager@@@Z
??0?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??0?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@@QEAA@PEAVIChannelObserverFactory@@@Z
??0?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAA@PEAVIQueryDASHSMASHInterface@@@Z
??0?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAA@PEAVISpecification@@@Z
??0?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VInteractiveSid@CSecurity@@@@PEAVInteractiveSid@CSecurity@@@@QEAA@PEAVInteractiveSid@CSecurity@@@Z
??0?$AutoCleanup@V?$AutoDelete@VIpHlpApiDllLoader@@@@PEAVIpHlpApiDllLoader@@@@QEAA@PEAVIpHlpApiDllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VMachineName@@@@PEAVMachineName@@@@QEAA@PEAVMachineName@@@Z
??0?$AutoCleanup@V?$AutoDelete@VNetworkServiceSid@CSecurity@@@@PEAVNetworkServiceSid@CSecurity@@@@QEAA@PEAVNetworkServiceSid@CSecurity@@@Z
??0?$AutoCleanup@V?$AutoDelete@VNtDsApiDllLoader@@@@PEAVNtDsApiDllLoader@@@@QEAA@PEAVNtDsApiDllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAA@PEAVOptionValue@SessionOptions@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@QEAA@PEAVPacketCreator@@@Z
??0?$AutoCleanup@V?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@@QEAA@PEAVPacketParser@@@Z
??0?$AutoCleanup@V?$AutoDelete@VResources@Locale@@@@PEAVResources@Locale@@@@QEAA@PEAVResources@Locale@@@Z
??0?$AutoCleanup@V?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@@QEAA@PEAVRunAsConfiguration@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSafeBufferWrite@@@@PEAVSafeBufferWrite@@@@QEAA@PEAVSafeBufferWrite@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@QEAA@PEAVSecurityEntry@Catalog@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@PEAVSendPacketArgs@RobustConnectionBuffer@@@@QEAA@PEAVSendPacketArgs@RobustConnectionBuffer@@@Z
??0?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@QEAA@PEAVServiceSoapProcessor@@@Z
??0?$AutoCleanup@V?$AutoDelete@VShell32DllLoader@@@@PEAVShell32DllLoader@@@@QEAA@PEAVShell32DllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VShlWApiDllLoader@@@@PEAVShlWApiDllLoader@@@@QEAA@PEAVShlWApiDllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@@QEAA@PEAVSubscriptionEnumerator@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSubscriptionManager@@@@PEAVSubscriptionManager@@@@QEAA@PEAVSubscriptionManager@@@Z
??0?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAA@PEAVTSTRBUFFER@@@Z
??0?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@@QEAA@PEAVUniqueStringOverflow@@@Z
??0?$AutoCleanup@V?$AutoDelete@VUser32DllLoader@@@@PEAVUser32DllLoader@@@@QEAA@PEAVUser32DllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@@QEAA@PEAVWSMANCONFIGTABLE_IDENTITY@@@Z
??0?$AutoCleanup@V?$AutoDelete@VWSManMemCryptManager@@@@PEAVWSManMemCryptManager@@@@QEAA@PEAVWSManMemCryptManager@@@Z
??0?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAA@PEAVWmiEnumContext@@@Z
??0?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@QEAA@PEAVXmlReader@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@QEAA@PEBG@Z
??0?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@QEAA@PEAD@Z
??0?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@PEAE@Z
??0?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@H@@PEAH@@QEAA@PEAH@Z
??0?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAA@PEAPEAG@Z
??0?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAA@PEAPEBG@Z
??0?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@U_CONFIG_UPDATE@@@@PEAU_CONFIG_UPDATE@@@@QEAA@PEAU_CONFIG_UPDATE@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAA@PEAU_WINRS_RUN_COMMAND_ARG@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAA@PEAU_WSMAN_OPTION@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAA@PEAE@Z
??0?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@QEAA@PEAVPacket@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostAdminManager@@@@PEAUIAppHostAdminManager@@@@QEAA@PEAUIAppHostAdminManager@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostChildElementCollection@@@@PEAUIAppHostChildElementCollection@@@@QEAA@PEAUIAppHostChildElementCollection@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostConfigException@@@@PEAUIAppHostConfigException@@@@QEAA@PEAUIAppHostConfigException@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostElement@@@@PEAUIAppHostElement@@@@QEAA@PEAUIAppHostElement@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostElementCollection@@@@PEAUIAppHostElementCollection@@@@QEAA@PEAUIAppHostElementCollection@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostProperty@@@@PEAUIAppHostProperty@@@@QEAA@PEAUIAppHostProperty@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostPropertyCollection@@@@PEAUIAppHostPropertyCollection@@@@QEAA@PEAUIAppHostPropertyCollection@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAA@PEAUIClientSecurity@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAA@PEAUIEnumWbemClassObject@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAA@PEAUIErrorInfo@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAA@PEAUIUnknown@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAA@PEAUIWbemClassObject@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAA@PEAUIWbemContext@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAA@PEAUIWbemLocator@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAA@PEAUIWbemObjectTextSrc@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAA@PEAUIWbemPath@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAA@PEAUIWbemPathKeyList@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAA@PEAUIWbemQualifierSet@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAA@PEAUIWbemQuery@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAA@PEAUIWbemServices@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VApplication@Client@WSMan@@@@PEAVApplication@Client@WSMan@@@@QEAA@PEAVApplication@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAA@PEAVCBaseConfigCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@QEAA@PEAVCClientConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@@QEAA@PEAVCCommonConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@@QEAA@PEAVCConfigCacheMap@CBaseConfigCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@QEAA@PEAVCConfigManager@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCRemoteOperation@@@@PEAVCRemoteOperation@@@@QEAA@PEAVCRemoteOperation@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEAA@PEAVCRemoteSession@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAA@PEAVCRequestContext@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@@QEAA@PEAVCServiceCommonConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@@QEAA@PEAVCServiceConfigCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@QEAA@PEAVCServiceConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyCache@@@@PEAVCWSManGroupPolicyCache@@@@QEAA@PEAVCWSManGroupPolicyCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@QEAA@PEAVCWSManGroupPolicyManager@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManObject@@@@PEAVCWSManObject@@@@QEAA@PEAVCWSManObject@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAA@PEAVCWinRSPluginConfigCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@QEAA@PEAVCWinRSPluginConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@QEAA@PEAVCommand@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VConfigNotification@@@@PEAVConfigNotification@@@@QEAA@PEAVConfigNotification@@@Z
??0?$AutoCleanup@V?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@PEAVConnectShellOperation@Client@WSMan@@@@QEAA@PEAVConnectShellOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@PEAVCreateShellOperation@Client@WSMan@@@@QEAA@PEAVCreateShellOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@PEAVDeleteShellOperation@Client@WSMan@@@@QEAA@PEAVDeleteShellOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@PEAVDisconnectOperation@Client@WSMan@@@@QEAA@PEAVDisconnectOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??0?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??0?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VIISConfigSettings@@@@PEAVIISConfigSettings@@@@QEAA@PEAVIISConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VIPCSoapProcessor@@@@PEAVIPCSoapProcessor@@@@QEAA@PEAVIPCSoapProcessor@@@Z
??0?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAA@PEAVIRequestContext@@@Z
??0?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VISubscription@@@@PEAVISubscription@@@@QEAA@PEAVISubscription@@@Z
??0?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEAA@PEAVInboundRequestDetails@@@Z
??0?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@QEAA@PEAVReceiveOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VReconnectOperation@Client@WSMan@@@@PEAVReconnectOperation@Client@WSMan@@@@QEAA@PEAVReconnectOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@QEAA@PEAVSendOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAA@PEAVShell@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VShellInfo@@@@PEAVShellInfo@@@@QEAA@PEAVShellInfo@@@Z
??0?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@QEAA@PEAVSignalOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@QEAA@PEAVUserRecord@@@Z
??0?$AutoCleanup@V?$AutoRelease@VWSManHttpListener@@@@PEAVWSManHttpListener@@@@QEAA@PEAVWSManHttpListener@@@Z
??0?$AutoCleanup@V?$AutoReleaseEx@VHostMappingTableEntry@@@@PEAVHostMappingTableEntry@@@@QEAA@PEAVHostMappingTableEntry@@@Z
??0?$AutoCleanup@V?$AutoReleaseEx@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAA@PEAVShell@Client@WSMan@@@Z
??0?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@XZ
??0?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@XZ
??0?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@PEBU_CERT_CONTEXT@@@Z
??0?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@PEBU_CERT_CHAIN_CONTEXT@@@Z
??0?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@PEAUHINSTANCE__@@@Z
??0?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@XZ
??0?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@PEAU_MI_Class@@@Z
??0?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@XZ
??0?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@PEAU_MI_Instance@@@Z
??0?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@XZ
??0?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@PEAUWSMAN_OBJECT@@@Z
??0?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@PEAUHKEY__@@@Z
??0?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@XZ
??0?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@XZ
??0?$AutoDelete@D@@QEAA@XZ
??0?$AutoDelete@G@@QEAA@PEAG@Z
??0?$AutoDelete@G@@QEAA@XZ
??0?$AutoDelete@UIPRange@CWSManIPFilter@@@@QEAA@XZ
??0?$AutoDelete@U_SID@@@@QEAA@PEAU_SID@@@Z
??0?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@QEAA@PEAU_WSMAN_STREAM_ID_SET@@@Z
??0?$AutoDelete@V?$Handle@VISubscription@@@@@@QEAA@PEAV?$Handle@VISubscription@@@@@Z
??0?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@XZ
??0?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@QEAA@PEAV?$SafeSet@PEAVCCertMapping@@@@@Z
??0?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@QEAA@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@Z
??0?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@QEAA@XZ
??0?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAA@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@Z
??0?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAA@XZ
??0?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAA@XZ
??0?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAA@XZ
??0?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAA@XZ
??0?$AutoDelete@VAdminSid@CSecurity@@@@QEAA@PEAVAdminSid@CSecurity@@@Z
??0?$AutoDelete@VBlockedRecord@@@@QEAA@XZ
??0?$AutoDelete@VCBaseConfigCache@@@@QEAA@PEAVCBaseConfigCache@@@Z
??0?$AutoDelete@VCCertMapping@@@@QEAA@PEAVCCertMapping@@@Z
??0?$AutoDelete@VCConfigChangeSource@@@@QEAA@XZ
??0?$AutoDelete@VCListenerSettings@@@@QEAA@PEAVCListenerSettings@@@Z
??0?$AutoDelete@VCObserverConfigChangeErrors@@@@QEAA@XZ
??0?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@QEAA@PEAVCServiceWatcher@CServiceConfigCache@@@Z
??0?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@QEAA@XZ
??0?$AutoDelete@VCShellUriSettings@@@@QEAA@PEAVCShellUriSettings@@@Z
??0?$AutoDelete@VCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??0?$AutoDelete@VCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??0?$AutoDelete@VCWSManResource@@@@QEAA@XZ
??0?$AutoDelete@VCertHash@@@@QEAA@PEAVCertHash@@@Z
??0?$AutoDelete@VCertHash@@@@QEAA@XZ
??0?$AutoDelete@VConfigUpdate@@@@QEAA@PEAVConfigUpdate@@@Z
??0?$AutoDelete@VConfigUpdate@@@@QEAA@XZ
??0?$AutoDelete@VEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??0?$AutoDelete@VEnumSinkEx@@@@QEAA@XZ
??0?$AutoDelete@VEventHandler@WSMan@@@@QEAA@PEAVEventHandler@WSMan@@@Z
??0?$AutoDelete@VExpiredOperationIdRecord@@@@QEAA@PEAVExpiredOperationIdRecord@@@Z
??0?$AutoDelete@VGPApiManager@@@@QEAA@XZ
??0?$AutoDelete@VGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??0?$AutoDelete@VGeneralSinkEx@@@@QEAA@XZ
??0?$AutoDelete@VIChannelObserverFactory@@@@QEAA@PEAVIChannelObserverFactory@@@Z
??0?$AutoDelete@VIChannelObserverFactory@@@@QEAA@XZ
??0?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@PEAVIQueryDASHSMASHInterface@@@Z
??0?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@XZ
??0?$AutoDelete@VISpecification@@@@QEAA@PEAVISpecification@@@Z
??0?$AutoDelete@VISpecification@@@@QEAA@XZ
??0?$AutoDelete@VInteractiveSid@CSecurity@@@@QEAA@PEAVInteractiveSid@CSecurity@@@Z
??0?$AutoDelete@VIpHlpApiDllLoader@@@@QEAA@PEAVIpHlpApiDllLoader@@@Z
??0?$AutoDelete@VMachineName@@@@QEAA@PEAVMachineName@@@Z
??0?$AutoDelete@VNetworkServiceSid@CSecurity@@@@QEAA@PEAVNetworkServiceSid@CSecurity@@@Z
??0?$AutoDelete@VNtDsApiDllLoader@@@@QEAA@PEAVNtDsApiDllLoader@@@Z
??0?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@QEAA@PEAVOptionValue@SessionOptions@Client@WSMan@@@Z
??0?$AutoDelete@VPacketCreator@@@@QEAA@PEAVPacketCreator@@@Z
??0?$AutoDelete@VPacketCreator@@@@QEAA@XZ
??0?$AutoDelete@VPacketParser@@@@QEAA@XZ
??0?$AutoDelete@VResources@Locale@@@@QEAA@PEAVResources@Locale@@@Z
??0?$AutoDelete@VRunAsConfiguration@@@@QEAA@PEAVRunAsConfiguration@@@Z
??0?$AutoDelete@VSafeBufferWrite@@@@QEAA@PEAVSafeBufferWrite@@@Z
??0?$AutoDelete@VSecurityEntry@Catalog@@@@QEAA@PEAVSecurityEntry@Catalog@@@Z
??0?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@QEAA@PEAVSendPacketArgs@RobustConnectionBuffer@@@Z
??0?$AutoDelete@VServiceSoapProcessor@@@@QEAA@XZ
??0?$AutoDelete@VShell32DllLoader@@@@QEAA@PEAVShell32DllLoader@@@Z
??0?$AutoDelete@VShlWApiDllLoader@@@@QEAA@PEAVShlWApiDllLoader@@@Z
??0?$AutoDelete@VSubscriptionEnumerator@@@@QEAA@XZ
??0?$AutoDelete@VSubscriptionManager@@@@QEAA@PEAVSubscriptionManager@@@Z
??0?$AutoDelete@VTSTRBUFFER@@@@QEAA@PEAVTSTRBUFFER@@@Z
??0?$AutoDelete@VTSTRBUFFER@@@@QEAA@XZ
??0?$AutoDelete@VUniqueStringOverflow@@@@QEAA@XZ
??0?$AutoDelete@VUser32DllLoader@@@@QEAA@PEAVUser32DllLoader@@@Z
??0?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@QEAA@PEAVWSMANCONFIGTABLE_IDENTITY@@@Z
??0?$AutoDelete@VWSManMemCryptManager@@@@QEAA@PEAVWSManMemCryptManager@@@Z
??0?$AutoDelete@VWmiEnumContext@@@@QEAA@PEAVWmiEnumContext@@@Z
??0?$AutoDelete@VWmiEnumContext@@@@QEAA@XZ
??0?$AutoDelete@VXmlReader@@@@QEAA@PEAVXmlReader@@@Z
??0?$AutoDelete@VXmlReader@@@@QEAA@XZ
??0?$AutoDeleteVector@$$CBG@@QEAA@XZ
??0?$AutoDeleteVector@D@@QEAA@PEAD@Z
??0?$AutoDeleteVector@D@@QEAA@XZ
??0?$AutoDeleteVector@E@@QEAA@PEAE@Z
??0?$AutoDeleteVector@E@@QEAA@XZ
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
??0?$AutoDeleteVector@G@@QEAA@XZ
??0?$AutoDeleteVector@H@@QEAA@PEAH@Z
??0?$AutoDeleteVector@PEAG@@QEAA@PEAPEAG@Z
??0?$AutoDeleteVector@PEAG@@QEAA@XZ
??0?$AutoDeleteVector@PEBG@@QEAA@PEAPEBG@Z
??0?$AutoDeleteVector@PEBG@@QEAA@XZ
??0?$AutoDeleteVector@U_CONFIG_UPDATE@@@@QEAA@XZ
??0?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@Z
??0?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@XZ
??0?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAA@PEAU_WINRS_RUN_COMMAND_ARG@@@Z
??0?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAA@XZ
??0?$AutoDeleteVector@U_WSMAN_OPTION@@@@QEAA@PEAU_WSMAN_OPTION@@@Z
??0?$AutoDeleteVector@U_WSMAN_OPTION@@@@QEAA@XZ
??0?$AutoDeleteVector@X@@QEAA@PEAX@Z
??0?$AutoDeleteVector@X@@QEAA@XZ
??0?$AutoFree@E@@QEAA@PEAE@Z
??0?$AutoFree@E@@QEAA@XZ
??0?$AutoLocklessItemRecycle@VPacket@@@@QEAA@PEAVPacket@@@Z
??0?$AutoLocklessItemRecycle@VPacket@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostAdminManager@@@@QEAA@PEAUIAppHostAdminManager@@@Z
??0?$AutoRelease@UIAppHostChildElementCollection@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostConfigException@@@@QEAA@PEAUIAppHostConfigException@@@Z
??0?$AutoRelease@UIAppHostElement@@@@QEAA@PEAUIAppHostElement@@@Z
??0?$AutoRelease@UIAppHostElement@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostElementCollection@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostProperty@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostPropertyCollection@@@@QEAA@XZ
??0?$AutoRelease@UIClientSecurity@@@@QEAA@PEAUIClientSecurity@@@Z
??0?$AutoRelease@UIClientSecurity@@@@QEAA@XZ
??0?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@PEAUIEnumWbemClassObject@@@Z
??0?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@XZ
??0?$AutoRelease@UIErrorInfo@@@@QEAA@PEAUIErrorInfo@@@Z
??0?$AutoRelease@UIErrorInfo@@@@QEAA@XZ
??0?$AutoRelease@UIUnknown@@@@QEAA@PEAUIUnknown@@@Z
??0?$AutoRelease@UIUnknown@@@@QEAA@XZ
??0?$AutoRelease@UIWbemClassObject@@@@QEAA@PEAUIWbemClassObject@@@Z
??0?$AutoRelease@UIWbemClassObject@@@@QEAA@XZ
??0?$AutoRelease@UIWbemContext@@@@QEAA@PEAUIWbemContext@@@Z
??0?$AutoRelease@UIWbemContext@@@@QEAA@XZ
??0?$AutoRelease@UIWbemLocator@@@@QEAA@PEAUIWbemLocator@@@Z
??0?$AutoRelease@UIWbemLocator@@@@QEAA@XZ
??0?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@PEAUIWbemObjectTextSrc@@@Z
??0?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@XZ
??0?$AutoRelease@UIWbemPath@@@@QEAA@PEAUIWbemPath@@@Z
??0?$AutoRelease@UIWbemPath@@@@QEAA@XZ
??0?$AutoRelease@UIWbemPathKeyList@@@@QEAA@PEAUIWbemPathKeyList@@@Z
??0?$AutoRelease@UIWbemPathKeyList@@@@QEAA@XZ
??0?$AutoRelease@UIWbemQualifierSet@@@@QEAA@PEAUIWbemQualifierSet@@@Z
??0?$AutoRelease@UIWbemQualifierSet@@@@QEAA@XZ
??0?$AutoRelease@UIWbemQuery@@@@QEAA@PEAUIWbemQuery@@@Z
??0?$AutoRelease@UIWbemQuery@@@@QEAA@XZ
??0?$AutoRelease@UIWbemServices@@@@QEAA@PEAUIWbemServices@@@Z
??0?$AutoRelease@UIWbemServices@@@@QEAA@XZ
??0?$AutoRelease@VApplication@Client@WSMan@@@@QEAA@XZ
??0?$AutoRelease@VCBaseConfigCache@@@@QEAA@PEAVCBaseConfigCache@@@Z
??0?$AutoRelease@VCClientConfigSettings@@@@QEAA@PEAVCClientConfigSettings@@@Z
??0?$AutoRelease@VCClientConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCCommonConfigSettings@@@@QEAA@PEAVCCommonConfigSettings@@@Z
??0?$AutoRelease@VCCommonConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@QEAA@PEAVCConfigCacheMap@CBaseConfigCache@@@Z
??0?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@QEAA@XZ
??0?$AutoRelease@VCConfigManager@@@@QEAA@PEAVCConfigManager@@@Z
??0?$AutoRelease@VCConfigManager@@@@QEAA@XZ
??0?$AutoRelease@VCRemoteOperation@@@@QEAA@PEAVCRemoteOperation@@@Z
??0?$AutoRelease@VCRemoteSession@@@@QEAA@PEAVCRemoteSession@@@Z
??0?$AutoRelease@VCRemoteSession@@@@QEAA@XZ
??0?$AutoRelease@VCRequestContext@@@@QEAA@PEAVCRequestContext@@@Z
??0?$AutoRelease@VCRequestContext@@@@QEAA@XZ
??0?$AutoRelease@VCServiceCommonConfigSettings@@@@QEAA@PEAVCServiceCommonConfigSettings@@@Z
??0?$AutoRelease@VCServiceCommonConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCServiceConfigCache@@@@QEAA@PEAVCServiceConfigCache@@@Z
??0?$AutoRelease@VCServiceConfigCache@@@@QEAA@XZ
??0?$AutoRelease@VCServiceConfigSettings@@@@QEAA@PEAVCServiceConfigSettings@@@Z
??0?$AutoRelease@VCServiceConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??0?$AutoRelease@VCWSManEPR@@@@QEAA@XZ
??0?$AutoRelease@VCWSManGroupPolicyCache@@@@QEAA@PEAVCWSManGroupPolicyCache@@@Z
??0?$AutoRelease@VCWSManGroupPolicyManager@@@@QEAA@PEAVCWSManGroupPolicyManager@@@Z
??0?$AutoRelease@VCWSManObject@@@@QEAA@PEAVCWSManObject@@@Z
??0?$AutoRelease@VCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??0?$AutoRelease@VCWSManResource@@@@QEAA@XZ
??0?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAA@PEAVCWinRSPluginConfigCache@@@Z
??0?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAA@XZ
??0?$AutoRelease@VCWinRSPluginConfigSettings@@@@QEAA@PEAVCWinRSPluginConfigSettings@@@Z
??0?$AutoRelease@VCommand@Client@WSMan@@@@QEAA@PEAVCommand@Client@WSMan@@@Z
??0?$AutoRelease@VConfigNotification@@@@QEAA@PEAVConfigNotification@@@Z
??0?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@QEAA@PEAVConnectShellOperation@Client@WSMan@@@Z
??0?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@QEAA@PEAVCreateShellOperation@Client@WSMan@@@Z
??0?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@QEAA@PEAVDeleteShellOperation@Client@WSMan@@@Z
??0?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@QEAA@PEAVDisconnectOperation@Client@WSMan@@@Z
??0?$AutoRelease@VEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??0?$AutoRelease@VEnumSinkEx@@@@QEAA@XZ
??0?$AutoRelease@VGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??0?$AutoRelease@VGeneralSinkEx@@@@QEAA@XZ
??0?$AutoRelease@VIISConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VIPCSoapProcessor@@@@QEAA@PEAVIPCSoapProcessor@@@Z
??0?$AutoRelease@VIRequestContext@@@@QEAA@PEAVIRequestContext@@@Z
??0?$AutoRelease@VIRequestContext@@@@QEAA@XZ
??0?$AutoRelease@VISubscription@@@@QEAA@PEAVISubscription@@@Z
??0?$AutoRelease@VInboundRequestDetails@@@@QEAA@XZ
??0?$AutoRelease@VReceiveOperation@Client@WSMan@@@@QEAA@PEAVReceiveOperation@Client@WSMan@@@Z
??0?$AutoRelease@VReconnectOperation@Client@WSMan@@@@QEAA@PEAVReconnectOperation@Client@WSMan@@@Z
??0?$AutoRelease@VSendOperation@Client@WSMan@@@@QEAA@PEAVSendOperation@Client@WSMan@@@Z
??0?$AutoRelease@VShell@Client@WSMan@@@@QEAA@PEAVShell@Client@WSMan@@@Z
??0?$AutoRelease@VShellInfo@@@@QEAA@XZ
??0?$AutoRelease@VSignalOperation@Client@WSMan@@@@QEAA@PEAVSignalOperation@Client@WSMan@@@Z
??0?$AutoRelease@VUserRecord@@@@QEAA@XZ
??0?$AutoRelease@VWSManHttpListener@@@@QEAA@PEAVWSManHttpListener@@@Z
??0?$AutoReleaseEx@VHostMappingTableEntry@@@@QEAA@XZ
??0?$AutoReleaseEx@VShell@Client@WSMan@@@@QEAA@PEAVShell@Client@WSMan@@@Z
??0?$ILoader@VAdminSid@CSecurity@@@@QEAA@P8AdminSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VEventHandler@WSMan@@@@QEAA@P8EventHandler@WSMan@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VInteractiveSid@CSecurity@@@@QEAA@P8InteractiveSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VIpHlpApiDllLoader@@@@QEAA@P8IpHlpApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VMachineName@@@@QEAA@P8MachineName@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VNetworkServiceSid@CSecurity@@@@QEAA@P8NetworkServiceSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VNtDsApiDllLoader@@@@QEAA@P8NtDsApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VResources@Locale@@@@QEAA@P8Resources@Locale@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VShell32DllLoader@@@@QEAA@P8Shell32DllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VShlWApiDllLoader@@@@QEAA@P8ShlWApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VSubscriptionManager@@@@QEAA@P8SubscriptionManager@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VUser32DllLoader@@@@QEAA@P8User32DllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VWSManMemCryptManager@@@@QEAA@P8WSManMemCryptManager@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$Loader@VAdminSid@CSecurity@@$00@@QEAA@XZ
??0?$Loader@VEventHandler@WSMan@@$00@@QEAA@XZ
??0?$Loader@VInteractiveSid@CSecurity@@$00@@QEAA@XZ
??0?$Loader@VIpHlpApiDllLoader@@$00@@QEAA@XZ
??0?$Loader@VMachineName@@$00@@QEAA@XZ
??0?$Loader@VNetworkServiceSid@CSecurity@@$00@@QEAA@XZ
??0?$Loader@VNtDsApiDllLoader@@$00@@QEAA@XZ
??0?$Loader@VResources@Locale@@$0A@@@QEAA@XZ
??0?$Loader@VShell32DllLoader@@$00@@QEAA@XZ
??0?$Loader@VShlWApiDllLoader@@$00@@QEAA@XZ
??0?$Loader@VUser32DllLoader@@$00@@QEAA@XZ
??0?$Loader@VWSManMemCryptManager@@$00@@QEAA@XZ
??0?$LoaderSerializer@VAdminSid@CSecurity@@$00@@QEAA@P8AdminSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VEventHandler@WSMan@@$00@@QEAA@P8EventHandler@WSMan@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VInteractiveSid@CSecurity@@$00@@QEAA@P8InteractiveSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VIpHlpApiDllLoader@@$00@@QEAA@P8IpHlpApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VMachineName@@$00@@QEAA@P8MachineName@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VNetworkServiceSid@CSecurity@@$00@@QEAA@P8NetworkServiceSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VNtDsApiDllLoader@@$00@@QEAA@P8NtDsApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VResources@Locale@@$0A@@@QEAA@P8Resources@Locale@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VShell32DllLoader@@$00@@QEAA@P8Shell32DllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VShlWApiDllLoader@@$00@@QEAA@P8ShlWApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VSubscriptionManager@@$01@@QEAA@P8SubscriptionManager@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VUser32DllLoader@@$00@@QEAA@P8User32DllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VWSManMemCryptManager@@$00@@QEAA@P8WSManMemCryptManager@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$PacketElement@K@PacketParser@@QEAA@XZ
??0?$PacketElement@PEAU_FWXML_ELEMENT@@@PacketParser@@QEAA@XZ
??0?$PacketElement@PEBG@PacketParser@@QEAA@XZ
??0?$PacketElement@_K@PacketParser@@QEAA@XZ
??0?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAA@XZ
??0?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??0?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAA@XZ
??0?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAA@XZ
??0?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA@XZ
??0?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA@XZ
??0?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAA@XZ
??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@XZ
??0?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA@XZ
??0?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA@XZ
??0?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA@XZ
??0?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@XZ
??0?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA@XZ
??0?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEAA@AEAV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEAA@AEAV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEAA@AEAV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Iterator@PEAXUEmpty@@@@QEAA@AEAV?$SafeMap@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@_N@Z
??0?$SafeMap_Iterator@UPluginKey@@K@@QEAA@AEAV?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@_N@Z
??0?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@QEAA@AEAV?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@_N@Z
??0?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEAA@AEAV?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@_N@Z
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Iterator@VStringKeyCI@@K@@QEAA@AEAV?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@_N@Z
??0?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEAA@AEAV?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@_N@Z
??0?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEAA@AEAV?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@_N@Z
??0?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@QEAA@AEAV?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@_N@Z
??0?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAA@AEAV?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@_N@Z
??0?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@QEAA@AEAV?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@QEAA@AEBV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAA@AEBV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEAA@AEBV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@AEBV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@QEAA@AEBV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAA@AEBV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@_N@Z
??0?$SafeMap_Lock@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@QEAA@AEBV?$SafeMap@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@_N@Z
??0?$SafeMap_Lock@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAA@AEBV?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@_N@Z
??0?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA@AEBV?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@_N@Z
??0?$SafeMap_Lock@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA@AEBV?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@_N@Z
??0?$SafeMap_Lock@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAA@AEBV?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@AEBV?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@QEAA@AEBV?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA@AEBV?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA@AEBV?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA@AEBV?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@_N@Z
??0?$SafeMap_Lock@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@AEBV?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@_N@Z
??0?$SafeMap_Lock@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA@AEBV?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@_N@Z
??0?$SafeSet@PEAVCCertMapping@@@@QEAA@XZ
??0?$SafeSet@PEAVCListenerOperation@@@@QEAA@XZ
??0?$SafeSet@PEAVCShellUriSettings@@@@QEAA@XZ
??0?$SafeSet@PEAX@@QEAA@XZ
??0?$SafeSet_Iterator@PEAVCCertMapping@@@@QEAA@AEAV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@_N@Z
??0?$SafeSet_Iterator@PEAVCCertMapping@@@@QEAA@AEAV?$SafeSet@PEAVCCertMapping@@@@@Z
??0?$SafeSet_Iterator@PEAVCListenerOperation@@@@QEAA@AEAV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@_N@Z
??0?$SafeSet_Iterator@PEAVCListenerOperation@@@@QEAA@AEAV?$SafeSet@PEAVCListenerOperation@@@@@Z
??0?$SafeSet_Iterator@PEAVCShellUriSettings@@@@QEAA@AEAV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@_N@Z
??0?$SafeSet_Iterator@PEAX@@QEAA@AEAV?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@_N@Z
??0?$SimpleQueue@T_LARGE_INTEGER@@@@QEAA@XZ
??0AutoBstr@@QEAA@PEAG@Z
??0AutoBstr@@QEAA@XZ
??0AutoBstrNoAlloc@@QEAA@PEAG@Z

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 845KB - Virtual size: 844KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WsmTxt.xsl
.xml
Ex_PE_v3.1.9/CMap/libs/WsmWmiPl.dll
.dll windows:10 windows x64 arch:x64

82469943932cc96d7fe159fb18b1a039

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WsmWmiPl.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
iswalnum
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
iswalpha
wcstoul
wcscpy_s
wcstok_s
_wcsicoll
_purecall
_HUGE
wcstod
wcsncmp
_fpclass
wcsstr
towlower
iswdigit
_vsnwprintf
_wtoi
wcschr
_wcslwr
wcsrchr
_wcsicmp
_ultow_s
_itow_s
_lock
_unlock
__dllonexit
_onexit
memset
_errno
iswspace
__CxxFrameHandler3
wcscmp

api-ms-win-core-synch-l1-1-0

SetEvent
DeleteCriticalSection
EnterCriticalSection
WaitForMultipleObjectsEx
CreateEventW
ResetEvent
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForSingleObject

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceEnableFlags

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
CreateThread

oleaut32

GetErrorInfo
VariantInit
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetDim
VariantCopy
VariantClear
VarCmp
SysFreeString
SysStringLen
SysAllocString

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

miutils

WMIEventToCIMIndication
RtlInitializeCachedFastLock
?GetNoneCachedWmiClass@WMISchema@@UEAAJPEBGPEAUIWbemServices@@AEAV?$CComPtr@UIWbemClassObject@@@ATL@@PEAUIConversionContext@@@Z
RtlInterlockedWakeAll
RtlInterlockedCompareWait
MI_Hash
RtlDeleteCachedFastLock
RtlQueueAcquireCachedFastLockShared
RtlTryAcquireCachedFastLockShared
RtlReleaseCachedFastLockShared
RtlQueueAcquireCachedFastLockExclusive
RtlReleaseCachedFastLockExclusive
IsLifeCycleIndicationQuery
??1WMISchema@@UEAA@XZ
??0WMISchema@@QEAA@XZ

wsmsvc

??1?$AutoRelease@UIWbemQuery@@@@QEAA@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAPEAUIWbemQuery@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAPEAPEAUIWbemQuery@@XZ
??0?$AutoRelease@UIWbemQuery@@@@QEAA@PEAUIWbemQuery@@@Z
WSManDeliverEndSubscriptionNotification
WSManDeliverEvent
WSManClosePublisherHandle
??C?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAUIEnumWbemClassObject@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAPEAUIEnumWbemClassObject@@XZ
??0?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@PEAUIEnumWbemClassObject@@@Z
WSManCloseObjectHandle
WSManEnumeratorAddEvent
FwXmlIsSimpleContentOrEmpty
??B?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAUIUnknown@@XZ
??0ExtendedSemantic@@QEAA@K@Z
?Storage@?$AutoCleanup@VAutoHandle@@PEAX@@QEAAPEAPEAXXZ
??7?$AutoCleanup@VAutoHandle@@PEAX@@QEBA_NXZ
WSManPluginInteractiveCallback
?CreateAnEvent@SoapSemanticConverter@@QEAAKKPEAVSemanticMessage@@AEAVBufferFormatter@@PEAVIRequestContext@@@Z
??1SoapSemanticConverter@@QEAA@XZ
??0SoapSemanticConverter@@QEAA@XZ
?DuplicateCurrentToken@CSecurity@@SAHPEAPEAXKPEAU_SECURITY_ATTRIBUTES@@W4_SECURITY_IMPERSONATION_LEVEL@@W4_TOKEN_TYPE@@H@Z
?ImpersonateUserOrSelf@CSecurity@@SAHW4CallSiteId@@PEAX@Z
StringCchEndsWithCI
StringTrimWhitespace
?ParseHeaders@CWSManResourceNoResourceUri@@QEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@11@Z
??1CWSManResourceNoResourceUri@@UEAA@XZ
??0CWSManResourceNoResourceUri@@QEAA@H@Z
?GetErrorCode@CErrorContext@@UEBAKXZ
??7?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBA_NXZ
WSManEncodeObject
??4AutoBstrNoAlloc@@QEAAAEAV0@PEAG@Z
StringIsBlank
??7?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEBA_NXZ
??4?$AutoRelease@UIWbemClassObject@@@@QEAAAEAV0@PEAUIWbemClassObject@@@Z
??1?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAPEAUIWbemObjectTextSrc@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAPEAPEAUIWbemObjectTextSrc@@XZ
??0?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@XZ
??1?$AutoRelease@UIUnknown@@@@QEAA@XZ
?Storage@?$AutoCleanup@VAutoBstr@@PEAG@@QEAAPEAPEAGXZ
??1?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@XZ
??1?$AutoDelete@VISpecification@@@@QEAA@XZ
??B?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAPEAVISpecification@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAPEAVISpecification@@XZ
??4?$AutoDelete@VISpecification@@@@QEAAAEAV0@PEAVISpecification@@@Z
WSManPluginOperationComplete
??1CErrorContext@@UEAA@XZ
??0CErrorContext@@QEAA@_N@Z
?Free@WSManMemory@@SAXPEAXH@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
?CompleteWithErrorContext@CRequestContext@@QEAAXPEAU_WSMAN_PLUGIN_REQUEST@@@Z
??1CRequestContext@@UEAA@XZ
??0CRequestContext@@QEAA@XZ
WSManPluginObjectResult
??1CWSManCriticalSection@@QEAA@XZ
WSManError
??0?$AutoDelete@VWmiEnumContext@@@@QEAA@XZ
??B?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAPEAVWmiEnumContext@@XZ
??C?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAPEAVWmiEnumContext@@XZ
??1?$AutoDelete@VWmiEnumContext@@@@QEAA@XZ
??1TSTRBUFFER@@QEAA@XZ
??1?$AutoRelease@UIWbemServices@@@@QEAA@XZ
??1?$AutoDeleteVector@G@@QEAA@XZ
?GetWsmanData@TSTRBUFFER@@QEAAXPEAU_WSMAN_DATA@@@Z
?Reset@TSTRBUFFER@@QEAAXXZ
??0TSTRBUFFER@@QEAA@XZ
?GetSpaceUsed@BufferFormatter@@UEBAK_N@Z
?GetBuffer@BufferFormatter@@UEAAPEAEXZ
?Reset@BufferFormatter@@UEAAXXZ
??1BufferFormatter@@UEAA@XZ
??0BufferFormatter@@QEAA@XZ
?Acquire@CWSManCriticalSection@@QEAAXXZ
?Release@CWSManCriticalSection@@QEAAXXZ
??0AutoBstrNoAlloc@@QEAA@XZ
StringCchEqualsCI
StringCchEquals
?SetUpdateMode@BufferFormatter@@UEAAXW4Mode@1@@Z
?GrowBuffer@BufferFormatter@@UEAAKXZ
?GetError@BufferFormatter@@QEBAKXZ
StringCchStartsWithCI
??0AutoBstr@@QEAA@XZ
StringCchStartsWith
FwXmlCompareElementName
FwXmlGetElementNameEx
FwXmlNumChildren
FwXmlCloseParser
??0AutoBstr@@QEAA@PEAG@Z
?AllocBstr@WSManMemory@@SAPEAGPEBGHH@Z
FwXmlGetChild
SafeStringToUI64
?ParseEprElement@CWSManEPR@@SAPEAV1@PEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?GetUri@CWSManResource@@QEAAPEBGXZ
?GetKeyCount@CWSManResourceNoResourceUri@@QEAAKXZ
?GetKeys@CWSManResourceNoResourceUri@@QEAAPEAU_WSMAN_KEY@@XZ
?Parse@CWSManResource@@SAPEAV1@PEAVIRequestContext@@PEBGH@Z
FwXmlNumConsecutiveChildrenWithName
FwXmlNumChildrenWithName
FwXmlCompareName
FwXmlGetAttributeValue
?RecordMIFailure@IRequestContext@@QEAAXW4_MI_Result@@K@Z
??4AutoBstr@@QEAAAEAV0@PEAG@Z
FwXmlGetElementName
FwXmlHasText
FwXmlIsSimpleContent
FwXmlGetSimpleContentEx
FwXmlIsNull
FwXmlIsEmpty
?AppendXmlStartElem@TSTRBUFFER@@QEAAJPEBGHKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithPrefix@TSTRBUFFER@@QEAAJPEBG0HKPEAU_XML_ATTRIB@@@Z
?AppendXmlEndElem@TSTRBUFFER@@QEAAJPEBG@Z
?AppendXmlEndElemWithPrefix@TSTRBUFFER@@QEAAJPEBG0@Z
?AppendEscapeXmlContent@TSTRBUFFER@@QEAAJPEBG_N@Z
?AppendXmlStartElemWithNamespaces@TSTRBUFFER@@QEAAJPEBGKPEAU_XML_NAMESPACE_PREFIX@@HKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithNamespacesAndPrefixes@TSTRBUFFER@@QEAAJPEBG0KPEAU_XML_NAMESPACE_PREFIX@@HKPEAU_XML_ATTRIB@@@Z
FwXmlParserCreate
FwXmlParseText
FwXmlGetEntryNameEx
?StringToDword@@YAHPEBGPEAK@Z
??0?$AutoDeleteVector@E@@QEAA@XZ
??1?$AutoDeleteVector@E@@QEAA@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAEXZ
RestoreAllPrivileges
EnableAllPrivileges
?SetLocale@CRequestContext@@QEAA_NPEBGK@Z
??0?$AutoDeleteVector@G@@QEAA@XZ
??4?$AutoDeleteVector@G@@QEAAAEAV0@PEAG@Z
??B?$AutoCleanup@VAutoBstr@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAPEAGXZ
?Storage@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAPEAPEAGXZ
??4?$AutoDeleteVector@E@@QEAAAEAV0@PEAE@Z
?Storage@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAPEAEXZ
??0?$AutoDelete@G@@QEAA@XZ
??4?$AutoDelete@G@@QEAAAEAV0@PEAG@Z
??B?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
??0?$AutoRelease@UIWbemClassObject@@@@QEAA@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAPEAUIWbemClassObject@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
??0?$AutoRelease@UIWbemServices@@@@QEAA@XZ
??4?$AutoRelease@UIWbemServices@@@@QEAAAEAV0@PEAUIWbemServices@@@Z
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAPEAUIWbemServices@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
??0?$AutoRelease@UIWbemContext@@@@QEAA@XZ
??0?$AutoRelease@UIWbemContext@@@@QEAA@PEAUIWbemContext@@@Z
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAPEAUIWbemContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
??0?$AutoDelete@VTSTRBUFFER@@@@QEAA@PEAVTSTRBUFFER@@@Z
??4?$AutoDelete@VTSTRBUFFER@@@@QEAAAEAV0@PEAVTSTRBUFFER@@@Z
??7?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEBA_NXZ
??B?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAPEAVTSTRBUFFER@@XZ
??C?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAPEAVTSTRBUFFER@@XZ
??0?$AutoDeleteVector@PEAG@@QEAA@PEAPEAG@Z
??B?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAAPEAPEAGXZ
??0?$AutoRelease@UIWbemQualifierSet@@@@QEAA@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAUIWbemQualifierSet@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAPEAUIWbemQualifierSet@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAUIWbemQualifierSet@@XZ
??0?$AutoRelease@UIUnknown@@@@QEAA@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAUIUnknown@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAPEAUIUnknown@@XZ
??0?$AutoRelease@VCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??B?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
??0?$AutoDelete@VCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??B?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
??0?$AutoRelease@UIWbemPath@@@@QEAA@PEAUIWbemPath@@@Z
??B?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAUIWbemPath@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAPEAUIWbemPath@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAUIWbemPath@@XZ
??0?$AutoRelease@UIWbemPathKeyList@@@@QEAA@PEAUIWbemPathKeyList@@@Z
??B?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAUIWbemPathKeyList@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAPEAUIWbemPathKeyList@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAUIWbemPathKeyList@@XZ
??0?$AutoRelease@UIErrorInfo@@@@QEAA@XZ
??B?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAUIErrorInfo@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAPEAUIErrorInfo@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAUIErrorInfo@@XZ
??1?$AutoRelease@UIErrorInfo@@@@QEAA@XZ
??1?$AutoRelease@UIWbemContext@@@@QEAA@XZ
??1?$AutoRelease@UIWbemPathKeyList@@@@QEAA@XZ
??1?$AutoRelease@UIWbemPath@@@@QEAA@XZ
??1?$AutoDelete@VCWSManResource@@@@QEAA@XZ
??1?$AutoRelease@VCWSManEPR@@@@QEAA@XZ
??0?$AutoDelete@VISpecification@@@@QEAA@PEAVISpecification@@@Z
??1?$AutoRelease@UIWbemQualifierSet@@@@QEAA@XZ
??1?$AutoDeleteVector@PEAG@@QEAA@XZ
??1?$AutoDelete@G@@QEAA@XZ
??1AutoBstr@@QEAA@XZ
??1AutoBstrNoAlloc@@QEAA@XZ
??1?$AutoDelete@VTSTRBUFFER@@@@QEAA@XZ
??1?$AutoRelease@UIWbemClassObject@@@@QEAA@XZ
?GetStrPtr@TSTRBUFFER@@QEAAPEAGXZ
?SetSize@TSTRBUFFER@@QEAAJII@Z
?AllocSysString@TSTRBUFFER@@QEBAJPEAPEAG@Z
?GetCharInUse@TSTRBUFFER@@QEBAIXZ
?QueryStr@TSTRBUFFER@@QEBAPEBGXZ
?AppendChar@TSTRBUFFER@@QEAAJG@Z
?Append@TSTRBUFFER@@QEAAJPEBGII@Z
?Append@TSTRBUFFER@@QEAAJPEBG@Z
?GetSizeInUse@SBUFFER@@QEBAIXZ
?Resize@RBUFFER@@QEAAHI@Z
?QuerySize@RBUFFER@@QEBAIXZ
??0CWSManCriticalSection@@QEAA@XZ
?IsValid@CWSManCriticalSection@@QEBAHXZ
??0AutoHandle@@QEAA@PEAX@Z
?GetToken@CSecurity@@SAPEAXXZ
??0AutoLocalFree@@QEAA@XZ
?ExtractSidFromToken@CSecurity@@SAHPEAVIRequestContext@@PEAXAEAVAutoLocalFree@@@Z
WrapperCoSetProxyBlanket
??B?$AutoCleanup@VAutoHandle@@PEAX@@QEAAPEAXXZ
??B?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAPEAXXZ
??B?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBAQEAGXZ
??0?$AutoRelease@UIWbemServices@@@@QEAA@PEAUIWbemServices@@@Z
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEBAQEAUIWbemServices@@XZ
??0?$AutoRelease@UIWbemLocator@@@@QEAA@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAUIWbemLocator@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAPEAUIWbemLocator@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAUIWbemLocator@@XZ
??0?$AutoRelease@UIClientSecurity@@@@QEAA@XZ
??1?$AutoRelease@UIClientSecurity@@@@QEAA@XZ
??1?$AutoRelease@UIWbemLocator@@@@QEAA@XZ
??1AutoLocalFree@@QEAA@XZ
??1AutoHandle@@QEAA@XZ
?AppendXmlStartFragment@TSTRBUFFER@@QEAAJXZ
?AppendXmlEndFragment@TSTRBUFFER@@QEAAJXZ
??0?$AutoRelease@UIWbemClassObject@@@@QEAA@PEAUIWbemClassObject@@@Z
??0?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@XZ
??B?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAUIEnumWbemClassObject@@XZ
??4?$AutoDelete@VWmiEnumContext@@@@QEAAAEAV0@PEAVWmiEnumContext@@@Z
??0?$AutoRelease@VEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??B?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
??C?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
??1?$AutoRelease@VEnumSinkEx@@@@QEAA@XZ
??1?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@XZ
?AppendXmlEndItem@TSTRBUFFER@@QEAAJXZ
?AppendXmlStartItem@TSTRBUFFER@@QEAAJXZ
??0?$AutoRelease@VGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??B?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
??C?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
??1?$AutoRelease@VGeneralSinkEx@@@@QEAA@XZ
?CopyString@@YAPEAGPEBGAEBHAEAVIRequestContext@@@Z
??0AutoHandle@@QEAA@XZ
??0AutoLibrary@@QEAA@PEAUHINSTANCE__@@@Z
??1AutoLibrary@@QEAA@XZ
??4AutoHandle@@QEAAAEAV0@PEAX@Z
?IsEventEnabled@EventHandler@WSMan@@SA_NAEBU_EVENT_DESCRIPTOR@@@Z
?ReAlloc@WSManMemory@@SAPEAXPEAX_KHW4_NitsFaultMode@@@Z
?FormatDataDescriptor@EventHandler@WSMan@@SAXAEAU_EVENT_DATA_DESCRIPTOR@@AEAJ@Z
?Write@EventHandler@WSMan@@SAXAEBU_EVENT_DESCRIPTOR@@KPEAU_EVENT_DATA_DESCRIPTOR@@@Z
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
??B?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAAPEAUHINSTANCE__@@XZ
??0?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@XZ
??4?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAAAEAV0@PEAVIQueryDASHSMASHInterface@@@Z
??B?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAPEAVIQueryDASHSMASHInterface@@XZ
??C?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAPEAVIQueryDASHSMASHInterface@@XZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
??0?$AutoDelete@VISpecification@@@@QEAA@XZ

crypt32

CryptStringToBinaryW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
?Acquire@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEBAXXZ
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?Initialize@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?IsValid@?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?Release@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEBAXXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ
WSManPluginShutdown
WSManPluginStartup
WSManProvCreate
WSManProvDelete
WSManProvEnumerate
WSManProvGet
WSManProvIdentify
WSManProvInvoke
WSManProvPullEvents
WSManProvPut
WSManProvSubscribe
WSManProvUnsubscribe

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WudfSMCClassExt.dll
.dll windows:10 windows x64 arch:x64

9e6a87008bb74f3a9e5d7d50b81bc2c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WudfSMCClassExt.pdb

Imports

msvcrt

_initterm
_amsg_exit
_XcptFilter
memcpy
free
_callnewh
__C_specific_handler
malloc
memset

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
TraceMessage

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Microsoft_WDF_UMDF_Version

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WwaApi.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a5b7d2505e937b6cd5627f4f9370c5b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WwaApi.pdb

Imports

msvcrt

memcpy_s
_purecall
malloc
free
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
_lock
_unlock
__dllonexit
_onexit
memcmp
_vsnwprintf
memset

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoWaitForMultipleHandles
CoGetApartmentType

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCreateString
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
WindowsDeleteString
HSTRING_UserFree
HSTRING_UserSize64
HSTRING_UserFree64
WindowsDuplicateString
HSTRING_UserSize
HSTRING_UserMarshal64
WindowsIsStringEmpty
WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
HSTRING_UserMarshal

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-misc-l1-1-0

Sleep
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeSRWLock
LeaveCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreateEventExW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
LoadLibraryExW
GetModuleHandleExW
LoadStringW
FreeLibrary
GetModuleFileNameA

api-ms-win-downlevel-advapi32-l1-1-0

GetTokenInformation

api-ms-win-downlevel-kernel32-l1-1-0

QueueUserWorkItem

api-ms-win-downlevel-shlwapi-l2-1-0

SHGetThreadRef

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIsCriticalSectionLocked
RtlDeleteCriticalSection

rpcrt4

IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrStubCall3
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_Invoke
NdrStubForwardingFunction

urlmon

CreateUri

combase

ord10
ord20
ord15
ord9
ord16
ord8
ord7
ord5
ord34
ord33
ord18
CStdStubBuffer2_QueryInterface
ord12
ord6
CStdStubBuffer2_Disconnect
ord22
ord14
ord19
CStdStubBuffer2_Connect
ord11
ord13
ord32
CStdStubBuffer2_CountRefs
ord21
ord2
ord17

oleaut32

SysStringLen
SysAllocString
SysAllocStringLen
SysFreeString

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WwaExt.dll
.dll windows:10 windows x64 arch:x64

c8e91ea002440c7101b3d460d03f9e4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WwaExt.pdb

Imports

msvcrt

_unlock
_lock
__dllonexit
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
memset
_onexit
free
_purecall
malloc
memcpy_s
_vsnwprintf

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
GetProcAddress

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreExW
CreateMutexExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

RtlIsCriticalSectionLocked
RtlDeleteCriticalSection

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

combase

ord90
ord157

Exports

Exports

CheckAllowDiagnosticsMode
DetermineCurrentDisplayRotationAngle
DllMain
ExtensionModulePreActivate
GetExtensionHostModuleCount
GetExtensionHostModuleFactory
GetExtensionWebModuleCount
GetExtensionWebModuleFactory
GetExtensionWebMultiThreadedModuleCount
GetExtensionWebMultiThreadedModuleFactory
ProcessDisplayRotation
SetPhoneWerParameters
StaticExtensionInitialization
StaticExtensionUnInitialization
WWABehaviorEnabled

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/WwanRadioManager.dll
.dll windows:10 windows x64 arch:x64

82d3870e32f87cb2c7c0272f4097410c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WwanRadioManager.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o_calloc
_o_free
_o_malloc
_o_toupper
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
EtwTraceMessage
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
RtlCaptureContext
NtQueryWnfStateData
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ResetEvent
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapAlloc
HeapFree
HeapReAlloc
HeapDestroy

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
CreateThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-synch-l1-2-0

Sleep

iphlpapi

ConvertInterfaceGuidToLuid
GetIfEntry2

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

NotifyServiceStatusChangeW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventProviderEnabled
EventSetInformation
EventUnregister

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/Wwanpref.dll
.dll windows:10 windows x64 arch:x64

1b38dd4bf3318d1b6425e428dd735c98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wwanpref.pdb

Imports

msvcrt

_XcptFilter
_amsg_exit
_errno
realloc
_lock
_unlock
_callnewh
wcsstr
wcsncpy_s
malloc
free
_initterm
memcpy_s
__C_specific_handler
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memset
__CxxFrameHandler3
_CxxThrowException
_purecall
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

UnhandledExceptionFilter
ReleaseActCtx
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
Sleep
SizeofResource
CreateActCtxW
ActivateActCtx
SetLastError
EnterCriticalSection
GetModuleHandleExW
OutputDebugStringA
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
FindActCtxSectionStringW
DeactivateActCtx
QueryActCtxW
MultiByteToWideChar
GetLastError
RaiseException
LoadLibraryW
FindResourceExW
LoadResource
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
lstrlenW
lstrlenA

advapi32

GetTraceLoggerHandle
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
TraceMessage
RegDeleteValueW
RegEnumKeyExW
GetTraceEnableFlags
RegSetValueExW
GetTraceEnableLevel

oleaut32

VarUI4FromStr

shell32

ord155
SHCreateItemInKnownFolder
ShellExecuteExW
SHGetIDListFromObject
ord18

user32

UnregisterClassA
SetMenuDefaultItem
InsertMenuW
LoadStringW
CharNextW
CharLowerW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
IIDFromString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XAudio2_8.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

xaudio2_8.pdb

Exports

Exports

CreateAudioReverb
CreateAudioVolumeMeter
CreateFX
X3DAudioCalculate
X3DAudioInitialize
XAudio2Create
XAudio2CreateWithVersionInfo

Sections

.rdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XAudio2_9.dll
.dll windows:10 windows x64 arch:x64

4b7d7e0a9f1167b635f71347ca9cdb73

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XAudio2_9.pdb

Imports

msvcrt

__dllonexit
_unlock
_purecall
_vsnprintf
_lock
_XcptFilter
_onexit
sqrt
_aligned_free
_aligned_malloc
wcscpy_s
malloc
_clearfp
_control87
_vsnwprintf
memcpy_s
??3@YAXPEAX@Z
sin
memcpy
cos
floorf
memcmp
memset
sqrtf
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memmove
??1type_info@@UEAA@XZ
_amsg_exit
__C_specific_handler
free
_initterm
acosf
atan2f
cosf
exp
floor
log
pow
powf
sinf
tanf

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
CreateEventA
LeaveCriticalSection
ResetEvent
CreateMutexExW
WaitForSingleObjectEx
CreateEventExA
DeleteCriticalSection
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObject
SetEvent
CreateEventW
CreateWaitableTimerExW
ReleaseMutex
TryEnterCriticalSection
SetWaitableTimer
CreateSemaphoreExW
CancelWaitableTimer
WaitForMultipleObjectsEx
EnterCriticalSection

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapDestroy
HeapSize
GetProcessHeap
HeapCreate
HeapFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-com-l1-1-0

CoCreateInstance
PropVariantClear
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
CoCreateGuid

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
Sleep
InitializeConditionVariable
WakeAllConditionVariable

api-ms-win-core-processthreads-l1-1-0

ResumeThread
GetCurrentProcessId
GetThreadPriority
GetCurrentThreadId
TerminateProcess
SetThreadPriority
CreateThread
GetCurrentThread
GetCurrentProcess

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

mmdevapi

ord17

avrt

AvSetMmThreadPriority
AvSetMmThreadCharacteristicsA
AvRevertMmThreadCharacteristics

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-featurestaging-l1-1-0

UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage
SubscribeFeatureStateChangeNotification

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateAudioReverb
CreateAudioReverbV2_8
CreateAudioVolumeMeter
CreateFX
X3DAudioCalculate
X3DAudioInitialize
XAudio2Create
XAudio2CreateV2_9
XAudio2CreateWithSharedContexts
XAudio2CreateWithVersionInfo

Sections

.text
Size: 446KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.no_bbt
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XInput1_4.dll
.dll windows:10 windows x64 arch:x64

d05a85d591f6e82ba032f8ecb86de7bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XInput1_4.pdb

Imports

msvcrt

_initterm
memcpy
malloc
free
_amsg_exit
_XcptFilter
_wcsnicmp
__C_specific_handler
_vsnwprintf
memset

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo
GetTickCount

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
FreeLibrary
LoadLibraryExW
LoadLibraryExA

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ResetEvent
LeaveCriticalSection
SetEvent
CreateEventW
AcquireSRWLockExclusive
InitializeCriticalSection
WaitForSingleObject
ReleaseSRWLockExclusive
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

CreateThread
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-devices-query-l1-1-0

DevCloseObjectQuery
DevCreateObjectQuery

api-ms-win-rtcore-ntuser-private-l1-1-4

ord2597

devobj

DevObjGetDeviceProperty
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInfo
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjDestroyDeviceInfoList

api-ms-win-downlevel-kernel32-l1-1-0

QueueUserWorkItem

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

Exports

Exports

DllMain
XInputEnable
XInputGetAudioDeviceIds
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetKeystroke
XInputGetState
XInputSetState

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XInput9_1_0.dll
.dll windows:10 windows x64 arch:x64

63d93368171f55b978aaeadef4dc5439

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XInput9_1_0.pdb

Imports

msvcrt

__C_specific_handler
_XcptFilter
_initterm
malloc
free
_amsg_exit

kernel32

Sleep
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
FreeLibrary
LoadLibraryExW
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId

Exports

Exports

DllMain
XInputGetCapabilities
XInputGetDSoundAudioDeviceGuids
XInputGetState
XInputSetState

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XInputUap.dll
.dll windows:10 windows x64 arch:x64

ba5cafa611966aacf9d4221b03f1679e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XInputUap.pdb

Imports

msvcrt

_initterm
malloc
free
__C_specific_handler
_XcptFilter
_purecall
_onexit
__CxxFrameHandler3
_lock
??3@YAXPEAX@Z
??1type_info@@UEAA@XZ
_unlock
_amsg_exit
__dllonexit
memcpy_s
_vsnwprintf
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
memset

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseMutex
CreateMutexExW
WaitForSingleObjectEx
LeaveCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
EnterCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

Exports

Exports

DllMain
XInputEnable
XInputGetAudioDeviceIds
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetKeystroke
XInputGetState
XInputSetState

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/X_80.contrast-black.png
.png
Ex_PE_v3.1.9/CMap/libs/X_80.contrast-white.png
.png
Ex_PE_v3.1.9/CMap/libs/X_80.png
.png
Ex_PE_v3.1.9/CMap/libs/XamlTileRender.dll
.dll windows:10 windows x64 arch:x64

676fc741c159ab63dd398a1039a81679

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XamlTileRender.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wtoi
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o_towlower
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcscmp

shcore

ord244
SHTaskPoolQueueTask

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
ReleaseSemaphore
ReleaseSRWLockShared
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockShared
InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsPreallocateStringBuffer
WindowsDeleteStringBuffer
WindowsPromoteStringBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
GetRestrictedErrorInfo
RoTransformError
SetRestrictedErrorInfo
RoFailFastWithErrorContext

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoIncrementMTAUsage
CoGetObjectContext
CoTaskMemFree

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoOriginateLanguageException

msvcp_win

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

oleaut32

SysStringLen
SysFreeString

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XblAuthManager.dll
.dll windows:10 windows x64 arch:x64

c9fe76fa00dbca05f5e9e8985d7ca489

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XblAuthManager.pdb

Imports

msvcp_win

?_Xbad_alloc@std@@YAXXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
_Wcscoll
_Wcsxfrm
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$collate@G@std@@2V0locale@2@A

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__mkgmtime64
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wctime64_s
memmove
_o__wtoi64
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_o_terminate
_o_towlower
_o_towupper
_o_wcstol
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__execute_onexit_table
_o__configure_narrow_argv
_o__errno
_o__cexit
_o__callnewh
strrchr
wcsstr
wcschr
strchr
wcsrchr
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcscmp
wcsncmp
wcsnlen
memset

api-ms-win-core-com-l1-1-0

CoInitializeSecurity
CoRegisterClassObject
CoTaskMemFree
CoDecrementMTAUsage
CoGetCallContext
CoImpersonateClient
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoReleaseServerProcess
CoWaitForMultipleHandles
StringFromGUID2
CoAddRefServerProcess
CoRevertToSelf
CoDisconnectContext
CoRevokeClassObject
CoGetStandardMarshal
CoResumeClassObjects
CoCreateFreeThreadedMarshaler

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser
MakeAbsoluteSD
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
DuplicateToken

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
CreateSemaphoreExW
ReleaseSemaphore
OpenSemaphoreW
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseMutex
CreateEventExW
ReleaseSRWLockShared
SetEvent
CreateMutexExW
AcquireSRWLockShared
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
CreateEventW
DeleteCriticalSection
ResetEvent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDuplicateString
WindowsIsStringEmpty
WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsGetStringLen

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
SetThreadToken
OpenThreadToken

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoInitialize
RoUninitialize
RoRevokeActivationFactories
RoGetActivationFactory
RoRegisterActivationFactories

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoTransformError
RoOriginateError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

combase

ord66
ord68
ord69
ord67

appxalluserstore

FamilyMonikerStringToSid

wininet

InternetSetOptionW
InternetQueryOptionW

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegOpenCurrentUser
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegGetValueW
RegEnumValueW
RegDeleteTreeW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

ntdll

RtlFreeSid
DbgPrintEx
NtQueryInformationToken
RtlIpv4AddressToStringW
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlPublishWnfStateData
RtlUnsubscribeWnfStateChangeNotification

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer
ChangeTimerQueueTimer
QueueUserWorkItem

crypt32

CertAddEncodedCertificateToStore
CertFindCertificateInStore
CertOpenStore
CertAddCertificateContextToStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertCompareCertificate
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CryptQueryObject
CertGetCertificateContextProperty

winhttp

WinHttpSetTimeouts
WinHttpConnect
WinHttpOpenRequest
WinHttpOpen
WinHttpSetStatusCallback
WinHttpSetDefaultProxyConfiguration
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpCloseHandle
WinHttpSetOption
WinHttpSendRequest
WinHttpCrackUrl

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

oleaut32

SysFreeString

api-ms-win-core-heap-l2-1-0

LocalFree

bcrypt

BCryptFinalizeKeyPair
BCryptGenerateKeyPair
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptSignHash
BCryptExportKey
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptImportKeyPair

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

iphlpapi

GetAdaptersAddresses

ws2_32

htonl
WSAGetLastError
InetPtonW

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
WriteFile
GetFileSize
GetFileAttributesW
CreateDirectoryW
DeleteFileW
CreateFileW
ReadFile
FindFirstFileW
FindClose
FindNextFileW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

userenv

ExpandEnvironmentStringsForUserW

api-ms-win-security-credentials-l1-1-0

CredWriteW
CredDeleteW
CredFree
CredReadW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

rpcrt4

RpcSsDestroyClientContext
RpcAsyncCompleteCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcAsyncInitializeHandle
RpcStringFreeW
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcAsyncCancelCall
Ndr64AsyncClientCall

ncrypt

NCryptStreamOpenToUnprotect
NCryptCloseProtectionDescriptor
NCryptStreamClose
NCryptStreamUpdate
NCryptCreateProtectionDescriptor
NCryptStreamOpenToProtect

sspicli

LogonUserExExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-appmodel-identity-l1-2-0

AppContainerDeriveSidFromMoniker

api-ms-win-appmodel-runtime-l1-1-0

GetPackagesByPackageFamily
GetPackageFamilyName

urlmon

CreateUri

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ServiceMain

Sections

.text
Size: 828KB - Virtual size: 827KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XblAuthManagerProxy.dll
.dll windows:10 windows x64 arch:x64

554b9d3fc531eb6bf112868ddfed781a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XblAuthManagerProxy.pdb

Imports

msvcrt

malloc
_lock
_unlock
__dllonexit
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
_initterm
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_onexit
_amsg_exit
memcmp
_XcptFilter
_purecall
??3@YAXPEAX@Z
memcpy
memmove
??1type_info@@UEAA@XZ
free
__CxxFrameHandler3
??1exception@@UEAA@XZ
__C_specific_handler
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

rpcrt4

CStdStubBuffer_Invoke
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
NdrStubCall3
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserSize64
HSTRING_UserUnmarshal64
HSTRING_UserFree64
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserSize

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateInstance
CoGetStandardMarshal
CoTaskMemFree

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient12
ObjectStublessClient22
ObjectStublessClient4
ObjectStublessClient26
CStdAsyncStubBuffer_QueryInterface
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_AddRef
ObjectStublessClient5
CStdAsyncStubBuffer_Connect
ObjectStublessClient28
ObjectStublessClient27
ObjectStublessClient3
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Release
ObjectStublessClient25
ObjectStublessClient24
CStdStubBuffer2_Connect
NdrProxyForwardingFunction3
ObjectStublessClient21
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient14
CStdStubBuffer2_CountRefs
ObjectStublessClient11

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XblAuthTokenBrokerExt.dll
.dll windows:10 windows x64 arch:x64

832310b8ecc7bdbeed37ba8537682837

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XblAuthTokenBrokerExt.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_realloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__crt_atexit
_o___std_exception_copy
_o__configure_narrow_argv
wcschr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringLen
WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
OpenProcessToken

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
CreateEventW
InitializeSRWLock
LeaveCriticalSection
ReleaseSemaphore
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
SetEvent
WaitForSingleObjectEx
EnterCriticalSection
ReleaseSRWLockShared
CreateMutexExW
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
AcquireSRWLockShared
AcquireSRWLockExclusive

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateInstance

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
RoTransformError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XblGameSave.dll
.dll windows:10 windows x64 arch:x64

7e80c7b4f275c9ea605678d912adb2c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XblGameSave.pdb

Imports

msvcrt

__C_specific_handler
??0exception@@QEAA@AEBQEBDH@Z
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
malloc
_initterm
??_V@YAXPEAX@Z
_vsnprintf
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
_onexit
memmove
__CxxFrameHandler3
free
??3@YAXPEAX@Z
_amsg_exit
_XcptFilter
_callnewh
_purecall
_CxxThrowException
??0bad_cast@@QEAA@AEBV0@@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
strchr
realloc
towupper
wcscat_s
??8type_info@@QEBAHAEBV0@@Z
_ultow_s
memmove_s
_wcstoui64
_wcsicmp
wcsstr
wcsncpy_s
wcscpy_s
_wtoi64
wcschr
wcsncmp
swscanf_s
_wtoi
tolower
setlocale
memcpy
___mb_cur_max_func
_errno
___lc_handle_func
___lc_codepage_func
__pctype_func
calloc
__crtLCMapStringW
___lc_collate_cp_func
memcmp
__crtCompareStringW
abort
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
_vsnprintf_s
memcpy_s
_vsnwprintf
?terminate@@YAXXZ
memset

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

SetEvent
ResetEvent
CreateSemaphoreExW
InitializeCriticalSectionEx
InitializeCriticalSection
ReleaseSemaphore
CreateMutexExW
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject
CreateEventW
DeleteCriticalSection
InitializeSRWLock
EnterCriticalSection
ReleaseSRWLockShared
OpenSemaphoreW
LeaveCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoReleaseServerProcess
CoFreeUnusedLibraries
CoCreateInstance
CoInitializeEx
CoAddRefServerProcess
CoUninitialize
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoSetProxyBlanket
CoSwitchCallContext
StringFromGUID2
CoCreateGuid
CoRevertToSelf
CoImpersonateClient
CoRevokeClassObject
CoEnableCallCancellation
CoDecrementMTAUsage
CoCancelCall
CoDisableCallCancellation
CoInitializeSecurity
CoRegisterClassObject
CoResumeClassObjects
CoDisconnectContext

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoUninitialize
RoInitialize
RoRegisterActivationFactories
RoGetActivationFactory
RoRevokeActivationFactories

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsGetStringLen
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsDuplicateString
WindowsGetStringRawBuffer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError
RoTransformError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
InitOnceExecuteOnce

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD
RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetSystemTime

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegDeleteKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegDeleteTreeW
RegGetValueW
RegCloseKey
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW

oleaut32

VariantInit

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-file-l1-1-0

FindClose
GetFileInformationByHandle
CreateDirectoryW
CreateFileW
SetFilePointerEx
SetEndOfFile
FindNextFileW
FindFirstFileW
ReadFile
WriteFile
CompareFileTime
GetFileSizeEx
GetFileAttributesW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

rpcrt4

NdrServerCallAll
NdrServerCall2
RpcRevertToSelfEx
RpcImpersonateClient
RpcServerUnregisterIf
RpcBindingVectorFree
RpcServerUseProtseqW
RpcServerInqBindings
RpcServerRegisterIf3
RpcEpRegisterW
RpcEpUnregister
UuidFromStringW

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

ntdll

NtFlushBuffersFileEx
NtSetInformationFile
RtlDosPathNameToNtPathName_U
NtQueryInformationToken
DbgPrintEx
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlCapabilityCheck
RtlInitUnicodeString
RtlIsMultiSessionSku
RtlSubscribeWnfStateChangeNotification

combase

ord67
ord69
ord68
ord66

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ServiceMain

Sections

.text
Size: 841KB - Virtual size: 840KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XblGameSaveExt.dll
.dll windows:10 windows x64 arch:x64

439a5494913805c562813ed13f86862c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XblGameSaveExt.pdb

Imports

msvcrt

__dllonexit
__C_specific_handler
__CxxFrameHandler3
_unlock
_onexit
_initterm
malloc
memcmp
free
_amsg_exit
_vsnwprintf
_wcsicmp
_lock
wcsncmp
qsort_s
wcschr
_vsnprintf
_wcsnicmp
swscanf_s
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
_XcptFilter
??3@YAXPEAX@Z
memcpy_s
_purecall
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateWaitableTimerExW
SetWaitableTimer
CreateMutexExW
CancelWaitableTimer
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockShared
ReleaseMutex
InitializeSRWLock
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSemaphore
OpenEventW
CreateEventW
LeaveCriticalSection
CreateSemaphoreExW
InitializeCriticalSection
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentProcessId
CreateThread
ResumeThread
GetCurrentThreadId
QueueUserAPC
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateGuid
CoTaskMemFree
CoGetMalloc
CoWaitForMultipleHandles
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoGetCallContext

dnsapi

DnsQueryEx
DnsRecordListUnmapV4MappedAAAAInPlace
DnsFree

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegOpenKeyExW

winhttp

WinHttpCloseHandle
WinHttpCrackUrl
WinHttpCreateUrl
WinHttpQueryHeaders
WinHttpQueryOption
WinHttpReadData
WinHttpWriteData
WinHttpReceiveResponse
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpSendRequest
WinHttpOpen

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-file-l1-1-0

GetFileSizeEx
DeleteFileW
CreateFileW

crypt32

CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateChain
CertGetCertificateContextProperty
CertFreeCertificateContext

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-path-l1-1-0

PathCchAddExtension
PathCchAppend

rpcrt4

UuidCreateSequential

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-mm-time-l1-1-0

timeBeginPeriod
timeEndPeriod

ntdll

RtlIpv4StringToAddressExW
NtQueryObject
RtlIpv6StringToAddressExW
RtlGetLastWin32Error
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

Exports

Exports

XblGameSave_GetUserStorageRoot
XblGameSave_NTMSCreateInstance
XblGameSave_NTMSServerStart
XblGameSave_NTMSServerStop

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XblGameSaveProxy.dll
.dll regsvr32 windows:10 windows x64 arch:x64

c16d46dedf9fc2ba917bcf7f71dbf80f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XblGameSaveProxy.pdb

Imports

msvcrt

_amsg_exit
_XcptFilter
__C_specific_handler
_initterm
free
malloc
memcmp

rpcrt4

CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_IsIIDSupported
NdrOleFree

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserFree
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserSize
HSTRING_UserUnmarshal64

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
CStdAsyncStubBuffer_AddRef
ObjectStublessClient6
ObjectStublessClient13
CStdAsyncStubBuffer_Invoke
ObjectStublessClient7
CStdAsyncStubBuffer_QueryInterface
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient12
CStdAsyncStubBuffer_Disconnect
ObjectStublessClient10
ObjectStublessClient5
CStdAsyncStubBuffer_Connect
CStdAsyncStubBuffer_Release
ObjectStublessClient11
ObjectStublessClient4

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XblGameSaveTask.exe
.exe windows:10 windows x64 arch:x64

5fe4d2e140acb326c0c6cd7c4ef83c9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

XblGameSaveTask.pdb

Imports

msvcrt

_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
_lock
_unlock
__setusermatherr
_initterm
_fmode
malloc
_commode
__dllonexit
?what@exception@@UEBAPEBDXZ
_onexit
wprintf
_wcsicmp
??0exception@@QEAA@AEBQEBD@Z
__C_specific_handler
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBDH@Z
??3@YAXPEAX@Z
??1type_info@@UEAA@XZ
memcpy_s
_vsnwprintf
?terminate@@YAXXZ
__CxxFrameHandler3
memcpy
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
WaitForSingleObject
CreateMutexExW
CreateSemaphoreExW
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

RpcBindingSetAuthInfoExW
I_RpcExceptionFilter
RpcBindingFromStringBindingW
RpcBindingFree
RpcStringFreeW
NdrClientCall3
RpcStringBindingComposeW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ntdll

RtlIsMultiSessionSku

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XboxGipRadioManager.dll
.dll regsvr32 windows:10 windows x64 arch:x64

261c24b57ec8d0d6368e6850f42def73

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XboxGipRadioManager.pdb

Imports

msvcrt

_lock
__CxxFrameHandler3
_errno
??1type_info@@UEAA@XZ
_onexit
?terminate@@YAXXZ
_CxxThrowException
_initterm
_amsg_exit
_XcptFilter
_callnewh
vswprintf_s
_vscwprintf
_unlock
__dllonexit
memmove_s
wprintf
calloc
_resetstkoflw
_purecall
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
realloc
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
RtlVirtualUnwind
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwRegisterTraceGuidsW

oleaut32

LoadTypeLi
SysStringLen
UnRegisterTypeLi
VarUI4FromStr
RegisterTypeLi
SysFreeString
SysAllocStringLen
SysAllocString

kernel32

Sleep
AcquireSRWLockExclusive
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
UnhandledExceptionFilter
ReleaseSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
CreateThread
CreateEventW
SetEvent
DeviceIoControl
OutputDebugStringA
GetTickCount
CreateFileW
FreeLibrary
SetUnhandledExceptionFilter
CloseHandle
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
lstrcmpiW
GetCurrentThreadId
DeleteCriticalSection
WaitForSingleObject
GetModuleFileNameW
InitializeCriticalSection
LeaveCriticalSection
RaiseException
EnterCriticalSection
FindResourceExW
MultiByteToWideChar
SizeofResource
LoadResource
GetSystemTimeAsFileTime

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
StringFromGUID2

user32

CharNextW
LoadStringW
UnregisterClassA

advapi32

RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW

cfgmgr32

CM_Unregister_Notification
CM_Register_Notification

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XboxNetApiSvc.dll
.dll windows:10 windows x64 arch:x64

41b0457d980e1d74c5f605e82d3b3bdd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XboxNetApiSvc.pdb

Imports

msvcrt

__CxxFrameHandler3
memcpy_s
_vsnwprintf
wcschr
_ultow_s
realloc
vswprintf_s
_vsnprintf_s
memcmp
memmove_s
wcscpy_s
swprintf_s
_snwprintf_s
strtoul
_wcsicmp
_wcstoui64
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
memset

powrprof

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

ntdll

RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCreateServiceSid

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoRevokeClassObject
CoRegisterClassObject
CoResumeClassObjects
CoCreateGuid
CoInitializeEx
CoWaitForMultipleHandles
CoTaskMemFree
CoCreateInstance
CoAddRefServerProcess
CoReleaseServerProcess
CoUninitialize
CoDisconnectContext

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull
WindowsDeleteString

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoRevokeActivationFactories
RoActivateInstance
RoRegisterActivationFactories
RoInitialize
RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoOriginateErrorW
RoSetErrorReportingFlags
SetRestrictedErrorInfo
RoTransformError
RoOriginateError

api-ms-win-core-synch-l1-1-0

SetWaitableTimer
DeleteCriticalSection
InitializeSRWLock
AcquireSRWLockShared
InitializeCriticalSection
WaitForMultipleObjectsEx
CreateWaitableTimerExW
SetEvent
WaitForSingleObject
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
ResetEvent

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetLengthSid
EqualSid
CopySid
CreateWellKnownSid

api-ms-win-core-processthreads-l1-1-0

CreateThread
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
TerminateProcess
OpenThreadToken
GetCurrentProcess
GetExitCodeThread
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetComputerNameExW

iphlpapi

GetIpNetEntry2
GetIpForwardTable2
GetAdaptersAddresses
FreeMibTable
DeleteIpNetEntry2
InitializeIpForwardEntry
NotifyUnicastIpAddressChange
CancelMibChangeNotify2
NotifyRouteChange2
GetBestRoute2
NotifyIpInterfaceChange

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

CreateFileW
ReadFile
GetFileAttributesW

ws2_32

getsockname
bind
setsockopt
WSAGetLastError
WSASocketW
WSAStartup
WSACleanup
WSAGetOverlappedResult
WSASendTo
FreeAddrInfoW
WSARecvFrom
GetAddrInfoW
GetNameInfoW
getaddrinfo
freeaddrinfo
ntohs
closesocket

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW

rpcrt4

RpcServerInqCallAttributesW
NdrClientCall3
RpcBindingCreateW
RpcBindingBind
RpcBindingUnbind
RpcBindingFree

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

winhttp

WinHttpOpen
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpQueryOption
WinHttpReadData

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

crypt32

CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CryptDecodeObject
CertStrToNameW
PFXImportCertStore
PFXIsPFXBlob
CertFindCertificateInStore
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertOpenStore
CertGetNameStringW
CertFreeCertificateChain
CertCreateCertificateChainEngine
CertFreeCertificateContext
CryptFindCertificateKeyProvInfo
CryptExportPublicKeyInfo
CertIsRDNAttrsInCertificateName
CryptSignAndEncodeCertificate
CryptStringToBinaryW
CryptBinaryToStringW
CertDeleteCertificateFromStore
CertCloseStore
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertCreateCertificateContext
CertEnumCertificatesInStore
CertVerifyTimeValidity

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-core-l1-1-1

EnumServicesStatusExW

api-ms-win-service-management-l2-1-0

QueryServiceConfig2W
QueryServiceStatusEx

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

oleaut32

SysAllocString
VariantClear
SysFreeString
VariantChangeType
VariantInit

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

nsi

NsiGetAllParameters

winnsi

NsiRpcRegisterChangeNotification
NsiRpcDeregisterChangeNotification
NsiConnectToServer
NsiDisconnectFromServer

api-ms-win-downlevel-kernel32-l2-1-0

MulDiv

api-ms-win-appmodel-runtime-l1-1-0

GetApplicationUserModelId
GetPackageFullName

api-ms-win-appmodel-runtime-l1-1-1

GetStagedPackagePathByFullName

ncrypt

NCryptDeleteKey
NCryptExportKey
NCryptSetProperty
NCryptCreatePersistedKey
NCryptOpenStorageProvider
NCryptFinalizeKey
NCryptFreeObject

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

fwpuclnt

IkeextSaDestroyEnumHandle0
FwppGetMD5HashBytes
IkeextSaEnum2
FwpmEngineOpen0
FwpmProviderGetByKey0
FwpmProviderAdd0
FwpmProviderDeleteByKey0
FwpmEngineClose0
FwpmFreeMemory0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderContextAdd2
FwpmProviderContextDeleteByKey0
FwpmProviderContextGetById2
FwpmFilterAdd0
FwpmFilterDeleteById0
IPsecSaContextDeleteById0
IPsecSaContextGetById1
IPsecSaContextCreateEnumHandle0
IPsecSaContextEnum1
IPsecSaContextDestroyEnumHandle0
IPsecSaInitiateAsync0
IkeextSaCreateEnumHandle0

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptExportKey
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextA

firewallapi

FWDeleteSecurityRealm
FWSetAuthenticationSet
FWDeleteAuthenticationSet
FWAddSecurityRealm
FWOpenPolicyStore
FWAddCryptoSet
FWDeleteCryptoSet
FWEnumProducts
FWClosePolicyStore
FWRevertTransaction
FWGetGlobalConfig
FWAddFirewallRule
FWDeleteFirewallRule
FWGetConfig
FWAddAuthenticationSet
FWFreeProducts

Exports

Exports

ServiceMain

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XpsDocumentTargetPrint.dll
.dll regsvr32 windows:10 windows x64 arch:x64

462d18eea38c83f5e26842c54a4a845c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

xpsdocumenttargetprint.pdb

Imports

msvcrt

srand
memmove_s
??0exception@@QEAA@AEBQEBDH@Z
rand
time
wcscpy_s
memcmp
memcpy
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
free
_amsg_exit
malloc
_XcptFilter
_CxxThrowException
_wcsicmp
_callnewh
swprintf_s
strncmp
??1type_info@@UEAA@XZ
wcsrchr
_vsnprintf
strcspn
localeconv
sprintf_s
_strtoi64
_strtoui64
ldiv
_errno
__pctype_func
___lc_handle_func
___lc_codepage_func
__mb_cur_max
setlocale
__uncaught_exception
__crtGetStringTypeW
__crtLCMapStringW
isupper
__crtLCMapStringA
___mb_cur_max_func
islower
isspace
tolower
memchr
abort
isalnum
isdigit
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
_purecall
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
SetEvent
WaitForSingleObject
CreateSemaphoreExW
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
ReleaseMutex
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSemaphore
InitializeCriticalSectionEx
ReleaseSRWLockShared
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventSetInformation
EventWrite
EventUnregister
EventRegister
EventEnabled
EventWriteTransfer

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetProcessTimes

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-com-l1-1-0

CreateStreamOnHGlobal
CoTaskMemFree
CoSetProxyBlanket
CoCreateInstanceEx
CoGetMalloc
CoUninitialize
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoCreateGuid
StringFromCLSID
CoInitializeEx

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolWork
CloseThreadpoolTimer
CreateThreadpoolWork
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree

oleaut32

SetErrorInfo
SysAllocStringLen
SysAllocString
VariantInit
SysFreeString
VariantClear
SysStringLen

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

rpcrt4

NdrDllGetClassObject
NdrDllUnregisterProxy
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
NdrDllRegisterProxy
NdrOleFree
IUnknown_Release_Proxy
NdrOleAllocate
NdrCStdStubBuffer2_Release
IUnknown_QueryInterface_Proxy
NdrStubCall3
RpcServerInqCallAttributesW
UuidCreateSequential
UuidToStringW
RpcStringFreeW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetFileAttributesW
DeleteFileW
WriteFile

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

WinSqmIncrementDWORD
NtQueryInformationToken
WinSqmIsOptedIn
RtlNtStatusToDosError
RtlGetAppContainerSidType
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockShared
RtlInitializeSRWLock
RtlAcquireSRWLockShared

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

api-ms-win-shlwapi-ie-l1-1-0

PathIsDirectoryW

xpsservices

ord9
ord8

combase

CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerRelease
ord4
CStdStubBuffer_Disconnect
ord6
CStdStubBuffer2_Disconnect
ord32
ord33
CStdStubBuffer_QueryInterface
ord2
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer2_CountRefs
CStdStubBuffer_Invoke
CStdStubBuffer2_Connect
CStdStubBuffer_Connect
ord3
CStdStubBuffer_IsIIDSupported
ord34
CStdStubBuffer2_QueryInterface
ord35
CStdStubBuffer_CountRefs

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

xmllite

CreateXmlReader

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XpsGdiConverter.dll
.dll windows:10 windows x64 arch:x64

7d229aee6f417a0016cbdfcdcc0ba99b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XpsGdiConverter.pdb

Imports

msvcrt

powf
sin
_XcptFilter
??8type_info@@QEBAHAEBV0@@Z
fmodf
floorf
floor
cos
ceilf
ceil
memmove
memcpy
??0exception@@QEAA@AEBQEBD@Z
rand
srand
_vsnprintf_s
??0exception@@QEAA@XZ
_purecall
memcmp
_vsnwprintf
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
_amsg_exit
_initterm
__C_specific_handler
??1type_info@@UEAA@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
sqrt
_callnewh
_unlock
atan
memcpy_s
memset
wcsnlen
_lock
malloc
free
acosf
asinf
sqrtf

kernel32

InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
SleepConditionVariableSRW
WakeAllConditionVariable
VirtualQuery
FreeLibrary
LoadLibraryW
InitOnceComplete
InitOnceBeginInitialize
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetSystemDefaultLCID
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
GetSystemInfo
OutputDebugStringW
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
DisableThreadLibraryCalls
RaiseException
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
VirtualProtect
QueryPerformanceFrequency
VerifyVersionInfoW
VerSetConditionMask
GetCurrentProcessId
GetTickCount64

user32

FillRect

gdi32

CreateSolidBrush
SetMiterLimit
ExtCreatePen
GetMiterLimit
GetPolyFillMode
FillPath
BeginPath
PolyDraw
SelectClipPath
SetPolyFillMode
CreateRectRgn
EndPath
LineTo
SelectClipRgn
MoveToEx
GetTextMetricsW
ExtTextOutW
SaveDC
ModifyWorldTransform
StartPage
CreateDIBSection
CreateCompatibleDC
SetGraphicsMode
AbortDoc
EndDoc
GdiFlush
ResetDCW
StretchDIBits
CreateDCW
GetStockObject
GetDeviceCaps
DeleteDC
ExtEscape
SetStretchBltMode
RestoreDC
StartDocW
EndPage
SetWorldTransform
AddFontMemResourceEx
SelectObject
GetTextFaceW
GetTextAlign
SetTextColor
GetTextColor
DeleteObject
RemoveFontMemResourceEx
CreateFontIndirectW
SetTextAlign
SetBkMode

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

oleaut32

SysFreeString
VariantInit

shlwapi

PathIsRelativeW

shell32

SHGetKnownFolderPath

prntvpt

ord4
ord2
ord10
ord8
ord1

advapi32

RegQueryValueExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
EventWrite
EventWriteTransfer
EventSetInformation
EventEnabled
EventRegister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
EventUnregister

d3d11

D3D11CreateDevice

d2d1

ord5
ord1

dwrite

DWriteCreateFactory

Sections

.text
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/XpsPrint.dll
.dll windows:10 windows x64 arch:x64

6eca595c8c82f810b21eb481ad76799c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

xpsprint.pdb

Imports

msvcrt

tolower
_amsg_exit
_initterm
islower
_wsetlocale
__crtLCMapStringA
__crtLCMapStringW
_wcsdup
memchr
ldexp
__C_specific_handler
?terminate@@YAXXZ
abort
__dllonexit
_onexit
___mb_cur_max_func
_vsnwprintf
memcpy_s
??3@YAXPEAX@Z
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler3
_vsnprintf_s
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_XcptFilter
memcmp
isalnum
isdigit
??0exception@@QEAA@AEBQEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
memset
calloc
___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
__uncaught_exception
setlocale
_unlock
_lock
_errno
wcsrchr
_vsnprintf
_finite
_vsnwprintf_l
wcstod
_isnan
memmove
memcpy
_CxxThrowException
_callnewh
strncmp
swprintf_s
_wtof
ldiv
malloc
memmove_s
wcscpy_s
??1type_info@@UEAA@XZ
??_V@YAXPEAX@Z
_wcsicmp
sprintf_s
isspace
free
localeconv
strcspn
??0bad_cast@@QEAA@AEBV0@@Z
_ismbblead

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibraryAndExitThread
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetModuleHandleExW
FreeLibrary

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseSRWLockExclusive
SetEvent
InitializeCriticalSection
InitializeCriticalSectionEx
CreateEventW
DeleteCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
EnterCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObjectEx
ResetEvent
AcquireSRWLockExclusive
ReleaseMutex
OpenSemaphoreW
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
EventEnabled
EventWrite

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
SetThreadToken
ResumeThread
GetCurrentThread
OpenThreadToken
CreateThread
ExitProcess
GetCurrentThreadId
GetCurrentProcess
GetProcessTimes
TlsSetValue
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateGuid
CoCreateInstanceEx
CoSetProxyBlanket
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
CoGetMalloc
CoUninitialize
StringFromCLSID
CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
Sleep
SleepConditionVariableSRW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree

oleaut32

VariantInit
SysAllocStringLen
SysStringLen
VariantClear
SetErrorInfo
SysFreeString
SysAllocString

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-string-l1-1-0

GetStringTypeW
CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-file-l1-1-0

SetFilePointer
CreateFileW
GetFileAttributesW
FindNextFileW
FlushFileBuffers
FindFirstFileW
WriteFile
DeleteFileW
FindClose
ReadFile
CreateDirectoryW
SetFilePointerEx
SetEndOfFile

api-ms-win-security-base-l1-1-0

GetTokenInformation

rpcrt4

UuidCreateSequential
UuidToStringW
RpcServerInqCallAttributesW
RpcStringFreeW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlReleaseSRWLockShared
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
WinSqmIncrementDWORD
NtQueryInformationToken
RtlNtStatusToDosError
RtlGetAppContainerSidType
RtlAcquireSRWLockShared
WinSqmIsOptedIn

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

api-ms-win-shlwapi-ie-l1-1-0

PathIsDirectoryW

xpsservices

ord8
ord9

winspool.drv

ord361
ord362
GetPrintExecutionData

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

urlmon

CreateUri

xmllite

CreateXmlReader

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
UnregisterWaitEx
QueueUserWorkItem

Exports

Exports

StartXpsPrintJob
StartXpsPrintJob1

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/mediaservice/dsengine.dll
.dll windows:6 windows x86 arch:x86

a7312b954bff8f4fced558def9dfeefc

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-07-2009 17:25

Not After

07-12-2030 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 15:43

Not After

07-11-2030 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:34:61:50:30:94:33:f3:02:f6:ec:f2:31:43:1a:6d
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

23-11-2021 07:32

Not After

01-12-2022 07:32

Subject

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 19:19

Not After

29-12-2040 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22-07-2020 15:33

Not After

29-12-2030 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

97:18:7c:2f:44:75:6c:dc:f8:fd:6b:e9:ae:b5:2a:6c:54:bb:d2:c6:d9:11:6a:43:95:10:46:ca:43:92:22:48
Signer

Actual PE Digest

97:18:7c:2f:44:75:6c:dc:f8:fd:6b:e9:ae:b5:2a:6c:54:bb:d2:c6:d9:11:6a:43:95:10:46:ca:43:92:22:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\dsengine.pdb

Imports

gdi32

Rectangle
SelectObject
DeleteObject
CreateSolidBrush
CreatePen

mf

MFGetService

mfplat

MFCreateMediaType
MFFrameRateToAverageTimePerFrame

d3d9

Direct3DCreate9Ex

dxva2

DXVA2CreateDirect3DDeviceManager9

winmm

timeKillEvent
timeSetEvent
timeEndPeriod
timeBeginPeriod

evr

MFCreateVideoSampleFromSurface

qt5multimedia

??0QMediaContent@@QAE@XZ
??0QMediaContent@@QAE@ABV0@@Z
??1QMediaContent@@QAE@XZ
?qt_metacall@QImageEncoderControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QImageEncoderControl@@UAEPAXPBD@Z
?staticMetaObject@QImageEncoderControl@@2UQMetaObject@@B
?qt_metacall@QCameraZoomControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QCameraZoomControl@@UAEPAXPBD@Z
?staticMetaObject@QCameraZoomControl@@2UQMetaObject@@B
?qt_metacall@QCameraCaptureBufferFormatControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QCameraCaptureBufferFormatControl@@UAEPAXPBD@Z
?staticMetaObject@QCameraCaptureBufferFormatControl@@2UQMetaObject@@B
?qt_metacall@QCameraCaptureDestinationControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QCameraCaptureDestinationControl@@UAEPAXPBD@Z
?staticMetaObject@QCameraCaptureDestinationControl@@2UQMetaObject@@B
?qt_metacall@QCameraExposureControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QCameraExposureControl@@UAEPAXPBD@Z
?staticMetaObject@QCameraExposureControl@@2UQMetaObject@@B
?qt_metacall@QCameraImageProcessingControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QCameraImageProcessingControl@@UAEPAXPBD@Z
?staticMetaObject@QCameraImageProcessingControl@@2UQMetaObject@@B
?qt_metacall@QCameraImageCaptureControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QCameraImageCaptureControl@@UAEPAXPBD@Z
?staticMetaObject@QCameraImageCaptureControl@@2UQMetaObject@@B
?qt_metacall@QVideoDeviceSelectorControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QVideoDeviceSelectorControl@@UAEPAXPBD@Z
?staticMetaObject@QVideoDeviceSelectorControl@@2UQMetaObject@@B
?qt_metacall@QCameraControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QCameraControl@@UAEPAXPBD@Z
?staticMetaObject@QCameraControl@@2UQMetaObject@@B
?qt_metacall@QVideoWindowControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QVideoWindowControl@@UAEPAXPBD@Z
?Conductor@QMediaMetaData@@3VQString@@B
??4QMediaContent@@QAEAAV0@ABV0@@Z
??8QMediaContent@@QBE_NABV0@@Z
?convertVolume@QAudio@@YANNW4VolumeScale@1@0@Z
?staticMetaObject@QVideoWindowControl@@2UQMetaObject@@B
?qt_metacall@QMetaDataReaderControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMetaDataReaderControl@@UAEPAXPBD@Z
?staticMetaObject@QMetaDataReaderControl@@2UQMetaObject@@B
?qt_metacall@QAudioOutputSelectorControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QAudioOutputSelectorControl@@UAEPAXPBD@Z
?staticMetaObject@QAudioOutputSelectorControl@@2UQMetaObject@@B
?qt_metacall@QVideoRendererControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QVideoRendererControl@@UAEPAXPBD@Z
?staticMetaObject@QVideoRendererControl@@2UQMetaObject@@B
?qt_metacall@QMediaService@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaService@@UAEPAXPBD@Z
?staticMetaObject@QMediaService@@2UQMetaObject@@B
?qt_metacall@QMediaPlayerControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaPlayerControl@@UAEPAXPBD@Z
?staticMetaObject@QMediaPlayerControl@@2UQMetaObject@@B
?qt_metacall@QMediaAudioProbeControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaAudioProbeControl@@UAEPAXPBD@Z
?staticMetaObject@QMediaAudioProbeControl@@2UQMetaObject@@B
?qt_metacall@QMediaVideoProbeControl@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaVideoProbeControl@@UAEPAXPBD@Z
?staticMetaObject@QMediaVideoProbeControl@@2UQMetaObject@@B
??0QMediaServiceProviderPlugin@@QAE@XZ
?qt_metacall@QMediaServiceProviderPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaServiceProviderPlugin@@UAEPAXPBD@Z
??0QMediaServiceFeaturesInterface@@QAE@XZ
??1QMediaServiceFeaturesInterface@@UAE@XZ
??0QMediaServiceDefaultDeviceInterface@@QAE@XZ
??1QMediaServiceDefaultDeviceInterface@@UAE@XZ
??0QMediaServiceSupportedDevicesInterface@@QAE@XZ
??1QMediaServiceSupportedDevicesInterface@@UAE@XZ
??1QMediaServiceProviderFactoryInterface@@UAE@XZ
?staticMetaObject@QMediaServiceProviderPlugin@@2UQMetaObject@@B
??0QImageEncoderControl@@IAE@PAVQObject@@@Z
??1QImageEncoderControl@@UAE@XZ
??4QImageEncoderSettings@@QAEAAV0@ABV0@@Z
??0QImageEncoderSettings@@QAE@ABV0@@Z
??0QCameraZoomControl@@IAE@PAVQObject@@@Z
?currentOpticalZoomChanged@QCameraZoomControl@@QAEXN@Z
?requestedOpticalZoomChanged@QCameraZoomControl@@QAEXN@Z
?maximumOpticalZoomChanged@QCameraZoomControl@@QAEXN@Z
??1QCameraZoomControl@@UAE@XZ
??0QCameraCaptureBufferFormatControl@@IAE@PAVQObject@@@Z
??1QCameraCaptureBufferFormatControl@@UAE@XZ
??0QCameraCaptureDestinationControl@@IAE@PAVQObject@@@Z
?captureDestinationChanged@QCameraCaptureDestinationControl@@QAEXV?$QFlags@W4CaptureDestination@QCameraImageCapture@@@@@Z
??1QCameraCaptureDestinationControl@@UAE@XZ
??0QCameraExposureControl@@IAE@PAVQObject@@@Z
?parameterRangeChanged@QCameraExposureControl@@QAEXH@Z
?actualValueChanged@QCameraExposureControl@@QAEXH@Z
??1QCameraExposureControl@@UAE@XZ
??0QCameraImageProcessingControl@@IAE@PAVQObject@@@Z
??1QCameraImageProcessingControl@@UAE@XZ
?qt_metacast@QCameraViewfinderSettingsControl2@@UAEPAXPBD@Z
?qt_metacall@QCameraViewfinderSettingsControl2@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?metaObject@QCameraViewfinderSettingsControl2@@UBEPBUQMetaObject@@XZ
??0QCameraViewfinderSettingsControl2@@IAE@PAVQObject@@@Z
??1QCameraViewfinderSettingsControl2@@UAE@XZ
??1QMediaStorageLocation@@QAE@XZ
?generateFileName@QMediaStorageLocation@@QBE?AVQString@@ABV2@W4MediaType@1@00@Z
??0QMediaStorageLocation@@QAE@XZ
?setPixelAspectRatio@QCameraViewfinderSettings@@QAEXABVQSize@@@Z
?pixelAspectRatio@QCameraViewfinderSettings@@QBE?AVQSize@@XZ
?setPixelFormat@QCameraViewfinderSettings@@QAEXW4PixelFormat@QVideoFrame@@@Z
?pixelFormat@QCameraViewfinderSettings@@QBE?AW4PixelFormat@QVideoFrame@@XZ
?setMaximumFrameRate@QCameraViewfinderSettings@@QAEXN@Z
?maximumFrameRate@QCameraViewfinderSettings@@QBENXZ
?setMinimumFrameRate@QCameraViewfinderSettings@@QAEXN@Z
?minimumFrameRate@QCameraViewfinderSettings@@QBENXZ
?setResolution@QCameraViewfinderSettings@@QAEXABVQSize@@@Z
?resolution@QCameraViewfinderSettings@@QBE?AVQSize@@XZ
?isNull@QCameraViewfinderSettings@@QBE_NXZ
??4QCameraViewfinderSettings@@QAEAAV0@ABV0@@Z
??1QCameraViewfinderSettings@@QAE@XZ
??0QCameraViewfinderSettings@@QAE@ABV0@@Z
??0QCameraViewfinderSettings@@QAE@XZ
?resolution@QImageEncoderSettings@@QBE?AVQSize@@XZ
?codec@QImageEncoderSettings@@QBE?AVQString@@XZ
??1QImageEncoderSettings@@QAE@XZ
??0QImageEncoderSettings@@QAE@XZ
?scanLineDirection@QVideoSurfaceFormat@@QBE?AW4Direction@1@XZ
?image@QVideoFrame@@QBE?AVQImage@@XZ
?isValid@QVideoFrame@@QBE_NXZ
??4QVideoFrame@@QAEAAV0@ABV0@@Z
??0QVideoFrame@@QAE@ABVQImage@@@Z
??0QCameraImageCaptureControl@@IAE@PAVQObject@@@Z
?error@QCameraImageCaptureControl@@QAEXHHABVQString@@@Z
?imageSaved@QCameraImageCaptureControl@@QAEXHABVQString@@@Z
?imageAvailable@QCameraImageCaptureControl@@QAEXHABVQVideoFrame@@@Z
?imageCaptured@QCameraImageCaptureControl@@QAEXHABVQImage@@@Z
?imageExposed@QCameraImageCaptureControl@@QAEXH@Z
?readyForCaptureChanged@QCameraImageCaptureControl@@QAEX_N@Z
??1QCameraImageCaptureControl@@UAE@XZ
??0QVideoDeviceSelectorControl@@IAE@PAVQObject@@@Z
??1QVideoDeviceSelectorControl@@UAE@XZ
??0QCameraControl@@IAE@PAVQObject@@@Z
?captureModeChanged@QCameraControl@@QAEXV?$QFlags@W4CaptureMode@QCamera@@@@@Z
?error@QCameraControl@@QAEXHABVQString@@@Z
?statusChanged@QCameraControl@@QAEXW4Status@QCamera@@@Z
?stateChanged@QCameraControl@@QAEXW4State@QCamera@@@Z
??1QCameraControl@@UAE@XZ
?setPixelAspectRatio@QVideoSurfaceFormat@@QAEXHH@Z
?frameHeight@QVideoSurfaceFormat@@QBEHXZ
?handleType@QVideoSurfaceFormat@@QBE?AW4HandleType@QAbstractVideoBuffer@@XZ
??0QVideoFrame@@QAE@ABV0@@Z
?handleType@QAbstractVideoBuffer@@QBE?AW4HandleType@1@XZ
?isActive@QAbstractVideoSurface@@QBE_NXZ
?surfaceFormat@QAbstractVideoSurface@@QBE?AVQVideoSurfaceFormat@@XZ
??9QVideoSurfaceFormat@@QBE_NABV0@@Z
?setEndTime@QVideoFrame@@QAEX_J@Z
?endTime@QVideoFrame@@QBE_JXZ
?setStartTime@QVideoFrame@@QAEX_J@Z
?startTime@QVideoFrame@@QBE_JXZ
??0QVideoWindowControl@@IAE@PAVQObject@@@Z
?saturationChanged@QVideoWindowControl@@QAEXH@Z
?hueChanged@QVideoWindowControl@@QAEXH@Z
?contrastChanged@QVideoWindowControl@@QAEXH@Z
?brightnessChanged@QVideoWindowControl@@QAEXH@Z
?fullScreenChanged@QVideoWindowControl@@QAEX_N@Z
??1QVideoWindowControl@@UAE@XZ
?ThumbnailImage@QMediaMetaData@@3VQString@@B
?Writer@QMediaMetaData@@3VQString@@B
?LeadPerformer@QMediaMetaData@@3VQString@@B
?Director@QMediaMetaData@@3VQString@@B
?ChapterNumber@QMediaMetaData@@3VQString@@B
?VideoCodec@QMediaMetaData@@3VQString@@B
?VideoBitRate@QMediaMetaData@@3VQString@@B
?VideoFrameRate@QMediaMetaData@@3VQString@@B
?PixelAspectRatio@QMediaMetaData@@3VQString@@B
?Resolution@QMediaMetaData@@3VQString@@B
?TrackNumber@QMediaMetaData@@3VQString@@B
?Mood@QMediaMetaData@@3VQString@@B
?Lyrics@QMediaMetaData@@3VQString@@B
??1QMediaPlayerControl@@UAE@XZ
?Composer@QMediaMetaData@@3VQString@@B
?ContributingArtist@QMediaMetaData@@3VQString@@B
?AlbumArtist@QMediaMetaData@@3VQString@@B
?AlbumTitle@QMediaMetaData@@3VQString@@B
?SampleRate@QMediaMetaData@@3VQString@@B
?PeakValue@QMediaMetaData@@3VQString@@B
?ChannelCount@QMediaMetaData@@3VQString@@B
?AverageLevel@QMediaMetaData@@3VQString@@B
?AudioCodec@QMediaMetaData@@3VQString@@B
?AudioBitRate@QMediaMetaData@@3VQString@@B
?Duration@QMediaMetaData@@3VQString@@B
?MediaType@QMediaMetaData@@3VQString@@B
?Size@QMediaMetaData@@3VQString@@B
?ParentalRating@QMediaMetaData@@3VQString@@B
?Copyright@QMediaMetaData@@3VQString@@B
?Publisher@QMediaMetaData@@3VQString@@B
?Language@QMediaMetaData@@3VQString@@B
?Keywords@QMediaMetaData@@3VQString@@B
?UserRating@QMediaMetaData@@3VQString@@B
?Date@QMediaMetaData@@3VQString@@B
?Year@QMediaMetaData@@3VQString@@B
?Genre@QMediaMetaData@@3VQString@@B
?Category@QMediaMetaData@@3VQString@@B
?Description@QMediaMetaData@@3VQString@@B
?Comment@QMediaMetaData@@3VQString@@B
?Author@QMediaMetaData@@3VQString@@B
?SubTitle@QMediaMetaData@@3VQString@@B
?Title@QMediaMetaData@@3VQString@@B
??0QMetaDataReaderControl@@IAE@PAVQObject@@@Z
??1QMetaDataReaderControl@@UAE@XZ
??0QAudioOutputSelectorControl@@IAE@PAVQObject@@@Z
??1QAudioOutputSelectorControl@@UAE@XZ
?staticMetaObject@QAbstractVideoSurface@@2UQMetaObject@@B
?supportedFormatsChanged@QAbstractVideoSurface@@QAEXXZ
??6@YA?AVQDebug@@V0@ABVQVideoSurfaceFormat@@@Z
??4QVideoSurfaceFormat@@QAEAAV0@ABV0@@Z
??6@YA?AVQDebug@@V0@W4PixelFormat@QVideoFrame@@@Z
??0QVideoFrame@@QAE@XZ
??0QVideoRendererControl@@IAE@PAVQObject@@@Z
??1QVideoRendererControl@@UAE@XZ
?unmap@QMemoryVideoBuffer@@UAEXXZ
?mapMode@QMemoryVideoBuffer@@UBE?AW4MapMode@QAbstractVideoBuffer@@XZ
?map@QMemoryVideoBuffer@@UAEPAEW4MapMode@QAbstractVideoBuffer@@PAH1@Z
??1QMemoryVideoBuffer@@UAE@XZ
??0QMemoryVideoBuffer@@QAE@ABVQByteArray@@H@Z
??1QAudioBuffer@@QAE@XZ
??0QAudioBuffer@@QAE@ABVQByteArray@@ABVQAudioFormat@@_J@Z
?setSampleType@QAudioFormat@@QAEXW4SampleType@1@@Z
?setByteOrder@QAudioFormat@@QAEXW4Endian@1@@Z
?setCodec@QAudioFormat@@QAEXABVQString@@@Z
?sampleSize@QAudioFormat@@QBEHXZ
?setSampleSize@QAudioFormat@@QAEXH@Z
?setChannelCount@QAudioFormat@@QAEXH@Z
?setSampleRate@QAudioFormat@@QAEXH@Z
??1QAudioFormat@@QAE@XZ
??0QAudioFormat@@QAE@XZ
?audioBufferProbed@QMediaAudioProbeControl@@QAEXABVQAudioBuffer@@@Z
?frameSize@QVideoSurfaceFormat@@QBE?AVQSize@@XZ
?isValid@QVideoSurfaceFormat@@QBE_NXZ
??1QVideoFrame@@QAE@XZ
??0QVideoFrame@@QAE@PAVQAbstractVideoBuffer@@ABVQSize@@W4PixelFormat@0@@Z
??4QMediaTimeRange@@QAEAAV0@ABV0@@Z
??1QMediaTimeRange@@QAE@XZ
??0QMediaTimeRange@@QAE@ABV0@@Z
??0QMediaTimeRange@@QAE@_J0@Z
??0QMediaTimeRange@@QAE@XZ
??0QMediaService@@IAE@PAVQObject@@@Z
??1QMediaService@@UAE@XZ
?request@QMediaContent@@QBE?AVQNetworkRequest@@XZ
??0QMediaPlayerControl@@IAE@PAVQObject@@@Z
?error@QMediaPlayerControl@@QAEXHABVQString@@@Z
??0QVideoSurfaceFormat@@QAE@XZ
??0QVideoSurfaceFormat@@QAE@ABVQSize@@W4PixelFormat@QVideoFrame@@W4HandleType@QAbstractVideoBuffer@@@Z
??0QVideoSurfaceFormat@@QAE@ABV0@@Z
??1QVideoSurfaceFormat@@QAE@XZ
?pixelFormat@QVideoSurfaceFormat@@QBE?AW4PixelFormat@QVideoFrame@@XZ
?frameWidth@QVideoSurfaceFormat@@QBEHXZ
?setScanLineDirection@QVideoSurfaceFormat@@QAEXW4Direction@1@@Z
?setFrameRate@QVideoSurfaceFormat@@QAEXN@Z
??0QAbstractVideoBuffer@@QAE@W4HandleType@0@@Z
??1QAbstractVideoBuffer@@UAE@XZ
?playbackRateChanged@QMediaPlayerControl@@QAEXN@Z
?seekableChanged@QMediaPlayerControl@@QAEX_N@Z
?videoAvailableChanged@QMediaPlayerControl@@QAEX_N@Z
?audioAvailableChanged@QMediaPlayerControl@@QAEX_N@Z
?mutedChanged@QMediaPlayerControl@@QAEX_N@Z
?handle@QAbstractVideoBuffer@@UBE?AVQVariant@@XZ
?release@QAbstractVideoBuffer@@UAEXXZ
??1QMediaVideoProbeControl@@UAE@XZ
?videoFrameProbed@QMediaVideoProbeControl@@QAEXABVQVideoFrame@@@Z
?flush@QMediaVideoProbeControl@@QAEXXZ
??0QMediaVideoProbeControl@@IAE@PAVQObject@@@Z
??1QMediaAudioProbeControl@@UAE@XZ
?volumeChanged@QMediaPlayerControl@@QAEXH@Z
?mediaStatusChanged@QMediaPlayerControl@@QAEXW4MediaStatus@QMediaPlayer@@@Z
?stateChanged@QMediaPlayerControl@@QAEXW4State@QMediaPlayer@@@Z
?positionChanged@QMediaPlayerControl@@QAEX_J@Z
?durationChanged@QMediaPlayerControl@@QAEX_J@Z
?mediaChanged@QMediaPlayerControl@@QAEXABVQMediaContent@@@Z
??0QMediaAudioProbeControl@@IAE@PAVQObject@@@Z

qt5widgets

?find@QWidget@@SAPAV1@I@Z
?palette@QWidget@@QBEABVQPalette@@XZ

qt5gui

?supportedImageFormats@QImageWriter@@SA?AV?$QList@VQByteArray@@@@XZ
?mirrored_helper@QImage@@IBE?AV1@_N0@Z
?save@QImage@@QBE_NABVQString@@PBDH@Z
?isNull@QImage@@QBE_NXZ
??4QImage@@QAEAAV0@$$QAV0@@Z
??0QImage@@QAE@ABV0@@Z
??0QImage@@QAE@XZ
?surfaceType@QOffscreenSurface@@UBE?AW4SurfaceType@QSurface@@XZ
?surfaceHandle@QOffscreenSurface@@EBEPAVQPlatformSurface@@XZ
?size@QOffscreenSurface@@UBE?AVQSize@@XZ
?qt_metacast@QOffscreenSurface@@UAEPAXPBD@Z
?qt_metacall@QOffscreenSurface@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?metaObject@QOffscreenSurface@@UBEPBUQMetaObject@@XZ
?format@QOffscreenSurface@@UBE?AVQSurfaceFormat@@XZ
?glGenTextures@QOpenGLFunctions@@QAEXHPAI@Z
?glDeleteTextures@QOpenGLFunctions@@QAEXHPBI@Z
?glBindTexture@QOpenGLFunctions@@QAEXII@Z
?platformNativeInterface@QGuiApplication@@SAPAVQPlatformNativeInterface@@XZ
?create@QOffscreenSurface@@QAEXXZ
??1QOffscreenSurface@@UAE@XZ
??0QOffscreenSurface@@QAE@PAVQScreen@@@Z
?openGLModuleType@QOpenGLContext@@SA?AW4OpenGLModuleType@1@XZ
?functions@QOpenGLContext@@QBEPAVQOpenGLFunctions@@XZ
?currentContext@QOpenGLContext@@SAPAV1@XZ
?doneCurrent@QOpenGLContext@@QAEXXZ
?makeCurrent@QOpenGLContext@@QAE_NPAVQSurface@@@Z
?format@QOpenGLContext@@QBE?AVQSurfaceFormat@@XZ
?hasAlpha@QSurfaceFormat@@QBE_NXZ
??1QSurfaceFormat@@QAE@XZ
?color@QPalette@@QBEABVQColor@@W4ColorRole@1@@Z
?blue@QColor@@QBEHXZ
?green@QColor@@QBEHXZ
?red@QColor@@QBEHXZ
??1QImage@@UAE@XZ
??BQImage@@QBE?AVQVariant@@XZ
?fromData@QImage@@SA?AV1@PBEHPBD@Z

qt5network

??1QNetworkRequest@@QAE@XZ
?url@QNetworkRequest@@QBE?AVQUrl@@XZ

qt5core

??0QByteArray@@QAE@XZ
?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z
?staticMetaObject@QObject@@2UQMetaObject@@B
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?QStringList_contains@QtPrivate@@YA_NPBVQStringList@@ABVQString@@W4CaseSensitivity@Qt@@@Z
?cmp@QVariant@@QBE_NABV1@@Z
??0QVariant@@QAE@$$QAV0@@Z
?staticMetaObject@QTimer@@2UQMetaObject@@B
?timeout@QTimer@@QAEXUQPrivateSignal@1@@Z
?start@QTimer@@QAEXH@Z
??1QTimer@@UAE@XZ
??0QTimer@@QAE@PAVQObject@@@Z
?start@QThreadPool@@QAEXPAVQRunnable@@H@Z
?globalInstance@QThreadPool@@SAPAV1@XZ
?isCanceled@QFutureInterfaceBase@@QBE_NXZ
?setThreadPool@QFutureInterfaceBase@@QAEXPAVQThreadPool@@@Z
?setRunnable@QFutureInterfaceBase@@QAEXPAVQRunnable@@@Z
?reportFinished@QFutureInterfaceBase@@QAEXXZ
?reportStarted@QFutureInterfaceBase@@QAEXXZ
??1QFutureInterfaceBase@@UAE@XZ
??0QFutureInterfaceBase@@QAE@ABV0@@Z
??0QFutureInterfaceBase@@QAE@W4State@0@@Z
??1QRunnable@@UAE@XZ
??0QRunnable@@QAE@XZ
??6QDebug@@QAEAAV0@ABVQString@@@Z
??6QDebug@@QAEAAV0@J@Z
?convert@QVariant@@QBE_NHPAX@Z
?constData@QVariant@@QBEPBXXZ
?toInt@QVariant@@QBEHPA_N@Z
?userType@QVariant@@QBEHXZ
??0QVariant@@QAE@HPBXI@Z
?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z
?toLower@QString@@QHAE?AV1@XZ
?indexOf@QString@@QBEHABV1@HW4CaseSensitivity@Qt@@@Z
?indexOf@QString@@QBEHVQLatin1String@@HW4CaseSensitivity@Qt@@@Z
?clear@QString@@QAEXXZ
?qErrnoWarning@@YAXHPBDZZ
?warning@QMessageLogger@@QBE?AVQDebug@@XZ
?elapsed@QElapsedTimer@@QBE_JXZ
?isValid@QElapsedTimer@@QBE_NXZ
?restart@QElapsedTimer@@QAE_JXZ
??0QString@@QAE@ABVQByteArray@@@Z
?fromUtf8@QString@@SA?AV1@PBDH@Z
?toUtf8@QString@@QGBE?AVQByteArray@@XZ
?remove@QString@@QAEAAV1@HH@Z
?startsWith@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z
??4QByteArray@@QAEAAV0@$$QAV0@@Z
?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z
?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z
?cast@QMetaObject@@QBEPAVQObject@@PAV2@@Z
?qt_metacast@QObject@@UAEPAXPBD@Z
?qt_metacall@QObject@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?metaObject@QObject@@UBEPBUQMetaObject@@XZ
?disconnectImpl@QObject@@CA_NPBV1@PAPAX01PBUQMetaObject@@@Z
?prepend@QListData@@QAEPAPAXXZ
?erase@QListData@@QAEPAPAXPAPAX@Z
?scaled@QSize@@QBE?AV1@ABV1@W4AspectRatioMode@Qt@@@Z
?load@QSystemLibrary@@SAPAUHINSTANCE__@@PB_W_N@Z
?toString@QVariant@@QBE?AVQString@@XZ
?toReal@QVariant@@QBENPA_N@Z
?toLongLong@QVariant@@QBE_JPA_N@Z
?toUInt@QVariant@@QBEIPA_N@Z
??4QVariant@@QAEAAV0@$$QAV0@@Z
??4QVariant@@QAEAAV0@ABV0@@Z
??0QVariant@@QAE@ABVQSize@@@Z
??0QVariant@@QAE@ABVQDate@@@Z
??0QVariant@@QAE@ABVQStringList@@@Z
??0QVariant@@QAE@ABVQString@@@Z
??0QVariant@@QAE@ABVQByteArray@@@Z
??0QVariant@@QAE@N@Z
??0QVariant@@QAE@_N@Z
??0QVariant@@QAE@_K@Z
??0QVariant@@QAE@_J@Z
??0QVariant@@QAE@I@Z
??0QVariant@@QAE@H@Z
??0QVariant@@QAE@ABV0@@Z
??0QVariant@@QAE@XZ
??0QDate@@QAE@HHH@Z
?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z
??8QString@@QBE_NPBD@Z
?fromUtf16@QString@@SA?AV1@PBGH@Z
?resize@QString@@QAEXH@Z
?data@QByteArray@@QAEPADXZ
?resize@QByteArray@@QAEXH@Z
?createData@QMapDataBase@@SAPAU1@XZ
?createNode@QMapDataBase@@QAEPAUQMapNodeBase@@HHPAU2@_N@Z
?recalcMostLeftNode@QMapDataBase@@QAEXXZ
?nextNode@QMapNodeBase@@QBEPBU1@XZ
??M@YA_NABVQString@@0@Z
??8@YA_NABVQString@@0@Z
?endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z
?relock@QWriteLocker@@QAEXXZ
?unlock@QWriteLocker@@QAEXXZ
?relock@QReadLocker@@QAEXXZ
?unlock@QReadLocker@@QAEXXZ
??1QReadWriteLock@@QAE@XZ
??0QReadWriteLock@@QAE@W4RecursionMode@0@@Z
??6QDebug@@QAEAAV0@PBD@Z
??1QDebug@@QAE@XZ
?realloc@QListData@@QAEXH@Z
?debug@QMessageLogger@@QBE?AVQDebug@@XZ
?shared_null@QMapDataBase@@2U1@B
?qt_metacast@QThread@@UAEPAXPBD@Z
?qt_metacall@QThread@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?metaObject@QThread@@UBEPBUQMetaObject@@XZ
?event@QThread@@UAE_NPAVQEvent@@@Z
?wait@QThread@@QAE_NVQDeadlineTimer@@@Z
?start@QThread@@QAEXW4Priority@1@@Z
??1QThread@@UAE@XZ
??0QThread@@QAE@PAVQObject@@@Z
?toNativeSeparators@QDir@@SA?AVQString@@ABV2@@Z
?isReadable@QIODevice@@QBE_NXZ
??1QVariant@@QAE@XZ
?toLocalFile@QUrl@@QBE?AVQString@@XZ
?isLocalFile@QUrl@@QBE_NXZ
?scheme@QUrl@@QBE?AVQString@@XZ
?isEmpty@QUrl@@QBE_NXZ
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
??1QUrl@@QAE@XZ
??4QUrl@@QAEAAV0@$$QAV0@@Z
??0QUrl@@QAE@XZ
?freeData@QMapDataBase@@SAXPAU1@@Z
?freeTree@QMapDataBase@@QAEXPAUQMapNodeBase@@H@Z
?deleteLater@QObject@@QAEXXZ
?fromAscii_helper@QString@@CAPAU?$QTypedArrayData@G@@PBDH@Z
?toLocal8Bit@QString@@QHAE?AVQByteArray@@XZ
?toLocal8Bit@QString@@QGBE?AVQByteArray@@XZ
?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z
??0QString@@QAE@$$QAV0@@Z
?toInt@QByteArray@@QBEHPA_NH@Z
?qstrcmp@@YAHPBD0@Z
??0QChar@@QAE@UQLatin1Char@@@Z
??0QMessageLogger@@QAE@PBDH0@Z
?qgetenv@@YA?AVQByteArray@@PBD@Z
?qt_error_string@@YA?AVQString@@H@Z
??4QString@@QAEAAV0@ABV0@@Z
??0QString@@QAE@VQLatin1String@@@Z
?staticMetaObject@QIODevice@@2UQMetaObject@@B
?currentThread@QThread@@SAPAV1@XZ
?readyRead@QIODevice@@QAEXXZ
?read@QIODevice@@QAE_JPAD_J@Z
?wakeAll@QWaitCondition@@QAEXXZ
?wait@QWaitCondition@@QAE_NPAVQMutex@@K@Z
?wait@QWaitCondition@@QAE_NPAVQMutex@@VQDeadlineTimer@@@Z
??1QWaitCondition@@QAE@XZ
??0QWaitCondition@@QAE@XZ
??0QDeadlineTimer@@QAE@W4ForeverConstant@0@W4TimerType@Qt@@@Z
?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z
?moveToThread@QObject@@QAEXPAVQThread@@@Z
?thread@QObject@@QBEPAVQThread@@XZ
??1Connection@QMetaObject@@QAE@XZ
??0QByteArray@@QAE@PBDH@Z
?isWarningEnabled@QLoggingCategory@@QBE_NXZ
?warning@QMessageLogger@@QBAXPBDZZ
?isDebugEnabled@QLoggingCategory@@QBE_NXZ
?debug@QMessageLogger@@QBAXPBDZZ
??0QMessageLogger@@QAE@PBDH00@Z
?utf16@QString@@QBEPBGXZ
?detach@QListData@@QAEPAUData@1@H@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?postEvent@QCoreApplication@@SAXPAVQObject@@PAVQEvent@@H@Z
?sendEvent@QCoreApplication@@SA_NPAVQObject@@PAVQEvent@@@Z
??1QEvent@@UAE@XZ
??0QEvent@@QAE@W4Type@0@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
??1QObject@@UAE@XZ
??0QObject@@QAE@PAV0@@Z
?relock@QMutexLocker@@QAEXXZ
?unlock@QMutexLocker@@QAEXXZ
??1QMutex@@QAE@XZ
??0QMutex@@QAE@XZ
??1QRecursiveMutex@@QAE@XZ
??0QRecursiveMutex@@QAE@XZ
?unlock@QMutex@@QAEXXZ
?lock@QMutex@@QAEXXZ
?isNull@QString@@QBE_NXZ
?fromWCharArray@QString@@SA?AV1@PB_WH@Z
?toWCharArray@QString@@QBEHPA_W@Z
?data@QString@@QBEPBVQChar@@XZ
?truncate@QString@@QAEXH@Z
??4QString@@QAEAAV0@$$QAV0@@Z
??1QString@@QAE@XZ
?compareStrings@QtPrivate@@YAHVQStringView@@0W4CaseSensitivity@Qt@@@Z
?qustrlen@QtPrivate@@YAHPBG@Z
?shared_null@QListData@@2UData@1@B
??1QLoggingCategory@@QAE@XZ
??0QLoggingCategory@@QAE@PBD@Z
?append@QListData@@QAEPAPAXXZ
?dispose@QListData@@SAXPAUData@1@@Z
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
??8QString@@QBE_NVQLatin1String@@@Z
??0QString@@QAE@ABV0@@Z
??0QString@@QAE@XZ
?constData@QByteArray@@QBEPBDXZ
??1QByteArray@@QAE@XZ
??0QByteArray@@QAE@ABV0@@Z
?qstrcmp@@YAHABVQByteArray@@PBD@Z

ole32

CoInitialize
CoTaskMemFree
CreateBindCtx
StringFromCLSID
PropVariantClear
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoGetMalloc

oleaut32

SysStringLen
SysFreeString
VariantClear
VariantInit

user32

GetShellWindow
MsgWaitForMultipleObjects
PostThreadMessageW
PeekMessageW
EndPaint
BeginPaint

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z

kernel32

ResetEvent
CreateEventW
WaitForMultipleObjects
CloseHandle
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetEvent
WaitForSingleObject
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetModuleHandleW
MulDiv
GetExitCodeThread
CreateThread
GetLastError
FileTimeToSystemTime
GetProcAddress
FormatMessageW
LocalFree
LocalAlloc

vcruntime140

__std_type_info_destroy_list
_except_handler4_common
strstr
memmove
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
memcpy
_purecall

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_seh_filter_dll
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv

api-ms-win-crt-math-l1-1-0

log2
_libm_sse2_pow_precise

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 173B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/CSXS/manifest.xml
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/AEFT/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/DRWV/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/FLPR/jsx/brush.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/FLPR/jsx/color.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/FLPR/jsx/core.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/FLPR/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/IDSN/jsx/color.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/IDSN/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/IDSN/jsx/text.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/ILST/jsx/color.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/ILST/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/ILST/jsx/text.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/ILST/jsx/util.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/KBRG/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PHXS/jsx/brush.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PHXS/jsx/color.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PHXS/jsx/constants.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PHXS/jsx/gradient.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PHXS/jsx/layerstyle.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PHXS/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PHXS/jsx/text.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PHXS/jsx/util.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/applications/PPRO/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/ACCC-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-10-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-12-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-16-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-18-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-2-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-20-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-22-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-24-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-26-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-28-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-30-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-32-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-34-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-36-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-38-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-4-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-40-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-42-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-44-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-46-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-48-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-50-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-51-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-53-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-55-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-57-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-59-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-6-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-61-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-63-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-65-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-67-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-69-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-71-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-73-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-75-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-77-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-79-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-8-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-81-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-83-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-85-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-87-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-89-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-91-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-93-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-95-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-97-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/AEFT-css-generated-99-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/DRWV-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/DRWV-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/DRWV-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/DRWV-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/ESHR-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/ESHR-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/FLPR-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/FLPR-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/GoogleSlides-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/IDSN-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/IDSN-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/IDSN-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/IDSN-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/ILST-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/ILST-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/ILST-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/ILST-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/KBRG-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/KBRG-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/KBRG-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/KBRG-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PHXS-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PHXS-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PHXS-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PHXS-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-10-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-12-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-16-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-18-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-2-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-20-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-22-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-24-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-26-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-28-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-30-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-32-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-34-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-36-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-38-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-4-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-40-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-42-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-44-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-46-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-48-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-50-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-51-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-53-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-55-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-57-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-59-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-6-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-61-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-63-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-65-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-67-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-69-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-71-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-73-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-75-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-77-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-79-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-8-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-81-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-83-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-85-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-87-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-89-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-91-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-93-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-95-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-97-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PPRO-css-generated-99-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PowerPoint-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/PowerPoint-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/SPRK-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/Word-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/css/Word-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/CSXS/manifest.xml
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/ColorExtractor.worker.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/GradientExtractor.worker.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/ShapeExtractor.worker.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/capture.html
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/capture_main.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/cs_CZ/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/da_DK/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/de_DE/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/en_US/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/es_ES/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/fi_FI/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/fr_FR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/hu_HU/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/it_IT/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/ja_JP/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/ko_KR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/nb_NO/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/nl_NL/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/pl_PL/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/pt_BR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/ru_RU/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/sv_SE/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/tr_TR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/uk_UA/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/zh_CN/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/locale/zh_TW/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/package.json
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/resources/CornucopiaCore.wasm
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/resources/GradientCaptureCore.wasm
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/resources/VectorizeCore.wasm
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/resources/capture_merchandising.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/extensions/capture/resources/capture_sample.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/images/IconDark.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/images/[email protected]
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/images/IconLight.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/images/[email protected]
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/jsx/core.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/jsx/json2.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/jsx/shims.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/cs_CZ/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/da_DK/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/de_DE/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/en_US/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/es_ES/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/es_MX/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/fi_FI/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/fr_CA/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/fr_FR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/fr_MA/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/hu_HU/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/it_IT/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/ja_JP/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/ko_KR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/nb_NO/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/nl_NL/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/pl_PL/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/pt_BR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/ru_RU/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/sv_SE/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/tr_TR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/uk_UA/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/zh_CN/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/zh_TW/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/locale/zz_ZZ/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/qtmultimedia_m3u.dll
.dll windows:6 windows x86 arch:x86

d35460b9a3baf35d1aaeb2c0ade3acc2

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-07-2009 17:25

Not After

07-12-2030 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 15:43

Not After

07-11-2030 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:34:61:50:30:94:33:f3:02:f6:ec:f2:31:43:1a:6d
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

23-11-2021 07:32

Not After

01-12-2022 07:32

Subject

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 19:19

Not After

29-12-2040 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22-07-2020 15:33

Not After

29-12-2030 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09
Signer

Actual PE Digest

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\qt\work\qt\qtmultimedia\plugins\playlistformats\qtmultimedia_m3u.pdb

Imports

qt5multimedia

?qt_metacall@QMediaPlaylistIOPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaPlaylistIOPlugin@@UAEPAXPBD@Z
?staticMetaObject@QMediaPlaylistIOPlugin@@2UQMetaObject@@B
??1QMediaPlaylistIOPlugin@@UAE@XZ
??0QMediaPlaylistIOPlugin@@QAE@PAVQObject@@@Z
??0QMediaPlaylistWriter@@QAE@XZ
??1QMediaPlaylistWriter@@UAE@XZ
??0QMediaContent@@QAE@XZ
??1QMediaPlaylistReader@@UAE@XZ
?request@QMediaContent@@QBE?AVQNetworkRequest@@XZ
?isNull@QMediaContent@@QBE_NXZ
??4QMediaContent@@QAEAAV0@ABV0@@Z
??1QMediaContent@@QAE@XZ
??0QMediaContent@@QAE@ABV0@@Z
??0QMediaContent@@QAE@ABVQUrl@@@Z
??0QMediaPlaylistReader@@QAE@XZ

qt5network

??1QNetworkRequest@@QAE@XZ
?url@QNetworkRequest@@QBE?AVQUrl@@XZ

qt5core

?trimmed@QString@@QHAE?AV1@XZ
??8QString@@QBE_NVQLatin1String@@@Z
??BQCharRef@@QBE?AVQChar@@XZ
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?dispose@QListData@@SAXPAUData@1@@Z
?append@QListData@@QAEPAPAXXZ
?isOpen@QIODevice@@QBE_NXZ
?isReadable@QIODevice@@QBE_NXZ
?isWritable@QIODevice@@QBE_NXZ
??0QTextStream@@QAE@PAVQIODevice@@@Z
??1QTextStream@@UAE@XZ
?atEnd@QTextStream@@QBE_NXZ
?readLine@QTextStream@@QAE?AVQString@@_J@Z
??6QTextStream@@QAEAAV0@ABVQString@@@Z
?endl@Qt@@YAAAVQTextStream@@AAV2@@Z
??0QUrl@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
??1QUrl@@QAE@XZ
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?fromUserInput@QUrl@@SA?AV1@ABVQString@@@Z
?isEmpty@QUrl@@QBE_NXZ
?endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z
?resolved@QUrl@@QBE?AV1@ABV1@@Z
?isRelative@QUrl@@QBE_NXZ
?fromLocalFile@QUrl@@SA?AV1@ABVQString@@@Z
?toLocalFile@QUrl@@QBE?AVQString@@XZ
??0QFile@@QAE@ABVQString@@@Z
??1QFile@@UAE@XZ
?exists@QFile@@SA_NABVQString@@@Z
??0QFileInfo@@QAE@ABVQString@@@Z
??1QFileInfo@@QAE@XZ
?isReadable@QFileInfo@@QBE_NXZ
?atEnd@QFileDevice@@UBE_NXZ
?bytesAvailable@QIODevice@@UBE_JXZ
?bytesToWrite@QIODevice@@UBE_JXZ
?canReadLine@QIODevice@@UBE_NXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?close@QFileDevice@@UAEXXZ
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?fileName@QFile@@UBE?AVQString@@XZ
?isSequential@QFileDevice@@UBE_NXZ
??AQString@@QAE?AVQCharRef@@H@Z
?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?permissions@QFile@@UBE?AV?$QFlags@W4Permission@QFileDevice@@@@XZ
?pos@QFileDevice@@UBE_JXZ
?qt_metacall@QFile@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QFile@@UAEPAXPBD@Z
?readData@QFileDevice@@MAE_JPAD_J@Z
?readLineData@QFileDevice@@MAE_JPAD_J@Z
?reset@QIODevice@@UAE_NXZ
?resize@QFile@@UAE_N_J@Z
?seek@QFileDevice@@UAE_N_J@Z
?setPermissions@QFile@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z
?size@QFile@@UBE_JXZ
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?waitForBytesWritten@QIODevice@@UAE_NH@Z
?waitForReadyRead@QIODevice@@UAE_NH@Z
?writeData@QFileDevice@@MAE_JPBD_J@Z
?shared_null@QListData@@2UData@1@B
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z
??1QString@@QAE@XZ
?qstrcmp@@YAHABVQByteArray@@PBD@Z
?toLower@QString@@QHAE?AV1@XZ
?scheme@QUrl@@QBE?AVQString@@XZ
?metaObject@QFile@@UBEPBUQMetaObject@@XZ

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
EnterCriticalSection
TerminateProcess
GetCurrentProcess
InitializeSListHead
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 90B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/CreativeCloud_icon.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/DropGraphicFiles.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/GroupOnboardingBackground_CCD.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/GroupOnboardingGraphic_CCD.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/MissingLinkedElement_Dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/MissingLinkedElement_Light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/NewUserEmpty_dark.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/NewUserEmpty_light.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/ScrollDownArrow_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/ScrollDownArrow_darker.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/ScrollDownArrow_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/ScrollDownArrow_lighter.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/ScrollUpArrow_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/ScrollUpArrow_darker.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/ScrollUpArrow_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/ScrollUpArrow_lighter.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/aac_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/aac_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/aif_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/aif_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/aiff_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/aiff_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/captureCoachMark.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/checkerboard.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/coachmark.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/icons.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/m4a_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/m4a_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/mp2_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/mp2_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/mp3_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/mp3_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/scroll_triangle_down_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/scroll_triangle_down_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/scroll_triangle_left_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/scroll_triangle_left_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/scroll_triangle_right_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/scroll_triangle_right_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/scroll_triangle_up_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/scroll_triangle_up_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/unlock_coachmark.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/wait_32.gif
.gif
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/wav_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/resources/wav_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/META-INF/signatures.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/AEFT/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/DRWV/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/FLPR/jsx/brush.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/FLPR/jsx/color.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/FLPR/jsx/core.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/FLPR/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/IDSN/jsx/color.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/IDSN/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/IDSN/jsx/text.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/ILST/jsx/color.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/ILST/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/ILST/jsx/text.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/ILST/jsx/util.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/KBRG/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PHXS/jsx/brush.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PHXS/jsx/color.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PHXS/jsx/constants.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PHXS/jsx/gradient.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PHXS/jsx/layerstyle.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PHXS/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PHXS/jsx/text.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PHXS/jsx/util.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/applications/PPRO/jsx/main.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/CSXS/manifest.xml
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/ColorExtractor.worker.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/GradientExtractor.worker.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/ShapeExtractor.worker.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/capture.html
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/capture_main.js
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/cs_CZ/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/da_DK/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/de_DE/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/en_US/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/es_ES/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/fi_FI/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/fr_FR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/hu_HU/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/it_IT/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/ja_JP/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/ko_KR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/nb_NO/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/nl_NL/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/pl_PL/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/pt_BR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/ru_RU/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/sv_SE/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/tr_TR/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/uk_UA/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/zh_CN/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/locale/zh_TW/messages.properties
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/package.json
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/resources/CornucopiaCore.wasm
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/resources/GradientCaptureCore.wasm
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/resources/VectorizeCore.wasm
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/resources/capture_merchandising.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/extensions/capture/resources/capture_sample.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/images/IconDark.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/images/[email protected]
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/images/IconLight.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/images/[email protected]
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/jsx/core.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/jsx/json2.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/jsx/shims.jsx
.js
Ex_PE_v3.1.9/CMap/libs/playlistformats/qtmultimedia_m3u.dll
.dll windows:6 windows x86 arch:x86

d35460b9a3baf35d1aaeb2c0ade3acc2

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-07-2009 17:25

Not After

07-12-2030 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 15:43

Not After

07-11-2030 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:34:61:50:30:94:33:f3:02:f6:ec:f2:31:43:1a:6d
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

23-11-2021 07:32

Not After

01-12-2022 07:32

Subject

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 19:19

Not After

29-12-2040 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22-07-2020 15:33

Not After

29-12-2030 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09
Signer

Actual PE Digest

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\qt\work\qt\qtmultimedia\plugins\playlistformats\qtmultimedia_m3u.pdb

Imports

qt5multimedia

?qt_metacall@QMediaPlaylistIOPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaPlaylistIOPlugin@@UAEPAXPBD@Z
?staticMetaObject@QMediaPlaylistIOPlugin@@2UQMetaObject@@B
??1QMediaPlaylistIOPlugin@@UAE@XZ
??0QMediaPlaylistIOPlugin@@QAE@PAVQObject@@@Z
??0QMediaPlaylistWriter@@QAE@XZ
??1QMediaPlaylistWriter@@UAE@XZ
??0QMediaContent@@QAE@XZ
??1QMediaPlaylistReader@@UAE@XZ
?request@QMediaContent@@QBE?AVQNetworkRequest@@XZ
?isNull@QMediaContent@@QBE_NXZ
??4QMediaContent@@QAEAAV0@ABV0@@Z
??1QMediaContent@@QAE@XZ
??0QMediaContent@@QAE@ABV0@@Z
??0QMediaContent@@QAE@ABVQUrl@@@Z
??0QMediaPlaylistReader@@QAE@XZ

qt5network

??1QNetworkRequest@@QAE@XZ
?url@QNetworkRequest@@QBE?AVQUrl@@XZ

qt5core

?trimmed@QString@@QHAE?AV1@XZ
??8QString@@QBE_NVQLatin1String@@@Z
??BQCharRef@@QBE?AVQChar@@XZ
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?dispose@QListData@@SAXPAUData@1@@Z
?append@QListData@@QAEPAPAXXZ
?isOpen@QIODevice@@QBE_NXZ
?isReadable@QIODevice@@QBE_NXZ
?isWritable@QIODevice@@QBE_NXZ
??0QTextStream@@QAE@PAVQIODevice@@@Z
??1QTextStream@@UAE@XZ
?atEnd@QTextStream@@QBE_NXZ
?readLine@QTextStream@@QAE?AVQString@@_J@Z
??6QTextStream@@QAEAAV0@ABVQString@@@Z
?endl@Qt@@YAAAVQTextStream@@AAV2@@Z
??0QUrl@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
??1QUrl@@QAE@XZ
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?fromUserInput@QUrl@@SA?AV1@ABVQString@@@Z
?isEmpty@QUrl@@QBE_NXZ
?endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z
?resolved@QUrl@@QBE?AV1@ABV1@@Z
?isRelative@QUrl@@QBE_NXZ
?fromLocalFile@QUrl@@SA?AV1@ABVQString@@@Z
?toLocalFile@QUrl@@QBE?AVQString@@XZ
??0QFile@@QAE@ABVQString@@@Z
??1QFile@@UAE@XZ
?exists@QFile@@SA_NABVQString@@@Z
??0QFileInfo@@QAE@ABVQString@@@Z
??1QFileInfo@@QAE@XZ
?isReadable@QFileInfo@@QBE_NXZ
?atEnd@QFileDevice@@UBE_NXZ
?bytesAvailable@QIODevice@@UBE_JXZ
?bytesToWrite@QIODevice@@UBE_JXZ
?canReadLine@QIODevice@@UBE_NXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?close@QFileDevice@@UAEXXZ
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?fileName@QFile@@UBE?AVQString@@XZ
?isSequential@QFileDevice@@UBE_NXZ
??AQString@@QAE?AVQCharRef@@H@Z
?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?permissions@QFile@@UBE?AV?$QFlags@W4Permission@QFileDevice@@@@XZ
?pos@QFileDevice@@UBE_JXZ
?qt_metacall@QFile@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QFile@@UAEPAXPBD@Z
?readData@QFileDevice@@MAE_JPAD_J@Z
?readLineData@QFileDevice@@MAE_JPAD_J@Z
?reset@QIODevice@@UAE_NXZ
?resize@QFile@@UAE_N_J@Z
?seek@QFileDevice@@UAE_N_J@Z
?setPermissions@QFile@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z
?size@QFile@@UBE_JXZ
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?waitForBytesWritten@QIODevice@@UAE_NH@Z
?waitForReadyRead@QIODevice@@UAE_NH@Z
?writeData@QFileDevice@@MAE_JPBD_J@Z
?shared_null@QListData@@2UData@1@B
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z
??1QString@@QAE@XZ
?qstrcmp@@YAHABVQByteArray@@PBD@Z
?toLower@QString@@QHAE?AV1@XZ
?scheme@QUrl@@QBE?AVQString@@XZ
?metaObject@QFile@@UBEPBUQMetaObject@@XZ

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
EnterCriticalSection
TerminateProcess
GetCurrentProcess
InitializeSListHead
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 90B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/CreativeCloud_icon.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/DropGraphicFiles.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/GroupOnboardingBackground_CCD.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/GroupOnboardingGraphic_CCD.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/MissingLinkedElement_Dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/MissingLinkedElement_Light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/NewUserEmpty_dark.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/NewUserEmpty_light.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/ScrollDownArrow_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/ScrollDownArrow_darker.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/ScrollDownArrow_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/ScrollDownArrow_lighter.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/ScrollUpArrow_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/ScrollUpArrow_darker.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/ScrollUpArrow_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/ScrollUpArrow_lighter.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/aac_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/aac_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/aif_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/aif_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/aiff_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/aiff_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/captureCoachMark.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/checkerboard.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/coachmark.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/icons.svg
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/m4a_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/m4a_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/mp2_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/mp2_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/mp3_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/mp3_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/scroll_triangle_down_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/scroll_triangle_down_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/scroll_triangle_left_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/scroll_triangle_left_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/scroll_triangle_right_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/scroll_triangle_right_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/scroll_triangle_up_dark.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/scroll_triangle_up_light.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/unlock_coachmark.png
.png
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/wait_32.gif
.gif
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/wav_filetype_256.svg
.xml
Ex_PE_v3.1.9/CMap/libs/playlistformats/resources/wav_filetype_64.svg
.xml
Ex_PE_v3.1.9/CMap/libs/wkspbrokerAx.dll
.dll regsvr32 windows:10 windows x64 arch:x64

49cc6a01a9ed1f9c8bbaf13fc1799bec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wkspbrokerAx.pdb

Imports

msvcrt

memset
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
memcmp
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
wcscat_s
wcscpy_s
calloc
_purecall
_resetstkoflw
swprintf_s
wcsncpy_s
memcpy_s
free
malloc
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
_XcptFilter
wcscmp

kernel32

MultiByteToWideChar
lstrcmpW
MulDiv
LoadLibraryExW
FindResourceExW
LoadResource
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
lstrcmpiW
RaiseException
SizeofResource
GetModuleFileNameW
GetModuleHandleExA
InitializeCriticalSection
GetCurrentThreadId
SetLastError
GetThreadLocale
SetThreadLocale
HeapFree
VirtualFree
GetCurrentProcess
CloseHandle
LoadLibraryExA
EncodePointer
HeapAlloc
DecodePointer
GetProcessHeap
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
LocalAlloc
LocalFree
LoadLibraryW
GetModuleFileNameA
CreateSemaphoreExW
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DebugBreak
IsDebuggerPresent
GetLastError
ReleaseSemaphore
VirtualAlloc

advapi32

TraceMessage
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

oleaut32

BSTR_UserFree64
SysFreeString
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal64
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize64
BSTR_UserMarshal64
SysStringLen
SysAllocString
VariantInit
VariantClear
SysStringByteLen
VarUI4FromStr
SysAllocStringByteLen
SafeArrayDestroy
SafeArrayGetVartype
LoadRegTypeLi
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi

user32

GetWindowLongPtrW
SetWindowLongPtrW
GetClientRect
DestroyWindow
CreateWindowExW
UnregisterClassA
CallWindowProcW
EnumChildWindows
AllowSetForegroundWindow
RegisterClassExW
LoadCursorW
GetClassInfoExW
DefWindowProcW
GetFocus
CharNextW
GetClassNameW
IsWindow
IsChild
ReleaseDC
GetDC
EndPaint
BeginPaint

gdi32

SetViewportOrgEx
SetMapMode
LPtoDP
RestoreDC
SaveDC
TextOutW
SetTextAlign
CreateDCW
DeleteDC
SetWindowOrgEx
GetDeviceCaps

rpcrt4

NdrStubCall3
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
CStdStubBuffer_Invoke
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrCStdStubBuffer2_Release
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrDllUnregisterProxy
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
ObjectStublessClient25
ObjectStublessClient24
CStdStubBuffer2_Connect
ObjectStublessClient21
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient26
ObjectStublessClient9
ObjectStublessClient8
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction6
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient22
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
NdrProxyForwardingFunction3

ntoskrnl.exe

_vsnwprintf

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

combase

ord157
ord90

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wksprt.exe
.exe windows:10 windows x64 arch:x64

355bc8cdfe11baeb67d8288b84db582d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wksprt.pdb

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventActivityIdControl
TraceMessage
RegQueryValueExW
RegNotifyChangeKeyValue
RegGetValueW
RegEnumValueW
RegDeleteTreeW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetKeyValueW
IsTextUnicode
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW

kernel32

SetFilePointer
DeleteCriticalSection
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteFileW
GetTempPathW
GetSystemWindowsDirectoryW
Sleep
GetCommandLineW
SetLastError
GetCurrentThreadId
GetDateFormatW
GetTimeFormatW
WaitForMultipleObjects
CloseHandle
TerminateThread
CreateThread
CreateEventW
SearchPathW
GetCurrentProcessId
CompareStringW
SetEvent
DeleteTimerQueueTimer
CreateTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
GetModuleHandleExA
WaitForSingleObject
GetModuleFileNameW
FindResourceExW
GetVersionExW
FormatMessageW
ResetEvent
LoadResource
TlsFree
TlsAlloc
LoadLibraryA
GetSystemTime
SystemTimeToFileTime
LoadLibraryW
LocalFree
LocalAlloc
ExpandEnvironmentStringsW
GetACP
ReadFile
GetFileSize
WriteFile
GetFileAttributesW
CreateFileW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
LeaveCriticalSection
InitializeCriticalSection
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
WideCharToMultiByte
HeapFree
VirtualFree
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
EncodePointer
HeapAlloc
DecodePointer
GetProcessHeap
SizeofResource
MultiByteToWideChar
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
lstrcmpiW
RaiseException

user32

GetClientRect
DialogBoxParamW
EndDialog
UnregisterClassA
CharNextW
AllowSetForegroundWindow
PostMessageW
SendMessageW
PostThreadMessageW
GetMessageW
IsDialogMessageW
TranslateMessage
UnregisterClassW
LoadStringW
GetActiveWindow
DispatchMessageW
DestroyWindow
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
SetWindowLongPtrW
CharUpperW
DefWindowProcW
DestroyMenu
InsertMenuItemW
CreatePopupMenu
ShowWindow
LoadIconW
RegisterWindowMessageW
EnableMenuItem
GetMenuItemCount
GetMenuItemInfoW
RemoveMenu
EndMenu
PostQuitMessage
GetCursorPos
SetForegroundWindow
TrackPopupMenuEx
CreateDialogParamW
GetWindowLongPtrW
CallWindowProcW
GetDlgItem
GetSystemMenu
SetWindowTextW

msvcrt

__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
wcsncpy_s
malloc
free
memcpy_s
??0exception@@QEAA@AEBV0@@Z
_wcsicmp
_vsnwprintf
swscanf
swprintf_s
_resetstkoflw
_purecall
calloc
wcscat_s
?what@exception@@UEBAPEBDXZ
memmove_s
wcscpy_s
_wfopen_s
_errno
fputws
fclose
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
_XcptFilter
_wcslwr
towlower
wcstol
wcstok_s
wcstombs_s
_wcsnicmp
toupper
memmove
memcpy
memcmp
bsearch
wcsncmp
_onexit
__dllonexit
_unlock
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
_wcmdln
_fmode
_commode
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
realloc
_lock
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

ole32

CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoSuspendClassObjects
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoCreateGuid
CoCreateInstance
CoUninitialize
StringFromGUID2
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysStringLen
RegisterTypeLi
UnRegisterTypeLi
SafeArrayRedim
SafeArrayCreate
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
SafeArrayGetVartype
VariantInit
SafeArrayGetUBound
LoadTypeLi
SysFreeString
LoadRegTypeLi
SafeArrayGetLBound
VarUI4FromStr

comctl32

InitCommonControlsEx

shell32

SHGetIDListFromObject
ShellExecuteExW
ord155
Shell_NotifyIconW
SHCreateItemInKnownFolder
ShellExecuteW

crypt32

CryptStringToBinaryW
CryptDecodeObject
CryptProtectData
CertFindExtension
CertFreeCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertGetCertificateContextProperty
CryptSignMessage
CryptVerifyDetachedMessageSignature
CertCloseStore
CertVerifyCertificateChainPolicy
CryptMsgOpenToDecode
CryptMsgUpdate
CertOpenStore
CryptMsgClose
CryptBinaryToStringW
CertGetCertificateChain

webservices

WsFreeError
WsCloseServiceProxy
WsFreeServiceProxy
WsFreeHeap
WsGetErrorProperty
WsGetErrorString
WsCreateHeap
WsCreateError
WsAddMappedHeader
WsCall
WsCreateServiceProxy
WsOpenServiceProxy

shlwapi

PathRemoveFileSpecW
ord388
PathIsContentTypeW

wininet

InternetOpenW
HttpSendRequestExW
InternetCloseHandle
InternetSetStatusCallbackW
InternetCrackUrlW
HttpOpenRequestW
InternetConnectW
InternetCanonicalizeUrlW
InternetCombineUrlW

iphlpapi

ParseNetworkString

Sections

.text
Size: 251KB - Virtual size: 250KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wksprtPS.dll
.dll regsvr32 windows:10 windows x64 arch:x64

dddb9f9413efb22f5f2f95f82521c599

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wksprtPS.pdb

Imports

msvcrt

memcmp
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter

kernel32

QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
DisableThreadLibraryCalls
Sleep
GetCurrentProcessId

ole32

ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient13
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient15
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient3
NdrProxyForwardingFunction6

oleaut32

LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize64
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserFree64
BSTR_UserSize64
LPSAFEARRAY_UserSize
BSTR_UserMarshal64
BSTR_UserUnmarshal64
BSTR_UserFree
BSTR_UserSize
LPSAFEARRAY_UserFree

rpcrt4

CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrStubForwardingFunction
CStdStubBuffer_Disconnect
NdrCStdStubBuffer2_Release
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrStubCall3
NdrOleAllocate

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wkssvc.dll
.dll windows:10 windows x64 arch:x64

4df40003d563631ed1e3880008a18229

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wkssvc.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
memmove
_o_free
_o_iswalpha
_o_malloc
_o_tolower
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstoul
_o__execute_onexit_table
_o__errno
_CxxThrowException
_o__configure_narrow_argv
wcsstr
__std_terminate
__CxxFrameHandler4
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
wcschr
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcscmp
wcsspn

rpcrt4

RpcBindingVectorFree
NdrAsyncServerCall
I_RpcMapWin32Status
RpcAsyncAbortCall
RpcBindingToStringBindingW
RpcServerUseProtseqW
RpcServerUnregisterIf
RpcAsyncCompleteCall
RpcStringFreeW
NdrServerCall2
RpcStringBindingParseW
RpcServerRegisterIfEx
RpcImpersonateClient
NdrServerCallAll
RpcBindingServerFromClient
RpcServerTestCancel
RpcBindingFree
RpcEpUnregister
Ndr64AsyncServerCallAll
RpcEpRegisterW
RpcServerUnregisterIfEx
RpcServerUseProtseqEpW
RpcServerInqBindings
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcServerInqCallAttributesW
RpcRevertToSelf
Ndr64AsyncClientCall
I_RpcBindingIsClientLocal
NdrClientCall3
RpcBindingSetOption
RpcAsyncInitializeHandle
RpcAsyncCancelCall
RpcBindingSetAuthInfoExW
RpcEpResolveBinding
RpcMgmtSetComTimeout
RpcBindingFromStringBindingW

api-ms-win-security-activedirectoryclient-l1-1-0

DsBindWithSpnExW
DsMakePasswordCredentialsW
DsFreeNameResultW
DsFreePasswordCredentials
DsCrackNamesW
DsFreeDomainControllerInfoW
DsGetDomainControllerInfoW
DsUnBindW

api-ms-win-core-heap-l2-1-0

LocalUnlock
LocalReAlloc
LocalFree
LocalLock
LocalAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

ntdll

NtOpenThreadToken
RtlCopyLuid
RtlAcquireResourceShared
RtlCompareUnicodeString
WinSqmSetDWORD
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
NtCreateFile
RtlIpv6AddressToStringExW
NtQueryVolumeInformationFile
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
RtlRunDecodeUnicodeString
RtlRunEncodeUnicodeString
RtlIpv6AddressToStringW
RtlGetNtProductType
RtlInitUnicodeString
NtQueryInformationFile
RtlIpv4AddressToStringW
RtlAcquireResourceExclusive
RtlReleaseResource
RtlValidRelativeSecurityDescriptor
NtQueryInformationToken
NtOpenFile
NtFsControlFile
NtClose
RtlAdjustPrivilege
NtAccessCheckAndAuditAlarm
RtlIpv4AddressToStringExW
NtDeviceIoControlFile
RtlMapSecurityErrorToNtStatus
RtlCopySid
RtlLengthSid
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetSaclSecurityDescriptor
NtOpenProcessToken
RtlNewSecurityObject
RtlDeleteSecurityObject
DbgPrint
RtlInitializeGenericTable
RtlNtStatusToDosError
RtlDeregisterWaitEx
RtlDeleteElementGenericTable
NtCreateEvent
RtlDeregisterWait
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlEnumerateGenericTable
WinSqmIsOptedIn
RtlRegisterWait
RtlInitString
RtlDeleteResource
RtlInitializeResource
RtlHashUnicodeString

api-ms-win-security-base-l1-1-0

RevertToSelf
CreateWellKnownSid
PrivilegeCheck
CheckTokenMembership

netutils

NetpwPathCanonicalize
NetpwListTraverse
NetpwListCanonicalize
NetpwPathType
NetApiBufferAllocate
NetpwNameCanonicalize
NetApiBufferFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
LeaveCriticalSection
CreateEventW
DeleteCriticalSection
OpenEventW
ResetEvent
SetEvent
WaitForSingleObject
WaitForMultipleObjectsEx
EnterCriticalSection

api-ms-win-core-kernel32-private-l1-1-0

DosPathToSessionPathW
EnumerateLocalComputerNamesW
SetLocalPrimaryComputerNameW
RemoveLocalAlternateComputerNameW

api-ms-win-security-lsalookup-l1-1-0

LsaLookupGetDomainInfo
LsaLookupClose
LsaLookupFreeMemory
LsaLookupOpenLocalPolicy

bcrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptDecrypt
BCryptEncrypt
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGenerateSymmetricKey

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-kernel32-legacy-l1-1-0

DnsHostnameToComputerNameW
RegisterWaitForSingleObject
AddLocalAlternateComputerNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersion
GetTickCount64
GetVersionExW
GetComputerNameExW
GlobalMemoryStatusEx
GetLocalTime

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

DefineDosDeviceW
QueryDosDeviceW
CreateFileW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
CreateThread
TerminateProcess
GetCurrentProcessId
SetThreadToken

userenv

LeaveCriticalPolicySection
UnregisterGPNotification
EnterCriticalPolicySection
RegisterGPNotification

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegDeleteKeyExW
RegGetValueW
RegCreateKeyExW
RegFlushKey
RegEnumKeyExW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlCompareMemory

api-ms-win-service-private-l1-1-0

I_ScSetServiceBitsW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-io-l1-1-0

PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort

dsparse

DsMakeSpnW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlanapi.dll
.dll windows:10 windows x64 arch:x64

c48e3ea6417fb6db191610d01fdd8b48

Code Sign

33:00:00:03:8b:79:45:c1:8b:0e:b6:87:ec:00:00:00:00:03:8b
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-05-2022 19:23

Not After

04-05-2023 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:c4:e0:c0:6e:e7:42:9f:b2:b6:20:9c:df:55:72:82:07:05:9a:5b:0e:e1:fb:42:c6:1e:84:d9:73:88:83:04
Signer

Actual PE Digest

3a:c4:e0:c0:6e:e7:42:9f:b2:b6:20:9c:df:55:72:82:07:05:9a:5b:0e:e1:fb:42:c6:1e:84:d9:73:88:83:04

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wlanapi.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

wcsncmp
memset
wcscmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_iswalnum
_o_iswdigit
_o_iswxdigit
_o_malloc
_o_memcpy_s
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_o_wmemcpy_s
__CxxFrameHandler4
__std_terminate
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__endthreadex
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
memcmp
memcpy

ntdll

RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlNtStatusToDosError
WinSqmIncrementDWORD
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
WaitForMultipleObjectsEx
ReleaseSRWLockShared
InitializeCriticalSectionEx
ReleaseSemaphore
AcquireSRWLockExclusive
SetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
OpenSemaphoreW
ResetEvent
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
LeaveCriticalSection
ReleaseMutex
AcquireSRWLockShared
CreateMutexExW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount

rpcrt4

RpcAsyncCompleteCall
RpcBindingSetOption
RpcEpResolveBinding
RpcExceptionFilter
RpcAsyncGetCallStatus
RpcMgmtInqServerPrincNameW
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
NdrClientCall3
Ndr64AsyncClientCall
RpcBindingFromStringBindingW
RpcStringFreeW
RpcStringBindingComposeW
RpcAsyncCancelCall
RpcBindingSetAuthInfoExW
RpcBindingFree

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
CreateThread
ProcessIdToSessionId
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CreateThreadpoolWait
CreateThreadpoolCleanupGroup
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc
HeapDestroy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
LoadStringW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetVersionExW

api-ms-win-core-synch-l1-2-0

Sleep

profapi

ord104

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegGetValueW

api-ms-win-core-file-l1-1-0

CompareFileTime
GetFileTime
CreateFileW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
GetSecurityDescriptorLength
MakeSelfRelativeSD
InitializeAcl
SetSecurityDescriptorGroup
AddAccessDeniedAce
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetAce
InitializeSecurityDescriptor
GetLengthSid
CreateWellKnownSid
EqualSid
IsValidSid

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

QueryNetconStatus
QueryNetconVirtualCharacteristic
WFDAbortSessionInt
WFDAcceptConnectRequestAndOpenSessionInt
WFDAcceptGroupRequestAndOpenSessionInt
WFDCancelConnectorPairWithOOB
WFDCancelListenerPairWithOOB
WFDCancelOpenSession
WFDCancelOpenSessionInt
WFDCloseHandle
WFDCloseHandleInt
WFDCloseLegacySessionInt
WFDCloseOOBPairingSession
WFDCloseSession
WFDCloseSessionInt
WFDConfigureFirewallForSessionInt
WFDCreateDHPrivatePublicKeyPairInt
WFDDeclineConnectRequestInt
WFDDeclineGroupRequestInt
WFDDiscoverDeviceServiceInformationInt
WFDDiscoverDevicesExInt
WFDDiscoverDevicesInt
WFDFlushVisibleDeviceListInt
WFDForceDisconnectInt
WFDForceDisconnectLegacyPeerInt
WFDFreeMemoryInt
WFDGetDefaultGroupProfileInt
WFDGetDeviceDescriptorForPendingRequestInt
WFDGetNFCCarrierConfigBlobInt
WFDGetOOBBlob
WFDGetPrimaryAdapterStateInt
WFDGetProfileKeyInfoInt
WFDGetSessionEndpointPairsInt
WFDGetVisibleDevicesExInt
WFDGetVisibleDevicesInt
WFDIsInterfaceWiFiDirect
WFDIsWiFiDirectRunningOnWiFiAdapter
WFDLowPrivCancelOpenSessionInt
WFDLowPrivCloseHandleInt
WFDLowPrivCloseLegacySessionInt
WFDLowPrivCloseSessionInt
WFDLowPrivConfigureFirewallForSessionInt
WFDLowPrivDeclineDeviceApiConnectionRequestInt
WFDLowPrivGetPendingGroupRequestDetailsInt
WFDLowPrivGetSessionEndpointPairsInt
WFDLowPrivIsWfdSupportedInt
WFDLowPrivOpenHandleInt
WFDLowPrivOpenLegacySessionInt
WFDLowPrivOpenSessionByDafObjectIdInt
WFDLowPrivQueryPropertyInt
WFDLowPrivRegisterNotificationInt
WFDLowPrivRegisterVMgrCallerInt
WFDLowPrivSetPropertyInt
WFDLowPrivStartDeviceApiConnectionRequestListenerInt
WFDLowPrivStartUsingGroupInt
WFDLowPrivStopDeviceApiConnectionRequestListenerInt
WFDLowPrivStopUsingGroupInt
WFDLowPrivUnregisterVMgrCallerInt
WFDOpenHandle
WFDOpenHandleInt
WFDOpenLegacySession
WFDOpenLegacySessionInt
WFDPairCancelByDeviceAddressInt
WFDPairCancelInt
WFDPairContinuePairWithDeviceInt
WFDPairEnumerateCeremoniesInt
WFDPairSelectCeremonyInt
WFDPairWithDeviceAndOpenSessionExInt
WFDPairWithDeviceAndOpenSessionInt
WFDParseOOBBlob
WFDParseOOBBlobTypeAndGetPayloadInt
WFDParseProfileXmlInt
WFDParseWfaNfcCarrierConfigBlobInt
WFDQueryPropertyInt
WFDRegisterNotificationInt
WFDRegisterVMgrCallerInt
WFDResetSelectedWfdMgrInt
WFDSetAdditionalIEsInt
WFDSetPropertyInt
WFDSetSecondaryDeviceTypeListInt
WFDSetSelectedWfdMgrInt
WFDStartBackgroundDiscoveryInt
WFDStartConnectorPairWithOOB
WFDStartListenerPairWithOOB
WFDStartOffloadedDiscoveryInt
WFDStartOpenSession
WFDStartOpenSessionInt
WFDStartUsingGroupExInt
WFDStartUsingGroupInt
WFDStopBackgroundDiscoveryInt
WFDStopDiscoverDevicesExInt
WFDStopDiscoverDevicesInt
WFDStopOffloadedDiscoveryInt
WFDStopUsingGroupInt
WFDSvcLowPrivAcceptSessionInt
WFDSvcLowPrivCancelSessionInt
WFDSvcLowPrivCloseSessionInt
WFDSvcLowPrivConfigureSessionInt
WFDSvcLowPrivConnectSessionInt
WFDSvcLowPrivGetProvisioningInfoInt
WFDSvcLowPrivGetSessionEndpointPairsInt
WFDSvcLowPrivOpenAdvertiserSessionInt
WFDSvcLowPrivOpenSeekerSessionInt
WFDSvcLowPrivPublishServiceInt
WFDSvcLowPrivUnpublishServiceInt
WFDUnregisterVMgrCallerInt
WFDUpdateDeviceVisibility
WiFiDisplayResetSinkStateInt
WiFiDisplaySetSinkClientHandleInt
WiFiDisplaySetSinkStateInt
WlanAllocateMemory
WlanAllocateProfileIpConfiguration
WlanCancelPlap
WlanCloseHandle
WlanConnect
WlanConnectEx
WlanConnectWithInput
WlanDeinitPlapParams
WlanDeleteProfile
WlanDeviceServiceCommand
WlanDisconnect
WlanDoPlap
WlanDoesBssMatchSecurity
WlanEnumAllInterfaces
WlanEnumInterfaces
WlanExtractPsdIEDataList
WlanFreeMemory
WlanGenerateProfileXmlBasicSettings
WlanGetAvailableNetworkList
WlanGetAvailableNetworkList2
WlanGetFilterList
WlanGetInterfaceCapability
WlanGetMFPNegotiated
WlanGetNetworkBssList
WlanGetProfile
WlanGetProfileCustomUserData
WlanGetProfileEapUserDataInfo
WlanGetProfileIndex
WlanGetProfileKeyInfo
WlanGetProfileList
WlanGetProfileMetadata
WlanGetProfileMetadataWithProfileGuid
WlanGetProfileSsidList
WlanGetRadioInformation
WlanGetSecuritySettings
WlanGetStoredRadioState
WlanGetSupportedDeviceServices
WlanHostedNetworkForceStart
WlanHostedNetworkForceStop
WlanHostedNetworkFreeWCNSettings
WlanHostedNetworkHlpQueryEverUsed
WlanHostedNetworkInitSettings
WlanHostedNetworkQueryProperty
WlanHostedNetworkQuerySecondaryKey
WlanHostedNetworkQueryStatus
WlanHostedNetworkQueryWCNSettings
WlanHostedNetworkRefreshSecuritySettings
WlanHostedNetworkSetProperty
WlanHostedNetworkSetSecondaryKey
WlanHostedNetworkSetWCNSettings
WlanHostedNetworkStartUsing
WlanHostedNetworkStopUsing
WlanIhvControl
WlanInitPlapParams
WlanInternalCancelFTMRequest
WlanInternalGetNetworkBssListWithFTMData
WlanInternalNonDisruptiveScan
WlanInternalNonDisruptiveScanEx
WlanInternalRequestFTM
WlanInternalScan
WlanIsActiveConsoleUser
WlanIsNetworkSuppressed
WlanIsUIRequestPending
WlanLowPrivCloseHandle
WlanLowPrivEnumInterfaces
WlanLowPrivFreeMemory
WlanLowPrivNotifyVsIeProviderInt
WlanLowPrivOpenHandle
WlanLowPrivQueryInterface
WlanLowPrivSetInterface
WlanNotifyVsIeProviderExInt
WlanNotifyVsIeProviderInt
WlanOpenHandle
WlanParseProfileXmlBasicSettings
WlanPrivateCanDeleteProfile
WlanPrivateClearAnqpCache
WlanPrivateDeleteProfile
WlanPrivateEnableAnqpOsuRegistration
WlanPrivateGetAnqpCacheResponse
WlanPrivateGetAnqpOSUProviderList
WlanPrivateGetAnqpOsuRegistrationStatus
WlanPrivateGetAvailableNetworkList
WlanPrivateParseAnqpRawData
WlanPrivateQuery11adPairedConfig
WlanPrivateQueryInterface
WlanPrivateRefreshAnqpCache
WlanPrivateSetInterface
WlanPrivateSetProfile
WlanProfileIpConfigurationGetAddressList
WlanProfileIpConfigurationGetDnsServerList
WlanProfileIpConfigurationGetGatewayList
WlanQueryAutoConfigParameter
WlanQueryCreateAllUserProfileRestricted
WlanQueryInterface
WlanQueryPlapCredentials
WlanQueryPreConnectInput
WlanQueryVirtualInterfaceType
WlanReasonCodeToString
WlanRefreshConnections
WlanRegisterDeviceServiceNotification
WlanRegisterNotification
WlanRegisterVirtualStationNotification
WlanRemoveUIForwardingNetworkList
WlanRenameProfile
WlanSaveTemporaryProfile
WlanScan
WlanSendUIResponse
WlanSetAllUserProfileRestricted
WlanSetAutoConfigParameter
WlanSetFilterList
WlanSetInterface
WlanSetProfile
WlanSetProfileCustomUserData
WlanSetProfileEapUserData
WlanSetProfileEapXmlUserData
WlanSetProfileList
WlanSetProfileListForOffload
WlanSetProfileMetadata
WlanSetProfilePosition
WlanSetProtectedScenario
WlanSetPsdIEDataList
WlanSetSecuritySettings
WlanSetUIForwardingNetworkList
WlanSignalValueToBar
WlanSignalValueToBarEx
WlanSsidToDisplayName
WlanStartAP
WlanStartMovementDetector
WlanStopAP
WlanStopMovementDetector
WlanStoreRadioStateOnEnteringAirPlaneMode
WlanStringToSsid
WlanStringToUtf8Ssid
WlanTryUpgradeCurrentConnectionAuthCipher
WlanUpdateBasicProfileSecurity
WlanUpdateProfileWithAuthCipher
WlanUtf8SsidToDisplayName
WlanVMgrQueryCurrentScenariosInt
WlanVerifyProfileIpConfiguration
WlanWcmDisconnect
WlanWcmGetInterface
WlanWcmGetProfileList
WlanWcmSetInterface
WlanWcmSetProfile
WlanWfdGOSetWCNSettings
WlanWfdGetPeerInfo
WlanWfdStartGO
WlanWfdStopGO

Sections

.text
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlandlg.dll
.dll regsvr32 windows:10 windows x64 arch:x64

e2e4ebf579cb3e9451ae34e749a8ddb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wlandlg.pdb

Imports

msvcrt

realloc
?terminate@@YAXXZ
_lock
_unlock
_errno
_onexit
??1type_info@@UEAA@XZ
memcpy
_CxxThrowException
_initterm
_amsg_exit
__dllonexit
swprintf_s
_XcptFilter
_callnewh
?what@exception@@UEBAPEBDXZ
towlower
__CxxFrameHandler3
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
wcsncpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
__C_specific_handler
iswctype
memset

ntdll

RtlCaptureContext
RtlVirtualUnwind
WinSqmIncrementDWORD
RtlLookupFunctionEntry

advapi32

EventUnregister
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
RegSetValueExW
GetTraceEnableFlags
RegEnumKeyExW
GetTraceLoggerHandle
RegCreateKeyExW
EventRegister
RegQueryInfoKeyW
RegCloseKey
TraceMessage
EventWriteTransfer
RegDeleteValueW

user32

SendMessageW
PostMessageW
GetPropW
SetWindowLongPtrW
RemovePropW
LoadStringW
SetPropW
GetParent
UnregisterClassA
CharNextW

ole32

CoTaskMemAlloc
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID
CoCreateInstance

oleaut32

VarUI4FromStr
SysStringLen
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
UnRegisterTypeLi
VariantClear
SysAllocStringByteLen
VariantInit

kernel32

HeapFree
HeapAlloc
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
WideCharToMultiByte
LoadLibraryExW
lstrcmpiW
FreeLibrary
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
DisableThreadLibraryCalls
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetProcessHeap
SetLastError
GetModuleFileNameW
EnterCriticalSection
SizeofResource

eappcfg

EapHostPeerFreeMemory
EapHostPeerFreeErrorMemory

wlanapi

WlanSendUIResponse

onex

OneXFreeMemory

onexui

OneXMapEAPHostInteractiveUIToOneXUIResponse
OneXShowUI

dui70

DuiCreateObject
StrToID
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?Release@Value@DirectUI@@QEAAXXZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlanext.exe
.exe windows:10 windows x64 arch:x64

93b58e7d480a8a2281eae5ddf5f178f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wlanext.pdb

Imports

msvcrt

memset
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
memcpy
__wgetmainargs
?terminate@@YAXXZ
_amsg_exit
_XcptFilter
__C_specific_handler
_wtoi64
wcscmp

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-processthreads-l1-1-0

ExitProcess
OpenProcessToken
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
OpenThreadToken
CreateThread
GetCurrentThread
GetCurrentProcess

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-security-base-l1-1-0

IsValidSid
GetTokenInformation
CopySid
AdjustTokenPrivileges
EqualSid
GetLengthSid

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSetInformation
HeapAlloc
HeapFree

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
CreateEventW
ResetEvent
SetEvent
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
LoadLibraryExW
FreeLibrary

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx
DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer
CreateTimerQueue
ChangeTimerQueueTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-file-l1-1-0

CreateFileW
ReadFile
WriteFile

ntdll

RtlStringFromGUID
NtDeviceIoControlFile
NtWaitForSingleObject
RtlFreeUnicodeString
EtwTraceMessage
RtlNtStatusToDosError

api-ms-win-core-kernel32-legacy-l1-1-0

BindIoCompletionCallback

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlangpui.dll
.dll regsvr32 windows:10 windows x64 arch:x64

8497537780026fafd8d2d0e2f67e985a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wlangpui.pdb

Imports

mfc42u

ord1043
ord629
ord3740
ord2408
ord2427
ord1574
ord286
ord3830
ord3790
ord1441
ord1647
ord1122
ord624
ord2975
ord5887
ord6886
ord5584
ord5585
ord5583
ord5304
ord5114
ord5352
ord5687
ord5246
ord5406
ord2517
ord6437
ord4365
ord1777
ord4752
ord5663
ord2399
ord5586
ord6812
ord4694
ord5709
ord4017
ord5227
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord3049
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord4082
ord4083
ord4077
ord3164
ord4371
ord4988
ord4771
ord5382
ord999
ord551
ord2906
ord4612
ord1287
ord2876
ord2121
ord5804
ord6821
ord5815
ord6832
ord1499
ord1677
ord2676
ord1498
ord567
ord1005
ord2846
ord1259
ord568
ord1006
ord1355
ord5950
ord6880
ord6223
ord3872
ord659
ord1063
ord4214
ord2752
ord1426
ord3916
ord4770
ord4983
ord3534
ord6053
ord5711
ord5730
ord5065
ord4368
ord5724
ord5722
ord3468
ord1463
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord2593
ord6440
ord1778
ord4747
ord5712
ord5229
ord3501
ord3806
ord665
ord912
ord2586
ord4741
ord3535
ord3743
ord822
ord2329
ord4257
ord2902
ord6393
ord2661
ord6385
ord561
ord1003
ord6588
ord1365
ord2532
ord3177
ord1404
ord3396
ord6351
ord4375
ord3234
ord2856
ord4424
ord1906
ord4582
ord549
ord6418
ord5077
ord4699
ord4722
ord4860
ord2629
ord6705
ord6708
ord2422
ord2023
ord4542
ord2589
ord4743
ord3751
ord832
ord2328
ord6767
ord6326
ord3180
ord867
ord3774
ord6614
ord625
ord1781
ord6328
ord4131
ord4344
ord2384
ord2311
ord1123
ord5912
ord6706
ord1442
ord1443
ord6147
ord6395
ord372
ord2518
ord3652
ord6021
ord6216
ord852
ord3417
ord1812
ord337
ord4557
ord5245
ord5702
ord4721
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord1284
ord4473
ord3754
ord287
ord6887
ord620
ord626
ord1126
ord2412
ord1040

msvcrt

_XcptFilter
_CxxThrowException
calloc
swprintf_s
wcscpy_s
_initterm
time
__C_specific_handler
_wcsicmp
realloc
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
memcmp
__RTDynamicCast
_wcsdup
_purecall
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
memcpy
free
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
_wcsnset_s
wcscat_s
_amsg_exit
malloc
__CxxFrameHandler3
_wtoi
iswctype
towlower
wcsncpy_s
_vsnwprintf
memset

atl

ord30
ord16
ord21
ord15
ord18
ord22
ord43
ord44
ord32

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExA
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

ws2_32

WSAStartup
WSACleanup

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
GlobalFree
LocalAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW

rpcrt4

RpcStringFreeW
UuidToStringW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
ReleaseActCtx
ActivateActCtx
QueryActCtxW
CreateActCtxW
FindActCtxSectionStringW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

l2gpstore

L2GPPolicyDataRead
L2GPPolicyDataDelete
L2GPPolicyDataWrite
L2GPPolicyStoreOpen
L2GPPolicyStoreClose
L2GPPolicyFreeMem

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InterlockedPushEntrySList

ntdll

EtwTraceMessage

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-ole32-ie-l1-1-0

CoInitialize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetAdPolicyAsXML
GetWmiPolicyAsXML

Sections

.text
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlanhlp.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wlanhlp.pdb

Exports

Exports

QueryNetconStatus
QueryNetconVirtualCharacteristic
WFDAbortSessionInt
WFDAcceptConnectRequestAndOpenSessionInt
WFDAcceptGroupRequestAndOpenSessionInt
WFDCancelConnectorPairWithOOB
WFDCancelListenerPairWithOOB
WFDCancelOpenSessionInt
WFDCloseHandleInt
WFDCloseLegacySessionInt
WFDCloseOOBPairingSession
WFDCloseSessionInt
WFDConfigureFirewallForSessionInt
WFDCreateDHPrivatePublicKeyPairInt
WFDDeclineConnectRequestInt
WFDDeclineGroupRequestInt
WFDDiscoverDeviceServiceInformationInt
WFDDiscoverDevicesExInt
WFDDiscoverDevicesInt
WFDFlushVisibleDeviceListInt
WFDForceDisconnectInt
WFDForceDisconnectLegacyPeerInt
WFDFreeMemoryInt
WFDGetDefaultGroupProfileInt
WFDGetDeviceDescriptorForPendingRequestInt
WFDGetNFCCarrierConfigBlobInt
WFDGetOOBBlob
WFDGetPrimaryAdapterStateInt
WFDGetProfileKeyInfoInt
WFDGetSessionEndpointPairsInt
WFDGetVisibleDevicesExInt
WFDGetVisibleDevicesInt
WFDIsInterfaceWiFiDirect
WFDIsWiFiDirectRunningOnWiFiAdapter
WFDLowPrivCancelOpenSessionInt
WFDLowPrivCloseHandleInt
WFDLowPrivCloseLegacySessionInt
WFDLowPrivCloseSessionInt
WFDLowPrivConfigureFirewallForSessionInt
WFDLowPrivDeclineDeviceApiConnectionRequestInt
WFDLowPrivGetPendingGroupRequestDetailsInt
WFDLowPrivGetSessionEndpointPairsInt
WFDLowPrivIsWfdSupportedInt
WFDLowPrivOpenHandleInt
WFDLowPrivOpenLegacySessionInt
WFDLowPrivOpenSessionByDafObjectIdInt
WFDLowPrivQueryPropertyInt
WFDLowPrivRegisterNotificationInt
WFDLowPrivRegisterVMgrCallerInt
WFDLowPrivSetPropertyInt
WFDLowPrivStartDeviceApiConnectionRequestListenerInt
WFDLowPrivStartUsingGroupInt
WFDLowPrivStopDeviceApiConnectionRequestListenerInt
WFDLowPrivStopUsingGroupInt
WFDLowPrivUnregisterVMgrCallerInt
WFDOpenHandleInt
WFDOpenLegacySessionInt
WFDPairCancelByDeviceAddressInt
WFDPairCancelInt
WFDPairContinuePairWithDeviceInt
WFDPairEnumerateCeremoniesInt
WFDPairSelectCeremonyInt
WFDPairWithDeviceAndOpenSessionExInt
WFDPairWithDeviceAndOpenSessionInt
WFDParseOOBBlob
WFDParseOOBBlobTypeAndGetPayloadInt
WFDParseProfileXmlInt
WFDParseWfaNfcCarrierConfigBlobInt
WFDQueryPropertyInt
WFDRegisterNotificationInt
WFDRegisterVMgrCallerInt
WFDResetSelectedWfdMgrInt
WFDSetAdditionalIEsInt
WFDSetPropertyInt
WFDSetSecondaryDeviceTypeListInt
WFDSetSelectedWfdMgrInt
WFDStartBackgroundDiscoveryInt
WFDStartConnectorPairWithOOB
WFDStartListenerPairWithOOB
WFDStartOffloadedDiscoveryInt
WFDStartOpenSessionInt
WFDStartUsingGroupExInt
WFDStartUsingGroupInt
WFDStopBackgroundDiscoveryInt
WFDStopDiscoverDevicesExInt
WFDStopDiscoverDevicesInt
WFDStopOffloadedDiscoveryInt
WFDStopUsingGroupInt
WFDSvcLowPrivAcceptSessionInt
WFDSvcLowPrivCancelSessionInt
WFDSvcLowPrivCloseSessionInt
WFDSvcLowPrivConfigureSessionInt
WFDSvcLowPrivConnectSessionInt
WFDSvcLowPrivGetProvisioningInfoInt
WFDSvcLowPrivGetSessionEndpointPairsInt
WFDSvcLowPrivOpenAdvertiserSessionInt
WFDSvcLowPrivOpenSeekerSessionInt
WFDSvcLowPrivPublishServiceInt
WFDSvcLowPrivUnpublishServiceInt
WFDUnregisterVMgrCallerInt
WiFiDisplayResetSinkStateInt
WiFiDisplaySetSinkClientHandleInt
WiFiDisplaySetSinkStateInt
WlanCancelPlap
WlanConnectWithInput
WlanDeinitPlapParams
WlanDoPlap
WlanDoesBssMatchSecurity
WlanEnumAllInterfaces
WlanGenerateProfileXmlBasicSettings
WlanGetMFPNegotiated
WlanGetProfileEapUserDataInfo
WlanGetProfileIndex
WlanGetProfileKeyInfo
WlanGetProfileMetadata
WlanGetProfileMetadataWithProfileGuid
WlanGetProfileSsidList
WlanGetRadioInformation
WlanGetStoredRadioState
WlanHostedNetworkFreeWCNSettings
WlanHostedNetworkHlpQueryEverUsed
WlanHostedNetworkQueryWCNSettings
WlanHostedNetworkSetWCNSettings
WlanInitPlapParams
WlanInternalCancelFTMRequest
WlanInternalGetNetworkBssListWithFTMData
WlanInternalNonDisruptiveScan
WlanInternalNonDisruptiveScanEx
WlanInternalRequestFTM
WlanInternalScan
WlanIsNetworkSuppressed
WlanIsUIRequestPending
WlanLowPrivCloseHandle
WlanLowPrivEnumInterfaces
WlanLowPrivFreeMemory
WlanLowPrivNotifyVsIeProviderInt
WlanLowPrivOpenHandle
WlanLowPrivQueryInterface
WlanLowPrivSetInterface
WlanNotifyVsIeProviderExInt
WlanNotifyVsIeProviderInt
WlanParseProfileXmlBasicSettings
WlanPrivateClearAnqpCache
WlanPrivateEnableAnqpOsuRegistration
WlanPrivateGetAnqpCacheResponse
WlanPrivateGetAnqpOSUProviderList
WlanPrivateGetAnqpOsuRegistrationStatus
WlanPrivateGetAvailableNetworkList
WlanPrivateParseAnqpRawData
WlanPrivateRefreshAnqpCache
WlanQueryCreateAllUserProfileRestricted
WlanQueryPlapCredentials
WlanQueryPreConnectInput
WlanQueryVirtualInterfaceType
WlanRefreshConnections
WlanRemoveUIForwardingNetworkList
WlanSendUIResponse
WlanSetAllUserProfileRestricted
WlanSetProfileMetadata
WlanSetProtectedScenario
WlanSetUIForwardingNetworkList
WlanStartAP
WlanStartMovementDetector
WlanStopAP
WlanStopMovementDetector
WlanStoreRadioStateOnEnteringAirPlaneMode
WlanTryUpgradeCurrentConnectionAuthCipher
WlanUpdateProfileWithAuthCipher
WlanVMgrQueryCurrentScenariosInt
WlanWcmDisconnect
WlanWcmGetInterface
WlanWcmGetProfileList
WlanWcmSetInterface
WlanWcmSetProfile
WlanWfdGOSetWCNSettings
WlanWfdGetPeerInfo
WlanWfdStartGO
WlanWfdStopGO

Sections

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlgpclnt.dll
.dll windows:10 windows x64 arch:x64

b60c1e3cdf99d7a47fa0f830a2534206

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wlgpclnt.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler3
wcsncpy_s
_wcsnset_s
wcscat_s
wcscpy_s
??0exception@@QEAA@AEBQEBDH@Z
memmove_s
calloc
memcpy
memcpy_s
malloc
free
_vsnwprintf
swprintf_s
iswctype
towlower
memset

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite
EventEnabled

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
OpenEventW
SetEvent
CreateEventW
WaitForSingleObject

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThreadId
ResumeThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-file-l1-1-0

GetTempFileNameW
DeleteFileW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegDeleteKeyExW
RegSetValueExW
RegCreateKeyExW
RegGetValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-grouppolicy-l1-1-0

UnregisterGPNotificationInternal
RegisterGPNotificationInternal

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

ntdll

EtwTraceMessage

api-ms-win-core-shlwapi-legacy-l1-1-0

PathAppendW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

GenerateWLANPolicy
ProcessWLANPolicyEx
WLGPADeInit
WLGPAInit

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlidcli.dll
.dll regsvr32 windows:10 windows x64 arch:x64

dd576a276cfefa0aec8f9b16d9dee60b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wlidcli.pdb

Imports

msvcrt

_set_errno
wcsrchr
_mbsstr
vsprintf_s
_vscprintf
_wtol
wcsstr
_gmtime64_s
wcsftime
_time64
_mktime64
calloc
iswspace
strrchr
__C_specific_handler
swprintf_s
_vsnwprintf
wcscspn
wcsspn
_wcsicmp
_wcsupr_s
_mbslwr_s
_mbscmp
towupper
_purecall
_localtime64_s
wcschr
_vsnprintf_s
_vscwprintf
vswprintf_s
malloc
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
free
memmove_s
memcpy_s
??0exception@@QEAA@AEBV0@@Z
wcsncpy_s
wcstoul
wcstol
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_resetstkoflw
wcscpy_s
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
_errno
realloc
memset
__CxxFrameHandler3
_wcslwr_s
memcmp
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExA
GetProcAddress
GetModuleFileNameA
GetModuleFileNameW
FreeLibrary
SizeofResource
LockResource
FindResourceExW
LoadResource
GetModuleHandleExW
LoadLibraryExW

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
RpcBindingFree
CStdStubBuffer_CountRefs
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrMesTypeEncode3
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcAsyncCancelCall
Ndr64AsyncClientCall
RpcAsyncCompleteCall
NdrMesTypeAlignSize3
RpcStringFreeA
CStdStubBuffer_QueryInterface
RpcSsDestroyClientContext
RpcAsyncInitializeHandle
I_RpcBindingInqLocalClientPID
MesDecodeBufferHandleCreate
MesHandleFree
MesBufferHandleReset
RpcStringFreeW
UuidToStringW
UuidCreate
MesEncodeFixedBufferHandleCreate
UuidToStringA

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient4
ObjectStublessClient6
ObjectStublessClient5
ObjectStublessClient3

api-ms-win-core-processthreads-l1-1-0

OpenThread
GetProcessIdOfThread
TlsAlloc
GetCurrentThread
OpenThreadToken
TerminateProcess
TlsSetValue
TerminateThread
TlsFree
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
TlsGetValue
CreateThread
GetCurrentThreadId
SetThreadToken

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseSRWLockExclusive
CreateMutexExW
CreateSemaphoreExW
CreateEventW
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
CreateEventExW
ResetEvent
TryEnterCriticalSection
LeaveCriticalSection
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjectsEx
OpenSemaphoreW
AcquireSRWLockExclusive
SetEvent

crypt32

CertCloseStore
CertOpenStore
CryptImportPublicKeyInfo
CertFindCertificateInStore
CertGetCertificateChain
CertCreateCertificateContext
CertDuplicateCertificateContext
CryptProtectData
CryptProtectMemory
CryptUnprotectMemory
CertFreeCertificateChain
CryptAcquireCertificatePrivateKey
CertFreeCertificateContext
CertEnumCertificatesInStore
CertSetCertificateContextProperty
CryptSignMessage
CertGetNameStringA
CertVerifyCertificateChainPolicy
CertGetCertificateContextProperty
CryptUnprotectData

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
CompareFileTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalAlloc

api-ms-win-core-com-l1-1-0

CoGetCallerTID
StringFromGUID2
CoTaskMemAlloc
CreateStreamOnHGlobal
CoUninitialize
CoInitializeEx
CoTaskMemRealloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoCreateInstance
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegDeleteTreeW
RegOpenCurrentUser
RegCloseKey
RegSetKeySecurity
RegGetValueW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-0

GetThreadLocale
GetThreadPreferredUILanguages
GetUserDefaultLocaleName
FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapSize
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-security-base-l1-1-0

FreeSid
AccessCheck
CheckTokenMembership
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
DuplicateToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
IsValidSecurityDescriptor
InitializeAcl
ImpersonateLoggedOnUser
RevertToSelf
IsValidSid
CreateWellKnownSid
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
GetTokenInformation
GetSecurityDescriptorSacl
AddAccessAllowedAce

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-psapi-l1-1-0

K32EnumProcessModules
K32GetModuleFileNameExW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

sspicli

LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess
LsaRegisterLogonProcess
LsaConnectUntrusted
LogonUserExExW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

cryptsp

CryptDuplicateKey
CryptEncrypt
CryptGenKey
CryptDecrypt
CryptSetProvParam
CryptSignHashW
CryptGetHashParam
CryptSetHashParam
CryptCreateHash
CryptContextAddRef
CryptAcquireContextA
CryptHashData
CryptSetKeyParam
CryptGenRandom
CryptGetKeyParam
CryptVerifySignatureW
CryptDestroyHash
CryptDestroyKey
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptGetUserKey

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv
GetComputerNameW

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-core-shlwapi-legacy-l1-1-0

PathCombineW
PathAppendW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

combase

ord140

gdi32

CreateCompatibleDC
CreateSolidBrush
GetDeviceCaps
GetStockObject
GetObjectW
CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
DeleteDC

user32

GetClassInfoExW
RedrawWindow
SetWindowPos
GetSysColor
GetClassNameW
GetClientRect
FillRect
CreateWindowExW
IsWindow
DestroyWindow
SendMessageW
GetDlgItem
GetWindow
SetFocus
GetFocus
IsChild
EndPaint
CreateAcceleratorTableW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
UnregisterClassW
GetWindowThreadProcessId
FindWindowExW
IsWindowEnabled
EnumWindows
SendMessageTimeoutW
UnregisterClassA
LoadImageW
ReleaseCapture
SetCapture
GetSystemMetrics
GetThreadDesktop
GetUserObjectInformationW
UnhookWindowsHookEx
RegisterClassExW
LoadCursorW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
BeginPaint
CallWindowProcW
DefWindowProcW
SetWindowLongW
GetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
DestroyAcceleratorTable
GetDesktopWindow
ReleaseDC
InvalidateRect
GetDC
InvalidateRgn

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

bcrypt

BCryptCloseAlgorithmProvider

Exports

Exports

AddUserToSsoGroup
AssociateDeviceToUser
AuthIdentityToService
AuthIdentityToServiceEx
CancelPendingRequest
CloseEnumIdentitiesHandle
CloseIdentityHandle
CreateIdentityHandle
CreateIdentityHandleEx
CreateLinkedIdentityHandle
DeProvisionDeviceId
DecryptWithSessionKey
DecryptWithSessionKeyEx
DisassociateDeviceFromUser
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
EncryptWithSessionKey
EncryptWithSessionKeyEx
EnumIdentitiesWithCachedCredentials
EnumerateCertificates
EnumerateDeviceID
EnumerateUserAssociatedDevices
FlushIDCRLTraceBuffer
GenerateCertToken
GenerateDeviceToken
GetAssertion
GetAuthState
GetAuthStateEx
GetAuthenticationStatus
GetCertificate
GetConfigDWORDValue
GetDefaultNoUISSOUser
GetDefaultUserForTarget
GetDeviceId
GetDeviceIdEx
GetDeviceShortLivedToken
GetErrorMessage
GetExtendedError
GetExtendedProperty
GetHIPChallenge
GetIdentityProperty
GetIdentityPropertyByName
GetRealmInfo
GetResponseForHttpChallenge
GetServiceConfig
GetUserExtendedProperty
GetUsersFromSsoGroup
GetWebAuthUrl
GetWebAuthUrlEx
HasPersistedCredential
IDCRL_GetLatestProtectionKey
IDCRL_GetSpecifiedProtectionKey
Initialize
InitializeApp
InitializeEx
InitializeIDCRLTraceBuffer
IsDeviceIDAdmin
IsMappedError
LogonIdentity
LogonIdentityEx
LogonIdentityExSSO
LogonIdentityExWithUI
NextIdentity
OpenAuthenticatedBrowser
PassportFreeMemory
PersistCredential
ProvisionDeviceId
RemoveChangeNotificationCallback
RemovePersistedCredential
RemoveUserFromSsoGroup
RenewDeviceId
SendOneTimeCode
SendWatsonReport
SetChangeNotificationCallback
SetCredential
SetDefaultUserForTarget
SetDeviceConsent
SetExtendedProperty
SetHIPSolution
SetIdcrlOptions
SetIdentityCallback
SetIdentityProperty
SetUserExtendedProperty
StartTracing
StopTracing
UICollectCredential
UIEndWaitDialog
UIShowWaitDialog
UnPackErrorBlob
Uninitialize
UpdateUserAssociatedDeviceProperties
VerifyAssertion
VerifyCertificate

Sections

.text
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlidcredprov.dll
.dll windows:10 windows x64 arch:x64

c23c4ae0dcbe66ea4fd66869f311e026

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WLIDCredProv.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
memset
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
calloc
__C_specific_handler
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_callnewh
memmove_s
__CxxFrameHandler3
memcmp
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
_wcsicmp
strrchr
_purecall
wcsstr
_set_errno
wcstol
vswprintf_s
_vscwprintf
wcschr
toupper
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
memcpy
wcscmp

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shcore-thread-l1-1-0

SHCreateThread

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
SizeofResource
LoadLibraryExW
GetModuleFileNameA
GetModuleFileNameW
LockResource
FindResourceExW
LoadResource
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

ReleaseMutex
AcquireSRWLockShared
AcquireSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
SetEvent
ResetEvent
WaitForMultipleObjectsEx
OpenSemaphoreW
DeleteCriticalSection
CreateEventExW
InitializeCriticalSection
CreateEventW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
WaitForSingleObject
WaitForSingleObjectEx
InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

HeapFree
HeapDestroy
HeapReAlloc
HeapSize
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetProcessIdOfThread
GetCurrentProcess
OpenThread
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
OpenThreadToken
GetCurrentThread

api-ms-win-core-localization-l1-2-0

GetThreadPreferredUILanguages
GetThreadUILanguage
GetUserDefaultLocaleName
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoGetMalloc
CoCreateInstance
CoGetCallerTID
CoUninitialize

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumKeyExW
RegGetValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenCurrentUser
RegSetKeySecurity
RegDeleteTreeW
RegDeleteValueW
RegDeleteKeyExW
RegCreateKeyExW

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
IsValidSid
GetTokenInformation
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

rpcrt4

MesHandleFree
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
RpcAsyncCancelCall
Ndr64AsyncClientCall
RpcAsyncCompleteCall
MesBufferHandleReset
NdrMesTypeEncode3
NdrMesTypeFree3
RpcAsyncInitializeHandle
NdrMesTypeAlignSize3
MesEncodeFixedBufferHandleCreate
I_RpcBindingInqLocalClientPID
UuidCreate
RpcStringBindingComposeW
MesDecodeBufferHandleCreate
RpcBindingFromStringBindingW
NdrMesTypeDecode3

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-security-credentials-l1-1-0

CredUnprotectW
CredIsProtectedW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch
StrRChrW

ntdll

RtlGetDeviceFamilyInfoEnum
NtQueryWnfStateData
RtlNtStatusToDosError
RtlInitString

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlidfdp.dll
.dll regsvr32 windows:10 windows x64 arch:x64

7e0c440e219c632dba514bc4bdafbcbb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WLIDfdp.pdb

Imports

msvcrt

_XcptFilter
_onexit
_amsg_exit
?terminate@@YAXXZ
_CxxThrowException
??1type_info@@UEAA@XZ
_unlock
?what@exception@@UEBAPEBDXZ
_lock
__dllonexit
??1exception@@UEAA@XZ
__CxxFrameHandler3
_vsnwprintf
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_purecall
memmove_s
memcpy_s
strrchr
wcsncpy_s
wcscat_s
wcscpy_s
free
malloc
__C_specific_handler
_initterm
memset

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-com-l1-1-0

CoUninitialize
CoCreateInstance
CoInitializeEx
CoRevertToSelf
CoTaskMemFree
CoImpersonateClient
StringFromGUID2
PropVariantClear
CoTaskMemAlloc

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
GetProcAddress
LoadResource
LockResource
SizeofResource
GetModuleHandleW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-localization-l1-2-0

SetThreadLocale
GetThreadLocale

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW
InitializeCriticalSection
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegDeleteValueW
RegOpenCurrentUser
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteTreeW
RegGetValueW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteKeyExW
RegEnumValueW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateSelf

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

api-ms-win-core-heap-l1-1-0

HeapSize
HeapFree
HeapDestroy
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

rpcrt4

RpcStringFreeW
RpcBindingFromStringBindingW
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
RpcAsyncCompleteCall
Ndr64AsyncClientCall
RpcAsyncCancelCall
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcStringBindingComposeW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlidnsp.dll
.dll regsvr32 windows:10 windows x64 arch:x64

b166503220966bd95f77d007f99b3fef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wlidNSP.pdb

Imports

msvcrt

_unlock
_lock
__C_specific_handler
_onexit
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
__dllonexit
__CxxFrameHandler3
_vsnwprintf
_purecall
_XcptFilter
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_callnewh
_wcsicmp
memcpy_s
strrchr
wcscpy_s
memset

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegOpenCurrentUser
RegGetValueW
RegSetValueExW
RegDeleteKeyExW
RegDeleteValueW
RegDeleteTreeW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumValueW
RegQueryValueExW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
WaitForMultipleObjectsEx
LeaveCriticalSection
CreateEventW
InitializeCriticalSection
DeleteCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
DisableThreadLibraryCalls

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

rpcrt4

RpcStringFreeW
Ndr64AsyncClientCall
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
RpcAsyncCancelCall
RpcAsyncCompleteCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
RpcBindingSetAuthInfoExW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllRegisterServer
DllUnregisterServer
NSPCleanup
NSPStartup

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlidprov.dll
.dll regsvr32 windows:10 windows x64 arch:x64

48053fc9112d9a41bd076b2921b217bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WLIDProv.pdb

Imports

msvcrt

calloc
_XcptFilter
??0exception@@QEAA@XZ
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
_amsg_exit
_initterm
_errno
??1exception@@UEAA@XZ
realloc
?terminate@@YAXXZ
memmove_s
_callnewh
??1type_info@@UEAA@XZ
_lock
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler3
__dllonexit
_onexit
memset
_vsnwprintf
_time64
_set_errno
_get_errno
memcpy
_CxxThrowException
wcsncpy_s
malloc
free
_purecall
memcpy_s
__C_specific_handler
_unlock
?what@exception@@UEBAPEBDXZ
memcmp
wcscmp

oleaut32

SysAllocStringLen
VarUI4FromStr
VariantClear

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
FindResourceExW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleExW
SizeofResource
FreeLibrary
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
ReleaseMutex
SetEvent
AcquireSRWLockShared
ReleaseSemaphore
CreateSemaphoreExW
ResetEvent
EnterCriticalSection
OpenEventW
DeleteCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateEventW
ReleaseSRWLockShared
CreateMutexExW
WaitForMultipleObjectsEx
InitializeCriticalSection
InitializeCriticalSectionEx
CreateEventExW
OpenSemaphoreW
LeaveCriticalSection

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoGetCallerTID
CoUninitialize
PropVariantClear
CoTaskMemAlloc
CoWaitForMultipleHandles
CoReleaseMarshalData
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoMarshalInterface
CoTaskMemFree
CoGetApartmentType
CoTaskMemRealloc

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegQueryInfoKeyW
RegSetKeySecurity
RegSetValueExW
RegGetValueW
RegDeleteKeyExW
RegDeleteTreeW
RegDeleteValueW
RegCreateKeyExW
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventActivityIdControl
EventSetInformation

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadPreferredUILanguages
GetUserDefaultLocaleName

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
OpenThread
OpenProcessToken
OpenThreadToken
CreateThread
GetProcessIdOfThread
SetThreadToken
GetCurrentThread
TerminateProcess
GetCurrentProcessId

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapFree
HeapSize
HeapAlloc
HeapReAlloc
GetProcessHeap

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetTickCount64

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

GetTokenInformation
RevertToSelf
CreateWellKnownSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
FreeSid
GetSecurityDescriptorSacl
IsValidSid
GetSecurityDescriptorDacl

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
HSTRING_UserUnmarshal64
HSTRING_UserSize
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
HSTRING_UserMarshal
HSTRING_UserMarshal64
WindowsDuplicateString
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserUnmarshal
WindowsGetStringRawBuffer
HSTRING_UserFree
WindowsIsStringEmpty

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
RoOriginateErrorW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-processthreads-l1-1-1

OpenProcess

samcli

NetUserDel
NetLocalGroupAddMembers

rpcrt4

RpcBindingBind
RpcBindingCreateW
NdrMesTypeAlignSize3
NdrMesTypeFree3
NdrMesTypeEncode3
NdrMesTypeDecode3
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcAsyncCancelCall
Ndr64AsyncClientCall
RpcAsyncCompleteCall
RpcSsDestroyClientContext
I_RpcExceptionFilter
I_RpcBindingInqLocalClientPID
UuidCreate
MesDecodeBufferHandleCreate
MesBufferHandleReset
MesEncodeFixedBufferHandleCreate
CStdStubBuffer_Connect
NdrClientCall3
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
I_RpcMapWin32Status
RpcAsyncInitializeHandle
MesHandleFree

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Release
CStdAsyncStubBuffer_Invoke
ObjectStublessClient7
CStdAsyncStubBuffer_QueryInterface
ObjectStublessClient8
ObjectStublessClient9
CStdAsyncStubBuffer_Connect
ObjectStublessClient10
ObjectStublessClient4
ObjectStublessClient6
ObjectStublessClient5
CStdAsyncStubBuffer_AddRef

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

bcrypt

BCryptGenRandom

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-security-credentials-l1-1-0

CredIsProtectedW
CredUnprotectW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-security-lsalookup-l1-1-2

LsaLookupUserAccountType

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-marshal-l1-1-0

HWND_UserSize64
HWND_UserSize
HWND_UserUnmarshal64
HWND_UserMarshal64
HWND_UserFree
HWND_UserUnmarshal
HWND_UserMarshal
HWND_UserFree64

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

ntdll

RtlWakeAllConditionVariable
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
_vsnprintf
isdigit
toupper
wcschr
RtlSleepConditionVariableSRW
RtlGetDeviceFamilyInfoEnum
_wcslwr_s
WinSqmAddToStreamEx
wcstol
wcsstr
iswspace
_wcsicmp
wcscspn
wcsspn
_vscwprintf
vswprintf_s
strrchr

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlidres.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlidsvc.dll
.dll windows:10 windows x64 arch:x64

58f51243eceae00fd276445d1f0dbf5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WLIDSvc.pdb

Imports

msvcrt

memmove_s
_vsnprintf_s
??0exception@@QEAA@XZ
malloc
free
_purecall
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_vsnwprintf
__CxxFrameHandler3
__C_specific_handler
strcmp
strrchr
realloc
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
memcpy_s
_resetstkoflw
calloc
wcscpy_s
_XcptFilter
memcmp
memcpy
_amsg_exit
_initterm
memset
?terminate@@YAXXZ
_lock
_errno
_unlock
__dllonexit
_set_errno
wcsftime
_gmtime64_s
_time64
_mbsstr
_mktime64
_localtime64_s
_mbsrchr
time
_difftime64
_mbsicmp
_mbsinc
_get_errno
_mbsupr_s
_mbscmp
_mbslwr_s
printf
_mkgmtime64
_onexit
??1type_info@@UEAA@XZ
wcscmp

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree
GlobalAlloc
LocalAlloc

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
SizeofResource
LoadLibraryExW
GetModuleHandleA
FindResourceExW
LoadResource
GetModuleFileNameA
LockResource
GetProcAddress

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
WaitForSingleObject
ReleaseMutex
CreateMutexExW
WaitForSingleObjectEx
CreateEventExW
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
WaitForMultipleObjectsEx
CreateEventW
InitializeSRWLock
ResetEvent
ReleaseSRWLockShared
SetEvent
ReleaseSRWLockExclusive
LeaveCriticalSection
CreateMutexW
InitializeCriticalSectionEx
InitializeCriticalSection
OpenSemaphoreW
TryAcquireSRWLockExclusive

rpcrt4

I_RpcExceptionFilter
RpcBindingFree
RpcBindingCreateW
UuidToStringW
RpcServerInterfaceGroupDeactivate
RpcServerInterfaceGroupCreateW
RpcServerInterfaceGroupActivate
RpcBindingBind
RpcServerInterfaceGroupClose
NdrClientCall3
RpcStringFreeW
I_RpcMapWin32Status
RpcImpersonateClient
RpcRevertToSelf
I_RpcBindingInqLocalClientPID
UuidToStringA
RpcStringFreeA
NdrMesTypeAlignSize3
UuidCreate
MesDecodeBufferHandleCreate
NdrServerCallAll
MesEncodeFixedBufferHandleCreate
NdrServerCall2
NdrMesTypeFree3
NdrMesTypeEncode3
NdrMesTypeDecode3
MesHandleFree
MesBufferHandleReset

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CLSIDFromProgID
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoGetMalloc
CoGetCallerTID
CoCreateInstance
StringFromGUID2
CreateStreamOnHGlobal

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
GetCurrentThreadId
CreateThread
OpenProcessToken
GetProcessIdOfThread
GetCurrentThread
TlsAlloc
TlsSetValue
TerminateProcess
TlsFree
GetCurrentProcess
GetCurrentProcessId
TlsGetValue
OpenThread
OpenThreadToken

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName
GetThreadPreferredUILanguages

api-ms-win-core-heap-l1-1-0

HeapSize
HeapAlloc
HeapReAlloc
HeapDestroy
GetProcessHeap
HeapFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0

RegFlushKey
RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegSetKeySecurity
RegOpenCurrentUser
RegDeleteTreeW
RegQueryValueExW
RegEnumValueA
RegQueryValueExA
RegCloseKey
RegEnumValueW
RegDeleteKeyExW

crypt32

CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CertFreeCertificateChain
CryptBinaryToStringA
CertSetCertificateContextProperty
CryptImportPublicKeyInfo
CertCompareCertificate
CryptSignAndEncodeCertificate
CryptEncodeObjectEx
CryptExportPublicKeyInfo
CertGetIssuerCertificateFromStore
CertAddCertificateContextToStore
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertVerifySubjectCertificateContext
CertCreateCertificateContext
CertGetNameStringW
CertFreeCertificateContext
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CryptVerifyMessageSignature
CertGetNameStringA
CertGetCertificateContextProperty
CryptUnprotectMemory
CryptProtectMemory
CryptUnprotectData
CryptProtectData

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-security-base-l1-1-0

FreeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AccessCheck
RevertToSelf
IsValidSid
CreateWellKnownSid
DuplicateToken
IsValidSecurityDescriptor
CopySid
GetTokenInformation
EqualSid
GetSidSubAuthorityCount
AddAccessAllowedAce
InitializeAcl
ImpersonateLoggedOnUser
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetLengthSid
InitializeSecurityDescriptor
GetSidIdentifierAuthority
GetAclInformation
AddAce
MakeAbsoluteSD
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
AllocateAndInitializeSid
SetTokenInformation
ImpersonateSelf
SetSecurityDescriptorOwner
DuplicateTokenEx

bcrypt

BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptKeyDerivation
BCryptDestroyKey
BCryptGenRandom
BCryptGetProperty
BCryptDestroyHash
BCryptHashData
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptOpenAlgorithmProvider

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-security-credentials-l1-1-0

CredFree
CredWriteW
CredDeleteW
CredIsProtectedW
CredUnprotectW
CredReadW
CredEnumerateW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

ncrypt

NCryptExportKey
NCryptCreateClaim
NCryptSetProperty
NCryptOpenStorageProvider
NCryptOpenKey
NCryptFreeObject
NCryptGetProperty

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-1-0

WriteFile
DeleteFileW
ReadFile
FileTimeToLocalFileTime
CreateFileW
GetFileSizeEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-path-l1-1-0

PathCchCombine

cryptsp

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptDecrypt
CryptDuplicateKey
CryptEncrypt
CryptContextAddRef
CryptGenKey
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptExportKey
CryptImportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptSetProvParam
CryptGetUserKey
CryptGetKeyParam
CryptVerifySignatureW
CryptDestroyKey
CryptAcquireContextA

api-ms-win-security-lsalookup-l1-1-2

LsaLookupUserAccountType

profapi

ord104

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue

api-ms-win-core-registry-l2-1-0

RegCreateKeyTransactedW
RegOpenKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA
lstrcmpiW

clipc

ClipOpen
ClipInstallLicense
ClipClose
ClipGenerateDeviceLicenseRequest

ntdll

toupper
_i64tow_s
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
_wtol
_wcstoui64
RtlNtStatusToDosError
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
strstr
_wtoi
_itoa_s
_wcsupr_s
swprintf_s
RtlAcquireResourceShared
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitializeResource
RtlDeleteResource
towupper
_vscprintf
vsprintf_s
iswspace
wcscspn
wcsspn
wcschr
_wcslwr_s
wcstoul
_vscwprintf
vswprintf_s
_wcsicmp
wcstol
wcsstr
_vsnprintf
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlWakeAllConditionVariable
RtlSleepConditionVariableSRW
wcsncmp

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 774KB - Virtual size: 774KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wlrmdr.exe
.exe windows:10 windows x64 arch:x64

0c029ef03be0dfe4324558843609a28e

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:30

Not After

03-03-2021 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

84:f5:41:9c:da:6e:4a:bb:c8:7b:6d:96:26:3c:4a:a0:12:a5:d1:3a:bb:62:1a:cb:a8:f5:5e:b2:bb:28:c9:45
Signer

Actual PE Digest

84:f5:41:9c:da:6e:4a:bb:c8:7b:6d:96:26:3c:4a:a0:12:a5:d1:3a:bb:62:1a:cb:a8:f5:5e:b2:bb:28:c9:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wlrmdr.pdb

Imports

kernel32

CreateEventW
GetCurrentProcessId
GetCommandLineW
HeapSetInformation
CloseHandle
OpenProcess
RegisterWaitForSingleObject
SetWaitableTimer
CreateWaitableTimerW
LocalFree
GetSystemTimeAsFileTime
GetLastError
LocalAlloc
RaiseException
GetModuleHandleW
GetModuleHandleExW
UnregisterWaitEx
WaitForSingleObject
ProcessIdToSessionId

user32

SetForegroundWindow
CreateWindowExW
LoadIconW
GetSystemMetrics
DispatchMessageW
DestroyIcon
TranslateMessage
GetThreadDesktop
LoadCursorW
PeekMessageW
SetCursor
GetUserObjectInformationW
PostQuitMessage
GetProcessWindowStation
GetAncestor
DestroyWindow
LoadStringW
MsgWaitForMultipleObjects
EnableWindow

msvcrt

wcschr
wcsstr
_wtoi
_purecall
?terminate@@YAXXZ
_vsnwprintf
_wtol
memset
__CxxFrameHandler3
_commode
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc
CoUninitialize

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory
RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString
WindowsIsStringEmpty
WindowsCreateStringReference

sspicli

GetUserNameExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetStartupInfoW
TerminateProcess

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

ntdll

RtlNtStatusToDosError
RtlCompareUnicodeString
NtQueryInformationProcess
NtQuerySystemInformation

ole32

CoInitialize

rpcrt4

RpcStringFreeW
RpcBindingSetAuthInfoExW
Ndr64AsyncClientCall
RpcBindingFree
RpcAsyncCancelCall
RpcAsyncCompleteCall
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcAsyncInitializeHandle

shell32

ShellExecuteW

dui70

?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z
UnInitProcessPriv
UnInitThread
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
InitProcessPriv
InitThread
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?_ZeroRelease@Value@DirectUI@@AEAAXXZ

advapi32

CreateWellKnownSid
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW
GetTokenInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmcodecdspps.dll
.dll regsvr32 windows:10 windows x64 arch:x64

23ac37429bb87a2bbbdffbf395eea832

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmcodecdspps.pdb

Imports

msvcrt

_XcptFilter
__C_specific_handler
_initterm
_amsg_exit
free
malloc
memcmp

combase

CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerQueryInterface
ord2
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

rpcrt4

NdrDllCanUnloadNow
IUnknown_QueryInterface_Proxy
NdrOleAllocate
IUnknown_Release_Proxy
NdrOleFree
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmdmlog.dll
.dll regsvr32 windows:10 windows x64 arch:x64

545e894d459594521f3041cdc1f4b07b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMDMLOG.pdb

Imports

msvcrt

strcpy_s
free
strcat_s
malloc
_vsnprintf
atol
_callnewh
_XcptFilter
_amsg_exit
_initterm
memcpy
realloc
__C_specific_handler
memcmp
memset

advapi32

RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegEnumKeyExA

kernel32

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
UnhandledExceptionFilter
GetTempFileNameA
GetFileSize
GetLocalTime
CloseHandle
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
Sleep
lstrcmpiA
GetModuleFileNameA
SizeofResource
VirtualProtect
EnterCriticalSection
VirtualAlloc
LoadLibraryExA
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleA
MultiByteToWideChar
GetLastError
DisableThreadLibraryCalls
FindResourceExA
GetSystemInfo
IsDBCSLeadByte
LoadResource
HeapDestroy
GetProcAddress
DeleteCriticalSection
lstrcpynA
FreeLibrary
WideCharToMultiByte
DeleteFileA
VirtualQuery
ReadFile
MoveFileA
WriteFile
SetFilePointer
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetTempPathA
CreateFileA
GetSystemDirectoryA

oleaut32

VarUI4FromStr
SysStringLen
SysAllocString
RegisterTypeLi
LoadTypeLi
SysFreeString

user32

CharNextA
LoadStringA
CharPrevA

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmdmps.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a8438db20171c6c0636857838f00563c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMDMPS.pdb

Imports

msvcrt

free
malloc
_initterm
__C_specific_handler
_XcptFilter
_amsg_exit
memcmp

kernel32

QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
DisableThreadLibraryCalls
Sleep
GetCurrentProcessId

oleaut32

LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal64
BSTR_UserUnmarshal
BSTR_UserMarshal
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal
BSTR_UserFree64
BSTR_UserSize64
LPSAFEARRAY_UserSize64
BSTR_UserMarshal64
LPSAFEARRAY_UserFree64
BSTR_UserSize
BSTR_UserFree
LPSAFEARRAY_UserSize
BSTR_UserUnmarshal64
LPSAFEARRAY_UserFree

rpcrt4

CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
NdrDllCanUnloadNow
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmdrmsdk.dll
.dll regsvr32 windows:10 windows x64 arch:x64

92e98ccd6aa108e386042837a53c42f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmdrmsdk.pdb

Imports

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MFWMDRMOutputTrustAuthority_CreateInstance
WMDRMCreateProvider
WMDRMShutdown
WMDRMStartup
_WMDRMCreateProvider

Sections

.text
Size: 1024B - Virtual size: 722B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmerror.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmi.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmi.pdb

Exports

Exports

CloseTrace
ControlTraceA
ControlTraceW
CreateTraceInstanceId
EnableTrace
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
OpenTraceA
OpenTraceW
ProcessTrace
QueryAllTracesA
QueryAllTracesW
RegisterTraceGuidsA
RegisterTraceGuidsW
RemoveTraceCallback
SetTraceCallback
StartTraceA
StartTraceW
TraceEvent
TraceEventInstance
UnregisterTraceGuids
WmiCloseBlock
WmiDevInstToInstanceNameA
WmiDevInstToInstanceNameW
WmiEnumerateGuids
WmiExecuteMethodA
WmiExecuteMethodW
WmiFileHandleToInstanceNameA
WmiFileHandleToInstanceNameW
WmiFreeBuffer
WmiMofEnumerateResourcesA
WmiMofEnumerateResourcesW
WmiNotificationRegistrationA
WmiNotificationRegistrationW
WmiOpenBlock
WmiQueryAllDataA
WmiQueryAllDataW
WmiQueryGuidInformation
WmiQuerySingleInstanceA
WmiQuerySingleInstanceW
WmiSetSingleInstanceA
WmiSetSingleInstanceW
WmiSetSingleItemA
WmiSetSingleItemW

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmiclnt.dll
.dll windows:10 windows x64 arch:x64

b48fe7a7a13036c7efe1b88d7408a6f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmiclnt.pdb

Imports

ntdll

NtWaitForSingleObject
RtlSetLastWin32Error
NtCreateFile
RtlInitializeCriticalSection
RtlNtStatusToDosError
NtDeviceIoControlFile
RtlCaptureContext
RtlDosPathNameToRelativeNtPathName_U
RtlLeaveCriticalSection
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlEnterCriticalSection
memcpy
RtlWaitOnAddress
RtlWakeAddressSingle
RtlDeleteCriticalSection
_wcsnicmp
__C_specific_handler
RtlInitUnicodeString
RtlFreeHeap
NtClose
_vsnprintf
RtlDllShutdownInProgress
RtlAllocateHeap
_vsnwprintf
RtlReleaseRelativeName
memset

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-localization-obsolete-l1-2-0

EnumUILanguagesW

api-ms-win-core-localization-l1-2-0

GetFileMUIPath

api-ms-win-core-threadpool-l1-2-0

StartThreadpoolIo
CloseThreadpoolIo
CreateThreadpoolIo
CancelThreadpoolIo
FreeLibraryWhenCallbackReturns

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-io-l1-1-0

DeviceIoControl
CancelIoEx

api-ms-win-core-synch-l1-1-0

CreateEventW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

WmiCloseBlock
WmiDevInstToInstanceNameA
WmiDevInstToInstanceNameW
WmiEnumerateGuids
WmiExecuteMethodA
WmiExecuteMethodW
WmiFileHandleToInstanceNameA
WmiFileHandleToInstanceNameW
WmiFreeBuffer
WmiMofEnumerateResourcesA
WmiMofEnumerateResourcesW
WmiNotificationRegistrationA
WmiNotificationRegistrationW
WmiOpenBlock
WmiQueryAllDataA
WmiQueryAllDataMultipleA
WmiQueryAllDataMultipleW
WmiQueryAllDataW
WmiQueryGuidInformation
WmiQuerySingleInstanceA
WmiQuerySingleInstanceMultipleA
WmiQuerySingleInstanceMultipleW
WmiQuerySingleInstanceW
WmiReceiveNotificationsA
WmiReceiveNotificationsW
WmiSetSingleInstanceA
WmiSetSingleInstanceW
WmiSetSingleItemA
WmiSetSingleItemW

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmicmiplugin.dll
.dll windows:10 windows x64 arch:x64

73f0a76c4220ab1e744995eba6146959

Code Sign

33:00:00:03:8b:79:45:c1:8b:0e:b6:87:ec:00:00:00:00:03:8b
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-05-2022 19:23

Not After

04-05-2023 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:8c:af:a4:42:68:28:0b:3a:a0:ec:f0:7f:8d:70:66:59:16:65:72:27:b0:ca:f3:ab:79:96:76:41:7c:e8:34
Signer

Actual PE Digest

b3:8c:af:a4:42:68:28:0b:3a:a0:ec:f0:7f:8d:70:66:59:16:65:72:27:b0:ca:f3:ab:79:96:76:41:7c:e8:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmicmiplugin.pdb

Imports

msvcrt

memcpy
memset
realloc
?terminate@@YAXXZ
_initterm
_errno
__CxxFrameHandler3
_amsg_exit
_wtol
iswdigit
_wcstoui64
wcsncmp
_vsnwprintf
srand
memcmp
_XcptFilter
wcschr
memmove
_wcsicmp
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
wcsrchr
??0exception@@QEAA@AEBQEBD@Z
_vsnprintf
memcpy_s
malloc
wcsncpy_s
__C_specific_handler
free
_purecall
_lock
wcscmp

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleW
LoadStringW
GetModuleHandleExW
GetProcAddress
LoadResource
FreeLibrary
GetModuleFileNameW
SizeofResource
FindResourceExW

api-ms-win-core-com-l1-1-0

CLSIDFromString
StringFromCLSID
IIDFromString
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegFlushKey
RegOpenKeyExW
RegDeleteKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-synch-l1-1-0

SetEvent
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateEventW
InitializeCriticalSectionEx
LeaveCriticalSection

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThread
SetThreadToken
OpenThreadToken
GetCurrentThreadId

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
RevertToSelf
CreateWellKnownSid
GetLengthSid
IsValidSid
DuplicateToken
ImpersonateSelf
EqualSid
CopySid
IsWellKnownSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

LocalFileTimeToFileTime
DeleteFileW
FileTimeToLocalFileTime
GetTempFileNameW

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW

api-ms-win-eventing-legacy-l1-1-0

EnableTrace

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
CopyFileW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

oleaut32

VarUI4FromStr
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VarBstrCmp
LoadRegTypeLi
SysFreeString
LoadTypeLi
VariantInit
VariantClear

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-timezone-l1-1-0

TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupPrivilegeValueW
LookupAccountNameW

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory

ntdll

RtlNewSecurityObjectEx
RtlNtStatusToDosError
RtlLengthSecurityDescriptor
EtwTraceMessage

rpcrt4

RpcStringFreeW
RpcBindingSetAuthInfoExW
I_RpcExceptionFilter
UuidCreate
RpcBindingFromStringBindingW
RpcBindingFree
NdrClientCall3
RpcStringBindingComposeW

xmllite

CreateXmlWriter
CreateXmlWriterOutputWithEncodingName
CreateXmlReader

bcrypt

BCryptGetProperty
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmidcom.dll
.dll windows:10 windows x64 arch:x64

2882ca99594c872c0c6916879dccd179

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmidcom.pdb

Imports

msvcrt

??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
_XcptFilter
_amsg_exit
free
malloc
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__dllonexit
_onexit
memset
__CxxFrameHandler3
__C_specific_handler
??0exception@@QEAA@AEBQEBD@Z
_vsnwprintf
_unlock
_wcsicmp
_purecall
_lock
?what@exception@@UEBAPEBDXZ
memmove
memcpy
_CxxThrowException
wcscmp

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
SubmitThreadpoolWork
CallbackMayRunLong
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolWorkCallbacks
FreeLibraryWhenCallbackReturns
WaitForThreadpoolTimerCallbacks

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
InitializeCriticalSectionEx
SetEvent
WaitForSingleObject

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoSetProxyBlanket
CoDisconnectContext
CoInitializeEx
CoUninitialize

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
LoadLibraryExW

api-ms-win-security-base-l1-1-0

RevertToSelf
AdjustTokenPrivileges
ImpersonateLoggedOnUser
ImpersonateSelf
GetTokenInformation

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
OpenThreadToken
SetThreadToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread

crypt32

CryptUnprotectMemory
CryptProtectMemory

sspicli

LogonUserExExW

api-ms-win-core-localization-l1-2-0

LocaleNameToLCID

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

miutils

CimErrorFromErrorCode
SetModifiedPropertyNamesToContext
OperationOptions_CopyOptions
OptionsValueToContextValue
ValueToVariant
RtlInterlockedWakeAll
ParametersToWMIObject
RtlInterlockedCompareWait
ClassCache_GetClass
PublishClientOperationInfo
VariantToValue
InstanceToWMIObject
WMIExtendedObjectToInstance
CreateConversionContext
WMIObjectToClass
TypeToCimType
Instance_New
OperationOptions_Create
WMIObjectToInstance
ClassCache_AddClass
GetMethodParameters
ValueClear
GetReferenceFromWMIObjectPath
Instance_InitDynamic
IsLifeCycleIndicationQuery
WriteWBEM_MC_CLIENT_REQUEST_FAILURE
?GetFlags@MiSchema@@UEBAJXZ
SetCorrelationIdToWbemContext
??0IndicationSchema@@QEAA@XZ
?GetMiClass@IndicationSchema@@UEAAJPEBG00PEAPEBU_MI_Class@@@Z
?GetNoneCachedWmiClass@WMISchema@@UEAAJPEBGPEAUIWbemServices@@AEAV?$CComPtr@UIWbemClassObject@@@ATL@@PEAUIConversionContext@@@Z
?GetWmiClass@WMISchema@@UEAAJPEBG0AEAV?$CComPtr@UIWbemClassObject@@@ATL@@PEAUIConversionContext@@@Z
??1WMISchema@@UEAA@XZ
??0WMISchema@@QEAA@XZ
PublishDebugMessage
PublishDebugInfo
ResultFromHRESULT
?DeInitialize@WMISchema@@QEAAJXZ
ResultToHRESULT
ClassCache_Delete
?CreateInstance@DynamicSchema@@UEAAJPEBGPEAUIWbemClassObject@@KPEBU_MI_PropertySet@@_NAEAPEAU_MI_Instance@@PEAUIConversionContext@@@Z
?GetMiClass@DynamicSchema@@UEAAJPEBG00PEAPEBU_MI_Class@@@Z
??0DynamicSchema@@QEAA@XZ
ClassCache_New
GetCorrelationId
?SetFlags@MiSchema@@MEAAJJ@Z
?CreateInstance@IndicationSchema@@UEAAJPEBGPEAUIWbemClassObject@@KPEBU_MI_PropertySet@@_NAEAPEAU_MI_Instance@@PEAUIConversionContext@@@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

??0CCritSec@@QEAA@XZ
??1CCritSec@@QEAA@XZ
??4CAutoSetActivityId@@QEAAAEAV0@AEBV0@@Z
??4CCritSec@@QEAAAEAV0@AEBV0@@Z
MI_Application_InitializeV1

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmidx.dll
.dll windows:10 windows x64 arch:x64

fb8d0d572c7a4bc177a5f94662736d6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmidx.pdb

Imports

msvcrt

_wcsicmp
memcmp
memcpy
__dllonexit
_onexit
_unlock
_lock
memmove
_initterm
_amsg_exit
_XcptFilter
_callnewh
strcat_s
_purecall
strcpy_s
realloc
malloc
free
__C_specific_handler
memset

rpcrt4

UuidCreate

user32

CharPrevA
CharNextA
LoadStringA

wmasf

ord13
ASFCreateMediaObjectIndexMaker
ord14
ASFReadHeaderFromFileHandle

kernel32

GetTempPathW
GetVersion
HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
MultiByteToWideChar
CreateThread
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetLastError
WideCharToMultiByte
SetFilePointer
SetEndOfFile
CreateFileW
CreateFileA
GetFileType
GetFileSizeEx
ReadFile
WriteFile
GetSystemTime
SystemTimeToFileTime
DeleteFileW
DeleteFileA
lstrlenW
GetFileSize
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleA
lstrcmpiA
lstrcpynA
RtlVirtualUnwind
SizeofResource
LoadResource
FindResourceExA
GetModuleFileNameA
DisableThreadLibraryCalls
HeapDestroy
FormatMessageA
LoadLibraryA
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
IsDBCSLeadByte

ole32

ProgIDFromCLSID
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysStringLen
VarUI4FromStr
VariantInit
LoadRegTypeLi
CreateErrorInfo
SetErrorInfo
SysAllocString
SysFreeString
VariantClear

advapi32

CryptAcquireContextA
CryptReleaseContext
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CryptGenRandom

Exports

Exports

WMCreateASFChopper

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmiprop.dll
.dll windows:10 windows x64 arch:x64

ce70b50965560d226a42ff01bda3ef4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmiprop.pdb

Imports

msvcrt

memcpy
__C_specific_handler
iswdigit
malloc
free
_amsg_exit
_XcptFilter
wcsncpy_s
_wcsnicmp
swprintf_s
_wtoi64
wcscat_s
wcscpy_s
_initterm
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
Sleep
LocalFree
DisableThreadLibraryCalls
LocalAlloc
GetCurrentThreadId
GetTickCount

user32

GetDlgCtrlID
ShowWindow
SetWindowLongW
GetWindowLongPtrW
SendMessageW
SetWindowLongPtrW
MessageBoxW
GetDlgItem
GetSysColorBrush
EnableWindow
LoadStringW
GetSysColor

gdi32

SetBkColor

advapi32

RegQueryValueExW
RegCloseKey

comctl32

CreatePropertySheetPageW
DestroyPropertySheetPage

setupapi

CM_Get_Device_ID_ExW
SetupDiOpenClassRegKeyExW
SetupDiGetClassInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDevRegKeyW

oleaut32

VariantInit
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SysFreeString
SysAllocString
SafeArrayDestroy
VariantClear
SafeArrayCreateVector
SysStringLen
SafeArrayPutElement
SafeArrayGetVartype

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket
CoCreateInstance

Exports

Exports

WmiPropCoInstaller
WmiPropPageProvider

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmitomi.dll
.dll windows:10 windows x64 arch:x64

60cf19d64ab4d2ab0045e904ccab510b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmitomi.pdb

Imports

msvcrt

_purecall
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
__dllonexit
_unlock
_lock
__C_specific_handler
wcscpy_s
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
_CxxThrowException
memcpy
memmove
__CxxFrameHandler3
_XcptFilter
_amsg_exit
free
malloc
_onexit
swscanf
_wcsicmp
_vsnwprintf
_initterm
memset

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
DeleteCriticalSection
SetEvent
WaitForSingleObject

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket
CoImpersonateClient
CoCreateInstance
CoRevertToSelf
StringFromGUID2
CLSIDFromString

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
LoadLibraryExW
LoadStringW

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages

api-ms-win-security-base-l1-1-0

RevertToSelf
AdjustTokenPrivileges
ImpersonateSelf
GetTokenInformation
AccessCheck

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
SetThreadToken

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlLengthSid
RtlEqualSid

mi

MI_Application_InitializeV1

miutils

ValueClear
ValueToVariant
PublishProviderWriteError
Instance_Clone
ParametersToWMIObject
VariantArrayToSafeArray
CompareInstance
VariantToValue
PublishProviderResult
PublishProviderWriteMessage
FindQualifierInWMIObject
InstanceToWMIEvent
CimErrorFromErrorCode
InstanceToWMIExtendedStatus
??0StaticSchema@@QEAA@XZ
?Initialize@StaticSchema@@QEAAJPEBU_MI_Module@@@Z
?GetMiClass@StaticSchema@@UEAAJPEBG00PEAPEBU_MI_Class@@@Z
?CreateInstance@StaticSchema@@UEAAJPEBGPEAUIWbemClassObject@@KPEBU_MI_PropertySet@@_NAEAPEAU_MI_Instance@@PEAUIConversionContext@@@Z
CreateConversionContext
??1CAutoSetActivityId@@QEAA@XZ
??0CAutoSetActivityId@@QEAA@XZ
CimStatusCodeFromWindowsError
?DeInitialize@WMISchema@@QEAAJXZ
ResultToHRESULT
Instance_InitDynamic
Instance_New
ResultFromHRESULT
Instance_Construct
FindClassDecl
Instance_MatchKeys
InstanceToWMIObject
?GetNoneCachedWmiClass@WMISchema@@UEAAJPEBGPEAUIWbemServices@@AEAV?$CComPtr@UIWbemClassObject@@@ATL@@PEAUIConversionContext@@@Z
?GetWmiIWbemServices@WMISchema@@UEAAJPEBGAEAV?$CComPtr@UIWbemServices@@@ATL@@@Z
?GetWmiClass@WMISchema@@UEAAJPEBG0AEAV?$CComPtr@UIWbemClassObject@@@ATL@@PEAUIConversionContext@@@Z
?Initialize@WMISchema@@QEAAX_N@Z
PublishDebugMessage
??1WMISchema@@UEAA@XZ
??0WMISchema@@QEAA@_N@Z
SetProperties
GetReferenceFromWMIObjectPath
FindMethodDecl
GetMethodParameters
WMIObjectToInstance
WMIObjectToClass
?SetFlags@MiSchema@@MEAAJJ@Z
?GetFlags@MiSchema@@UEBAJXZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

??0CCritSec@@QEAA@XZ
??0MIServer@@QEAA@XZ
??1CCritSec@@QEAA@XZ
??4CAutoSetActivityId@@QEAAAEAV0@AEBV0@@Z
??4CCritSec@@QEAAAEAV0@AEBV0@@Z
??4MIServer@@QEAAAEAV0@$$QEAV0@@Z
??4MIServer@@QEAAAEAV0@AEBV0@@Z
?SetAdapter@AdapterContextBase@@QEAAJPEAUIUnknown@@@Z
Adapter_CreateAdapterObject
Adapter_DllCanUnloadNow
Adapter_DllGetClassObject
Adapter_RegisterDLL
Adapter_UnRegisterDLL

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmp.dll
.dll regsvr32 windows:10 windows x64 arch:x64

36b9b1016d85dfa1274194edc17cae71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmp.pdb

Imports

api-ms-win-crt-string-l1-1-0

strcmp
wcscspn
wcspbrk
memset
strncmp
wcscmp
wcsncpy
wcsnlen
strnlen
wcsspn
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-time-l1-1-0

clock
_time32

api-ms-win-crt-private-l1-1-0

_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_atan2
_o_atoi
_o_bsearch
_o_calloc
_o_ceil
_o_cos
_o_exit
_o_exp
_o_floor
_o_free
_o_isdigit
_o_isspace
_o_iswalnum
_o_iswalpha
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswprint
_o_iswspace
_o_iswxdigit
_o_isxdigit
_o_ldexp
_o_log
_o_malloc
_o_memcpy_s
_o_pow
_o_powf
_o_qsort
_o_qsort_s
_o_rand
_o_rand_s
_o_realloc
_o_sin
_o_sqrt
_o_srand
_o_strncpy_s
_o_terminate
_o_tolower
_o_toupper
_o_towlower
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsftime
_o_wcsncpy_s
_o_wcstod
_o_wcstok_s
_o_wcstol
memmove
_o_wcstoul
wcsrchr
wcsstr
wcschr
__CxxFrameHandler3
_o__seh_filter_dll
_o__register_onexit_function
_o__purecall
_o__memicmp
_o__wsplitpath_s
_o__ltow
_o__localtime32
_o__wcsupr_s
_o__wcstoui64
_o__itow_s
_o__itow
_o__itoa_s
_o__wcsnicmp
strchr
_o__wcslwr
_o__wcsicoll
_o__wcsicmp
_o__ultow_s
_o__strnicmp
_o__stricmp
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__endthread
_o__difftime32
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o__beginthread
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy

ntdll

RtlNtStatusToDosError
RtlGetPersistedStateLocation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

EncodePointer
HeapAlloc
DecodePointer
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FreeLibraryAndExitThread
GetUserDefaultLCID
CompareStringOrdinal
MoveFileW
GetFileSize
WideCharToMultiByte
GetLocaleInfoW
CeipIsOptedIn
GlobalAlloc
GlobalFree
GetExitCodeThread
GetLocalTime
GetVolumeInformationW
GetTickCount64
SetThreadExecutionState
GetCurrentDirectoryW
WriteFile
Sleep
TerminateThread
GlobalMemoryStatusEx
WaitForMultipleObjects
DeviceIoControl
SetErrorMode
GetComputerNameW
ReleaseSemaphore
CreateSemaphoreW
ExitThread
GetThreadPriority
ExpandEnvironmentStringsW
GetComputerNameExW
SetFilePointer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
LoadLibraryExA
GetThreadLocale
GetFileAttributesExW
HeapFree
GetProcessHeap
GetDriveTypeW
GlobalUnlock
GlobalLock
FindPackagesByPackageFamily
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateThread
GetDiskFreeSpaceExW
SetFileAttributesW
GetCurrentProcessId
DeleteFileW
GetTickCount
FindClose
FindNextFileW
FindFirstFileW
FindCloseChangeNotification
FindNextChangeNotification
FindFirstChangeNotificationW
CreateEventW
WaitForSingleObject
DebugBreak
OpenEventW
LocalFree
FormatMessageW
GetUserDefaultUILanguage
SetThreadPriority
SetEvent
lstrlenW
GetVersionExW
GetCurrentThread
RaiseFailFastException
GetCurrentProcess
VirtualFree
GetCurrentThreadId
SetLastError
CopyFileW
SystemTimeToFileTime
GetSystemTime
LockResource
lstrcpyW
HeapDestroy
DisableThreadLibraryCalls
HeapSetInformation
ReadFile
CreateFileW
GetShortPathNameW
FindResourceW
LoadLibraryW
MulDiv
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcpynW
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
BindIoCompletionCallback
CreateToolhelp32Snapshot
Process32NextW
CloseThreadpoolTimer
CreateThreadpoolTimer
CompareFileTime
FileTimeToSystemTime
CreateMutexW
ReleaseMutex
CopyFileExW
LocalFileTimeToFileTime
CreateDirectoryW
RemoveDirectoryW
GetDateFormatW
GetTimeFormatW
GetVersionExA
ExitProcess
QueryPerformanceFrequency
lstrcmpW
LocalAlloc
DuplicateHandle
HeapCreate
HeapReAlloc
HeapSize
GetLocaleInfoA
GetFileInformationByHandle
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetFileType
SetEndOfFile
FlushFileBuffers
OpenMutexW
OpenFileMappingW
GetFullPathNameW
GetLongPathNameW
GetTempFileNameW
IsValidLocale
GetProcessTimes
OpenThread
LCMapStringW
GlobalMemoryStatus
GetTempPathW
GetFileAttributesW
GetPrivateProfileStringW
OutputDebugStringW
MoveFileExW
InitializeCriticalSectionEx
GetDiskFreeSpaceW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsA
lstrcatW
FileTimeToLocalFileTime
GetNumberFormatW
GetModuleHandleA
GetACP
GetModuleFileNameA
CreateProcessW
GetExitCodeProcess
Process32FirstW
DelayLoadFailureHook
ResolveDelayLoadedAPI
FindFirstFileExW
GetOverlappedResult
ReadDirectoryChangesW
GetProcessMitigationPolicy
ProcessIdToSessionId
FindNLSString
TryEnterCriticalSection
SetFilePointerEx
WaitForMultipleObjectsEx
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GlobalDeleteAtom
GlobalAddAtomW
GlobalSize
GlobalReAlloc
GetSystemPowerStatus
lstrlenA
GetTimeZoneInformation

oleaut32

SysFreeString
VarUI4FromStr
VariantChangeType
VariantClear
SysStringLen
SysAllocStringLen
SysAllocString
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetElemsize
SafeArrayGetDim
OleCreatePropertyFrame
VariantChangeTypeEx
SafeArrayCreateVectorEx
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
OleCreatePropertyFrameIndirect
VariantInit
SetErrorInfo
VarCmp
VariantTimeToSystemTime
DispCallFunc
VarR8FromUI8
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreateVector
SystemTimeToVariantTime
CreateErrorInfo
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegEnumKeyW

api-ms-win-core-com-l1-1-0

CoMarshalInterface
CoUnmarshalInterface
CoReleaseMarshalData
CoSetProxyBlanket
StringFromIID
CoRegisterClassObject
GetHGlobalFromStream
StringFromCLSID
CoRevokeClassObject
CoCreateFreeThreadedMarshaler
CoCreateGuid
PropVariantCopy
IIDFromString
CoWaitForMultipleHandles
CoTaskMemRealloc
CoGetTreatAsClass
CoFreeUnusedLibraries
CLSIDFromString
CoTaskMemFree
CLSIDFromProgID
CreateStreamOnHGlobal
StringFromGUID2
CoGetInterfaceAndReleaseStream
CoTaskMemAlloc
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoDisconnectObject
PropVariantClear
CoInitializeEx
CoGetStandardMarshal
CoUninitialize
CoGetClassObject

api-ms-win-core-string-l2-1-0

CharNextW
CharPrevW
CharLowerW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegDeleteValueW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
GetTraceEnableLevel

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventEnabled
EventSetInformation
EventUnregister
EventRegister
EventWrite

api-ms-win-core-libraryloader-l1-2-0

LoadStringA
LoadStringW
GetModuleHandleExW
FreeResource

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-mm-time-l1-1-0

timeEndPeriod
timeGetTime
timeBeginPeriod

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathRemoveBackslashW
PathFindExtensionW
PathRemoveFileSpecW

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_QueryService

api-ms-win-security-cryptoapi-l1-1-0

CryptAcquireContextW
CryptGenRandom

api-ms-win-core-url-l1-1-0

UrlCombineW
UrlCanonicalizeW

api-ms-win-core-com-private-l1-1-0

CoRegisterMessageFilter

api-ms-win-security-base-l1-1-0

GetAce
EqualSid
GetAclInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
MakeSelfRelativeSD
AllocateAndInitializeSid
DuplicateTokenEx
SetFileSecurityW
GetSecurityDescriptorLength
IsValidSecurityDescriptor
GetSecurityDescriptorControl
CreateWellKnownSid
MapGenericMask
GetTokenInformation
FreeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AccessCheck
GetWindowsAccountDomainSid
GetFileSecurityW

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

api-ms-win-core-perfcounters-l1-1-0

PerfStopProvider
PerfSetCounterSetInfo
PerfStartProviderEx

api-ms-win-core-sysinfo-l2-1-0

GetUserNameW

api-ms-win-core-processthreads-l1-1-0

CreateProcessAsUserW
TlsSetValue
CreateProcessA
OpenThreadToken
OpenProcessToken
TlsGetValue

api-ms-win-core-stringansi-l1-1-0

CharNextA

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIA

api-ms-win-shcore-registry-l1-1-0

SHDeleteKeyW

wmvcore

WMValidateData
WMCreateSyncReader
WMCreateWriter
WMIsContentProtected
WMCreateReader
WMCreateEditor
WMCreateProfileManager

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
CreateEventExW
OpenSemaphoreW
CreateMutexExW

api-ms-win-core-localization-l1-2-0

GetUserDefaultLocaleName
GetGeoInfoW
LocaleNameToLCID
GetSystemDefaultLCID
GetUserDefaultLangID
GetUserGeoID

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-sysinfo-l1-1-0

GetVersion
GetWindowsDirectoryW
GetSystemDirectoryW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-string-l1-1-0

GetStringTypeExW
CompareStringW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpool
CreateThreadpool
WaitForThreadpoolWaitCallbacks

api-ms-win-core-file-l1-1-0

GetFileSizeEx
QueryDosDeviceW

api-ms-win-core-localization-l1-2-1

EnumSystemLocalesEx

gdiplus

GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetPropertyItemSize
GdipGetImagePalette
GdipGetImagePaletteSize
GdipFillPath
GdipGetImageHorizontalResolution
GdipGetImagePixelFormat
GdipGetPropertyItem
GdipLoadImageFromStream
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipSetSolidFillColor
GdipImageRotateFlip
GdipCreateHBITMAPFromBitmap
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCreateHICONFromBitmap
GdipDrawImageI
GdipDeleteGraphics
GdipDrawImageRectI
GdiplusShutdown
GdipGetImageEncodersSize
GdipSetWorldTransform
GdipGetDC
GdipSetLineBlend
GdipFillRectangleI
GdipCreateBitmapFromHBITMAP
GdipCreatePath
GdipDeletePath
GdipAddPathRectangleI
GdipCreatePathGradientFromPath
GdipSetPathGradientCenterColor
GdipSetPathGradientCenterPointI
GdipSetPathGradientFocusScales
GdipGetPropertySize
GdipLoadImageFromFile
GdipCreateBitmapFromResource
GdipCreateBitmapFromStream
GdipSetLineSigmaBlend
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipSaveImageToStream
GdipGetTextureTransform
GdipTranslateTextureTransform
GdipGetImageEncoders
GdipResetTextureTransform
GdipCreateFromHDC
GdipReleaseDC
GdipSetTextureTransform
GdipCreateTexture
GdipSetTextureWrapMode
GdipTranslateWorldTransform
GdipGetImageWidth
GdipDrawCachedBitmap
GdipCreateCachedBitmap
GdipCreateSolidFill
GdipGetAllPropertyItems
GdipCreatePen1
GdipDeletePen
GdipDrawRectangleI
GdipGetImageVerticalResolution
GdipBitmapSetResolution
GdipCreateBitmapFromHICON
GdipGetImageHeight
GdipCreateBitmapFromGdiDib
GdipSaveImageToFile
GdipSetPropertyItem
GdiplusStartup
GdipCreateBitmapFromScan0
GdipSetSmoothingMode
GdipDeleteBrush
GdipCloneBrush
GdipCreateImageAttributes
GdipGetImageGraphicsContext
GdipGetImageRawFormat
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetCompositingQuality
GdipDeleteCachedBitmap
GdipSetPathGradientBlend
GdipCreateLineBrushFromRectI
GdipFree

gdi32

Polyline
DPtoLP
DeleteObject
GetDeviceCaps
CreateFontIndirectW
SelectObject
GetTextMetricsW
GetTextExtentPointW
RestoreDC
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
CreateDCW
CreateRectRgnIndirect
CreateCompatibleDC
GetClipBox
OffsetViewportOrgEx
GetStockObject
ExcludeClipRect
RectVisible
SetLayout
SetStretchBltMode
SetBkMode
SetTextColor
CreateFontW
GetObjectW
CreateCompatibleBitmap
CreateRectRgn
CombineRgn
OffsetRgn
StretchBlt
StretchDIBits
CreateSolidBrush
SetRectRgn
GetRgnBox
PtInRegion
SetBkColor
PatBlt
IntersectClipRect
CreatePen
Rectangle
GetLayout
BitBlt
GetObjectType
GetBkColor
ExtTextOutW
SetTextAlign
TextOutW
GetObjectA
GetDIBColorTable
CreateDIBSection
CreateICW
SetDIBits
GetDIBits
SetDIBitsToDevice
ExtCreateRegion
SetDIBColorTable
ExtSelectClipRgn
GetRegionData
GetTextAlign
SelectPalette
RealizePalette
GetPaletteEntries
SetPaletteEntries
GetSystemPaletteEntries
CreatePalette
SelectClipRgn
GdiFlush
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
CreateMetaFileW
Ellipse
MoveToEx
LineTo
GetTextColor
SetTextCharacterExtra
CreateBrushIndirect
RoundRect
OffsetWindowOrgEx
GetTextExtentPoint32W

user32

DrawTextExW
SetGestureConfig
CloseGestureInfoHandle
SendMessageCallbackW
SetMenuInfo
SetMenuItemBitmaps
DrawMenuBar
GetScrollRange
GetWindowDC
SystemParametersInfoA
CopyAcceleratorTableW
GetDpiForWindow
UpdateLayeredWindowIndirect
TrackMouseEvent
GetScrollPos
GetQueueStatus
RegisterClipboardFormatW
SystemParametersInfoForDpi
IsMenu
EnumDisplayDevicesW
SetPropW
GetPropW
BringWindowToTop
GetClassLongPtrW
ShowCursor
GetShellWindow
SetLayeredWindowAttributes
EnumDisplayMonitors
RegisterWindowMessageA
CheckRadioButton
GetDlgItemInt
ShowScrollBar
GetScrollBarInfo
GetDlgItemTextW
EnumChildWindows
IsDlgButtonChecked
CheckDlgButton
GetMessageExtraInfo
NotifyWinEvent
GetWindowInfo
CloseWindow
EnumWindows
SetClassLongW
GetDoubleClickTime
CloseClipboard
GetClipboardData
OpenClipboard
GetClipboardOwner
DrawEdge
GetNextDlgTabItem
WindowFromDC
GetScrollInfo
GetMessageTime
SetClassLongPtrW
DrawFocusRect
GetMessagePos
InflateRect
MonitorFromRect
IsZoomed
GetSystemMenu
GetSysColor
MsgWaitForMultipleObjectsEx
InSendMessage
PostThreadMessageW
GetClassNameW
SendMessageTimeoutA
SendMessageTimeoutW
DestroyCursor
MonitorFromWindow
GetDesktopWindow
SetParent
GetClassInfoW
MsgWaitForMultipleObjects
SendDlgItemMessageW
SetDlgItemInt
SetDlgItemTextW
EndDialog
LoadIconW
VkKeyScanW
GetDlgCtrlID
DrawTextW
GetSystemMetricsForDpi
GetWindowLongPtrW
SetWindowLongPtrW
GetDC
ReleaseDC
GetDialogBaseUnits
EndPaint
GetClientRect
BeginPaint
GetFocus
IsChild
IsDialogMessageW
WinHelpW
MoveWindow
ShowWindow
IsWindow
RegisterClassExW
GetClassInfoExW
wsprintfW
LoadCursorW
DestroyWindow
DefWindowProcW
CreateWindowExW
GetDlgItem
SendMessageW
CallWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
MessageBoxW
LoadImageW
GetMenuItemCount
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
PostMessageW
GetWindowRect
PtInRect
GetActiveWindow
LoadMenuW
LoadAcceleratorsW
SetWindowPos
InvalidateRect
GetWindowLongW
PostQuitMessage
SetFocus
MapWindowPoints
MessageBeep
RemoveMenu
AppendMenuW
TrackPopupMenuEx
DestroyMenu
CreatePopupMenu
MonitorFromPoint
GetMonitorInfoW
GetParent
IsWindowVisible
SetWindowLongW
FillRect
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
DestroyAcceleratorTable
UnionRect
GetKeyState
UnregisterClassW
CopyRect
InvalidateRgn
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
GetCursorPos
SetCursor
SystemParametersInfoW
ClientToScreen
SetRectEmpty
IsRectEmpty
SetRect
GetSubMenu
TrackPopupMenu
EnableWindow
SetWindowTextW
UpdateWindow
CreateDialogParamW
GetWindowTextLengthW
GetWindowTextW
SetTimer
FrameRect
KillTimer
IsWindowUnicode
IsWindowEnabled
AdjustWindowRectEx
IsIconic
GetWindowPlacement
GetAsyncKeyState
SetActiveWindow
SetForegroundWindow
RedrawWindow
GetWindowThreadProcessId
GetTopWindow
GetWindow
GetMenuStringW
GetMenuItemID
EnableMenuItem
DeleteMenu
CheckMenuRadioItem
InsertMenuW
CreateMenu
CheckMenuItem
GetIconInfo
GetSysColorBrush
DrawIconEx
InsertMenuItemW
DestroyIcon
GetMenuInfo
GetAncestor
FindWindowW
SetThreadDpiAwarenessContext
AllowSetForegroundWindow
DialogBoxParamW
GetMenu
GetWindowRgn
CallNextHookEx
FindWindowExW
GetClassLongW
SetWindowPlacement
SetMenu
RegisterClassW
RegisterWindowMessageW
ChangeWindowMessageFilterEx
SetWindowsHookExW
UnhookWindowsHookEx
TranslateAcceleratorW
GetUpdateRect
GetGestureInfo
GetSystemMetrics
ValidateRect

ole32

WriteClassStm
CoAllowSetForegroundWindow
IsAccelerator
OleRegGetUserType
CreateDataAdviseHolder
DoDragDrop
RevokeDragDrop
RegisterDragDrop
OleSaveToStream
OleLoadFromStream
CreateBindCtx
CoInitialize
ReleaseStgMedium
GetRunningObjectTable
OleRegEnumVerbs
CreateOleAdviseHolder
OleRegGetMiscStatus

dwmapi

DwmIsCompositionEnabled

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-featurestaging-l1-1-0

UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage
SubscribeFeatureStateChangeNotification

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGetProperty
BCryptDestroyKey
BCryptVerifySignature
BCryptImportKeyPair
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCreateHash

mfperfhelper

ord1
ord101
ord58
ord100

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-com-l1-1-2

CoFileTimeNow

api-ms-win-core-io-l1-1-0

CancelIoEx

api-ms-win-crt-math-l1-1-0

sqrtf
sinf
tanf
cosf
logf

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 335KB - Virtual size: 334KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 824KB - Virtual size: 824KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmpdxm.dll
.dll regsvr32 windows:10 windows x64 arch:x64

15ea2ce73a48e17a90cc4c72f17af520

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmpdxm.pdb

Imports

msvcrt

__dllonexit
_onexit
memset
memcpy
malloc
free
wcscat_s
realloc
wcscpy_s
_purecall
_callnewh
memcmp
log10
_XcptFilter
_vsnwprintf
memcpy_s
wcspbrk
wcschr
_amsg_exit
_initterm
_lock
_unlock
__C_specific_handler
pow

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

UnhandledExceptionFilter
DisableThreadLibraryCalls
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
lstrlenW
lstrlenA
GetVersionExW
SleepConditionVariableSRW
WakeAllConditionVariable
HeapDestroy
DeleteCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcpynW
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DebugBreak
RaiseException
lstrcpyW
InitializeCriticalSection
SetUnhandledExceptionFilter
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW

gdi32

GetDeviceCaps

user32

GetDC
ReleaseDC
CharPrevW
CharNextW

advapi32

RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
RegSetValueExW

ole32

CLSIDFromString
OleLoadFromStream
StringFromCLSID
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

SysStringLen
SysFreeString
LoadTypeLi
SysStringByteLen
VariantChangeType
RegisterTypeLi
VarUI4FromStr
SysAllocString
VariantInit
VariantClear
SysAllocStringLen
SysAllocStringByteLen
LoadRegTypeLi
SafeArrayDestroy

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmpeffects.dll
.dll regsvr32 windows:10 windows x64 arch:x64

c5dd10b324a989fe3de44b116492ac05

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:29

Not After

02-12-2021 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:ea:7e:f8:54:09:69:bb:66:23:8b:5c:53:35:3c:74:ec:41:fc:09:6a:13:73:28:05:e3:97:97:b9:a3:84:54
Signer

Actual PE Digest

43:ea:7e:f8:54:09:69:bb:66:23:8b:5c:53:35:3c:74:ec:41:fc:09:6a:13:73:28:05:e3:97:97:b9:a3:84:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmpeffects.pdb

Imports

msvcrt

rand
memcmp
_callnewh
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
sqrt
sinf
sin
memcpy
memset
memmove
memcpy_s
__C_specific_handler
pow
realloc
wcscat_s
malloc
_purecall
free
floor
ceil
cos
cosf
tan

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

user32

CharNextW
CharPrevW
RegisterWindowMessageA
PostMessageW

msdmo

DMOUnregister
MoInitMediaType
MoCopyMediaType
MoFreeMediaType

kernel32

DelayLoadFailureHook
ResolveDelayLoadedAPI
lstrlenW
GetVersionExW
DebugBreak
CloseHandle
CreateMutexW
ReleaseMutex
WaitForSingleObject
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LoadLibraryExA
FindResourceExW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
DisableThreadLibraryCalls
HeapDestroy
GetModuleHandleW
lstrcmpiW
lstrcpynW
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
MultiByteToWideChar
SizeofResource
LoadResource

mfperfhelper

ord1
ord101
ord58
ord100

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 219KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmploc.DLL
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmpps.dll
.dll regsvr32 windows:10 windows x64 arch:x64

2d8e51be3f57ed7084b9befe2b76bac9

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:8e:5b:e7:34:b9:2a:1d:36:c6:23:b9:28:13:47:00:4e:04:3d:db:93:de:75:54:c7:0a:e4:29:75:0f:c8:23
Signer

Actual PE Digest

19:8e:5b:e7:34:b9:2a:1d:36:c6:23:b9:28:13:47:00:4e:04:3d:db:93:de:75:54:c7:0a:e4:29:75:0f:c8:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmpps.pdb

Imports

msvcrt

__C_specific_handler
_initterm
malloc
free
memcmp
_amsg_exit
_XcptFilter

ole32

HMENU_UserFree64
HMENU_UserMarshal64
HMENU_UserSize
HMENU_UserSize64
HMENU_UserUnmarshal64
HMENU_UserFree
HMENU_UserUnmarshal
HBITMAP_UserMarshal64
HBITMAP_UserFree
HBITMAP_UserUnmarshal64
HWND_UserUnmarshal64
HWND_UserMarshal64
HWND_UserMarshal
HBITMAP_UserUnmarshal
HWND_UserSize
HBITMAP_UserSize64
HWND_UserSize64
HBITMAP_UserMarshal
HWND_UserFree64
HBITMAP_UserFree64
HWND_UserFree
HWND_UserUnmarshal
HBITMAP_UserSize
ObjectStublessClient31
ObjectStublessClient25
ObjectStublessClient24
CStdStubBuffer2_Connect
NdrProxyForwardingFunction7
NdrProxyForwardingFunction3
ObjectStublessClient21
ObjectStublessClient29
ObjectStublessClient16
ObjectStublessClient30
NdrProxyForwardingFunction9
ObjectStublessClient17
ObjectStublessClient26
NdrProxyForwardingFunction10
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
NdrProxyForwardingFunction11
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction6
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient28
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient22
NdrProxyForwardingFunction8
CStdStubBuffer2_CountRefs
ObjectStublessClient14
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient4
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient5
ObjectStublessClient7
ObjectStublessClient3
HMENU_UserMarshal

oleaut32

BSTR_UserMarshal
BSTR_UserUnmarshal
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserUnmarshal64
LPSAFEARRAY_UserSize
BSTR_UserFree
BSTR_UserSize
LPSAFEARRAY_UserUnmarshal64
BSTR_UserFree64
BSTR_UserSize64
LPSAFEARRAY_UserSize64
BSTR_UserMarshal64
VARIANT_UserSize64
LPSAFEARRAY_UserMarshal
VARIANT_UserMarshal64
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserFree64
VARIANT_UserUnmarshal64

rpcrt4

IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrStubForwardingFunction
NdrStubCall3
CStdStubBuffer_Disconnect

kernel32

GetCurrentProcess
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
DisableThreadLibraryCalls
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmpshell.dll
.dll regsvr32 windows:10 windows x64 arch:x64

317b246e7a21a6245e5d7bc1833ef3f0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmpshell.pdb

Imports

msvcrt

_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
memmove
memcpy
memcmp
_vsnwprintf
towlower
memcpy_s
iswspace
iswdigit
wcspbrk
_callnewh
wcscpy_s
realloc
wcscat_s
malloc
_XcptFilter
wcschr
wcsstr
_purecall
_wcsnicmp
_wtol
wcsrchr
towupper
wcsncmp
_wcsicmp
bsearch
_wtoi
_beginthreadex
free
__C_specific_handler
memset

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
DisableThreadLibraryCalls
Sleep
VirtualAlloc
VirtualProtect
lstrcpynW
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetPrivateProfileStringW
ExpandEnvironmentStringsW
LoadLibraryW
GetProcAddress
InitializeCriticalSection
FreeLibrary
CloseHandle
GetLastError
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
VirtualQuery
HeapDestroy
GetSystemInfo
DeleteCriticalSection
lstrcpyW
GlobalUnlock
GlobalLock
GetModuleHandleA
GetUserDefaultLangID
CopyFileW
GetFileAttributesW
GetExitCodeThread
SetLastError
DeviceIoControl
CreateFileW
GetVersion
QueryDosDeviceW
GetDriveTypeW
DebugBreak
CreateMutexW
CreateEventW
WaitForSingleObject
lstrcmpiA
CompareStringW
lstrlenW
lstrlenA
GetVersionExW
WideCharToMultiByte
LockResource
FindResourceW
CompareStringOrdinal
CreateThread
SetErrorMode

advapi32

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
TraceMessage

ole32

ReleaseStgMedium
CoUnmarshalInterface
CreateStreamOnHGlobal
CoUninitialize
CoInitializeEx
PropVariantClear
StringFromCLSID
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoMarshalInterface

oleaut32

SysAllocStringLen
VariantClear
LoadTypeLi
SysFreeString
SysAllocString
SysStringLen
RegisterTypeLi
VarUI4FromStr

user32

FindWindowExW
FindWindowW
RegisterWindowMessageW
SendMessageW
CharNextW
CharPrevW
IsWindow
IsIconic
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
InsertMenuItemW
GetAsyncKeyState
RegisterClipboardFormatW
SendMessageTimeoutA
GetWindow
IsWindowVisible
GetWindowThreadProcessId
GetDesktopWindow
GetParent
GetClassNameW
SetForegroundWindow
ShowWindow

shell32

ord17
ord18
ord16
SHGetKnownFolderPath
SHGetInstanceExplorer
ShellExecuteExW
SHGetDesktopFolder

mfplat

MFGetSupportedSchemes

shlwapi

ord158
PathRemoveFileSpecW
ord16
AssocQueryStringByKeyW
PathGetCharTypeW
StrRetToBufW

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmsgapi.dll
.dll windows:10 windows x64 arch:x64

13aba2899166bd8aaf3fb493130e7e6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMsgapi.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
_o___std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

memset

rpcrt4

RpcBindingCreateW
RpcBindingFree
I_RpcExceptionFilter
RpcAsyncInitializeHandle
RpcBindingUnbind
RpcAsyncCancelCall
Ndr64AsyncClientCall
UuidFromStringW
RpcBindingCopy
RpcBindingBind
RpcAsyncCompleteCall

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateEventW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

WmsgBroadcastMessage
WmsgBroadcastNotifyMessage
WmsgPostMessage
WmsgPostNotifyMessage
WmsgSendMessage
WmsgSendPSPMessage

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wmvdspa.dll
.dll regsvr32 windows:10 windows x64 arch:x64

c9c05e9a741ec8e9b2bd7a4ec9dbb39b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmvdspa.pdb

Imports

msvcrt

__C_specific_handler
sqrtf
_callnewh
_amsg_exit
wcsncpy_s
malloc
free
_lock
_onexit
__dllonexit
_initterm
_errno
_wcsicmp
_unlock
realloc
_vsnwprintf
_wgetcwd
_wchdir
fclose
_wfopen
fwprintf
_purecall
wcscat_s
wcscpy_s
memcpy_s
_XcptFilter
cos
log
memcpy
memmove
memset
sin
sqrt
wcscmp

oleaut32

LoadTypeLi
SysFreeString
UnRegisterTypeLi
SysAllocString
VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
LoadResource
SizeofResource
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
FindResourceExW
GetProcAddress

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection

api-ms-win-core-com-l1-1-0

PropVariantClear
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
PropVariantCopy

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-file-l1-1-0

ReadFile
SetEndOfFile
CreateFileW
GetFileSize
SetFilePointer
WriteFile
GetFileAttributesW

api-ms-win-core-handle-l1-1-0

CloseHandle

msdmo

MoInitMediaType
DMORegister
DMOUnregister
MoFreeMediaType
MoCopyMediaType

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/workfolderssvc.dll
.dll windows:10 windows x64 arch:x64

01352520f5206a72d09fab52edcb7f81

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-09-2021 18:23

Not After

01-09-2022 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:1a:e1:74:70:d2:b4:95:3e:ad:26:4d:e0:88:53:45:5f:12:c6:ca:65:78:fd:79:bb:83:6b:b0:66:36:b0:46
Signer

Actual PE Digest

ba:1a:e1:74:70:d2:b4:95:3e:ad:26:4d:e0:88:53:45:5f:12:c6:ca:65:78:fd:79:bb:83:6b:b0:66:36:b0:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

workfolderssvc.pdb

Imports

msvcrt

wcsstr
towupper
memcmp
__dllonexit
_onexit
isdigit
isalnum
memset
??1type_info@@UEAA@XZ
__crtLCMapStringW
_wsetlocale
___lc_handle_func
realloc
_unlock
?terminate@@YAXXZ
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
memmove
??8type_info@@QEBAHAEBV0@@Z
_wcsdup
memmove_s
_ultow_s
wcstoul
_errno
_wcstoi64
tolower
toupper
wcschr
wcsrchr
wcsncmp
towlower
_wcsnicmp
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
_vsnprintf_s
memcpy_s
_vsnwprintf
abort
memchr
??0bad_cast@@QEAA@AEBV0@@Z
__uncaught_exception
__pctype_func
_ismbblead
___lc_codepage_func
___mb_cur_max_func
setlocale
wcstod
_strnicmp
_vsnprintf
wcstok_s
iswspace
localeconv
ldexp
wcsncpy_s
_lock
??1bad_cast@@UEAA@XZ
??3@YAXPEAX@Z
isspace
isalpha
??0bad_cast@@QEAA@PEBD@Z
_purecall
_wcsicmp
calloc
__CxxFrameHandler3
_resetstkoflw
wcscmp

oleaut32

SysStringLen
SysAllocStringLen
SysAllocString
LoadTypeLi
VarUI4FromStr
VariantClear
LoadRegTypeLi
VariantInit
SysFreeString

ntdll

RtlFreeUnicodeString
RtlGetFullPathName_UEx
RtlInitUnicodeStringEx
NtFlushBuffersFile
NtQuerySecurityObject
NtOpenFile
NtSetSecurityObject
RtlDosPathNameToNtPathName_U_WithStatus
RtlCaptureContext
NtFsControlFile
RtlInitUnicodeString
NtSetInformationFile
NtQueryInformationFile
RtlIsDosDeviceName_U
NtCreateFile
RtlReleaseRelativeName
RtlFreeHeap
RtlDosPathNameToRelativeNtPathName_U
NtClose
RtlDetermineDosPathNameType_U
NtPowerInformation
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryDirectoryFile

kernel32

FileTimeToSystemTime
CompareStringOrdinal
DecodePointer
EncodePointer
GetStringTypeW
GetFileSizeEx
DuplicateHandle
GlobalFree
SetFileAttributesW
GetMaximumProcessorCount
LCMapStringW
GetFinalPathNameByHandleW
DeviceIoControl
CancelIo
GetOverlappedResult
ReadFile
FindFirstFileW
WriteFile
CreateFileW
GlobalLock
GetComputerNameW
GetVersionExW
GetLastError
FormatMessageW
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
OutputDebugStringW
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
DisableThreadLibraryCalls
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeCriticalSectionEx
WideCharToMultiByte
GetComputerNameExW
FindClose
GetFullPathNameW
ExpandEnvironmentStringsW
SetFileInformationByHandle
GetVolumeNameForVolumeMountPointW
RemoveDirectoryW
FindNextFileW
DeleteFileW
FreeLibrary
LoadLibraryExW
lstrcmpiW
RaiseException
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
CreateThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpoolWork
LocalFree
GetFileAttributesW
GetVolumePathNameW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetCurrentThread
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CompareFileTime
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
CloseThreadpool
CreateThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThread
GetTickCount64
GlobalUnlock
LocalReAlloc
LocalAlloc
FindFirstFileExW

advapi32

TraceMessage
RegCloseKey
RegQueryInfoKeyW
SetFileSecurityW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
RegOpenCurrentUser
RegFlushKey
RegDeleteTreeW
RegGetValueW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegisterServiceCtrlHandlerExW
SetServiceStatus
EventWriteTransfer
RegQueryValueExW
GetTokenInformation
ConvertSidToStringSidW
OpenThreadToken
DecryptFileW
CredWriteW
CredDeleteW
CredReadW
CredFree
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
UnregisterTraceGuids
RegisterTraceGuidsW
EventActivityIdControl
ImpersonateLoggedOnUser
SetThreadToken
RevertToSelf
ConvertStringSidToSidW
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
InitializeAcl
CopySid
GetLengthSid
CreateWellKnownSid
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventUnregister
EventRegister
EventSetInformation
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

ext-ms-win-session-wtsapi32-l1-1-0

WTSQuerySessionInformationW
WTSFreeMemory

ext-ms-win-ntuser-powermanagement-l1-1-0

RegisterPowerSettingNotification

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
ResetEvent
SetEvent
CreateMutexW
CreateEventW
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CreateEventExW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoImpersonateClient
CoTaskMemFree
CoSetProxyBlanket
CoDisconnectContext
CoRevokeClassObject
CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoGetMalloc
CoAllowUnmarshalerCLSID
CoTaskMemRealloc
StringFromCLSID
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
StringFromGUID2
CoRegisterClassObject

user32

CharNextW
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassA

shell32

ord162
SHGetDesktopFolder
SHChangeNotify
SHCreateItemFromIDList
ord165
ord526
SHCreateItemFromParsingName

api-ms-win-core-path-l1-1-0

PathCchCanonicalizeEx
PathCchCombineEx
PathCchFindExtension
PathCchAppendEx

netapi32

NetGetJoinInformation
NetApiBufferFree

crypt32

CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore
CryptProtectData
CertDuplicateCertificateContext
CertFindChainInStore
CertOpenSystemStoreW
CryptUnprotectData

userenv

GetUserProfileDirectoryW
ExpandEnvironmentStringsForUserW

powrprof

PowerSettingUnregisterNotification

cldapi

CfCreatePlaceholders
CfGetPlaceholderInfo
CfDehydratePlaceholder
CfHydratePlaceholder
CfReportProviderProgress2
CfSetInSyncState
CfSetPinState
CfExecute
CfConvertToPlaceholder
CfReleaseProtectedHandle
CfGetWin32HandleFromProtectedHandle
CfReferenceProtectedHandle
CfCloseHandle
CfOpenFileWithOplock
CfUpdatePlaceholder
CfDisconnectSyncRoot
CfGetPlaceholderStateFromAttributeTag
CfConnectSyncRoot
CfRegisterSyncRoot
CfUnregisterSyncRoot

winsync

ord1

kernelbase

ReplaceFileExInternal

policymanager

PolicyManager_GetPolicyInt

winhttp

WinHttpQueryHeaders
WinHttpSetOption
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpSetStatusCallback
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCreateUrl
WinHttpAddRequestHeaders
WinHttpQueryOption
WinHttpSetCredentials
WinHttpCloseHandle
WinHttpOpen
WinHttpOpenRequest

shlwapi

ord214
PathMatchSpecExW
SHStrDupW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

esent

JetRetrieveColumn
JetSeek
JetMakeKey
JetGetTableColumnInfoW
JetUpdate2
JetSetColumn
JetAddColumnW
JetMove
JetGetSystemParameterW
JetCloseTable
JetCloseDatabase
JetEndSession
JetPrepareUpdate
JetOpenTableW
JetDelete
JetSetCurrentIndex4W
JetTerm2
JetCreateTableColumnIndex3W
JetCreateIndex3W
JetDeleteTableW
JetRenameTableW
JetCreateInstance2W
JetBeginSessionW
JetCreateDatabase2W
JetAttachDatabase2W
JetOpenDatabaseW
JetGetDatabaseFileInfoW
JetBeginTransaction2
JetCommitTransaction
JetRollback
JetGetErrorInfoW
JetStopServiceInstance
JetSetSystemParameterW
JetInit3W

Exports

Exports

ClientInitEcsLib
ClientUnInitEcsLib
DllCanUnloadNow
ServiceMain

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 540KB - Virtual size: 539KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wosc.dll
.dll windows:10 windows x64 arch:x64

5fb3509762ca008abf85b41d8306f9ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wosc.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsdup
_o__wcstoui64
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_wcscpy_s
_o_wcstol
_o_wcstoul
__C_specific_handler
_CxxThrowException
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o__errno
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__CxxFrameHandler3
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError
RoOriginateErrorW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ResetEvent
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
InitializeSRWLock
CreateEventExW
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsPromoteStringBuffer
WindowsPreallocateStringBuffer
WindowsCreateStringReference
WindowsCreateString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsDeleteStringBuffer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
CreateThread
GetCurrentThreadId
GetCurrentProcessId
ResumeThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
FindStringOrdinal
GetProcAddress
LoadLibraryExW
GetModuleHandleW

msvcp_win

?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoGetMalloc
CoGetApartmentType
CLSIDFromString

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-string-l2-1-0

CharUpperBuffW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegDeleteTreeW
RegGetValueW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-cryptoapi-l1-1-0

CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-file-l1-1-0

WriteFile
CreateFileW
GetFileSizeEx
CreateDirectoryW
DeleteFileW
ReadFile
SetFilePointerEx

api-ms-win-core-path-l1-1-0

PathCchSkipRoot
PathCchCanonicalize
PathCchCombine

api-ms-win-core-file-l2-1-2

CopyFileW

rpcrt4

RpcBindingFree
RpcStringFreeW
RpcExceptionFilter
NdrClientCall3
RpcStringBindingComposeW
RpcBindingFromStringBindingW

ntdll

RtlPublishWnfStateData
NtQueryWnfStateData

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathFindFileNameW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-url-l1-1-0

UrlEscapeW

crypt32

CryptBinaryToStringW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wow64.dll
.dll windows:10 windows x64 arch:x64

4d26806e6ca2ec5ea8df4ba29c854f96

Code Sign

33:00:00:04:0c:12:00:67:8b:16:b2:65:db:00:00:00:00:04:0c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-01-2023 19:22

Not After

15-12-2023 19:22

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

96:95:bb:31:ec:42:ae:64:55:59:bf:bb:fb:5e:4a:2a:ec:ef:b8:9a:2f:9e:d0:c4:1a:1b:7a:05:d6:19:8b:43
Signer

Actual PE Digest

96:95:bb:31:ec:42:ae:64:55:59:bf:bb:fb:5e:4a:2a:ec:ef:b8:9a:2f:9e:d0:c4:1a:1b:7a:05:d6:19:8b:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wow64.pdb

Imports

ntdll

memcpy
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtRaiseException
RtlWow64GetCpuAreaInfo
RtlGetExtendedContextLength
RtlInitializeExtendedContext
longjmp
RtlWow64GetCurrentCpuArea
NtContinueEx
NtTestAlert
__C_specific_handler
LdrLockLoaderLock
LdrUnlockLoaderLock
_vsnprintf
DbgPrintEx
_vsnwprintf
RtlGetNtSystemRoot
RtlInitUnicodeString
LdrLoadDll
RtlInitAnsiString
LdrGetProcedureAddress
LdrUnloadDll
NtQuerySystemInformation
NtQuerySection
RtlImageNtHeaderEx
NtProtectVirtualMemory
RtlInitializeSRWLock
RtlCreateHashTable
RtlAcquireSRWLockExclusive
RtlRemoveEntryHashTable
RtlReleaseSRWLockExclusive
NtClose
TpReleaseWait
NtCreateEvent
TpAllocWait
TpSetWait
RtlInsertEntryHashTable
TpSetWaitEx
LdrSystemDllInitBlock
NtOpenDirectoryObject
RtlInitUnicodeStringEx
NtOpenSection
LdrGetKnownDllSectionHandle
NtMapViewOfSection
RtlFindExportedRoutineByName
NtUnmapViewOfSection
RtlUserThreadStart
NtQueryInformationProcess
NtTerminateThread
RtlImageNtHeader
RtlImageDirectoryEntryToData
RtlNtdllName
NtOpenFile
NtQueryObject
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlPrefixUnicodeString
wcsncmp
RtlEqualUnicodeString
RtlRaiseStatus
NtReadVirtualMemory
NtOpenProcess
RtlCreateProcessParametersWithTemplate
NtResumeThread
RtlPrepareForProcessCloning
NtCreateUserProcess
RtlCompleteProcessCloning
NtTerminateProcess
RtlDestroyProcessParameters
NtQueryInformationThread
RtlCopyContext
RtlWow64GetProcessMachines
NtCreateThread
RtlWow64GetCurrentMachine
NtCreateThreadEx
RtlIsCurrentProcess
RtlUpdateClonedSRWLock
RtlWaitOnAddress
NtSuspendThread
NtGetContextThread
NtDuplicateObject
NtWaitForMultipleObjects
NtAlertThreadByThreadId
RtlWakeAddressAll
NtSetEvent
NtWaitForAlertByThreadId
NtFreeVirtualMemory
NtAllocateVirtualMemory
NtGetNextThread
RtlIsCurrentThread
RtlWow64SuspendThread
NtSetInformationThread
NtWaitForSingleObject
RtlAcquireSRWLockShared
RtlLookupEntryHashTable
RtlGetNextEntryHashTable
RtlReleaseSRWLockShared
LdrProcessInitializationComplete
RtlGetEnabledExtendedFeatures
RtlLocateLegacyContext
RtlAllocateHeap
RtlFreeHeap
RtlRaiseException
RtlNtStatusToDosError
RtlWow64GetEquivalentMachineCHPE
NtOpenThread
RtlQueryEnvironmentVariable_U
RtlInitializeBitMapEx
RtlTestBitEx
LdrControlFlowGuardEnforced
NtQueryVirtualMemory
DbgPrint
RtlpQueryProcessDebugInformationFromWow64
NtOpenKey
NtQueryValueKey
wcsrchr
RtlInitAnsiStringEx
RtlIsProcessorFeaturePresent
NtCreateSection
RtlWow64PushCrossProcessWorkOntoFreeList
RtlWow64GetSharedInfoProcess
RtlWow64PopAllCrossProcessWorkFromWorkList
RtlWow64PopCrossProcessWorkFromFreeList
RtlWow64RequestCrossProcessHeavyFlush
RtlWow64PushCrossProcessWorkOntoWorkList
LdrDisableThreadCalloutsForDll
RtlUnhandledExceptionFilter
memset
memmove
_setjmp
_local_unwind
NtRollbackRegistryTransaction
NtCreateProfileEx
NtOpenMutant
NtAccessCheckAndAuditAlarm
NtAdjustPrivilegesToken
NtSetTimer2
NtReplacePartitionUnit
NtOpenProcessTokenEx
NtSetEventBoostPriority
NtRecoverTransactionManager
NtCreateEnlistment
DbgPrompt
NtSetQuotaInformationFile
NtSetIRTimer
NtQueryMultipleValueKey
NtQueryOpenSubKeys
NtRemoveIoCompletionEx
NtCreateMailslotFile
NtRollbackComplete
NtDisableLastKnownGood
NtAlpcDeletePortSection
NtGetNotificationResourceManager
NtMakePermanentObject
NtOpenProcessToken
NtResetEvent
NtSetHighWaitLowEventPair
NtAllocateLocallyUniqueId
NtQueryBootEntryOrder
NtQuerySystemTime
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtIsSystemResumeAutomatic
NtCancelSynchronousIoFile
NtFlushWriteBuffer
NtQueryAuxiliaryCounterFrequency
NtQueryWnfStateNameInformation
NtTraceEvent
NtMapViewOfSectionEx
NtCreateDirectoryObject
NtCreateProcessEx
NtCreateWaitablePort
NtQueryBootOptions
NtDisplayString
NtRollforwardTransactionManager
NtLockRegistryKey
NtNotifyChangeSession
NtCreateTokenEx
NtCreateTimer2
NtGetCompleteWnfStateSubscription
NtCreateCrossVmMutant
NtOpenSymbolicLinkObject
NtSetIoCompletionEx
NtAlpcConnectPortEx
NtSetWnfProcessNotificationEvent
CsrAllocateMessagePointer
NtGetMUIRegistryInfo
NtThawRegistry
NtCreateDirectoryObjectEx
NtSinglePhaseReject
NtDuplicateToken
NtWaitForDebugEvent
NtCreateJobSet
NtCopyFileChunk
NtFilterBootOption
NtLoadKey2
NtCreatePort
NtSetIoCompletion
NtReplyPort
NtDeleteDriverEntry
NtGetNextProcess
NtSetTimer
NtCreateTransaction
NtRenameTransactionManager
NtWriteFile
NtCancelIoFileEx
NtQueryInformationWorkerFactory
NtDeleteWnfStateName
NtUnmapViewOfSectionEx
NtUnloadDriver
NtReleaseMutant
NtEnumerateValueKey
NtUnloadKeyEx
NtUnsubscribeWnfStateChange
NtCreateWnfStateName
NtQueueApcThread
NtSubscribeWnfStateChange
NtAlpcImpersonateClientContainerOfPort
NtWaitHighEventPair
NtSetDefaultUILanguage
NtPropagationComplete
NtAddDriverEntry
NtWorkerFactoryWorkerReady
NtAlertThread
NtFlushInstallUILanguage
NtSetInformationJobObject
NtResetWriteWatch
NtCreateResourceManager
NtFindAtom
NtSetLowWaitHighEventPair
NtOpenEvent
NtOpenSemaphore
NtAlpcDeleteResourceReserve
NtEnumerateDriverEntries
NtRollbackTransaction
NtOpenResourceManager
NtQueryPortInformationProcess
NtAlpcConnectPort
NtCompleteConnectPort
NtQueryQuotaInformationFile
NtPrivilegeObjectAuditAlarm
NtFreezeTransactions
NtFlushBuffersFileEx
NtQuerySymbolicLinkObject
NtDebugActiveProcess
NtNotifyChangeMultipleKeys
NtQueryPerformanceCounter
NtQuerySystemInformationEx
NtRemoveProcessDebug
NtCommitEnlistment
NtAddBootEntry
NtLoadKey
NtAlpcCancelMessage
NtReadOnlyEnlistment
NtSetInformationObject
NtUnlockFile
NtOpenKeyedEvent
NtReplyWaitReceivePortEx
NtSetDefaultLocale
CsrClientCallServer
NtSetSystemPowerState
NtCreateEventPair
NtImpersonateAnonymousToken
NtQueryInformationAtom
CsrCaptureMessageBuffer
NtPrePrepareEnlistment
NtImpersonateThread
NtSetSystemInformation
NtCompressKey
NtPrepareComplete
NtListenPort
NtRevertContainerImpersonation
NtSetInformationToken
NtSetInformationFile
NtAccessCheckByTypeAndAuditAlarm
NtQueryTimer
NtSetEaFile
NtSetTimerEx
NtCompareSigningLevels
NtSetLowEventPair
NtResumeProcess
NtCreateNamedPipeFile
NtQueryWnfStateData
NtModifyBootEntry
NtAlpcRevokeSecurityContext
NtAssociateWaitCompletionPacket
NtReadFile
NtDrawText
NtPrePrepareComplete
NtOpenEventPair
NtInitializeEnclave
NtOpenTimer
CsrGetProcessId
NtIsUILanguageComitted
NtLockFile
NtQueryInformationJobObject
NtFlushKey
NtDeleteFile
NtCompareObjects
NtSetBootEntryOrder
CsrCaptureMessageString
NtAllocateUserPhysicalPages
NtAlpcCreateResourceReserve
NtAlpcCreateSectionView
NtGetWriteWatch
NtNotifyChangeKey
NtQueryDriverEntryOrder
NtReleaseKeyedEvent
RtlGetCurrentProcessorNumberEx
NtOpenThreadTokenEx
NtCreateJobObject
NtSetInformationSymbolicLink
NtAccessCheckByTypeResultList
NtEnumerateTransactionObject
NtPrivilegedServiceAuditAlarm
NtPowerInformation
NtReplyWaitReceivePort
NtQueryInformationToken
NtSetInformationTransactionManager
NtSetSecurityObject
NtQueryDirectoryFileEx
NtWaitForMultipleObjects32
NtAreMappedFilesTheSame
NtAlpcImpersonateClientOfPort
NtQueryEaFile
NtWaitForWorkViaWorkerFactory
NtTranslateFilePath
NtCreateIoCompletion
NtAcceptConnectPort
NtAlpcCreateSecurityContext
NtDeleteBootEntry
NtCancelWaitCompletionPacket
NtDelayExecution
NtSerializeBoot
RtlLengthSid
NtPulseEvent
NtAlpcOpenSenderProcess
NtSetDefaultHardErrorPort
NtSetIntervalProfile
NtAssignProcessToJobObject
NtCompactKeys
NtUnloadKey2
NtTerminateJobObject
NtInitializeRegistry
NtQueryAttributesFile
NtReplyWaitReplyPort
CsrIdentifyAlertableThread
NtRaiseHardError
NtLockVirtualMemory
NtDeviceIoControlFile
NtPrepareEnlistment
NtCreateWaitCompletionPacket
NtSetDebugFilterState
NtOpenTransactionManager
NtIsProcessInJob
NtRecoverEnlistment
NtQueryInformationTransactionManager
NtSetDriverEntryOrder
NtAlpcQueryInformation
NtApphelpCacheControl
NtCreateProfile
NtFlushBuffersFile
NtCancelTimer
NtGetCachedSigningLevel
NtOpenSession
NtQuerySystemEnvironmentValue
NtCreateLowBoxToken
NtCloseObjectAuditAlarm
NtInitiatePowerAction
NtAcquireCrossVmMutant
NtStartProfile
NtOpenJobObject
NtMapUserPhysicalPagesScatter
NtWaitForKeyedEvent
NtCancelIoFile
NtCreateCrossVmEvent
NtQueryIoCompletion
NtShutdownWorkerFactory
NtRegisterProtocolAddressInformation
NtAcquireProcessActivityReference
NtCreateEnclave
NtAddAtomEx
NtQuerySemaphore
NtFsControlFile
NtDeleteAtom
NtRequestWaitReplyPort
NtQueryInformationTransaction
RtlCopySid
NtCreatePrivateNamespace
NtWaitLowEventPair
NtShutdownSystem
NtSetInformationResourceManager
NtAlpcDeleteSectionView
NtGetDevicePowerState
CsrClientConnectToServer
NtUnloadKey
NtRemoveIoCompletion
NtModifyDriverEntry
NtAlpcQueryInformationMessage
NtOpenObjectAuditAlarm
NtUnlockVirtualMemory
NtQueryEvent
NtQueryDirectoryObject
NtCreateRegistryTransaction
NtQueryInformationFile
NtAdjustGroupsToken
CsrFreeCaptureBuffer
NtSecureConnectPort
NtAccessCheckByType
NtFreeUserPhysicalPages
NtQueryDebugFilterState
NtReadFileScatter
NtSetSystemEnvironmentValueEx
NtExtendSection
NtSetTimerResolution
NtFilterToken
NtQueryLicenseValue
NtQueryInformationPort
NtAccessCheck
RtlWow64GetThreadSelectorEntry
NtSetHighEventPair
NtMapUserPhysicalPages
NtYieldExecution
NtGetNlsSectionPtr
NtCommitTransaction
NtDeletePrivateNamespace
NtOpenIoCompletion
NtOpenThreadToken
NtThawTransactions
NtLoadEnclaveData
NtCreateMutant
NtFilterTokenEx
NtRegisterThreadTerminatePort
NtAllocateVirtualMemoryEx
NtWriteFileGather
NtQuerySecurityPolicy
NtAccessCheckByTypeResultListAndAuditAlarm
NtCreateKeyedEvent
NtTraceControl
NtSetCachedSigningLevel2
NtCreateWorkerFactory
CsrVerifyRegion
NtCreateSymbolicLinkObject
NtAdjustTokenClaimsAndDeviceGroups
NtSetSystemTime
NtQuerySystemEnvironmentValueEx
NtQueryInformationByName
NtAllocateUserPhysicalPagesEx
NtTerminateEnclave
NtSetInformationKey
NtQueryDefaultUILanguage
NtUpdateWnfStateData
NtCreateDebugObject
NtImpersonateClientOfPort
NtRollbackEnlistment
NtPrivilegeCheck
NtGetCurrentProcessorNumber
NtSetInformationProcess
NtConnectPort
NtReplaceKey
NtAlpcAcceptConnectPort
NtDeleteWnfStateData
NtSetThreadExecutionState
NtPropagationFailed
NtCreateSemaphore
NtFlushProcessWriteBuffers
NtGetCurrentProcessorNumberEx
NtSetInformationTransaction
NtCallEnclave
NtWriteVirtualMemory
NtEnumerateBootEntries
NtClearEvent
NtOpenPartition
NtLoadKeyEx
NtSetSystemEnvironmentValue
NtSaveMergedKeys
NtQueryInformationResourceManager
NtEnumerateSystemEnvironmentValuesEx
NtAllocateUuids
NtSignalAndWaitForSingleObject
NtSaveKeyEx
NtQueryInstallUILanguage
NtQueueApcThreadEx
NtCreatePagingFile
NtCreateProcess
NtInitializeNlsFiles
NtOpenPrivateNamespace
NtSystemDebugControl
NtAlpcCreatePort
NtSetInformationVirtualMemory
NtMakeTemporaryObject
NtReleaseSemaphore
NtMapCMFModule
NtOpenEnlistment
NtQueryVolumeInformationFile
NtSetInformationDebugObject
NtLockProductActivationKeys
NtAlpcDeleteSecurityContext

wow64win

sdwhcon
sdwhwin32

Exports

Exports

Wow64AllocThreadHeap
Wow64AllocateHeap
Wow64AllocateTemp
Wow64ApcRoutine
Wow64CheckIfNXEnabled
Wow64DispatchExceptionCHPE
Wow64EmulateAtlThunk
Wow64FreeHeap
Wow64FreeThreadHeap
Wow64IsControlFlowGuardEnforced
Wow64IsStackExtentsCheckEnforced
Wow64KiUserCallbackDispatcher
Wow64LdrpInitialize
Wow64LogPrint
Wow64NotifyUnsimulateComplete
Wow64PassExceptionToGuest
Wow64PrepareForDebuggerAttach
Wow64PrepareForException
Wow64ProcessPendingCrossProcessItems
Wow64RaiseException
Wow64ShallowThunkAllocObjectAttributes32TO64_FNC
Wow64ShallowThunkAllocSecurityQualityOfService32TO64_FNC
Wow64ShallowThunkSIZE_T32TO64
Wow64ShallowThunkSIZE_T64TO32
Wow64SuspendLocalProcess
Wow64SuspendLocalThread
Wow64SystemServiceEx
Wow64ValidateUserCallTarget
Wow64ValidateUserCallTargetFilter

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mrdata
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wow64cpu.dll
.dll windows:10 windows x64 arch:x64

c22b977be4bf67b1a723dd49bcc47668

Code Sign

33:00:00:04:0c:12:00:67:8b:16:b2:65:db:00:00:00:00:04:0c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-01-2023 19:22

Not After

15-12-2023 19:22

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:e3:f2:95:aa:6c:8f:38:d1:6d:37:79:c4:12:16:f6:71:4f:14:39:5a:5f:40:dc:b0:0f:a4:85:87:80:71:19
Signer

Actual PE Digest

8f:e3:f2:95:aa:6c:8f:38:d1:6d:37:79:c4:12:16:f6:71:4f:14:39:5a:5f:40:dc:b0:0f:a4:85:87:80:71:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wow64cpu.pdb

Imports

ntdll

__C_specific_handler
RtlWow64GetCpuAreaInfo
RtlWow64GetCurrentCpuArea
RtlpWow64SetContextOnAmd64
NtQueryInformationProcess
NtSetInformationThread
RtlpWow64GetContextOnAmd64
NtProtectVirtualMemory
NtQueryInformationThread
RtlpWow64CtxFromAmd64
LdrDisableThreadCalloutsForDll
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter

wow64

Wow64PassExceptionToGuest
Wow64IsStackExtentsCheckEnforced
Wow64SystemServiceEx

Exports

Exports

BTCpuGetBopCode
BTCpuGetContext
BTCpuProcessInit
BTCpuResetToConsistentState
BTCpuSetContext
BTCpuSimulate
BTCpuTurboThunkControl
TurboDispatchJumpAddressEnd
TurboDispatchJumpAddressStart

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

WOW64SVC
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

W64SVC
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wow64win.dll
.dll windows:10 windows x64 arch:x64

aa2f336c00f80e5e84819ee774d160fe

Code Sign

33:00:00:03:81:a4:c7:63:e7:ad:c5:b4:ee:00:00:00:00:03:81
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-03-2022 19:24

Not After

08-03-2023 19:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:30:89:c4:82:88:33:a4:28:7f:9c:b6:7a:75:f8:a0:25:d3:f9:c7:61:da:a3:ee:d9:cf:e3:80:c3:57:0d:ae
Signer

Actual PE Digest

aa:30:89:c4:82:88:33:a4:28:7f:9c:b6:7a:75:f8:a0:25:d3:f9:c7:61:da:a3:ee:d9:cf:e3:80:c3:57:0d:ae

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wow64win.pdb

Imports

ntdll

LdrDisableThreadCalloutsForDll
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
__C_specific_handler
CsrClientConnectToServer
RtlAllocateHeap
NtClose
RtlFreeHeap
RtlRaiseStatus
NtCallbackReturn
_local_unwind
memcpy
RtlNtStatusToDosError
CsrClientCallServer

wow64

Wow64AllocThreadHeap
Wow64KiUserCallbackDispatcher
Wow64FreeThreadHeap
Wow64FreeHeap
Wow64LogPrint
Wow64AllocateTemp
Wow64ShallowThunkSIZE_T64TO32
Wow64ShallowThunkAllocObjectAttributes32TO64_FNC
Wow64ShallowThunkSIZE_T32TO64

Exports

Exports

sdwhcon
sdwhwin32

Sections

.text
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wowreg32.exe
.exe windows:10 windows x64 arch:x64

9e395710d74bf587fac4f5ca37bf2548

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wowreg32.pdb

Imports

kernel32

SetLastError
GetCommandLineW
OpenEventW
OpenFileMappingW
UnmapViewOfFile
GetLastError
SetEvent
CloseHandle
LoadLibraryW
ResetEvent
SetCurrentDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
MapViewOfFile
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep

msvcrt

_amsg_exit
_XcptFilter
wcsrchr
fprintf
_wcsicmp
_vsnwprintf
__C_specific_handler
?terminate@@YAXXZ
_commode
_fmode
_initterm
__getmainargs
_cexit
_exit
exit
fwprintf
__set_app_type
__setusermatherr
__iob_func

ntdll

DbgPrintEx
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

ole32

OleInitialize
OleUninitialize

setupapi

SetupWriteTextLog

shell32

CommandLineToArgvW

user32

MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
LoadStringW
TranslateMessage

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpbcreds.dll
.dll windows:10 windows x64 arch:x64

cebad6289589ec85225c5851c8e1a933

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpbcreds.pdb

Imports

msvcrt

memset
memmove
??1type_info@@UEAA@XZ
__CxxFrameHandler3
__C_specific_handler
_initterm
_amsg_exit
memcmp
_XcptFilter
_CxxThrowException
toupper
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
memcpy
free
iswspace
_wcsrev
_vsnwprintf

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlNtStatusToDosError
RtlIsMultiSessionSku
RtlVirtualUnwind

bcrypt

BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptSetProperty
BCryptExportKey
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinalizeKeyPair
BCryptFinishHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptResolveProviders
BCryptDecrypt
BCryptFreeBuffer
BCryptGetProperty
BCryptGenerateKeyPair
BCryptEncrypt
BCryptDeriveKeyPBKDF2
BCryptDestroyKey

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive

api-ms-win-security-base-l1-1-0

GetTokenInformation
IsValidSid
EqualSid

rpcrt4

UuidToStringW
RpcStringFreeW
UuidFromStringW
UuidCreate

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentThread
SetThreadToken

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegFlushKey
RegEnumValueW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegGetValueA

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

crypt32

CryptBinaryToStringW
CryptProtectMemory
CryptUnprotectMemory

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-handle-l1-1-0

CloseHandle

ncrypt

NCryptSetProperty
NCryptUnprotectSecret
NCryptEncrypt
NCryptFreeObject
NCryptCreatePersistedKey
NCryptDecrypt
NCryptCreateProtectionDescriptor
NCryptProtectSecret
NCryptOpenKey
NCryptOpenStorageProvider
NCryptCloseProtectionDescriptor
NCryptFinalizeKey
NCryptDeleteKey

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-memory-l1-1-1

VirtualLock
VirtualUnlock
SetProcessWorkingSetSizeEx
GetProcessWorkingSetSizeEx

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-registry-l2-1-0

RegOpenKeyW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
EventProviderEnabled

Exports

Exports

WpbcCleanup
WpbcCreateRemoveTestCredentials
WpbcCreateTestPin
WpbcExportCredentials
WpbcGetPinInfo
WpbcInitialize
WpbcVerifyUser

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpcatltoast.png
.png
Ex_PE_v3.1.9/CMap/libs/wpcmon.png
.png
Ex_PE_v3.1.9/CMap/libs/wpd_ci.dll
.dll windows:10 windows x64 arch:x64

581e07410afacac1bd5c62c7968aabaf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpd_ci.pdb

Imports

msvcrt

memset
??1type_info@@UEAA@XZ
wcscat_s
wcsnlen
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
__C_specific_handler
_callnewh
wcschr
_wcsnicmp
wcsstr
calloc
free
malloc
wcscpy_s
_wcsicmp
_vsnwprintf
memmove_s
_vscwprintf
vswprintf_s
memcpy_s
strstr
wcscmp

setupapi

SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiGetDeviceInstallParamsW
SetupDiGetDevicePropertyW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
SetupDiCreateDeviceInfoList
SetupDiSetDeviceInstallParamsW
SetupDiInstallDevice
SetupDiSetDeviceRegistryPropertyW
CM_Get_DevNode_Status
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiOpenDeviceInfoW
SetupDiOpenClassRegKey
CM_Reenumerate_DevNode
CM_Locate_DevNodeW
SetupDiSetDevicePropertyW
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInterfaceAlias
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInfo

advapi32

CryptReleaseContext
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
GetExplicitEntriesFromAclW
EqualSid
AllocateAndInitializeSid
SetEntriesInAclW
ConvertSecurityDescriptorToStringSecurityDescriptorW
AuditQuerySystemPolicy
SetSecurityDescriptorSacl
FreeSid
CheckTokenMembership
InitializeSecurityDescriptor
AuditFree
DuplicateTokenEx
GetSecurityDescriptorLength
AuditQueryPerUserPolicy
MakeSelfRelativeSD
GetTokenInformation
DeregisterEventSource
RegisterEventSourceW
ReportEventW
GetSecurityDescriptorDacl
RevertToSelf
ImpersonateLoggedOnUser
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegEnumKeyW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventWriteTransfer
EventUnregister
EventRegister
UnregisterTraceGuids
RegisterTraceGuidsW
OpenServiceW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
StartServiceW
ChangeServiceConfigW
ControlService
QueryServiceStatus
CloseServiceHandle
TraceMessage
OpenSCManagerW

user32

UnregisterClassA

shell32

SHCreateDirectoryExW
SHGetKnownFolderPath
SHGetFolderPathW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSQueryUserToken
WTSEnumerateSessionsW

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrustEx

kernel32

HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DelayLoadFailureHook
RegOpenCurrentUser
LocalAlloc
LeaveCriticalSection
GetTempFileNameW
GetTempPathW
CreateFileW
MoveFileExW
IsValidLocaleName
GetSystemDefaultLocaleName
GetUserDefaultLocaleName
WTSGetActiveConsoleSessionId
CreateDirectoryW
FindResourceExW
LoadResource
ResolveDelayLoadedAPI
LockResource
SizeofResource
GetVersionExW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
DeleteFileW
GetLastError
GetCurrentProcessId
GetTickCount
Sleep
CloseHandle
DisableThreadLibraryCalls
SetEvent
LocalFree
CreateEventW
RaiseException

shlwapi

PathIsDirectoryW
SHCreateStreamOnFileW
PathFileExistsW
SHCreateStreamOnFileEx

Exports

Exports

CoDeviceInstall
DoCmd
MigrateMTPDevicesInstalledAsMSC
RescanBus
WpdClassInstaller

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpdbusenum.dll
.dll windows:10 windows x64 arch:x64

3dffe4788216ab1a2bdafae262063ccd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpdBusEnum.pdb

Imports

msvcrt

vswprintf_s
_vscwprintf
memmove_s
memcpy_s
wcscat_s
wcsnlen
wcstoul
wcscpy_s
_XcptFilter
_amsg_exit
_initterm
??1type_info@@UEAA@XZ
_callnewh
_unlock
__dllonexit
_onexit
memset
memcpy
memcmp
_CxxThrowException
__CxxFrameHandler3
_vsnwprintf
_vsnprintf
wcsrchr
__C_specific_handler
_lock
free
malloc
_wcsicmp
wcscmp

ntdll

RtlCaptureContext
RtlCompareMemory
NtQueryVolumeInformationFile
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegGetValueW
RegCreateKeyExW

api-ms-win-eventing-controller-l1-1-0

ControlTraceW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetWindowsDirectoryW
GetSystemTime

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW
CM_Get_Device_Interface_PropertyW
CM_Locate_DevNodeW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_MapCrToWin32Err
CM_Set_DevNode_PropertyW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

api-ms-win-core-file-l1-1-0

GetDriveTypeW
CreateFileW
WriteFile
SetFilePointerEx

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-devices-swdevice-l1-1-0

SwDeviceClose
SwDeviceCreate

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-devices-swdevice-l1-1-1

SwDeviceSetLifetime

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
ResetEvent
LeaveCriticalSection
SetEvent

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
SizeofResource
LoadLibraryExW
FreeLibrary
FindResourceExW
LoadStringW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapReAlloc
HeapSize
HeapDestroy
HeapAlloc

api-ms-win-core-synch-l1-2-0

Sleep

kernel32

lstrcmpW
UnregisterWait
RegOpenCurrentUser
RegEnumValueW
GetSystemPowerStatus
WTSGetActiveConsoleSessionId

user32

RegisterDeviceNotificationW
UnregisterDeviceNotification
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
UnregisterClassA

advapi32

AuditFree
AuditQueryPerUserPolicy
AuditQuerySystemPolicy
SetEntriesInAclW
GetExplicitEntriesFromAclW
SetSecurityInfo
EnableTrace
RegDeleteKeyW

api-ms-win-security-base-l1-1-0

GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
GetSecurityDescriptorLength
InitializeSecurityDescriptor
MakeSelfRelativeSD
SetSecurityDescriptorDacl
RevertToSelf
EqualSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
SetSecurityDescriptorSacl
FreeSid
CheckTokenMembership

api-ms-win-core-shutdown-l1-1-1

InitiateShutdownW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpdshext.dll
.dll regsvr32 windows:10 windows x64 arch:x64

97e08a13396b7920968fbd4f1481d254

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpdshext.pdb

Imports

msvcrt

memset
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
wcsncpy_s
wcsstr
_ui64tow
malloc
vswprintf_s
_vscwprintf
_wcsicmp
wcstok_s
iswspace
wcstol
calloc
free
memmove_s
_wsplitpath_s
__C_specific_handler
wcscspn
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
__CxxFrameHandler3
_CxxThrowException
logf
memcmp
memcpy
sqrtf

kernel32

CreateFileW
DelayLoadFailureHook
ResolveDelayLoadedAPI
FreeLibraryWhenCallbackReturns
TlsGetValue
AcquireSRWLockShared
ReleaseSRWLockShared
GetThreadPriority
TlsAlloc
GetCurrentThread
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
Sleep
CompareStringOrdinal
LocalFree
DeactivateActCtx
LoadLibraryW
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
GetModuleFileNameW
QueryActCtxW
OutputDebugStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
SetEvent
InitOnceBeginInitialize
InitOnceComplete
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CompareFileTime
GlobalFree
CreateThread
LocalAlloc
lstrcmpW
lstrcmpiW
LoadLibraryExW
FreeLibrary
SizeofResource
LockResource
LoadResource
FindResourceExW
GetFileAttributesW
GetSystemTime
GetTickCount64
CreateTimerQueueTimer
WaitForMultipleObjects
DeleteTimerQueueTimer
FileTimeToSystemTime
GlobalAlloc
GlobalReAlloc
SystemTimeToFileTime
GetTickCount
RaiseException
ExpandEnvironmentStringsW
CreateEventExW
DeleteFileW
SystemTimeToTzSpecificLocalTime
ReadFile
WriteFile
SetFilePointerEx
FlushFileBuffers
GetFileInformationByHandle
GlobalSize
GlobalLock
GlobalUnlock
FileTimeToLocalFileTime
GetDateFormatW
GetTimeFormatW
ReleaseActCtx
SetFileAttributesW
GetLocaleInfoEx
GetUserPreferredUILanguages
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
SetThreadpoolTimerEx
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
GetDriveTypeW
DisableThreadLibraryCalls
GetSystemDirectoryW
GetNumberFormatW
MulDiv
GetTempPathW
TzSpecificLocalTimeToSystemTime
QueryPerformanceCounter
QueryPerformanceFrequency
HeapSize
HeapReAlloc
HeapDestroy
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
ResumeThread
CallbackMayRunLong
FreeLibraryAndExitThread
TrySubmitThreadpoolCallback
SetThreadPriority
TlsSetValue

advapi32

GetTraceEnableLevel
TraceEvent
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
RegCloseKey
EventActivityIdControl
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
RegEnumKeyW
RegQueryValueExW

gdi32

DeleteObject
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetTextExtentPoint32W
GetStockObject
GetTextExtentPointW
CreateDIBSection

shlwapi

ord168
SHGetThreadRef
ord156
SHCreateStreamOnFileEx
ord8
ord9
ord7
ord10
StrRetToBufW
SHRegGetValueW
ord199
ord174
ord219
PathCombineW
SHStrDupW
PathStripPathW
PathAddBackslashW
PathAppendW
StrCmpIW
StrStrW
StrCSpnW
PathFindFileNameW
StrCmpW
ord388
ord16
StrCmpLogicalW
PathRemoveBlanksW
AssocQueryKeyW
StrFormatByteSizeW
PathRemoveExtensionW
AssocCreate
PathFindExtensionW
ord158
ord176
PathRemoveFileSpecW
SHGetValueW
ord172

user32

MsgWaitForMultipleObjectsEx
UnregisterClassA
DialogBoxParamW
InsertMenuW
RemoveMenu
GetSubMenu
TrackPopupMenu
SetFocus
SetForegroundWindow
LoadStringW
SetMenuDefaultItem
SendMessageW
SetWindowTextW
SetDlgItemTextW
EndDialog
GetDlgItem
GetWindowLongPtrW
SetWindowLongPtrW
IsDlgButtonChecked
UnhookWindowsHookEx
SendDlgItemMessageW
CheckDlgButton
EnableWindow
ShowWindow
GetWindowLongW
SetWindowLongW
GetClientRect
GetSystemMetrics
LoadImageW
GetParent
IsChild
CallNextHookEx
CreateWindowExW
SetWindowPos
SetWindowsHookExW
GetDC
ReleaseDC
GetWindowRect
ScreenToClient
SetTimer
KillTimer
PostMessageW
GetDlgCtrlID
DestroyIcon
GetWindowTextW
CopyImage
GetSysColor
GetCursorPos
DefWindowProcW
GetClassInfoW
LoadCursorW
RegisterClassW
FindWindowW
GetWindow
GetClassNameW
GetWindowThreadProcessId
SendMessageTimeoutW
SwitchToThisWindow
GetLastActivePopup
DestroyWindow
RegisterClipboardFormatW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
LoadMenuW
GetShellWindow
GetForegroundWindow

gdiplus

GdipDrawImageRectRectI
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromGraphics
GdipDrawImageRect
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFillRectangleI
GdipCreatePen1
GdipDeletePen
GdipSetSolidFillColor
GdipFillEllipseI
GdipDrawArcI
GdipCreatePath
GdipDeletePath
GdipAddPathArcI
GdipGetPathLastPoint
GdipSetClipRectI
GdipSetInterpolationMode
GdipDrawEllipseI
GdipFillPieI
GdipDrawPieI
GdipCreateBitmapFromScan0
GdipSetCompositingMode
GdipDrawLineI

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateString

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

shcore

SubscribeFeatureStateChangeNotification
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification

Exports

Exports

CDefFolderMenu_MergeMenu
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 473KB - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpnapps.dll
.dll windows:10 windows x64 arch:x64

f53b5405f80685ccb93fb97fca618c83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpnapps.pdb

Imports

msvcp_win

?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
_Query_perf_counter
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
_Query_perf_frequency
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
??0facet@locale@std@@IEAA@_K@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
??1facet@locale@std@@MEAA@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?id@?$collate@G@std@@2V0locale@2@A
?__ExceptionPtrToBool@@YA_NPEBX@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
_Wcsxfrm
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
_Wcscoll
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?good@ios_base@std@@QEBA_NXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xbad_alloc@std@@YAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_XGetLastError@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?widen@?$ctype@G@std@@QEBAGD@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

memset
wcscmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_strncpy_s
_o_strtol
_o_terminate
_o_toupper
_o_wcstoul
__CxxFrameHandler3
__C_specific_handler
_o___std_type_info_destroy_list
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
wcschr
strchr
__std_terminate
__CxxFrameHandler4
wcsrchr
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o__cexit
_o___stdio_common_vsnprintf_s
_o__callnewh
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
FindResourceExW
SizeofResource
LoadResource
LockResource
LoadStringW
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-synch-l1-1-0

CreateMutexExW
ReleaseSemaphore
InitializeSRWLock
CreateSemaphoreExW
ResetEvent
AcquireSRWLockShared
InitializeCriticalSectionEx
CreateEventW
InitializeCriticalSection
WaitForSingleObject
ReleaseMutex
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
CreateEventExW
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
SetEvent
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventProviderEnabled

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetProcessId
GetCurrentProcessId
OpenProcessToken
OpenThreadToken
GetCurrentThread
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

I_RpcBindingInqLocalClientPID
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerQueryInterface
NdrOleAllocate
CStdStubBuffer_Disconnect
NdrCStdStubBuffer2_Release
IUnknown_QueryInterface_Proxy
NdrStubCall3
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
UuidCreate
NdrStubForwardingFunction
CStdStubBuffer_Connect
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
RpcServerInqCallAttributesW
IUnknown_AddRef_Proxy

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient8
NdrProxyForwardingFunction5
ObjectStublessClient15
ObjectStublessClient23
ObjectStublessClient25
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient9
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
NdrProxyForwardingFunction4
ObjectStublessClient24
ObjectStublessClient17
CStdStubBuffer2_Connect
ObjectStublessClient6
ObjectStublessClient11
ObjectStublessClient10
CStdStubBuffer2_Disconnect
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction3
ObjectStublessClient21
ObjectStublessClient16

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal

ntdll

NtQueryWnfStateData
RtlFreeHeap
NtQueryInformationToken
NtQuerySystemInformation
RtlSubscribeWnfStateChangeNotification
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlIsMultiUsersInSessionSku
RtlGetDeviceFamilyInfoEnum
WinSqmAddToStreamEx
RtlInitUnicodeString
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-security-base-l1-1-0

IsWellKnownSid
GetTokenInformation
GetSidSubAuthority
DuplicateTokenEx
GetSidSubAuthorityCount

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabledForPackage

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList

rmclient

RmAccessCheck

combase

ord154
ord148
ord168

api-ms-win-crt-math-l1-1-0

_fdtest
ceilf

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegQueryInfoKeyW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsFileSpecW
PathIsValidCharW
PathFindFileNameW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

xmllite

CreateXmlReader
CreateXmlReaderInputWithEncodingCodePage

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

twinapi.appcore

ord3
ord2

shcore

ord223

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 744KB - Virtual size: 743KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpnclient.dll
.dll windows:10 windows x64 arch:x64

84f10d39f842495b34514b661b79cb11

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpnClient.pdb

Imports

msvcp110_win

??0id@locale@std@@QEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$codecvt@GDH@std@@MEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?in@?$codecvt@GDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAG3AEAPEAG@Z
??0?$codecvt@GDH@std@@QEAA@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?id@?$codecvt@GDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@GDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Orphan_all@_Container_base0@std@@QEAAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

msvcrt

swprintf_s
wcsrchr
_wcsicmp
wcscspn
toupper
_errno
wcstoul
memset
memmove
memcpy
memcmp
_CxxThrowException
_wcstoui64
__CxxFrameHandler3
_vsnwprintf
memcpy_s
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcschr
realloc
memmove_s
??_V@YAXPEAX@Z
sprintf_s
free
malloc
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
_itow_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
wcscmp

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
LoadResource
SizeofResource
FindResourceExW
GetModuleFileNameA
GetProcAddress
LockResource
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
ReleaseSemaphore
OpenSemaphoreW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
CreateMutexExW
EnterCriticalSection
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
HSTRING_UserSize64
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
WindowsIsStringEmpty
HSTRING_UserFree64
HSTRING_UserMarshal
WindowsDuplicateString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
HSTRING_UserMarshal64
HSTRING_UserFree
WindowsCompareStringOrdinal
WindowsSubstringWithSpecifiedLength
WindowsStringHasEmbeddedNull
HSTRING_UserSize

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
RoTransformError

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoGetApartmentType
CoTaskMemRealloc

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

ntdll

RtlGetDeviceFamilyInfoEnum
RtlIsMultiUsersInSessionSku
RtlInitUnicodeString
RtlDeriveCapabilitySidsFromName

api-ms-win-appmodel-identity-l1-2-0

AppXGetPackageCapabilities
AppXFreeMemory

api-ms-win-security-base-l1-1-0

EqualSid

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventProviderEnabled
EventWriteTransfer

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathIsFileSpecW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce
InitOnceComplete
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

combase

ord9
CStdStubBuffer_DebugServerRelease
ord7
ord5
ord32
ord34
ord33
CStdStubBuffer_AddRef
CStdStubBuffer2_QueryInterface
ord12
CStdStubBuffer_IsIIDSupported
ord6
CStdStubBuffer2_Connect
ord8
CStdStubBuffer2_Disconnect
ord14
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer2_CountRefs
ord10
ord13
ord154
NdrCStdStubBuffer2_Release
ord11

urlmon

CreateUri
CoInternetCombineUrl

oleaut32

SysFreeString
SysStringLen
VariantClear
SysAllocString

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabledForPackage

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpncore.dll
.dll windows:10 windows x64 arch:x64

9f64b9f941fd52ee4d3c9bd390c5ca66

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpncore.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wtoi
_o__wtol
memmove
_o_free
_o_malloc
_o_qsort
_o_remove
_o_strcpy_s
_o_terminate
_o_toupper
_o_towlower
_o_wcstok_s
_o_wcstoull
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
wcsrchr
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__get_errno
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
wcschr
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
__std_terminate
__CxxFrameHandler4
_o__errno
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcscmp
wcsncmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
SetEvent
CreateMutexExW
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSemaphore
InitializeSRWLock
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSection
ReleaseMutex
ResetEvent
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventSetInformation
EventUnregister
EventActivityIdControl
EventProviderEnabled
EventRegister
EventWriteTransfer

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
OpenThreadToken
TerminateProcess
GetProcessId
OpenProcessToken

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlCompareMemory
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTime
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
GetLengthSid
EqualSid
IsValidSid
CheckTokenMembership
GetTokenInformation
GetSidSubAuthority
CreateWellKnownSid

api-ms-win-core-file-l1-1-0

GetTempFileNameW
CompareFileTime
CreateDirectoryW
FindClose
GetFileAttributesW
GetFileAttributesExW
FindNextFileW
DeleteFileW
LocalFileTimeToFileTime
CreateFileW
SetFileInformationByHandle
FindFirstFileW

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegSetValueExW
RegDeleteValueW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-com-l1-1-0

CoGetMalloc
CoDisableCallCancellation
CoTaskMemRealloc
CoCreateGuid
CoEnableCallCancellation
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoUninitialize
StringFromCLSID
CoGetCallContext
CoCreateInstance
CoCancelCall
CoGetClassObject
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

oleaut32

SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString
VariantTimeToSystemTime

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchRemoveBackslash
PathAllocCanonicalize
PathCchSkipRoot

api-ms-win-core-threadpool-l1-2-0

IsThreadpoolTimerSet
CreateThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
WakeByAddressAll
WaitOnAddress
InitializeConditionVariable
Sleep
InitOnceComplete
WakeConditionVariable
InitOnceBeginInitialize

combase

ord184
ord140

msvcp_win

?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_XGetLastError@std@@YAXXZ
_Query_perf_counter
_Query_perf_frequency
_Mtx_init_in_situ
_Cnd_init_in_situ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Cnd_timedwait
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_current_owns
_Xtime_get_ticks
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_function_call@std@@YAXXZ
_Cnd_signal
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_lock
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z

ntdll

NtQueryInformationToken
NtQuerySystemInformation
RtlFreeUnicodeString
RtlFreeHeap
RtlInitUnicodeString
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlDeriveCapabilitySidsFromName
RtlDowncaseUnicodeString
RtlNtStatusToDosError
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlPublishWnfStateData
NtRaiseHardError
RtlAdjustPrivilege
RtlGetSuiteMask
WinSqmSetDWORD
WinSqmAddToStreamEx
RtlGetDeviceFamilyInfoEnum

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathIsFileSpecW
PathFindFileNameW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-string-l2-1-0

IsCharAlphaNumericW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

winsqlite3

sqlite3_column_text16
sqlite3_errcode
sqlite3_column_text
sqlite3_column_int64
sqlite3_column_int
sqlite3_bind_blob
sqlite3_bind_text16
sqlite3_bind_text
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_clear_bindings
sqlite3_free
sqlite3_exec
sqlite3_prepare_v2
sqlite3_sql
sqlite3_stmt_busy
sqlite3_next_stmt
sqlite3_column_bytes
sqlite3_config
sqlite3_close
sqlite3_errmsg
sqlite3_log
sqlite3_open_v2
sqlite3_extended_errcode
sqlite3_file_control
sqlite3_extended_result_codes
sqlite3_finalize
sqlite3_reset
sqlite3_step
sqlite3_column_blob
sqlite3_busy_timeout
sqlite3_db_handle
sqlite3_bind_int

api-ms-win-shcore-stream-l1-1-0

IStream_Write
IStream_Read
IStream_Reset
SHCreateMemStream
IStream_Size

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer
DeleteTimerQueueEx

api-ms-win-appmodel-runtime-l1-1-1

GetApplicationUserModelIdFromToken

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

winhttp

WinHttpQueryAuthSchemes
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSetOption
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSetCredentials
WinHttpOpen
WinHttpConnect
WinHttpCrackUrl

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
VirtualFree
FlushViewOfFile
VirtualAlloc
MapViewOfFile

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-appmodel-runtime-l1-1-0

ClosePackageInfo
OpenPackageInfoByFullName
PackageFamilyNameFromFullName
GetPackageInfo
GetCurrentPackageInfo
GetPackageFullName

api-ms-win-core-registry-l2-1-0

RegOpenKeyW
RegEnumKeyW
RegCreateKeyW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

urlmon

ord503
ord504

api-ms-win-crt-time-l1-1-0

clock

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-appmodel-state-l1-2-0

OpenState
OpenStateExplicit
GetStateFolder
CloseState

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

umpdc

Pdcv2ActivationClientActivate
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientRegister
Pdcv2ActivationClientUnregister

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpninprc.dll
.dll windows:10 windows x64 arch:x64

f5a67f1586d50c8fade7051299df0cba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpninprc.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__seh_filter_dll

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
DeleteCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-com-l1-1-0

CoCreateInstance

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpnpinst.exe
.exe windows:10 windows x64 arch:x64

0bfabaeb4cd73dc65e72416c4edf1553

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wpnpinst.pdb

Imports

kernel32

WriteFile
RemoveDirectoryW
SetFileTime
SetFilePointer
GetTempPathW
FindClose
CreateFileW
GetVersionExW
GetSystemDirectoryW
SetFileAttributesW
MultiByteToWideChar
FormatMessageW
LocalFileTimeToFileTime
GetLastError
GlobalAlloc
DeleteFileW
GlobalFree
CloseHandle
LoadLibraryW
HeapSetInformation
GetCurrentDirectoryW
FindFirstFileW
GetProcAddress
MoveFileExW
FreeLibrary
WideCharToMultiByte
GetTempFileNameW
DosDateTimeToFileTime
lstrcmpiW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
GetTickCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
Sleep
FindNextFileW
ReadFile
SetCurrentDirectoryW
CreateDirectoryW

user32

LoadStringW

msvcrt

memcpy
_fmode
_wcmdln
__C_specific_handler
_initterm
?terminate@@YAXXZ
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
wcsrchr
wcsstr
wcschr
_wcslwr
__setusermatherr
_commode
_XcptFilter
memset

winspool.drv

UploadPrinterDriverPackageW

cabinet

ord20
ord22
ord23

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpnprv.dll
.dll windows:10 windows x64 arch:x64

a15eefaaf310638d81371d324eb64ab0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpnprv.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__itow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__strtoui64
_o__ui64toa_s
_o__wcsdup
memmove
_o__wtoi
_o__wtol
_o_atoi
_o_calloc
_o_free
_o_isdigit
_o_isupper
_o_malloc
_o_qsort
_o_strcpy_s
_o_strncpy_s
_o_strtok_s
_o_terminate
_o_toupper
_o_wcstoul
_o_wcstoull
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
strchr
strrchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcsncmp
wcscmp
strncmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameA
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleHandleExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken

api-ms-win-core-localization-l1-2-0

GetUserGeoID
FormatMessageW
GetUserDefaultLocaleName

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
ResetEvent
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
InitializeCriticalSectionEx
CreateEventW
CreateSemaphoreExW
ReleaseMutex
CreateMutexExW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
InitOnceBeginInitialize

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventWrite
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetVersionExA

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

nlaapi

NlaIndicateReprobe

eventaggregation

EaCreateAggregatedEvent
EaDeleteAggregatedEvent

msvcp_win

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??Bid@locale@std@@QEAA_KXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_XGetLastError@std@@YAXXZ
?_Xbad_alloc@std@@YAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc
LocalAlloc
LocalFree

api-ms-win-core-threadpool-l1-2-0

CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
CreateThreadpool
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExA
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
RegGetValueW

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx
CallNtPowerInformation

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

ntdll

WinSqmAddToStreamEx
RtlPublishWnfStateData
RtlNtStatusToDosError
RtlGetVersion
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

UuidCreate

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

iphlpapi

GetIpInterfaceEntry
ConvertInterfaceIndexToLuid
GetIfEntry2
FreeMibTable
GetBestInterfaceEx
GetIpInterfaceTable
ConvertInterfaceLuidToGuid

sspicli

InitSecurityInterfaceW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

xmllite

CreateXmlReader
CreateXmlReaderInputWithEncodingCodePage

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-security-base-l1-1-0

IsValidSid
GetTokenInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

umpdc

Pdcv2ActivationClientRegister
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientActivate
Pdcv2ActivationClientDeactivate

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 534KB - Virtual size: 534KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpnservice.dll
.dll windows:10 windows x64 arch:x64

9c17d4f3776fbf197fdd08b64bd8eb7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WpnService.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcstoui64
_o_free
_o_malloc
_o_wcstoull
__C_specific_handler
__CxxFrameHandler3
_o__errno
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

ResetEvent
EnterCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
LeaveCriticalSection
CreateEventExW
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateEventW
CreateMutexExW
SetEvent

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
OpenThreadToken

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation

api-ms-win-core-com-l1-1-0

CoImpersonateClient
CLSIDFromString
CoCreateInstance
CoRevertToSelf
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateGuid
CoRegisterClassObject
CoRevokeClassObject
CoDisconnectContext
CoResumeClassObjects
CoFreeUnusedLibrariesEx

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
InitializeConditionVariable
WakeConditionVariable

ntdll

RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetDeviceFamilyInfoEnum
RtlIsMultiUsersInSessionSku
RtlNtStatusToDosError
RtlInitializeSidEx

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

combase

ord66
ord67
ord68

msvcp_win

?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
DeleteTimerQueueEx
CreateTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueTimer

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-com-l1-1-1

RoGetAgileReference

oleaut32

SysFreeString
SysAllocString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetTokenInformation
IsValidSid
CheckTokenMembership

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpnsruprov.dll
.dll windows:10 windows x64 arch:x64

2ec8ac6ce8aa3440e84435ae2d5ece1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpnsruprov.pdb

Imports

msvcrt

?what@exception@@UEBAPEBDXZ
_CxxThrowException
_onexit
__dllonexit
_unlock
_lock
memset
memcpy
__C_specific_handler
_initterm
memmove
malloc
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
free
_amsg_exit
__CxxFrameHandler3
_XcptFilter
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
toupper
_callnewh
_purecall
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
RegisterTraceGuidsW
TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoRegisterClassObject
CoDisconnectObject
CoTaskMemFree
CoRevokeClassObject
CoRevertToSelf
CoTaskMemAlloc
CoImpersonateClient
CoUninitialize

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObject
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetLengthSid
IsValidSid

ntdll

RtlAcquireSRWLockExclusive
RtlCopySid
RtlLengthSid
RtlFreeSid
RtlEqualSid
RtlRbRemoveNode
RtlRbInsertNodeEx
RtlDeleteCriticalSection
RtlReleaseSRWLockExclusive
RtlInitializeCriticalSection
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlAllocateHeap
RtlFreeHeap
RtlInitializeSRWLock

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
CreateThread
OpenThreadToken
GetCurrentProcess
TerminateProcess
GetCurrentThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-heap-l2-1-0

LocalAlloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
SruInitializeProvider
SruUninitializeProvider

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpr.config.xml
.xml
Ex_PE_v3.1.9/CMap/libs/wpr.exe
.exe windows:10 windows x64 arch:x64

9af399d9b7d74da7faafe983798abed7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WPR.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcscmp
wcsncmp
wcsspn
wcscspn

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wfullpath
_o__wtol
_o_calloc
_o_exit
_o_fflush
_o_free
_o_iswalpha
_o_iswspace
_o_malloc
_o_terminate
_o_wcstoul
_o_wmemcpy_s
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___stdio_common_vfprintf
_o___std_exception_destroy
_o___std_exception_copy
_o__exit
_o___p__commode
_o__crt_atexit
_o___p___wargv
_o___p___argc
_o__configure_wide_argv
_o___acrt_iob_func
_o__configthreadlocale
wcsstr
wcsrchr
_o__errno
wcschr
__C_specific_handler
__CxxFrameHandler3
memcmp
_o__wcsnicmp
memcpy

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
GetModuleHandleW
SizeofResource
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleExW
FindResourceExW
GetModuleFileNameA
LoadResource
LockResource

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ReleaseMutex
CreateEventW
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
ResetEvent
CreateMutexExW
CreateSemaphoreExW
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapAlloc
HeapFree
HeapSize
HeapReAlloc
HeapDestroy
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
SetErrorMode
RaiseException
UnhandledExceptionFilter

oleaut32

SysStringByteLen
SysAllocStringLen
LoadRegTypeLi
CreateErrorInfo
LoadTypeLi
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringLen

api-ms-win-core-com-l1-1-0

IIDFromString
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoInitializeEx

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
FormatMessageW
SetThreadPreferredUILanguages

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-1-0

FindClose
GetFileAttributesW
DeleteFileW
RemoveDirectoryW
FindFirstFileW
CreateDirectoryW
SetFileAttributesW
FindNextFileW
CreateFileW
GetFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-kernel32-legacy-l1-1-0

FindResourceW
GetComputerNameW
LoadLibraryW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-wow64-l1-1-0

Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process

api-ms-win-eventing-controller-l1-1-0

QueryAllTracesW
EnumerateTraceGuidsEx

ntdll

RtlAdjustPrivilege
RtlGUIDFromString
RtlInitUnicodeString
NtSetSystemInformation
NtQuerySystemInformation
RtlFreeUnicodeString
NtSetIntervalProfile
NtQueryIntervalProfile
RtlGetVersion
NtSetInformationFile
RtlStringFromGUID

api-ms-win-core-memory-l1-1-0

MapViewOfFileEx
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathSkipRootW
PathAppendW
PathStripPathW
PathRemoveFileSpecW
PathQuoteSpacesW
PathAddBackslashW

windowsperformancerecordercontrol

WPRCRemoveLogging
WPRCControlLogging
WPRCFormatError
WPRCCreateInstanceUnderInstanceName

xmllite

CreateXmlReader

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wpx.dll
.dll windows:10 windows x64 arch:x64

6ad12fec4ee6558e1ea2afa1760b186b

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:a6:06:bc:04:e5:ba:b4:69:f7:7c:f8:32:6e:00:a0:da:b2:4f:de:16:2d:de:1c:04:bd:50:94:b4:dc:a0:a6
Signer

Actual PE Digest

c4:a6:06:bc:04:e5:ba:b4:69:f7:7c:f8:32:6e:00:a0:da:b2:4f:de:16:2d:de:1c:04:bd:50:94:b4:dc:a0:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wpx.pdb

Imports

msvcrt

??0exception@@QEAA@XZ
_vsnprintf_s
tolower
wcsspn
wcscspn
iswdigit
_wtoi
free
??0exception@@QEAA@AEBQEBD@Z
_aligned_free
_aligned_malloc
wcsnlen
wcscat_s
wcsncpy_s
_wcsnicmp
towupper
_vsnwprintf
wcspbrk
wprintf
_wtoi64
_wcsicmp
vswprintf_s
wcsstr
wcschr
wcsrchr
memcpy_s
iswspace
_vsnwprintf_s
_vscwprintf
wcscpy_s
_purecall
calloc
memmove_s
__CxxFrameHandler3
?terminate@@YAXXZ
memset
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
memmove
memcpy
memcmp
__RTDynamicCast
wcscmp

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetTickCount
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
TlsSetValue
GetFinalPathNameByHandleW
ReadFile
GetFileSizeEx
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
HeapFree
GetProcessHeap
HeapAlloc
SizeofResource
LockResource
LoadResource
FindResourceExW
GetTempPathW
GetLastError
GetFileAttributesW
GetTempFileNameW
CreateFileW
FindResourceW
MultiByteToWideChar
FreeResource
GetWindowsDirectoryW
LocalFree
OutputDebugStringW
FormatMessageW
IsDebuggerPresent
DeleteFileW
MoveFileExW
GetModuleFileNameA
CreateSemaphoreExW
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
GetProcAddress
CreateMutexExW
GetModuleHandleW
DebugBreak
IsWow64Process
HeapSize
HeapReAlloc
HeapDestroy
InitializeCriticalSection
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection

ole32

CoCreateInstance

shlwapi

StrToIntW
StrCmpW
PathFileExistsW

oleaut32

SysAllocString
SysFreeString

rpcrt4

UuidFromStringW

wimgapi

WIMGetImageCount
WIMLoadImage
WIMGetImageInformation
WIMExtractImagePath
WIMCreateFile
WIMCloseHandle
WIMSetTemporaryPath

advapi32

IsValidSecurityDescriptor

ntdll

RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlNumberOfSetBits
RtlRunOnceBeginInitialize
RtlRunOnceComplete
RtlUpcaseUnicodeChar
RtlNtStatusToDosError
RtlFindNextForwardRunClear

Exports

Exports

WpxCreateConfig
WpxCreateWriteOpt
WpxGetAnswerFileType
WpxGetDeplSettings
WpxResetDeplSettings
WpxSetDeplSettings
WpxSetLogger
WpxSetScratchDirectory

Sections

.text
Size: 646KB - Virtual size: 645KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 375KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/write.exe
.exe windows:10 windows x64 arch:x64

90a23f469ba0443719430cba4569b220

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

write.pdb

Imports

shell32

ShellExecuteW

kernel32

TerminateProcess
GetCurrentProcess
GetStartupInfoW
HeapSetInformation
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
Sleep

msvcrt

_commode
?terminate@@YAXXZ
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/ws2_32.dll
.dll windows:10 windows x64 arch:x64

6eee61ef7874aa59d1a3452c72e61d5c

Code Sign

33:00:00:02:5d:74:2a:12:5a:15:1b:70:74:00:00:00:00:02:5d
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

31-01-2020 19:26

Not After

22-01-2021 19:26

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:11:45:a5:08:ed:ef:b1:ee:ca:f4:19:3f:eb:dd:87:6b:19:85:33:0b:60:b1:a8:70:23:dc:e3:58:ac:df:c0
Signer

Actual PE Digest

9f:11:45:a5:08:ed:ef:b1:ee:ca:f4:19:3f:eb:dd:87:6b:19:85:33:0b:60:b1:a8:70:23:dc:e3:58:ac:df:c0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ws2_32.pdb

Imports

api-ms-win-core-crt-l1-1-0

memcmp
strrchr
memcpy
memset
strcmp
_wcsicmp
wcsncmp
towupper
wcscpy_s
strcpy_s
atoi
strchr
_stricmp
wcsstr
_vsnprintf_s
strtoul
sprintf_s
memcpy_s
_wcsnicmp
wcschr
_vsnwprintf_s
isspace
__isascii
__C_specific_handler

api-ms-win-core-crt-l2-1-0

__dllonexit3
exit
hgets
_initterm_e
_initterm
_onexit

ntdll

EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlCompareMemory
EtwEventEnabled
EtwEventWrite
RtlIpv6StringToAddressExW
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExA
RtlIpv6AddressToStringExA
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
RtlIpv6StringToAddressA
RtlIpv4StringToAddressA
EtwTraceMessageVa
EtwTraceMessage
NtCreateFile
RtlUnhandledExceptionFilter
RtlAllocateHeap
WinSqmIsOptedIn
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnicodeStringToInteger
RtlInitUnicodeStringEx
RtlGetNtProductType
NtQueryDirectoryFile
NtOpenFile
NtWaitForSingleObject
NtFsControlFile
NtCreateNamedPipeFile
NtLoadDriver
RtlAdjustPrivilege
RtlImpersonateSelf
NtDelayExecution
NtDeviceIoControlFile
NtClose
RtlNtStatusToDosError
RtlInitUnicodeString

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
OpenThreadToken
ResumeThread
GetCurrentProcessId
SwitchToThread
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
QueueUserAPC
CreateThread
TerminateProcess
TlsAlloc
SetThreadToken
TerminateThread
OpenProcessToken
TlsGetValue
TlsFree

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceExecuteOnce
SleepConditionVariableCS
Sleep
InitializeConditionVariable

api-ms-win-core-handle-l1-1-0

GetHandleInformation
DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
CreateEventW
ReleaseMutex
CreateMutexA
SetEvent
ResetEvent
CreateEventA
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjectsEx

api-ms-win-core-libraryloader-l1-2-0

LoadStringA
FreeLibraryAndExitThread
GetModuleHandleExA
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
LoadLibraryExA
GetModuleFileNameA
FreeLibrary
GetModuleHandleA
LoadStringW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks

api-ms-win-security-base-l1-1-0

AddAccessDeniedAce
SetSecurityDescriptorDacl
GetTokenInformation
InitializeSecurityDescriptor
EqualSid
GetAce
GetAclInformation
GetLengthSid
AddAccessAllowedAce
FreeSid
AllocateAndInitializeSid
RevertToSelf
IsValidSid
GetSecurityDescriptorDacl
ImpersonateLoggedOnUser
InitializeAcl
CopySid
CheckTokenMembership

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
HeapReAlloc

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExA
RegOpenKeyExW
RegEnumKeyExA
RegDeleteKeyExA
RegOpenKeyExA
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegDeleteTreeA
RegCreateKeyExA
RegNotifyChangeKeyValue
RegSetValueExA
RegGetKeySecurity

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsA
GetCommandLineW
GetEnvironmentVariableA
ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
LocalAlloc
GlobalFree

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
GetComputerNameExA
GetSystemDirectoryA
GetComputerNameExW

api-ms-win-core-file-l1-1-0

CreateFileA

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA
lstrlenA

api-ms-win-core-kernel32-legacy-l1-1-0

PulseEvent

rpcrt4

UuidCreate
RpcBindingVectorFree
RpcServerUnregisterIfEx
RpcServerUseProtseqW
RpcBindingInqObject
RpcServerUnregisterIf
RpcAsyncCompleteCall
RpcServerRegisterIfEx
RpcServerListen
RpcEpUnregister
RpcEpRegisterW
RpcServerInqBindings
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
I_RpcBindingInqTransportType
RpcRevertToSelfEx
RpcImpersonateClient
RpcRevertToSelf
RpcServerInqCallAttributesW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

FreeAddrInfoEx
FreeAddrInfoExW
FreeAddrInfoW
GetAddrInfoExA
GetAddrInfoExCancel
GetAddrInfoExOverlappedResult
GetAddrInfoExW
GetAddrInfoW
GetHostNameW
GetNameInfoW
InetNtopW
InetPtonW
SetAddrInfoExA
SetAddrInfoExW
WEP
WPUCompleteOverlappedRequest
WPUGetProviderPathEx
WSAAccept
WSAAddressToStringA
WSAAddressToStringW
WSAAdvertiseProvider
WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetServByName
WSAAsyncGetServByPort
WSAAsyncSelect
WSACancelAsyncRequest
WSACancelBlockingCall
WSACleanup
WSACloseEvent
WSAConnect
WSAConnectByList
WSAConnectByNameA
WSAConnectByNameW
WSACreateEvent
WSADuplicateSocketA
WSADuplicateSocketW
WSAEnumNameSpaceProvidersA
WSAEnumNameSpaceProvidersExA
WSAEnumNameSpaceProvidersExW
WSAEnumNameSpaceProvidersW
WSAEnumNetworkEvents
WSAEnumProtocolsA
WSAEnumProtocolsW
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAGetQOSByName
WSAGetServiceClassInfoA
WSAGetServiceClassInfoW
WSAGetServiceClassNameByClassIdA
WSAGetServiceClassNameByClassIdW
WSAHtonl
WSAHtons
WSAInstallServiceClassA
WSAInstallServiceClassW
WSAIoctl
WSAIsBlocking
WSAJoinLeaf
WSALookupServiceBeginA
WSALookupServiceBeginW
WSALookupServiceEnd
WSALookupServiceNextA
WSALookupServiceNextW
WSANSPIoctl
WSANtohl
WSANtohs
WSAPoll
WSAProviderCompleteAsyncCall
WSAProviderConfigChange
WSARecv
WSARecvDisconnect
WSARecvFrom
WSARemoveServiceClass
WSAResetEvent
WSASend
WSASendDisconnect
WSASendMsg
WSASendTo
WSASetBlockingHook
WSASetEvent
WSASetLastError
WSASetServiceA
WSASetServiceW
WSASocketA
WSASocketW
WSAStartup
WSAStringToAddressA
WSAStringToAddressW
WSAUnadvertiseProvider
WSAUnhookBlockingHook
WSAWaitForMultipleEvents
WSApSetPostRoutine
WSCDeinstallProvider
WSCDeinstallProvider32
WSCDeinstallProviderEx
WSCEnableNSProvider
WSCEnableNSProvider32
WSCEnumNameSpaceProviders32
WSCEnumNameSpaceProvidersEx32
WSCEnumProtocols
WSCEnumProtocols32
WSCEnumProtocolsEx
WSCGetApplicationCategory
WSCGetApplicationCategoryEx
WSCGetProviderInfo
WSCGetProviderInfo32
WSCGetProviderPath
WSCGetProviderPath32
WSCInstallNameSpace
WSCInstallNameSpace32
WSCInstallNameSpaceEx
WSCInstallNameSpaceEx2
WSCInstallNameSpaceEx32
WSCInstallProvider
WSCInstallProvider64_32
WSCInstallProviderAndChains64_32
WSCInstallProviderEx
WSCSetApplicationCategory
WSCSetApplicationCategoryEx
WSCSetProviderInfo
WSCSetProviderInfo32
WSCUnInstallNameSpace
WSCUnInstallNameSpace32
WSCUnInstallNameSpaceEx2
WSCUpdateProvider
WSCUpdateProvider32
WSCUpdateProviderEx
WSCWriteNameSpaceOrder
WSCWriteNameSpaceOrder32
WSCWriteProviderOrder
WSCWriteProviderOrder32
WSCWriteProviderOrderEx
WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification
WahWriteLSPEvent
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getprotobyname
getprotobynumber
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/ws2help.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ws2help.pdb

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification
WahWriteLSPEvent

Sections

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wscadminui.exe
.exe windows:10 windows x64 arch:x64

95dfb21a6aa7374716fd58473502a86f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wscadminui.pdb

Imports

msvcrt

_wcsicmp
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter

wscapi

wscLaunchAdminMakeDefaultUI

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wscapi.dll
.dll windows:10 windows x64 arch:x64

2fa0dacb2f334f951353fb080d58d3a3

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:fc:b7:71:f5:75:af:92:e3:58:de:c8:28:23:d9:30:b3:d4:f4:ae:6b:31:b1:ad:3d:3f:03:fe:b3:e9:a0:13
Signer

Actual PE Digest

41:fc:b7:71:f5:75:af:92:e3:58:de:c8:28:23:d9:30:b3:d4:f4:ae:6b:31:b1:ad:3d:3f:03:fe:b3:e9:a0:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WscApi.pdb

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_wcsicmp
_wtoi
wcsstr
wcsncpy_s
wcsncmp
_wcsnicmp
wcstok_s
_vsnwprintf
wcscat_s
memset
sprintf_s
memmove_s
memcpy_s
memcmp
__CxxFrameHandler3
free
__C_specific_handler
_purecall
??0exception@@QEAA@AEBV0@@Z
wcscmp

ntdll

WinSqmAddToStreamEx
WinSqmAddToStream
EtwTraceMessage
EtwGetTraceLoggerHandle
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel

urlmon

CoInternetCreateZoneManager

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo

rpcrt4

UuidCreate
NdrDllCanUnloadNow
NdrClientCall3
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
RpcExceptionFilter
NdrDllGetClassObject
CStdStubBuffer_IsIIDSupported
NdrStubCall3
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
RpcSsDestroyClientContext
NdrCStdStubBuffer2_Release
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
CStdStubBuffer_Invoke

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient17
ObjectStublessClient9
ObjectStublessClient16
ObjectStublessClient12
NdrProxyForwardingFunction3
ObjectStublessClient8
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient19
CStdStubBuffer2_Connect
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction6
ObjectStublessClient15
ObjectStublessClient14
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient10

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
SetWaitableTimer
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegDeleteKeyExW
RegNotifyChangeKeyValue
RegCloseKey
RegEnumValueW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptGetProperty
BCryptCreateHash

crypt32

CryptBinaryToStringW

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
DisableThreadLibraryCalls
LoadResource
SizeofResource
LockResource
GetModuleFileNameW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
CreateThread
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
HeapSize
HeapDestroy

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
QueueUserWorkItem

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

user32

LoadStringW
UnregisterClassA
DestroyWindow
SetCursor
DispatchMessageW
SetWindowLongPtrW
GetWindowLongPtrW
GetMessageW
DefWindowProcW
RegisterClassExW
LoadCursorW
PostMessageW
CreateWindowExW
TranslateMessage
DestroyCursor

kernel32

SystemTimeToFileTime
RegQueryValueExW
GetUserDefaultLangID
CreateActCtxW
ActivateActCtx
DeactivateActCtx
ReleaseActCtx
GetSystemTime
GetProcessMitigationPolicy
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
SetLastError
FormatMessageW
CreateFileW
FreeLibrary
LoadLibraryExW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CLSID_WSCDefaultProduct
CLSID_WSCProductList
DllCanUnloadNow
DllGetClassObject
IID_IWSCDefaultProduct
IID_IWSCProductList
IID_IWscProduct
LIBID_wscAPILib
WscGetAntiMalwareUri
WscGetSecurityProviderHealth
WscQueryAntiMalwareUri
WscRegisterForChanges
WscRegisterForUserNotifications
WscUnRegisterChanges
wscAntiSpywareGetStatus
wscAntiVirusExpiredBeyondThreshold
wscAntiVirusGetStatus
wscAutoUpdatesEnableScheduledMode
wscAutoUpdatesGetStatus
wscFirewallGetStatus
wscGeneralSecurityGetStatus
wscGetAlertStatus
wscIcfEnable
wscIeSettingsFix
wscInitiateOfflineCleaning
wscIsDefenderAntivirusSupported
wscLaunchAdminMakeDefaultUI
wscLuaSettingsFix
wscMakeDefaultProductRequest
wscNotifyUserForNearExpiration
wscOverrideComponentStatus
wscPing
wscProductInfoFree
wscRegisterChangeNotification
wscRegisterSecurityProduct
wscSetDefaultProduct
wscShowAMSCN
wscUnRegisterChangeNotification
wscUnregisterSecurityProduct
wscUpdateProductStatus
wscUpdateProductSubStatus

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wscinterop.dll
.dll windows:10 windows x64 arch:x64

17e7b31f1b6f213de15fb58ab9643c18

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wscinterop.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBDH@Z
malloc
memmove
_vsnwprintf
_XcptFilter
memcpy_s
_vscwprintf
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
vswprintf_s
?what@exception@@UEBAPEBDXZ
__C_specific_handler
_CxxThrowException
??1exception@@UEAA@XZ
_purecall
_amsg_exit
_initterm
calloc
memmove_s
free
??0exception@@QEAA@AEBQEBD@Z
memcpy
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
wcsncpy_s
_wtoi
_callnewh
__CxxFrameHandler3
memset
wcscmp

ntdll

EtwTraceMessage
WinSqmAddToStream
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LockResource
DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleExW
SizeofResource
LoadResource
GetModuleFileNameA
FindResourceExW
EnumResourceNamesExW
GetModuleFileNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-l1-1-0

HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateEventW
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockShared
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockShared
InitializeSRWLock

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

user32

PostMessageW
DestroyIcon
CreateIconIndirect
GetIconInfo
UnregisterClassA

gdi32

DeleteObject

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegGetValueW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wscisvif.dll
.dll windows:10 windows x64 arch:x64

0f939e15f54da7f8cf46f4a700cca2ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WscIsvIf.pdb

Imports

msvcrt

_XcptFilter
_amsg_exit
_callnewh
malloc
free
_purecall
__C_specific_handler
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
__CxxFrameHandler3
_CxxThrowException

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
LeaveCriticalSection
CreateThreadpool
GetLastError
CreateThreadpoolCleanupGroup
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpool

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysAllocString
SysFreeString

advapi32

GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceLoggerHandle

wscapi

wscUnregisterSecurityProduct
wscMakeDefaultProductRequest
wscInitiateOfflineCleaning
wscNotifyUserForNearExpiration
wscUpdateProductSubStatus
wscUpdateProductStatus
WscRegisterForChanges
WscUnRegisterChanges
wscRegisterSecurityProduct

api-ms-win-core-com-l1-1-0

CoCreateInstance

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wscproxystub.dll
.dll windows:10 windows x64 arch:x64

ce00e8fd5f5240aa3ab2f7ec367dc5a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WscProxyStub.pdb

Imports

msvcrt

malloc
_amsg_exit
_initterm
__C_specific_handler
_XcptFilter
free
memcmp

kernel32

QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
Sleep

rpcrt4

NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrDllCanUnloadNow
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported

oleaut32

BSTR_UserMarshal
BSTR_UserMarshal64
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal64
BSTR_UserUnmarshal
BSTR_UserSize64
BSTR_UserFree64

combase

ord7
ord8
ord3
ord5
ord4
ord6
ord2
ord10
ord11
ord9

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wscript.exe
.exe windows:10 windows x64 arch:x64

e01813c5c2502009fb8afaddc70ac8bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wscript.pdb

Imports

msvcrt

_swab
swprintf_s
strcpy_s
wcsrchr
_itow
_itow_s
memset
free
wcscat_s
_vsnwprintf
_wcsicmp
_wcsnicmp
wcsncmp
bsearch
_callnewh
malloc
sprintf_s
wcscpy_s
_vsnprintf
_beginthread
_endthread
__C_specific_handler
memcmp
memcpy
memmove
strcmp

oleaut32

VariantCopy
CreateErrorInfo
VariantInit
SafeArrayCreate
SafeArrayPutElement
SafeArrayGetUBound
SafeArrayDestroy
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
SysAllocString
LoadRegTypeLi
SysFreeString
SysStringLen
SysAllocStringLen
VariantChangeType
SafeArrayCopy
VariantClear
SafeArrayGetLBound
SafeArrayGetElement
SysAllocStringByteLen
SetErrorInfo

kernel32

DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
GetPrivateProfileIntW
GetModuleHandleA
GetStartupInfoA
ExitProcess
LeaveCriticalSection
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetLocaleInfoW
GetCommandLineW
GetProcessHeap
HeapAlloc
GetCommandLineA
MultiByteToWideChar
EnterCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
WideCharToMultiByte
CreateFileW
HeapReAlloc
HeapFree
UnmapViewOfFile
CreateFileMappingA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetFullPathNameW
GetCPInfo
GetFileAttributesA
GetPrivateProfileStringW
GetACP
GetFileAttributesW
FindClose
FindFirstFileA
FindFirstFileW
GetConsoleMode
GetStdHandle
CreateEventA
CreateThread
SetEvent
GetUserDefaultLCID
FlushFileBuffers
GetTempFileNameA
GetSystemDirectoryA
CreateFileA
GetTempPathA
GetFileSize
LoadLibraryExA
WriteFile
MapViewOfFile
SearchPathW
GetVersionExA
CloseHandle
SetLastError
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetModuleFileNameW
GetVersionExW
FindResourceExW
LoadResource
GetFullPathNameA
FormatMessageA
LocalFree
FormatMessageW
GetProcAddress
CreateFileMappingW
FreeLibrary
LocalAlloc
LoadLibraryExW

user32

LoadStringW
IsWindowVisible
PostMessageA
MsgWaitForMultipleObjectsEx
GetClassNameA
SetTimer
RegisterClassA
DefWindowProcA
CreateWindowExA
TranslateMessage
GetClassInfoA
SendMessageA
EnumThreadWindows
PeekMessageA
PostThreadMessageA
GetWindowLongPtrA
GetMessageA
MsgWaitForMultipleObjects
LoadStringA
DispatchMessageA
KillTimer
PostQuitMessage
GetParent
SetWindowLongPtrA
MessageBoxW
GetActiveWindow
CharNextA

ole32

CoGetTreatAsClass
CreateFileMoniker
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
CreateBindCtx
CoInitializeSecurity
CLSIDFromProgID
CoRegisterMessageFilter
CLSIDFromString
CoRevokeClassObject
CoGetMalloc
CoRegisterClassObject
StringFromCLSID
MkParseDisplayName
CoGetClassObject

advapi32

RegQueryValueExA
LookupAccountNameW
RegOpenKeyExA
ReportEventW
RegisterEventSourceW
RegEnumKeyExA
IsTextUnicode
GetUserNameW
DeregisterEventSource
ImpersonateLoggedOnUser
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyA
RegSetValueA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExW
RegQueryValueA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeW

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wscsvc.dll
.dll windows:10 windows x64 arch:x64

e1f370dd67bc9a058ba6946edcc07630

Code Sign

33:00:00:03:f1:30:7f:58:4e:59:80:81:54:00:00:00:00:03:f1
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13-10-2022 19:43

Not After

11-10-2023 19:43

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a2:4e:cd:ab:ad:64:27:9d:be:f1:56:e6:03:30:41:dd:53:a3:54:12:6a:a6:df:23:ad:9f:2d:1a:c0:c5:41:a5
Signer

Actual PE Digest

a2:4e:cd:ab:ad:64:27:9d:be:f1:56:e6:03:30:41:dd:53:a3:54:12:6a:a6:df:23:ad:9f:2d:1a:c0:c5:41:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wscsvc.pdb

Imports

msvcrt

memmove_s
memmove
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
_vscwprintf
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_XcptFilter
_amsg_exit
free
_initterm
_CxxThrowException
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_callnewh
??1type_info@@UEAA@XZ
wcsnlen
memcmp
malloc
_ultow_s
wcscmp
wcstok_s
__C_specific_handler
memset
_wcsicmp
memcpy
_onexit
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z

ntdll

WinSqmIsOptedIn
WinSqmSetDWORD
WinSqmAddToStream
ShipAssertMsgA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlNtStatusToDosErrorNoTeb
RtlPublishWnfStateData
EtwEventWrite
EtwTraceMessage
NtQueryInformationProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameW
FreeLibrary

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
InitializeCriticalSectionEx
LeaveCriticalSection
CancelWaitableTimer
CreateMutexExW
AcquireSRWLockShared
ReleaseSemaphore
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
SetEvent
WaitForMultipleObjectsEx
OpenSemaphoreW
SetWaitableTimer
ReleaseSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateEventW
ReleaseMutex
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

CreateThread
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
CreateProcessW
GetExitCodeProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

rpcrt4

NdrServerCallAll
RpcServerRegisterAuthInfoW
RpcEpRegisterW
RpcEpUnregister
RpcBindingVectorFree
RpcServerInqDefaultPrincNameW
RpcServerUnregisterIfEx
RpcServerRegisterIfEx
RpcServerUseProtseqW
RpcRevertToSelf
RpcRaiseException
RpcImpersonateClient
RpcStringFreeW
RpcServerInqCallAttributesW
RpcServerListen
NdrServerCall2
RpcServerInqBindings

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegGetValueW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventWrite
EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW
WaitForMultipleObjects

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

GetFileSizeEx
GetFileAttributesW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

firewallapi

FwActivate
FWChangeNotificationDestroy
FWChangeNotificationCreate
FwAnalyzeFirewallPolicy

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait

kernel32

GetSystemTime
GetCurrentThread
GetPrivateProfileStringW
GetSystemDirectoryW
SystemTimeToFileTime
CompareFileTime
OpenProcess
QueryFullProcessImageNameW
CreateFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetUserDefaultLangID

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
FreeSid
CheckTokenMembership
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

netutils

NetApiBufferFree

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wscui.cpl
.dll windows:10 windows x64 arch:x64

92e0cab2a964873bbd3f32c0f681cbd0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wscui.pdb

Imports

msvcrt

?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1exception@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
memset
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
_vsnwprintf
_wcsicmp
wcsstr
free
malloc
_wtoi
memmove_s
memcpy_s
_purecall
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z

ntdll

WinSqmAddToStreamEx
EtwTraceMessage
WinSqmAddToStream
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwEventWrite
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapDestroy
HeapFree
GetProcessHeap
HeapAlloc
HeapSize

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
LoadStringW
GetModuleFileNameW
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
SizeofResource
FindResourceExW
LoadResource
LockResource

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
CreateThread
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
FreeSid
CheckTokenMembership
AdjustTokenPrivileges

user32

DestroyCursor
UnregisterClassA
FindWindowExW
SetCursor
LoadCursorW
IsWindow
RegisterWindowMessageW
SendMessageW

gdiplus

GdiplusStartup
GdiplusShutdown

combase

CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_CountRefs
ord2
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
ord3
NdrCStdStubBuffer_Release

wscapi

wscIcfEnable
wscIeSettingsFix
wscLuaSettingsFix
wscAntiVirusGetStatus
wscAntiSpywareGetStatus
wscProductInfoFree

shell32

ShellExecuteExW
ShellExecuteW

shlwapi

PathFileExistsW
ord487
StrCmpNW

rpcrt4

IUnknown_AddRef_Proxy
NdrOleFree
NdrOleAllocate
NdrDllCanUnloadNow
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
IUnknown_Release_Proxy

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

kernel32

CreateActCtxW
FindActCtxSectionStringW
QueryActCtxW
DeactivateActCtx
ActivateActCtx
SetProcessWorkingSetSize
ReleaseActCtx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DoesActionRequireElevation
ExecuteSecurityActionHandler
ExecuteSecurityActionHandlerById
GetSecondaryListViewHwnd

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsdchngr.dll
.dll windows:10 windows x64 arch:x64

aec2f10f856da847bb953f9ab02df651

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WSDChngr.pdb

Imports

msvcrt

_lock
_unlock
__C_specific_handler
_initterm
_onexit
memmove
memcpy
__dllonexit
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_wcsicmp
memcpy_s
_vsnwprintf
memset

ole32

PropVariantClear
CLSIDFromString

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
OpenSemaphoreW
ReleaseSemaphore
EnterCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
CreateMutexExW
CreateSemaphoreExW
CreateEventW
LeaveCriticalSection
AcquireSRWLockExclusive
SetEvent
InitializeCriticalSectionAndSpinCount

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

deviceassociation

DafChallengeDevicePresence
DafCreateChallengeContext
DafCloseChallengeContext

api-ms-win-devices-query-l1-1-1

DevCreateObjectQueryEx

api-ms-win-devices-query-l1-1-0

DevCloseObjectQuery
DevGetObjectProperties
DevFreeObjectProperties

Exports

Exports

WSDCHNGRChallengeDeviceClass
WSDCHNGRInitialize
WSDCHNGRRegisterDeviceToChallenge
WSDCHNGRRegisterDeviceToChallengeByGlobalId
WSDCHNGRRemoveDevice
WSDCHNGRShutdown

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsecedit.dll
.dll windows:10 windows x64 arch:x64

4c81d95ec1f0be8461864ad026c1e140

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsecedit.pdb

Imports

mfc42u

ord6351
ord337
ord3531
ord3911
ord1056
ord4523
ord3419
ord3397
ord4602
ord2902
ord4485
ord6738
ord655
ord1059
ord4582
ord1749
ord2393
ord4424
ord6102
ord2586
ord4741
ord3743
ord1774
ord6801
ord2425
ord2024
ord4543
ord2592
ord4746
ord3805
ord3774
ord310
ord826
ord4027
ord2922
ord5980
ord2898
ord567
ord1005
ord6543
ord6223
ord3872
ord3754
ord1043
ord629
ord599
ord6734
ord4481
ord2909
ord372
ord2518
ord3598
ord1035
ord3867
ord996
ord3894
ord1441
ord371
ord877
ord5602
ord3440
ord5807
ord1977
ord5905
ord464
ord5880
ord1658
ord4328
ord3256
ord6823
ord5912
ord4548
ord1949
ord663
ord1066
ord2753
ord4550
ord1123
ord6054
ord5066
ord3180
ord4599
ord3920
ord3652
ord1443
ord1830
ord4553
ord5226
ord5244
ord4720
ord5426
ord4968
ord5123
ord5083
ord4967
ord4996
ord5487
ord6531
ord6533
ord4131
ord4127
ord4130
ord3953
ord6612
ord4257
ord4262
ord6395
ord1124
ord2422
ord2023
ord4542
ord2589
ord4743
ord3751
ord832
ord2593
ord4747
ord3501
ord3806
ord912
ord6385
ord408
ord904
ord2106
ord4722
ord4699
ord1906
ord551
ord999
ord549
ord3517
ord3868
ord336
ord851
ord1646
ord6577
ord6238
ord2776
ord2461
ord613
ord1036
ord2133
ord6379
ord6455
ord6457
ord5990
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord2329
ord1033
ord3892
ord3535
ord5712
ord1778
ord6440
ord2371
ord6418
ord6767
ord2384
ord2328
ord6226
ord6614
ord2094
ord4721
ord5245
ord5702
ord624
ord5229
ord3761
ord4217
ord6328
ord6147
ord5077
ord4557
ord339
ord2857
ord2801
ord621
ord1286
ord2845
ord2784
ord2859
ord6813
ord4836
ord2559
ord2515
ord6071
ord4191
ord1388
ord5615
ord2412
ord3468
ord5722
ord5724
ord4368
ord5065
ord5730
ord5711
ord6053
ord3534
ord4983
ord4770
ord3916
ord1426
ord2752
ord4214
ord1063
ord659
ord5584
ord5585
ord5583
ord5304
ord5114
ord5382
ord5352
ord5246
ord5709
ord5227
ord5687
ord5406
ord6437
ord4365
ord1777
ord4752
ord5663
ord2399
ord5586
ord6812
ord4694
ord4017
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2140
ord5699
ord3049
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord4082
ord4083
ord4077
ord3164
ord4371
ord4988
ord4771
ord2049
ord5804
ord6821
ord4161
ord2459
ord2121
ord2876
ord6184
ord5815
ord6832
ord6880
ord1287
ord5979
ord2979
ord6050
ord2846
ord6632
ord4436
ord1442
ord1284
ord1264
ord2474
ord1657
ord1067
ord665
ord1259
ord1262
ord2411
ord6708
ord6705
ord6216
ord5887
ord1003
ord561
ord6021
ord2783
ord2676
ord1677
ord2975
ord2781
ord1498
ord2517
ord2457
ord1405
ord1463
ord1647
ord1537
ord2178
ord1479
ord1122
ord2629
ord3740
ord3790
ord3830
ord286
ord2906
ord1574
ord2427
ord2408
ord1499
ord2856
ord4521
ord287
ord4473
ord867
ord911
ord822
ord3177
ord2661
ord852
ord1126
ord620
ord626
ord1040
ord5725

msvcrt

_wcslwr
malloc
_wtol
free
_wfindfirst
_findclose
wcsncpy_s
vswprintf_s
_wsetlocale
_snwprintf_s
_wchdir
_wfindnext
_vsnwprintf
memcpy_s
_vsnprintf_s
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
swprintf_s
memmove_s
wcschr
wcsnlen
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
?terminate@@YAXXZ
_lock
_unlock
__C_specific_handler
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z
_wcsnicmp
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memcmp
__RTDynamicCast
wcscat_s
wcscpy_s
_wcsicmp
wcstoul
_purecall
_initterm
_wtoi
memset

atl

ord21
ord16
ord32
ord15

kernel32

LoadResource
SizeofResource
FindResourceW
GetUserDefaultLangID
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentProcess
GetCurrentThread
CreateFileW
ExpandEnvironmentStringsW
GetThreadUILanguage
GetTempFileNameW
GetTempPathW
MultiByteToWideChar
SetFilePointer
ReadFile
WriteFile
CloseHandle
OutputDebugStringW
LockResource
LoadLibraryExW
GetFileAttributesW
GlobalUnlock
GlobalLock
GetWindowsDirectoryW
GetSystemWindowsDirectoryW
CompareStringW
LocalUnlock
LocalLock
lstrlenW
LocalAlloc
InitializeCriticalSection
FreeLibrary
FindClose
FindFirstFileW
FormatMessageW
SetCurrentDirectoryW
DeleteFileW
GlobalAlloc
DeleteCriticalSection
GlobalFree
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
lstrcmpW
LocalFree
GetProcAddress
LoadLibraryW
GetLastError
QueryActCtxW
DeactivateActCtx
FindActCtxSectionStringW
GetModuleFileNameW
OutputDebugStringA
GetModuleHandleExW
SetLastError
ActivateActCtx
CreateActCtxW
CreateDirectoryW
TryEnterCriticalSection
CreateThread
GetExitCodeThread
LocalReAlloc
GetConsoleOutputCP
WritePrivateProfileSectionW
WritePrivateProfileStringW
TlsSetValue
CreateEventW
SetEvent
Sleep
WaitForSingleObject
WideCharToMultiByte
CreateProcessW
CopyFileW
GetVersionExW
GetCurrentThreadId
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
InitializeCriticalSectionEx
OpenSemaphoreW
CreateThreadpoolTimer
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
FreeLibraryAndExitThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
DelayLoadFailureHook
ReleaseActCtx
ResolveDelayLoadedAPI

user32

RedrawWindow
CreateWindowExW
IsWindowVisible
GetDlgItem
GetParent
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
LoadIconW
EnableWindow
SendMessageW
SetWindowTextW
CloseClipboard
IsClipboardFormatAvailable
OpenClipboard
LoadImageW
PostThreadMessageW
RegisterClipboardFormatW
MessageBoxW
LoadStringW
SetClipboardData
EmptyClipboard
SetCursor
SendDlgItemMessageW
DrawFocusRect
GetSysColor
GetWindowRect
FrameRect
InflateRect
SetScrollRange
MoveWindow
DestroyWindow
SetWindowLongPtrW
SetWindowPos
GetSystemMetrics
GetClientRect
SetScrollInfo
ChildWindowFromPointEx
GetWindowLongW
ScrollWindow
SetScrollPos
GetScrollInfo
DefWindowProcW
SetFocus
GetFocus
GetWindowLongPtrW
GetDlgCtrlID
MapWindowPoints
GetMessagePos
IsWindowEnabled
MapDialogRect
RegisterClassW
LoadCursorW
ShowWindow
BringWindowToTop
ReleaseDC
GetDC
PostMessageW
DestroyIcon
GetSysColorBrush
DrawTextW
SystemParametersInfoW
GetWindow
IsWindow
WinHelpW
PtInRect

oleaut32

SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantInit
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
SysFreeString

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoSetProxyBlanket
CoTaskMemFree
CreateStreamOnHGlobal
ReleaseStgMedium
CoTaskMemAlloc
StringFromCLSID

advapi32

RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
IsTextUnicode
RegQueryValueExW
LookupPrivilegeDisplayNameW
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
RegQueryInfoKeyW
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
LookupAccountNameW
ConvertSidToStringSidW
CreateWellKnownSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSecurityDescriptor
LookupAccountSidW
LsaOpenPolicy
LsaQueryInformationPolicy
GetLengthSid
CopySid
LsaFreeMemory
AddAccessAllowedAce
MakeAbsoluteSD
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetAce
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
InitializeAcl
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
MapGenericMask
LsaLookupSids
GetSidSubAuthority
GetSidIdentifierAuthority
GetSidSubAuthorityCount
IsValidSid
LsaClose

gdi32

SetTextColor
SetBkColor
SetMapMode
GetTextColor
GetBkColor
CreateFontIndirectW
DeleteObject
GetTextExtentPoint32W
SelectObject
SetBkMode

shell32

ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFolderPathW

shlwapi

ord439
ord487
StrToIntW

scecli

SceLookupPrivRightName
SceCreateDirectory
SceWriteSecurityProfileInfo
SceAddToNameStatusList
SceOpenProfile
SceSvcConvertTextToSD
SceAnalyzeSystem
SceConfigureSystem
SceGetScpProfileDescription
SceGetServerProductType
SceUpdateObjectInfo
SceAddToNameList
SceSvcGetInformationTemplate
SceSvcQueryInfo
SceSvcFree
SceGetObjectChildren
SceSvcUpdateInfo
SceSvcSetInformationTemplate
SceCompareNameList
SceEnumerateServices
SceCompareSecurityDescriptors
SceGetObjectSecurity
SceCopyBaseProfile
SceAppendSecurityProfileInfo
SceFreeProfileMemory
SceGetSecurityProfileInfo
SceCloseProfile
SceStartTransaction
SceCommitTransaction
SceRollbackTransaction
SceFreeMemory
SceUpdateSecurityProfile

netutils

NetApiBufferFree

logoncli

DsGetDcNameW

setupapi

SetupFindNextLine
SetupGetLineTextW
SetupFindFirstLineW
SetupOpenInfFileW
SetupCloseInfFile

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
InvokeCAPEACLEditor
TranslateAceMasksAndCondition

Sections

.text
Size: 418KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsepno.dll
.dll windows:10 windows x64 arch:x64

6b825f638b5e07ce32ebab2597ea8e4a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsepno.pdb

Imports

msvcrt

_unlock
_onexit
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
memcmp
__dllonexit
memset
toupper
__CxxFrameHandler3
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_purecall
??_V@YAXPEAX@Z
wcsstr
memmove_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
__C_specific_handler
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
AcquireSRWLockShared
ReleaseSRWLockExclusive
WaitForSingleObject
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
CreateMutexExW
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegGetValueW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW
ReportEventW
DeregisterEventSource

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-security-base-l1-1-0

CopySid
GetLengthSid
IsValidSid

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

ntdll

RtlGetPersistedStateLocation
RtlIsStateSeparationEnabled
RtlNtStatusToDosError

efswrt

CdplIsSupported

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventProviderEnabled
EventSetInformation

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshbth.dll
.dll windows:10 windows x64 arch:x64

5962eb683ba24539103f0527ffb20da9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshbth.pdb

Imports

msvcrt

malloc
free
_amsg_exit
__C_specific_handler
memmove
_XcptFilter
memcpy
_wcsicmp
_vsnwprintf
_initterm
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlCompareMemory
EtwUnregisterTraceGuids
RtlGetLastNtStatus
RtlVirtualUnwind
EtwGetTraceEnableFlags
RtlInitUnicodeString
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
NtDeviceIoControlFile

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
CreateEventW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-security-base-l1-1-0

FreeSid
AllocateAndInitializeSid

rpcrt4

RpcStringBindingComposeW
NdrClientCall3
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

NSPStartup
WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshcon.dll
.dll regsvr32 windows:10 windows x64 arch:x64

22cb281caf6adb813ffa4471b38821fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshcon.pdb

Imports

msvcrt

free
_vsnprintf
sprintf_s
malloc
wcscpy_s
wcscat_s
_callnewh
memmove
__C_specific_handler
_initterm
_amsg_exit
strcpy_s
_XcptFilter
strcmp

kernel32

WideCharToMultiByte
FreeLibrary
GetProcAddress
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetModuleFileNameA
GetFullPathNameA
Sleep
RtlCaptureContext
GetCurrentProcess
GetModuleHandleA
RtlLookupFunctionEntry
MultiByteToWideChar
GetLastError
SetUnhandledExceptionFilter
LoadLibraryExW
UnhandledExceptionFilter
RtlVirtualUnwind

ole32

CoGetMalloc
CoCreateInstanceEx
StringFromCLSID
CreateFileMoniker

oleaut32

VariantChangeType
SysAllocStringLen
LoadTypeLibEx
SysAllocString
SysStringLen
VariantClear
UnRegisterTypeLi
LoadRegTypeLi
SysFreeString

advapi32

RegCreateKeyA
RegCloseKey
RegSetValueExA
RegSetValueA
RegDeleteKeyA
RegQueryValueA
RegOpenKeyA

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshelper.dll
.dll windows:10 windows x64 arch:x64

4ad269847d4bf63ee25269e5521b2812

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshelper.pdb

Imports

msvcrt

__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcsstr
wcstok
fprintf
wcstoul
__iob_func
wprintf
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

ws2_32

WSAEnumNameSpaceProvidersW
WSCGetProviderPath32
WSCGetProviderPath
WSCDeinstallProvider
WSCEnumNameSpaceProviders32
WSCEnumProtocols32
WSAStartup
WahWriteLSPEvent
WSCEnumProtocols

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-com-l1-1-0

StringFromCLSID
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegEnumKeyExA
RegSetValueExW
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

netsh.exe

PrintMessageFromModule
RegisterContext
RegisterHelper
MakeString
FreeString
MatchEnumTag
MatchToken
PrintError

wevtapi

EvtFormatMessage
EvtClose
EvtCreateRenderContext
EvtOpenPublisherMetadata
EvtQuery
EvtNext
EvtRender

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA
RegCopyTreeA

mswsock

MigrateWinsockConfiguration

Exports

Exports

InitHelperDll

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshext.dll
.dll regsvr32 windows:10 windows x64 arch:x64

d7e7e106e105c2331bda2b94da1bfe5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshext.pdb

Imports

msvcrt

memset
__C_specific_handler
_initterm
_itow_s
_XcptFilter
_callnewh
wcsncmp
wcsrchr
_vsnwprintf
_wcsnicmp
bsearch
_amsg_exit
wcsstr
_wcsicmp
wcscpy_s
malloc
strcpy_s
_vsnprintf
sprintf_s
strcat_s
_stricmp
free
realloc
memcmp
memcpy
strcmp

oleaut32

RegisterTypeLi
LoadRegTypeLi
UnRegisterTypeLi
SysFreeString
SysStringLen
LoadTypeLi
LoadTypeLibEx
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen

user32

MessageBoxA
GetDlgItemInt
GetDlgItem
SetDlgItemInt
EnableWindow
GetWindowRect
WinHelpA
IsDlgButtonChecked
SetForegroundWindow
LoadStringA
FindWindowA
SendMessageA
GetParent
GetWindowLongPtrA
SetWindowLongPtrA
GetDesktopWindow
FindWindowW
BringWindowToTop
LoadStringW
GetFocus
CheckDlgButton
SetDlgItemTextA
CharNextA
SetFocus
DefWindowProcA

advapi32

RegSetValueA
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
RegCreateKeyA
RegOpenKeyA
CryptGetHashParam
RegDeleteKeyA
RegQueryValueA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW

kernel32

GetFileAttributesW
FindClose
FindFirstFileA
FindFirstFileW
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetLastError
ResolveDelayLoadedAPI
GetWindowsDirectoryA
GetModuleFileNameW
GetModuleFileNameA
GetACP
GetModuleHandleA
GetFileAttributesA
MultiByteToWideChar
SearchPathW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetVersionExW
UnmapViewOfFile
InitializeCriticalSection
GetLocaleInfoW
GetLocaleInfoA
GetUserDefaultLCID
DeleteCriticalSection
GetPrivateProfileIntW
GetFullPathNameW
GetFullPathNameA
GetPrivateProfileStringW
WritePrivateProfileStringW
DelayLoadFailureHook
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
WideCharToMultiByte
RtlCaptureContext
SetEnvironmentVariableA
Sleep
FindResourceExW
GetVersionExA
lstrcmpiA
LoadResource
DuplicateHandle
CreateFileMappingW
ReadFile
WriteFile
LoadLibraryExA
SetFilePointer
CreateFileW
GetTempPathA
CreateFileA
GetSystemDirectoryA
CloseHandle
GetProcAddress
MapViewOfFile
FreeLibrary
GetTempFileNameA
LoadLibraryExW
FlushFileBuffers
SetEndOfFile
SetLastError
GetCurrentProcess
GetFileSize

ole32

CoUninitialize
StringFromCLSID
CoGetMalloc
CoInitialize
CoCreateInstance

shell32

SHGetMalloc
DragFinish
ShellExecuteExA
DragQueryFileA
DragQueryFileW

shlwapi

PathQuoteSpacesA
PathFindExtensionA
PathFindExtensionW

crypt32

CertDuplicateCertificateContext
CertOpenStore
CryptSIPRemoveProvider
CryptFindOIDInfo
CertCloseStore
CertFreeCertificateContext
CryptEncodeObject
CertOIDToAlgId
CryptSIPAddProvider
CertFindCertificateInStore

Exports

Exports

CreateIndirectData
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetSignedDataMsg
IsFileSupportedName
PutSignedDataMsg
RemoveSignedDataMsg
VerifyIndirectData

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshhyperv.dll
.dll windows:10 windows x64 arch:x64

9203bd76c41ac8bf92d2fdccd53f5694

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:29

Not After

02-12-2021 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:07:39:a2:7d:86:a9:83:a6:a8:15:2c:52:30:c5:4a:a2:68:71:c1:9f:20:bc:e8:60:bf:07:5c:bc:87:87:a4
Signer

Actual PE Digest

26:07:39:a2:7d:86:a9:83:a6:a8:15:2c:52:30:c5:4a:a2:68:71:c1:9f:20:bc:e8:60:bf:07:5c:bc:87:87:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshhyperv.pdb

Imports

ntdll

RtlInitUnicodeString
LdrDisableThreadCalloutsForDll
NtTerminateProcess
_wcsicmp
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
memmove
RtlCaptureContext
RtlGUIDFromString
memset

api-ms-win-core-com-l1-1-0

StringFromGUID2

Exports

Exports

WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wship6.dll
.dll windows:10 windows x64 arch:x64

7950d3e450c85468259854df6349eee2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wship6.pdb

Imports

ntdll

RtlUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlIpv6StringToAddressExW
RtlCaptureContext
RtlAllocateHeap
_wcsicmp
RtlIpv4AddressToStringExW
RtlInitUnicodeString
RtlIntegerToUnicodeString
RtlIpv6AddressToStringExW
NtTerminateProcess
RtlAppendUnicodeStringToString
LdrDisableThreadCalloutsForDll
memmove

ws2_32

ntohs
WSAGetLastError
setsockopt

Exports

Exports

WSHAddressToString
WSHEnumProtocols
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshom.ocx
.dll regsvr32 windows:10 windows x64 arch:x64

75ca27ad2db39adbb8bb86c5925a1fb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshom.pdb

Imports

msvcrt

_wcsicmp
memcpy
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_vsnprintf
_callnewh
malloc
wcsrchr
wcschr
_mbsnbcmp
sprintf_s
_mbsicmp
atoi
tolower
_mbsrchr
isupper
free
_vsnwprintf
_wcsnicmp
wcsncmp
bsearch
_stricmp
_ismbcdigit
_ismbcspace
strcpy_s
wcscat_s
wcscpy_s
strcat_s
fprintf
fclose
fopen
memset

oleaut32

SysStringLen
SafeArrayCreate
VarDateFromUdate
VariantChangeTypeEx
SafeArrayDestroy
VariantInit
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
VariantChangeType
VariantClear
VariantCopy
SafeArrayCopy
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
SafeArrayRedim
SysFreeString
SysAllocString
SafeArrayPutElement
SafeArrayCreateVector
SetErrorInfo
CreateErrorInfo
SysAllocStringLen

ole32

CoCreateInstance
CoGetMalloc

advapi32

RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExA
RegSetValueExW
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueW
RegDeleteValueA
RegEnumValueW
RegQueryValueExW
RegCloseKey
GetUserNameA
GetUserNameW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegOpenKeyExW
RegEnumKeyExA

kernel32

GetVersionExA
GetLocaleInfoA
GetLocaleInfoW
InitializeCriticalSection
LoadLibraryExA
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeLibrary
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateProcessA
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateThread
Sleep
GetExitCodeThread
SetCurrentDirectoryA
DuplicateHandle
CreatePipe
GetCurrentProcess
lstrcmpA
LoadLibraryExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
SearchPathW
SetLastError
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
CreateFileW
GetVersionExW
UnmapViewOfFile
FindResourceExW
LoadResource
CreateFileMappingW
QueryPerformanceCounter
GetCurrentDirectoryA
TerminateProcess
WaitForSingleObject
GetLastError
CloseHandle
GetExitCodeProcess
GetUserDefaultLCID
GetWindowsDirectoryA
GetLocalTime
WideCharToMultiByte
GetEnvironmentVariableW
GetEnvironmentVariableA
MultiByteToWideChar
GetComputerNameW
GetComputerNameA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
LocalAlloc
FormatMessageW
LocalFree
FormatMessageA
GetCurrentThreadId
GetSystemDefaultLangID
CompareStringA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetFullPathNameA
SetEnvironmentVariableW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsA
MapViewOfFile

user32

GetWindowTextLengthW
SendMessageTimeoutA
PeekMessageA
EnumThreadWindows
TranslateMessage
PostThreadMessageA
MsgWaitForMultipleObjects
MessageBoxW
DispatchMessageA
GetWindow
IsWindowEnabled
SetFocus
FindWindowW
GetDesktopWindow
EnumWindows
IsWindowVisible
GetWindowTextLengthA
FindWindowA
SetForegroundWindow
GetWindowTextW
keybd_event
VkKeyScanA
SetKeyboardState
GetKeyboardState
GetWindowTextA
CharNextA
PostMessageA
GetWindowThreadProcessId
LoadStringW
SendMessageTimeoutW
LoadStringA
AttachThreadInput

mpr

WNetAddConnection2W
WNetEnumResourceW
WNetCancelConnection2W
WNetOpenEnumA
WNetCancelConnection2A
WNetCloseEnum
WNetAddConnection2A
WNetEnumResourceA

shell32

SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHGetMalloc

scrrun

DoOpenPipeStream

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshqos.dll
.dll windows:10 windows x64 arch:x64

b36072f52a798790c78298652d6e8571

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshqos.pdb

Imports

msvcrt

__C_specific_handler
_initterm
malloc
memcpy
_wcsicmp
free
_amsg_exit
_XcptFilter
memmove

ntdll

RtlCaptureContext
RtlFreeHeap
ShipAssert
RtlAllocateHeap
RtlLookupFunctionEntry
RtlVirtualUnwind

ws2_32

WSAGetLastError
WSAIoctl

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

Exports

Exports

WSHAddressToString
WSHEnumProtocols
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshrm.dll
.dll windows:10 windows x64 arch:x64

1b5ff7212a1b98059799b6f461ab1c25

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshrm.pdb

Imports

msvcrt

_initterm
memmove
malloc
memset
free
_amsg_exit
_XcptFilter
swprintf_s
iswxdigit
iswdigit
_wcsicmp
iswlower
memcpy
__C_specific_handler

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlFreeHeap
RtlIpv4StringToAddressW
RtlCaptureContext
NtDelayExecution
RtlInitUnicodeString
RtlAllocateHeap
NtDeviceIoControlFile

kernel32

GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime

ws2_32

ntohs
htons

Exports

Exports

WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wshunix.dll
.dll windows:10 windows x64 arch:x64

a266c350e30ca3a7a8d23f2bd4d898b6

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:be:f9:8b:ae:48:d3:c3:d0:3e:59:bf:b2:5c:30:44:23:db:a1:cd:9c:c6:73:30:e9:33:22:5f:ad:af:43:43
Signer

Actual PE Digest

6b:be:f9:8b:ae:48:d3:c3:d0:3e:59:bf:b2:5c:30:44:23:db:a1:cd:9c:c6:73:30:e9:33:22:5f:ad:af:43:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshunix.pdb

Imports

ntdll

_wcsicmp
RtlInitUnicodeString
LdrDisableThreadCalloutsForDll
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
memmove
memset

Exports

Exports

WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsl.exe
.exe windows:10 windows x64 arch:x64

bd72b8a32c54713d9f381e9d466c236d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wsl.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__setmode
_o__wsetlocale
_o_abort
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_terminate
__CxxFrameHandler3
__C_specific_handler
_CxxThrowException
_o__get_initial_wide_environment
_o__fileno
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
_o___acrt_iob_func
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
memmove

api-ms-win-crt-string-l1-1-0

wcscmp
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
WaitForSingleObjectEx
OpenSemaphoreW
CreateEventExW
InitializeSRWLock
ReleaseSemaphore
CreateEventW
SetEvent
DeleteCriticalSection
CreateMutexExW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject
EnterCriticalSection
ReleaseSRWLockShared
CreateSemaphoreExW
LeaveCriticalSection
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetCurrentThreadId
TerminateProcess
CreateProcessW
GetCurrentProcessId
InitializeProcThreadAttributeList
GetExitCodeProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetStdHandle

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
ConnectNamedPipe

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
IIDFromString
CoCreateGuid
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoIncrementMTAUsage
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile
CreateFileW
GetFileType

api-ms-win-core-console-l2-1-0

SetConsoleCP
SetConsoleCursorPosition
SetConsoleOutputCP
GetConsoleScreenBufferInfo
GetConsoleScreenBufferInfoEx

api-ms-win-core-console-l1-2-1

ClosePseudoConsole
CreatePseudoConsole

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

kernelbase

LocalAlloc

ntdll

RtlStringFromGUID
RtlFreeUnicodeString

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

ext-ms-win-shell-shell32-l1-2-0

ShellExecuteExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject
SetInformationJobObject
CreateJobObjectW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
WriteConsoleW
GetConsoleMode
GetConsoleCP
SetConsoleMode

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-io-l1-1-0

CancelIoEx
GetOverlappedResult

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsDeleteStringBuffer
WindowsPreallocateStringBuffer
WindowsCreateString
WindowsPromoteStringBuffer

oleaut32

SysFreeString
SysStringLen

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wslapi.dll
.dll windows:10 windows x64 arch:x64

cc8be8ed1e908e0c3e9384478ea9c252

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wslapi.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o_abort
_o_free
_o_iswspace
_o_lround
_o_malloc
_o_terminate
_o_towlower
_o_wcstod
__CxxFrameHandler3
__current_exception
__AdjustPointer
__processing_throw
__C_specific_handler
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
memmove

api-ms-win-crt-string-l1-1-0

memset
wcsncmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
SetEvent
ReleaseSRWLockExclusive
CreateEventExW
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSRWLockShared
CreateEventW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
CreateMutexExW
AcquireSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
CreateProcessW
GetCurrentProcess
GetExitCodeProcess
CreateThread
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventActivityIdControl
EventSetInformation
EventUnregister

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegOpenCurrentUser

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoTaskMemFree
CoIncrementMTAUsage
CoTaskMemAlloc
CoCreateInstance
IIDFromString
CoCreateFreeThreadedMarshaler
CoInitializeSecurity

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathAllocCombine

api-ms-win-core-file-l1-1-0

GetFileType
CreateFileW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsDeleteStringBuffer
WindowsPromoteStringBuffer
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsCreateString
WindowsPreallocateStringBuffer

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackagePath

dismapi

DismEnableFeature
DismGetFeatureInfo
DismOpenSession
DismInitialize
DismShutdown
DismDelete

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleCursorPosition

api-ms-win-core-console-l1-1-0

GetConsoleMode
WriteConsoleW

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetKnownFolderPath

oleaut32

SysFreeString
SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
WslConfigureDistribution
WslGetDistributionConfiguration
WslIsDistributionRegistered
WslLaunch
WslLaunchInteractive
WslRegisterDistribution
WslUnregisterDistribution

Sections

.text
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsmanconfig_schema.xml
Ex_PE_v3.1.9/CMap/libs/wsmplpxy.dll
.dll regsvr32 windows:10 windows x64 arch:x64

3141b5f5237db42200d998d95104bdee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsmplpxy.pdb

Imports

msvcrt

malloc
_initterm
__C_specific_handler
_amsg_exit
_XcptFilter
free
memcmp

oleaut32

BSTR_UserUnmarshal64
BSTR_UserMarshal64
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserSize
BSTR_UserSize64
BSTR_UserFree64

rpcrt4

NdrDllRegisterProxy
NdrCStdStubBuffer_Release
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
CStdStubBuffer_DebugServerQueryInterface
NdrDllUnregisterProxy
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllCanUnloadNow
CStdStubBuffer_Connect

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

combase

ord2
ord4
ord5
ord7
ord6
ord3

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsmprovhost.exe
.exe windows:10 windows x64 arch:x64

e54118702a5da1e2a145713fb7d6a53b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wsmprovhost.pdb

Imports

msvcrt

memcpy
_CxxThrowException
memmove
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
__CxxFrameHandler3
?what@exception@@UEBAPEBDXZ
?terminate@@YAXXZ
_commode
_amsg_exit
_fmode
_XcptFilter
_acmdln
__C_specific_handler
_initterm
__setusermatherr
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_purecall
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
memset

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage

api-ms-win-core-synch-l1-1-0

SetEvent
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
WaitForSingleObjectEx

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoRevokeClassObject
CoInitializeSecurity
CoCreateInstance
CoRegisterClassObject

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetStartupInfoW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

wsmsvc

?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
CreateProvHost
WSManError
??1CWSManCriticalSection@@QEAA@XZ
?Free@WSManMemory@@SAXPEAXH@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??1?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??1?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@QEAA@XZ
??1?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA@XZ
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@UPluginKey@@K@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeSet@PEAVCListenerOperation@@@@QEAA@XZ
??1?$SafeSet@PEAVIOperation@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVCListenerOperation@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVIOperation@@@@QEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??_7?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@6B@
??_7?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@6B@
??_7?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@6B@
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
?Acquire@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@UEBAXXZ
?Acquire@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@UEBAXXZ
?Acquire@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?Acquired@?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@UEAA_NAEAVIRequestContext@@@Z
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetMap@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@UPluginKey@@K@@QEBAAEAV?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@XZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEBAAEBV?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?Initialize@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@UEAA_NAEAVIRequestContext@@@Z
?IsValid@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@UPluginKey@@K@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@QEBA_NXZ
?Release@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@UEBAXXZ
?Release@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@UEBAXXZ
?Release@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@UEBAXXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Release@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@UEBAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsnmp32.dll
.dll windows:10 windows x64 arch:x64

9d783ed7dd8a61952077d1567781a817

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsnmp32.pdb

Imports

msvcrt

_amsg_exit
free
malloc
_initterm
_XcptFilter
_beginthreadex
memcpy
memcmp
_errno
strtoul
_strupr
_ultoa
_endthreadex
__C_specific_handler
atol
strtok
strchr
atoi
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
SetSecurityDescriptorDacl

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetOverlappedResult
GetQueuedCompletionStatus
ReadFile
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
GetPrivateProfileStringA
lstrlenA
CreateIoCompletionPort
CreateEventA
GetCurrentProcessId
ResetEvent
DelayLoadFailureHook
ResolveDelayLoadedAPI
CloseHandle
GetVersionExA
SetEvent
CreateFileA
GetLastError
Sleep
PostQueuedCompletionStatus
WaitForSingleObject
GlobalAlloc
GlobalFree
SetNamedPipeHandleState
WaitNamedPipeA
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjectsEx
GetTickCount

ws2_32

WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
recvfrom
WSAEnumNetworkEvents
ioctlsocket
WSAStringToAddressA
getaddrinfo
freeaddrinfo
getnameinfo
WSACleanup
select
WSAIoctl
closesocket
WSASetLastError
WSASendMsg
WSAStartup
WSAAddressToStringA
socket
ntohs
htons
sendto
setsockopt
WSAGetLastError
bind

iphlpapi

GetBestInterfaceEx
GetAdaptersAddresses

Exports

Exports

SnmpCancelMsg
SnmpCleanup
SnmpCleanupEx
SnmpClose
SnmpContextToStr
SnmpConveyAgentAddress
SnmpCountVbl
SnmpCreatePdu
SnmpCreateSession
SnmpCreateVbl
SnmpDecodeMsg
SnmpDeleteVb
SnmpDuplicatePdu
SnmpDuplicateVbl
SnmpEncodeMsg
SnmpEntityToStr
SnmpFreeContext
SnmpFreeDescriptor
SnmpFreeEntity
SnmpFreePdu
SnmpFreeVbl
SnmpGetLastError
SnmpGetPduData
SnmpGetRetransmitMode
SnmpGetRetry
SnmpGetTimeout
SnmpGetTranslateMode
SnmpGetVb
SnmpGetVendorInfo
SnmpListen
SnmpListenEx
SnmpOidCompare
SnmpOidCopy
SnmpOidToStr
SnmpOpen
SnmpRecvMsg
SnmpRegister
SnmpSendMsg
SnmpSetAgentAddress
SnmpSetPduData
SnmpSetPort
SnmpSetRetransmitMode
SnmpSetRetry
SnmpSetTimeout
SnmpSetTranslateMode
SnmpSetVb
SnmpStartup
SnmpStartupEx
SnmpStrToContext
SnmpStrToEntity
SnmpStrToOid

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsock32.dll
.dll windows:10 windows x64 arch:x64

9036420a1cd883ae2cf99a9ccd44dfb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsock32.pdb

Imports

msvcrt

__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter

ws2_32

getsockopt
WSARecvFrom
setsockopt
WSARecv

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

Exports

Exports

AcceptEx
EnumProtocolsA
EnumProtocolsW
GetAcceptExSockaddrs
GetAddressByNameA
GetAddressByNameW
GetNameByTypeA
GetNameByTypeW
GetServiceA
GetServiceW
GetTypeByNameA
GetTypeByNameW
MigrateWinsockConfiguration
NPLoadNameSpaces
SetServiceA
SetServiceW
TransmitFile
WEP
WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetServByName
WSAAsyncGetServByPort
WSAAsyncSelect
WSACancelAsyncRequest
WSACancelBlockingCall
WSACleanup
WSAGetLastError
WSAIsBlocking
WSARecvEx
WSASetBlockingHook
WSASetLastError
WSAStartup
WSAUnhookBlockingHook
WSApSetPostRoutine
__WSAFDIsSet
accept
bind
closesocket
connect
dn_expand
gethostbyaddr
gethostbyname
gethostname
getnetbyname
getpeername
getprotobyname
getprotobynumber
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_network
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
rcmd
recv
recvfrom
rexec
rresvport
s_perror
select
send
sendto
sethostname
setsockopt
shutdown
socket

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsp_fs.dll
.dll regsvr32 windows:10 windows x64 arch:x64

ae9f9720c82ae2ac5ea1f63232f928c6

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:6a:d5:2c:61:f5:7f:c7:e4:db:17:7d:25:71:e2:3c:1a:b7:87:1c:aa:23:23:a0:bf:93:7a:f7:14:e0:35:c4
Signer

Actual PE Digest

eb:6a:d5:2c:61:f5:7f:c7:e4:db:17:7d:25:71:e2:3c:1a:b7:87:1c:aa:23:23:a0:bf:93:7a:f7:14:e0:35:c4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsp_fs.pdb

Imports

ntdll

RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
RtlNtStatusToDosError
NtQuerySystemInformation
RtlVirtualUnwind
RtlRemoveVectoredExceptionHandler
RtlLookupFunctionEntry
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlEnumerateGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetComputerNameExW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadStringW
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
LoadLibraryExW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventRegister
EventUnregister

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-0

TlsAlloc
OpenThreadToken
GetCurrentThreadId
GetCurrentThread
GetStartupInfoW
ExitProcess
SetThreadToken
OpenProcessToken
TerminateProcess
TlsGetValue
TlsSetValue
GetCurrentProcess
GetCurrentProcessId
TlsFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
HeapAlloc

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSemaphore
InitializeCriticalSectionEx
WaitForSingleObject
DeleteCriticalSection
ResetEvent
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
AcquireSRWLockExclusive
AcquireSRWLockShared
OpenSemaphoreW
LeaveCriticalSection
CreateMutexExW
SetEvent
CreateEventW
EnterCriticalSection
CreateSemaphoreExW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
SetStdHandle
GetCommandLineW
GetCommandLineA
GetStdHandle
GetEnvironmentVariableW
FreeEnvironmentStringsW

api-ms-win-core-file-l1-1-0

FindFirstFileExW
FindFirstVolumeW
FindClose
GetVolumeInformationW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindNextVolumeW
RemoveDirectoryW
GetFileType
WriteFile
GetVolumePathNameW
GetDiskFreeSpaceExW
FlushFileBuffers
FindVolumeClose
FindFirstFileW
GetFileAttributesW
CreateFileW
GetDriveTypeW

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
CompareStringOrdinal
CompareStringW
CompareStringEx
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

LCMapStringEx
FormatMessageA
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetCPInfo
GetOEMCP
GetACP
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
FormatMessageW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
WriteConsoleW
GetConsoleMode

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsSetValue
FlsAlloc
FlsGetValue

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
DuplicateTokenEx
IsValidAcl
GetAce
AddAce
InitializeAcl
GetLengthSid
AddAccessAllowedAceEx
AddAccessDeniedAceEx
GetTokenInformation
DeleteAce
FreeSid
IsValidSid
EqualSid
MakeAbsoluteSD
CopySid
GetAclInformation

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
GetNamedSecurityInfoW
SetNamedSecurityInfoW

netapi32

NetApiBufferFree
DsGetDcNameW

clusapi

CloseClusterNetInterface
CloseClusterNetwork
CloseClusterResource
CloseClusterGroup
MoveClusterGroup
DestroyCluster
CloseClusterNode
CloseCluster
ClusterOpenEnumEx
GetClusterFromResource
GetClusterNodeKey
OpenClusterNode
ClusterGetEnumCount
ClusterCloseEnum
OpenClusterResource
ClusterEnum
ClusterOpenEnum
OpenCluster
ClusterRegCloseKey
GetClusterResourceKey
GetClusterKey
ClusterRegSetValue
ClusterRegQueryValue
GetClusterNotifyV2
RegisterClusterResourceTypeNotifyV2
CreateClusterNotifyPortV2
CCHlpCreateClusterNameInAD
CCHlpConfigureNode
CreateCluster
CCHlpGetDNSHostLabel
GetNodeClusterState
DeleteClusterResourceType
ClusterResourceTypeControl
GetClusterNetInterfaceState
ClusterNetInterfaceControl
OpenClusterNetInterfaceEx
GetClusterNetworkState
ClusterNetworkControl
SetClusterNetworkName
OpenClusterNetworkEx
EvictClusterNodeEx
ResumeClusterNodeEx
PauseClusterNodeEx
GetClusterNodeState
ClusterNodeControl
OpenClusterNodeEx
CreateClusterResource
SetClusterGroupNodeList
SetClusterGroupName
CancelClusterGroupOperation
MoveClusterGroupEx
OnlineClusterGroupEx
OfflineClusterGroupEx
DeleteClusterGroup
DestroyClusterGroup
GetClusterGroupState
ClusterGroupControl
OpenClusterGroupEx
RemoveClusterResourceNode
AddClusterResourceNode
FailClusterResource
RestartClusterResource
SetClusterResourceDependencyExpression
GetClusterResourceDependencyExpression
RemoveClusterResourceDependency
AddClusterResourceDependency
ChangeClusterResourceGroup
OnlineClusterResourceEx
OfflineClusterResourceEx
DeleteClusterResource
GetClusterResourceState
SetClusterResourceName
ClusterResourceControl
OpenClusterResourceEx
ClusterUpgradeFunctionalLevel
CCHlpAddNodeUpdateCluster
CCHlpGetClusterServiceSecret
CreateClusterResourceType
CreateClusterGroupEx
SetClusterName
SetClusterQuorumResource
RemoveResourceFromClusterSharedVolumes
AddResourceToClusterSharedVolumes
ClusterControl
GetClusterQuorumResource
GetClusterInformation
AddClusterNode
OpenClusterEx
CloseClusterNotifyPort
ClusterNetworkCloseEnum
ClusterResourceTypeCloseEnum
ClusterResourceCloseEnum
ClusterGroupCloseEnum
ClusterCloseEnumEx
ClusterNodeCloseEnumEx
ClusterGroupCloseEnumEx
ClusterResourceCloseEnumEx
ClusterResourceGetEnumCountEx
ClusterResourceEnumEx
ClusterResourceOpenEnumEx
ClusterGroupGetEnumCountEx
ClusterGroupEnumEx
ClusterGroupOpenEnumEx
ClusterGroupGetEnumCount
ClusterGroupEnum
ClusterGroupOpenEnum
ClusterNetworkGetEnumCount
ClusterNetworkEnum
ClusterNetworkOpenEnum
ClusterResourceGetEnumCount
ClusterResourceEnum
ClusterResourceOpenEnum
ClusterResourceTypeGetEnumCount
ClusterResourceTypeEnum
ClusterResourceTypeOpenEnum
ClusterNodeGetEnumCountEx
ClusterNodeEnumEx
ClusterNodeOpenEnumEx
ClusterGetEnumCountEx
ClusterEnumEx

mispace

WspProviderEnter
WspEnumerateRemoteInstances
WspProviderExit
WspIsRemoteInstance
WspGetRemoteInstance
WspInvokeRemoteMethod
WspReferencesOfRemoteInstance
WspGetSubsystemFilter
WspFreeString
WspPackObjectId
WspUnpackObjectId

ws2_32

FreeAddrInfoW
GetAddrInfoW
htons
WSAGetLastError
WSAStringToAddressW
WSAAddressToStringW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce
InitOnceInitialize

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoCreateInstanceEx
CoInitializeEx

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolTimer
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks

crypt32

CryptUnprotectMemory
CryptProtectMemory

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

iphlpapi

IcmpCreateFile
IcmpSendEcho
Icmp6SendEcho2
Icmp6CreateFile
IcmpCloseHandle

oleaut32

SysAllocString
SysFreeString

dnsapi

DnsFlushResolverCacheEntry_W

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

cryptsp

CryptReleaseContext
CryptAcquireContextW
CryptGenRandom

sscore

SsCoreUninitialize

ntdsapi

DsBindWithCredW
DsUnBindW

mi

mi_clientFT_V1
MI_Application_InitializeV1

wldap32

ord142
ord79
ord203
ord73
ord145
ord14
ord140
ord97
ord224
ord13
ord88
ord26
ord18
ord41

api-ms-win-security-activedirectoryclient-l1-1-0

DsFreeNameResultW
DsCrackNamesW
DsFreePasswordCredentials

resutils

ResUtilGetResourceName

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
PreShutdown
SetShutdownCallback
SmpUnload

Sections

.text
Size: 948KB - Virtual size: 948KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 795KB - Virtual size: 794KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 121KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsp_health.dll
.dll regsvr32 windows:10 windows x64 arch:x64

ae322a9680c797bcb8dc81b52c4f30a2

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d1:7c:46:3a:2a:ca:25:bb:dc:95:f3:0f:86:8b:2d:3e:fb:a4:cf:dd:d3:eb:af:84:7b:85:af:96:19:97:2c:df
Signer

Actual PE Digest

d1:7c:46:3a:2a:ca:25:bb:dc:95:f3:0f:86:8b:2d:3e:fb:a4:cf:dd:d3:eb:af:84:7b:85:af:96:19:97:2c:df

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsp_health.pdb

Imports

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount64
GetSystemDirectoryW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
FreeLibrary
GetProcAddress
LoadStringW
GetModuleHandleW
GetModuleFileNameW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventActivityIdControl
EventWriteTransfer
EventSetInformation

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentThreadId
SetThreadToken
ExitProcess
OpenProcessToken
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-heap-l1-1-0

HeapSize
HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
ResetEvent
AcquireSRWLockShared
ReleaseSRWLockShared
OpenSemaphoreW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
InitializeSRWLock
InitializeCriticalSection
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
SetEvent
ReleaseSRWLockExclusive
CreateEventW
ReleaseSemaphore
AcquireSRWLockExclusive
InitializeCriticalSectionEx

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
GetCommandLineW
GetCommandLineA
SetStdHandle
GetStdHandle
GetEnvironmentStringsW

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
CreateFileW
FindNextFileW
FindFirstFileExW
FindClose
WriteFile
SetFilePointerEx
GetFileType
FlushFileBuffers

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringEx
CompareStringOrdinal
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetACP
GetCPInfo
EnumSystemLocalesW
GetUserDefaultLCID
LCMapStringEx
IsValidLocale
IsValidCodePage
GetOEMCP
FormatMessageW
FormatMessageA
GetLocaleInfoW
LCMapStringW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
GetConsoleMode
WriteConsoleW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsGetValue
FlsAlloc
FlsSetValue
FlsFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

ntdll

NtQuerySystemInformation
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlInitializeGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlEnumerateGenericTableAvl
RtlNtStatusToDosError
RtlRemoveVectoredExceptionHandler

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
GetTokenInformation
DuplicateTokenEx
GetLengthSid
IsValidSid
CopySid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-security-provider-l1-1-0

GetSecurityInfo

mispace

WspGetSubsystemFilter
WspCheckMinimumSubsystemVersion
WspReferencesOfRemoteInstance
WspPackObjectId
WspInvokeRemoteMethod
WspGetRemoteInstance
WspProviderEnter
WspEnumerateRemoteInstances
WspUnpackObjectId
WspGetClassName
WspProviderExit
WspFreeString
WspIsRemoteInstance

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceInitialize
Sleep

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-com-l1-1-0

CoCreateInstanceEx
CoUninitialize
CoInitializeEx
CoCreateInstance

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
CloseThreadpoolWork
SubmitThreadpoolWork

crypt32

CryptUnprotectMemory
CryptProtectMemory

oleaut32

SysAllocString
SysFreeString

clusapi

EvictClusterNodeEx
ResumeClusterNodeEx
PauseClusterNodeEx
GetClusterNodeState
ClusterNodeControl
OpenClusterNodeEx
CreateClusterResource
SetClusterGroupNodeList
SetClusterGroupName
CancelClusterGroupOperation
MoveClusterGroupEx
OnlineClusterGroupEx
OfflineClusterGroupEx
DeleteClusterGroup
DestroyClusterGroup
GetClusterGroupState
ClusterGroupControl
OpenClusterGroupEx
RemoveClusterResourceNode
AddClusterResourceNode
FailClusterResource
RestartClusterResource
SetClusterResourceDependencyExpression
GetClusterResourceDependencyExpression
RemoveClusterResourceDependency
AddClusterResourceDependency
ChangeClusterResourceGroup
OnlineClusterResourceEx
OfflineClusterResourceEx
DeleteClusterResource
GetClusterResourceState
SetClusterResourceName
ClusterResourceControl
OpenClusterResourceEx
ClusterUpgradeFunctionalLevel
CCHlpAddNodeUpdateCluster
CCHlpGetClusterServiceSecret
DestroyCluster
CreateClusterResourceType
CreateClusterGroupEx
SetClusterName
SetClusterQuorumResource
RemoveResourceFromClusterSharedVolumes
AddResourceToClusterSharedVolumes
ClusterControl
GetClusterQuorumResource
GetClusterInformation
AddClusterNode
OpenClusterEx
CloseClusterNotifyPort
ClusterNetworkCloseEnum
ClusterResourceTypeCloseEnum
ClusterResourceCloseEnum
ClusterGroupCloseEnum
ClusterCloseEnumEx
ClusterNodeCloseEnumEx
ClusterGroupCloseEnumEx
ClusterResourceCloseEnumEx
ClusterResourceGetEnumCountEx
ClusterResourceEnumEx
ClusterResourceOpenEnumEx
ClusterGroupGetEnumCountEx
ClusterGroupEnumEx
ClusterGroupOpenEnumEx
ClusterGroupGetEnumCount
OpenClusterNetworkEx
ClusterGroupOpenEnum
ClusterNetworkGetEnumCount
ClusterNetworkEnum
ClusterNetworkOpenEnum
ClusterResourceGetEnumCount
ClusterResourceEnum
ClusterResourceOpenEnum
ClusterResourceTypeGetEnumCount
ClusterResourceTypeEnum
ClusterResourceTypeOpenEnum
ClusterNodeGetEnumCountEx
ClusterNodeEnumEx
ClusterNodeOpenEnumEx
ClusterGetEnumCountEx
ClusterEnumEx
ClusterOpenEnumEx
CloseCluster
CloseClusterNode
CloseClusterGroup
CloseClusterResource
CloseClusterNetwork
CloseClusterNetInterface
SetClusterNetworkName
GetClusterNetInterfaceState
ClusterResourceTypeControl
DeleteClusterResourceType
GetNodeClusterState
CCHlpGetDNSHostLabel
CreateCluster
ClusterNetworkControl
GetClusterNetworkState
CCHlpConfigureNode
OpenClusterNetInterfaceEx
CCHlpCreateClusterNameInAD
CreateClusterNotifyPortV2
RegisterClusterResourceTypeNotifyV2
ClusterCloseEnum
GetClusterNotifyV2
ClusterRegQueryValue
ClusterRegSetValue
GetClusterNodeKey
OpenClusterNode
ClusterGetEnumCount
ClusterOpenEnum
ClusterEnum
MoveClusterGroup
GetClusterFromResource
OpenClusterResource
GetClusterKey
GetClusterResourceKey
ClusterRegCloseKey
ClusterGroupEnum
ClusterNetInterfaceControl

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

cryptsp

CryptGenRandom
CryptAcquireContextW
CryptReleaseContext

sscore

SsCoreUninitialize

ws2_32

WSAAddressToStringW
htons
WSAStringToAddressW
WSAGetLastError

resutils

ResUtilGetResourceName

mi

MI_Application_InitializeV1
mi_clientFT_V1

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
PreShutdown
SetShutdownCallback
SmpUnload

Sections

.text
Size: 785KB - Virtual size: 785KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 727KB - Virtual size: 726KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsp_sr.dll
.dll regsvr32 windows:10 windows x64 arch:x64

82416dfe9f59fd5329965a6db8b66e00

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:e1:f6:cc:bc:45:7d:8f:d7:f8:b2:58:98:90:6a:63:c0:7d:51:22:fe:aa:0b:31:c9:61:a7:cd:50:d0:1c:2a
Signer

Actual PE Digest

8c:e1:f6:cc:bc:45:7d:8f:d7:f8:b2:58:98:90:6a:63:c0:7d:51:22:fe:aa:0b:31:c9:61:a7:cd:50:d0:1c:2a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsp_sr.pdb

Imports

msvcrt

memset
_wcsdup
__crtLCMapStringW
_wsetlocale
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
abort
_ismbblead
___mb_cur_max_func
calloc
___lc_codepage_func
___lc_handle_func
__pctype_func
__uncaught_exception
setlocale
_errno
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
__ExceptionPtrToBool
__ExceptionPtrAssign
__ExceptionPtrCopy
__ExceptionPtrDestroy
__ExceptionPtrCreate
??0exception@@QEAA@XZ
_wcstoui64
wcstoul
wcsstr
_wcsicmp
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
__CxxFrameHandler3
_onexit
__dllonexit
_initterm
_amsg_exit
_XcptFilter
malloc
free
_unlock
_lock
swprintf_s
toupper

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

mispace

WspInvokeRemoteMethod
WspProviderEnter
WspIsRemoteInstance
WspGetRemoteInstance
WspFreeString
WspGetSubsystemFilter
WspProviderExit
WspEnumerateRemoteInstances
WspReferencesOfRemoteInstance
WspUnpackObjectId
WspPackObjectId

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeSRWLock
CreateEventW
SetEvent
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW
StopTraceW
EnableTraceEx2

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

FormatMessageA

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

ntdll

RtlStringFromGUID
RtlInitUnicodeString
RtlFreeUnicodeString
RtlGUIDFromString

mi

mi_clientFT_V1
MI_Application_InitializeV1

clusapi

GetClusterNotifyV2
CloseCluster
RegisterClusterResourceTypeNotifyV2
OpenCluster
CreateClusterNotifyPortV2
GetNodeClusterState
GetClusterInformation
CloseClusterNotifyPort

tdh

TdhFormatProperty
TdhGetPropertySize
TdhGetEventInformation
TdhGetEventMapInformation
TdhGetProperty

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
PreShutdown
SetShutdownCallback
SmpUnload

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 563KB - Virtual size: 562KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsplib.dll
.dll windows:10 windows x64 arch:x64

ad49c032a786f6d0d4c72228c9353f21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wsplib.pdb

Imports

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

memset
strncmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itoa_s
memcpy
_o__stricmp
_o__strnicmp
_o__wcsicmp
_o_atoi
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
wcschr
strrchr
strchr
strstr
_o__seh_filter_dll

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DecodeWspHeaders
FreeWspHeaders

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wsqmcons.exe
.exe windows:10 windows x64 arch:x64

66d217a7e226d2972029d623e5d0445d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wsqmcons.pdb

Imports

msvcrt

memcmp
__CxxFrameHandler3
_CxxThrowException
_vsnwprintf
memcpy_s
wcsrchr
_purecall
??1type_info@@UEAA@XZ
memmove_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free
??1exception@@UEAA@XZ
memset

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesExW

api-ms-win-eventing-controller-l1-1-0

ControlTraceW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
OpenSemaphoreW
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
CreateMutexW
WaitForSingleObject
WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathCombineW

ntdll

EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids

kernel32

GetSystemDirectoryW
GetProcAddress
LocalFree
FormatMessageW
GetFileAttributesW
CreateDirectoryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-downlevel-shlwapi-l2-1-0

SHDeleteKeyW

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wtsapi32.dll
.dll windows:10 windows x64 arch:x64

1d3a55f1b05a4aa4d327269fde13ba58

Code Sign

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:30

Not After

03-03-2021 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ce:61:82:0a:53:a6:d2:b5:e5:91:f4:8d:b1:7f:f1:de:6f:7a:76:c4:50:a8:0c:06:c9:8d:8c:6f:18:ec:6e:46
Signer

Actual PE Digest

ce:61:82:0a:53:a6:d2:b5:e5:91:f4:8d:b1:7f:f1:de:6f:7a:76:c4:50:a8:0c:06:c9:8d:8c:6f:18:ec:6e:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wtsapi32.pdb

Imports

msvcrt

malloc
_initterm
memcpy
__C_specific_handler
free
_amsg_exit
_XcptFilter
_wcsupr
swscanf
memcpy_s
memset

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentProcessId
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess
TerminateProcess

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-file-l1-1-0

WriteFile
ReadFile

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-synch-l1-1-0

WaitForSingleObject

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

ntdll

RtlNtStatusToDosError
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteSize
RtlUnicodeToMultiByteN
RtlAdjustPrivilege
NtDeviceIoControlFile
NtWaitForSingleObject

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

IsInteractiveUserSession
QueryActiveSession
QueryUserToken
RegisterUsertokenForNoWinlogon
WTSCloseServer
WTSConnectSessionA
WTSConnectSessionW
WTSCreateListenerA
WTSCreateListenerW
WTSDisconnectSession
WTSEnableChildSessions
WTSEnumerateListenersA
WTSEnumerateListenersW
WTSEnumerateProcessesA
WTSEnumerateProcessesExA
WTSEnumerateProcessesExW
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSEnumerateServersW
WTSEnumerateSessionsA
WTSEnumerateSessionsExA
WTSEnumerateSessionsExW
WTSEnumerateSessionsW
WTSFreeMemory
WTSFreeMemoryExA
WTSFreeMemoryExW
WTSGetChildSessionId
WTSGetListenerSecurityA
WTSGetListenerSecurityW
WTSIsChildSessionsEnabled
WTSLogoffSession
WTSOpenServerA
WTSOpenServerExA
WTSOpenServerExW
WTSOpenServerW
WTSQueryListenerConfigA
WTSQueryListenerConfigW
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserConfigW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSRegisterSessionNotificationEx
WTSSendMessageA
WTSSendMessageW
WTSSetListenerSecurityA
WTSSetListenerSecurityW
WTSSetRenderHint
WTSSetSessionInformationA
WTSSetSessionInformationW
WTSSetUserConfigA
WTSSetUserConfigW
WTSShutdownSystem
WTSStartRemoteControlSessionA
WTSStartRemoteControlSessionW
WTSStopRemoteControlSession
WTSTerminateProcess
WTSUnRegisterSessionNotification
WTSUnRegisterSessionNotificationEx
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelOpenEx
WTSVirtualChannelPurgeInput
WTSVirtualChannelPurgeOutput
WTSVirtualChannelQuery
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSWaitSystemEvent

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wuapi.dll
.dll regsvr32 windows:10 windows x64 arch:x64

08424a5edfcc4e2ca25fa6f343c49058

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wuapi.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wtol
_o_free
_o_iswspace
_o_malloc
_o_mbstowcs_s
_o_qsort
_o_strcpy_s
_o_strncpy_s
_o_strtol
_o_terminate
_o_toupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstombs_s
_o_wcstoul
__CxxFrameHandler3
_CxxThrowException
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
wcsstr
_o__cexit
_o__callnewh
wcsrchr
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
strrchr
strchr
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
FindResourceExW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
LoadStringW
GetModuleHandleW
GetModuleFileNameA
SizeofResource
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
SetEvent
AcquireSRWLockShared
ReleaseMutex
CreateMutexExW
OpenEventW
ResetEvent
InitializeCriticalSectionEx
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
LeaveCriticalSection
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
EnterCriticalSection
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenThreadToken
CreateProcessW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
OpenProcessToken
GetCurrentThread

api-ms-win-core-localization-l1-2-0

SetThreadLocale
FormatMessageW
GetThreadLocale

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

rpcrt4

NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrOleAllocate
NdrDllGetClassObject
CStdStubBuffer_CountRefs
NdrCStdStubBuffer2_Release
UuidToStringW
RpcStringFreeW
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrStubCall3
UuidToStringA
UuidFromStringW
UuidCreate
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
UuidCreateNil
UuidCompare
CStdStubBuffer_Disconnect
CStdStubBuffer_AddRef
NdrOleFree
RpcStringFreeA
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
CStdStubBuffer_Invoke
RpcServerInqCallAttributesW

api-ms-win-core-com-midlproxystub-l1-1-0

NdrProxyForwardingFunction7
CStdStubBuffer2_Connect
ObjectStublessClient24
ObjectStublessClient4
NdrProxyForwardingFunction3
NdrProxyForwardingFunction9
ObjectStublessClient10
ObjectStublessClient9
NdrProxyForwardingFunction10
ObjectStublessClient8
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
NdrProxyForwardingFunction13
NdrProxyForwardingFunction21
CStdStubBuffer2_QueryInterface
ObjectStublessClient18
NdrProxyForwardingFunction12
NdrProxyForwardingFunction11
NdrProxyForwardingFunction18
NdrProxyForwardingFunction17
ObjectStublessClient7
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction6
ObjectStublessClient12
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
ObjectStublessClient14
NdrProxyForwardingFunction20
NdrProxyForwardingFunction19
ObjectStublessClient11
ObjectStublessClient23
ObjectStublessClient19
ObjectStublessClient15
ObjectStublessClient13
NdrProxyForwardingFunction16
ObjectStublessClient3
ObjectStublessClient22
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction8

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventProviderEnabled
EventRegister

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenCurrentUser
RegQueryValueExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-shcore-thread-l1-1-0

GetProcessReference

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
CopySid
CheckTokenMembership
FreeSid
DuplicateToken
ImpersonateSelf
AdjustTokenPrivileges
RevertToSelf
ImpersonateLoggedOnUser
IsValidSid
GetLengthSid
DuplicateTokenEx
GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
LocalFree
GlobalAlloc

api-ms-win-core-localization-obsolete-l1-2-0

GetNumberFormatW
CompareStringA
GetUserDefaultUILanguage

crypt32

CertFindCertificateInStore
CryptProtectData
CryptUnprotectData
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertOpenStore
CryptHashPublicKeyInfo
CertGetEnhancedKeyUsage
CertCloseStore
CertFreeCertificateContext
CertControlStore

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathStripToRootW
PathIsRootW
PathIsRelativeW
PathIsUNCW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
ActivateActCtx
ReleaseActCtx
DeactivateActCtx

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

MapViewOfFileEx
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
StartServiceW
OpenSCManagerW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W
QueryServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrChrW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

GetFileAttributesW
SetFileTime
WriteFile
ReadFile
GetFileType
GetDriveTypeW
LocalFileTimeToFileTime
SetFilePointer
CreateFileW
CreateDirectoryW
GetFileSizeEx
GetVolumePathNameW

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx

api-ms-win-core-wow64-l1-1-0

Wow64DisableWow64FsRedirection
IsWow64Process
Wow64RevertWow64FsRedirection

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 582KB - Virtual size: 582KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wuapihost.exe
.exe windows:10 windows x64 arch:x64

04ac43054de90c6c2629ead16ab86780

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wuapihost.pdb

Imports

msvcrt

_fmode
_amsg_exit
__wgetmainargs
__set_app_type
exit
?terminate@@YAXXZ
_commode
_XcptFilter
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-com-l1-1-0

CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoGetClassObject
CoWaitForMultipleHandles
CoFreeUnusedLibraries
CoUninitialize

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
IsThreadpoolTimerSet
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-synch-l1-1-0

SetEvent
CreateEventW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetStartupInfoW
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-shcore-thread-l1-1-0

SetProcessReference

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wuauclt.exe
.exe windows:10 windows x64 arch:x64

7877cd5a9a148c0ef0276a038cd3e108

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

81:a2:e7:71:e5:1d:ef:07:4e:b4:8f:91:30:5a:5e:2e:f7:ba:0c:4d:2f:87:e1:19:7c:5b:08:92:3e:1d:6b:a6
Signer

Actual PE Digest

81:a2:e7:71:e5:1d:ef:07:4e:b4:8f:91:30:5a:5e:2e:f7:ba:0c:4d:2f:87:e1:19:7c:5b:08:92:3e:1d:6b:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wuauclt.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o_exit
_o_free
_o_terminate
__C_specific_handler
__CxxFrameHandler4
_CxxThrowException
_o__get_wide_winmain_command_line
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapSetInformation
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreExW
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-synch-l1-2-0

Sleep

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wuaueng.dll
.dll windows:10 windows x64 arch:x64

a0dda2a886fbbbc9a8594b2eba5218d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wuaueng.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__strnicmp
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wfopen
_o__wsplitpath_s
_o__wtoi
_o__wtoi64
_o__wtol
memmove
_o_bsearch
_o_fclose
_o_free
_o_iswalnum
_o_iswalpha
_o_iswdigit
_o_iswspace
_o_malloc
_o_mbstowcs
_o_mbstowcs_s
_o_memcpy_s
_o_qsort
_o_rand
_o_realloc
_o_srand
_o_strcpy_s
_o_strncpy_s
_o_strtol
_o_terminate
_o_tolower
_o_toupper
_o_wcstod
_o_wcstok_s
_o_wcstol
_o_wcstombs
_o_wcstoul
__C_specific_handler
strrchr
strchr
wcschr
wcsstr
wcsrchr
__CxxFrameHandler3
_CxxThrowException
_o__ltow_s
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memmove_s
wcsncmp
memset
wcscmp

api-ms-win-core-localization-l1-2-0

LocaleNameToLCID
GetSystemDefaultLCID
LCMapStringW
GetUserGeoID
GetUILanguageInfo
FormatMessageW
GetLocaleInfoW
GetGeoInfoW

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread
ResumeThread
GetCurrentThread
OpenThreadToken
CreateThread
OpenProcessToken
GetThreadId
CreateProcessAsUserW
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
TerminateProcess
SetThreadPriority

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

EnumResourceNamesExW
GetModuleFileNameW
DisableThreadLibraryCalls
GetProcAddress
SizeofResource
LockResource
GetModuleHandleExW
LoadLibraryExW
FreeLibraryAndExitThread
EnumResourceLanguagesExW
FindResourceExW
FreeLibrary
LoadResource
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetErrorMode
SetLastError
GetLastError
GetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
DeleteCriticalSection
WaitForSingleObject
OpenSemaphoreW
CreateEventExW
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
SleepEx
CreateMutexW
CreateMutexExW
CreateSemaphoreExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSection
InitializeSRWLock
CreateEventW
SetEvent
ResetEvent

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventUnregister
EventSetInformation
EventProviderEnabled
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetComputerNameExW
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetVersionExW
GetTickCount64
GetSystemInfo
GlobalMemoryStatusEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-security-lsapolicy-l1-1-0

LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
LsaOpenPolicy

ntdll

RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlNtStatusToDosError
NtQueryInformationProcess
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlFreeHeap
WinSqmSetDWORD
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
NtSetInformationThread
NtQuerySystemInformation
NtQuerySecurityPolicy
RtlIsMultiSessionSku
WinSqmIncrementDWORD
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD
InitializeSecurityDescriptor
CheckTokenMembership
SetSecurityDescriptorDacl
IsValidSid
GetLengthSid
CopySid
EqualSid
GetTokenInformation
GetSidSubAuthority
RevertToSelf
ImpersonateLoggedOnUser
FreeSid
ImpersonateSelf
GetSidSubAuthorityCount
CreateRestrictedToken
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc
GlobalFree

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegGetValueW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
FlushFileBuffers
GetDiskFreeSpaceW
CreateFileW
SetEndOfFile
WriteFile
GetVolumePathNameW
GetDriveTypeW
GetFileType
GetFileSize
ReadFile
FileTimeToLocalFileTime
LocalFileTimeToFileTime
CompareFileTime
GetLogicalDriveStringsW
RemoveDirectoryW
FindClose
DeleteFileW
CreateDirectoryW
GetDiskFreeSpaceExW
GetFinalPathNameByHandleW
FindNextFileW
FindFirstFileW
SetFileInformationByHandle
SetFileAttributesW
GetVolumeInformationW
DeleteFileA
GetFileSizeEx
SetFilePointerEx
GetFileInformationByHandle
GetFileTime
GetTempFileNameW
GetFileAttributesW
SetFilePointer
SetFileTime

crypt32

CryptMemFree
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptUnprotectData
CryptProtectData
CryptStringToBinaryW
CryptBinaryToStringW
CryptVerifyTimeStampSignature
CertOpenStore
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertFindCertificateInStore
CertFreeCertificateChain
CertControlStore
CertGetCertificateChain
CertGetEnhancedKeyUsage
CertAddEncodedCertificateToStore
CryptHashPublicKeyInfo
CertCreateCertificateContext
CryptImportPublicKeyInfoEx2

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CLSIDFromString
CoQueryProxyBlanket
CoSetProxyBlanket
CoCreateInstance
CoSwitchCallContext
CoInitializeEx
IIDFromString
CoCreateFreeThreadedMarshaler
CoDisconnectObject
CoCreateGuid
CoRevertToSelf
CoDisconnectContext
CoRevokeClassObject
CoResumeClassObjects
CoRegisterClassObject
CoImpersonateClient
CoInitializeSecurity
CoTaskMemAlloc
CoUninitialize
CoGetMalloc
CoTaskMemRealloc
PropVariantClear
CoTaskMemFree
StringFromGUID2
CoCancelCall
CoEnableCallCancellation
CoDisableCallCancellation

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime
GetSystemPowerStatus
GetComputerNameW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

oleaut32

VariantChangeType
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
VariantTimeToSystemTime
VarUI4FromStr
SafeArrayDestroy
SafeArrayCreate
SystemTimeToVariantTime
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringByteLen
VariantChangeTypeEx
VariantCopyInd
SysStringByteLen
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString
SafeArrayUnlock
SafeArrayGetVartype
SafeArrayLock

rpcrt4

RpcServerInqCallAttributesW
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
UuidToStringA
RpcStringFreeA
RpcStringFreeW
UuidCreate
UuidToStringW
UuidFromStringW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
CompareStringA
EnumUILanguagesW
GetSystemDefaultUILanguage

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
DeleteTimerQueueEx

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrToIntW
StrChrW
StrToIntExW
StrRChrW
StrTrimW

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable
VerSetConditionMask
GetNativeSystemInfo
GetProductInfo

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx
CallNtPowerInformation

bcrypt

BCryptVerifySignature
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptFinishHash
BCryptDestroyKey
BCryptHashData

winhttp

WinHttpGetDefaultProxyConfiguration
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpReadData
WinHttpQueryOption
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetOption
WinHttpOpen
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpCreateUrl

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRootW
PathFileExistsW
PathIsRelativeW
PathStripToRootW
PathIsUNCW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfig2W
ChangeServiceConfig2W
QueryServiceStatusEx
QueryServiceConfigW
ChangeServiceConfigW

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegEnumKeyW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-io-l1-1-0

DeviceIoControl

ws2_32

WSAGetLastError
WSAStartup
WSASocketW
WSACleanup
WSAIoctl
closesocket

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW
EnableTraceEx2

api-ms-win-core-file-l1-2-1

GetCompressedFileSizeW

api-ms-win-eventing-consumer-l1-1-0

CloseTrace

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
FlushViewOfFile
UnmapViewOfFile
MapViewOfFileEx

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-file-l1-2-0

GetTempPathW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-processthreads-l1-1-2

SetThreadInformation

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx

api-ms-win-core-url-l1-1-0

UrlEscapeW

umpdc

Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRegister
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientActivate
Pdcv2ActivationClientRenewActivation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoTransformError
SetRestrictedErrorInfo

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllMain
GeneralizeForImaging
WUCreateExpressionEvaluator
WUCreateUpdateHandler
WUServiceMain

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 800KB - Virtual size: 800KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wuceffects.dll
.dll windows:10 windows x64 arch:x64

65030fe86c3b094f71d80a2ad410075e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wuceffects.pdb

Imports

msvcp_win

?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__create_locale
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__ltoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp_l
_o_cos
_o_powf
_o_terminate
__CxxFrameHandler3
__C_specific_handler
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
strcmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
LoadResource
LockResource
SizeofResource

api-ms-win-core-synch-l1-1-0

CreateMutexExW
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObject
ResetEvent
ReleaseSemaphore
SetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
TerminateThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsSubstringWithSpecifiedLength
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsDuplicateString

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

FindResourceA

ntdll

NtQuerySystemInformation
DbgPrintEx
DbgPrompt

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-crt-math-l1-1-0

ceilf
cosf
sinf
sqrtf

Exports

Exports

CompileEffectDescription
CreateEffectDescription
DeserializeEffectDescription
SerializeEffectDescription

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wudriver.dll
.dll windows:10 windows x64 arch:x64

3bc212c57f2b81dea9c0c33dbc11c11a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wudriver.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtol
_o_free
_o_malloc
_o_qsort
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
__CxxFrameHandler4
__std_terminate
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ResetEvent
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
InitializeCriticalSection
SetEvent
CreateEventW
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

oleaut32

SysFreeString
VariantTimeToSystemTime
SysStringLen
VariantInit
SysAllocString

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitializeEx

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateDirectoryW
GetFileType
GetFileSizeEx
GetFullPathNameW
CreateFileW
GetDriveTypeW
ReadFile
LocalFileTimeToFileTime
RemoveDirectoryW
SetFilePointer
FindNextFileW
SetFileTime
DeleteFileW
FindClose
FindFirstFileW
GetVolumePathNameW
WriteFile

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchAppend

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

user32

PeekMessageW
TranslateMessage
MsgWaitForMultipleObjects
DispatchMessageW

shell32

SHCreateDirectoryExW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

profapi

ord104

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

rpcrt4

RpcStringFreeA
UuidToStringA

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-synch-l1-2-0

Sleep

kernel32

CompareStringA
DosDateTimeToFileTime

shlwapi

StrChrW
PathIsUNCW
StrRChrW
PathStripToRootW
PathIsRelativeW
PathIsRootW

cabinet

ord22
ord23
ord20

crypt32

CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertCloseStore
CryptHashPublicKeyInfo
CertFindCertificateInStore
CertControlStore
CertOpenStore
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

wintrust

WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain

Exports

Exports

CancelCDMOperation
CloseCDMContext
DetFilesDownloaded
DownloadIsInternetAvailable
DownloadUpdatedFiles
FindMatchingDriver
LogDriverNotFound
OpenCDMContext
OpenCDMContextEx
QueryDetectionFiles

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wups.dll
.dll regsvr32 windows:10 windows x64 arch:x64

cb334aae0eb30cb37bc028d86fc5ec7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wups.pdb

Imports

msvcrt

malloc
__C_specific_handler
_amsg_exit
_initterm
free
_XcptFilter
memcmp

rpcrt4

NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrDllGetClassObject
NdrStubForwardingFunction
NdrStubCall3

api-ms-win-core-com-midlproxystub-l1-1-0

NdrProxyForwardingFunction4
NdrProxyForwardingFunction3
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Connect
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient11
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient15
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient4
ObjectStublessClient9
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient21
ObjectStublessClient6
ObjectStublessClient5
ObjectStublessClient3
ObjectStublessClient7
ObjectStublessClient13
CStdStubBuffer2_Disconnect
ObjectStublessClient8

oleaut32

BSTR_UserSize64
BSTR_UserFree64
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserUnmarshal64
BSTR_UserMarshal64

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-com-l1-1-0

CoRegisterPSClsid

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wups2.dll
.dll regsvr32 windows:10 windows x64 arch:x64

7c216d2dce5c0fdb23011b0b2ceeeaa6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wups2.pdb

Imports

msvcrt

malloc
free
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
memcmp

oleaut32

BSTR_UserUnmarshal
BSTR_UserMarshal64
BSTR_UserUnmarshal64
BSTR_UserFree64
BSTR_UserSize64
BSTR_UserFree
BSTR_UserMarshal
BSTR_UserSize

rpcrt4

NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrCStdStubBuffer_Release
NdrStubCall3
NdrDllRegisterProxy
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
NdrStubForwardingFunction
CStdStubBuffer_DebugServerRelease
IUnknown_Release_Proxy
CStdStubBuffer_Connect
NdrOleFree
CStdStubBuffer_AddRef

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient7
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
CStdStubBuffer2_Disconnect
ObjectStublessClient15
ObjectStublessClient17
ObjectStublessClient10
NdrProxyForwardingFunction4
ObjectStublessClient3
ObjectStublessClient16
ObjectStublessClient4
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient14
NdrProxyForwardingFunction3
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient18
CStdStubBuffer2_QueryInterface
CStdStubBuffer2_Connect
ObjectStublessClient5

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-com-l1-1-0

CoRegisterPSClsid

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wusa.exe
.exe windows:10 windows x64 arch:x64

f42a26f78b11dd40a082fd1f08fc7f4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wusa.pdb

Imports

advapi32

RegCreateKeyExW
RegSetValueExW
RegCloseKey
InitiateSystemShutdownExW
CreateProcessAsUserW
RegOpenKeyExW
ConvertSidToStringSidW
RegDeleteValueW
RegEnumKeyW
RegQueryValueExW
RegDeleteKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
GetTokenInformation
CopySid
RegDeleteKeyValueW
StartTraceW
EnableTrace
ControlTraceW
CloseTrace
IsValidSid
GetLengthSid
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextW
CryptGenRandom
DecryptFileA
CryptReleaseContext
EventRegister
EventUnregister
EventEnabled
EventWrite

kernel32

GetSystemDirectoryA
lstrcmpW
DeleteFileW
MultiByteToWideChar
RemoveDirectoryW
OutputDebugStringW
GetFileAttributesW
GetFullPathNameW
GetFileAttributesA
CreateDirectoryA
LeaveCriticalSection
EnterCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
MoveFileExW
IsDebuggerPresent
FormatMessageW
GetProcessHeap
AcquireSRWLockShared
CreateMutexExW
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
CloseThreadpoolTimer
ReleaseMutex
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
GetModuleHandleExW
CreateFileW
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
DebugBreak
OutputDebugStringA
SetLastError
TerminateProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStartupInfoW
Sleep
GetCurrentProcessId
ProcessIdToSessionId
GetExitCodeProcess
GetCommandLineW
GetCurrentProcess
ReleaseSemaphore
GetModuleHandleW
GetLastError
LocalFree
CreateThread
WaitForSingleObject
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemWindowsDirectoryW
CloseHandle
GetExitCodeThread
FindClose
FindNextFileW
lstrcmpiW
FindFirstFileW

gdi32

GetDeviceCaps
GetStockObject
DeleteDC
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
DeleteObject
CreateFontIndirectW

user32

UpdateWindow
LoadCursorW
LoadIconW
SetWindowLongW
EnableWindow
SetDlgItemTextW
SetFocus
EndPaint
FillRect
BeginPaint
ReleaseDC
GetDC
DialogBoxParamW
SendMessageW
SetRect
GetClientRect
ShowWindow
SystemParametersInfoW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
RegisterClassExW
EndDialog
SendDlgItemMessageW
GetDlgItem
CreateWindowExW
ShutdownBlockReasonCreate
ShutdownBlockReasonDestroy
DestroyWindow
CreateAcceleratorTableW
TranslateAcceleratorW
DestroyAcceleratorTable
PostMessageW

msvcrt

_wcsnicmp
iswdigit
wcschr
_vsnprintf
__C_specific_handler
malloc
_callnewh
free
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
_wcmdln
_fmode
_commode
_lock
_unlock
_wcsicmp
_onexit
?terminate@@YAXXZ
memset
memmove
memcpy
memcmp
_purecall
_errno
_vsnwprintf
__dllonexit
wcsrchr
strcmp

oleaut32

SysAllocString
SysFreeString
VariantInit

shell32

CommandLineToArgvW
ShellExecuteExW
ord730

shlwapi

StrToIntExW

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmEndSession
WinSqmSetDWORD
WinSqmSetString
WinSqmStartSession

dpx

DpxNewJob

wtsapi32

WTSQueryUserToken

comctl32

InitCommonControlsEx
ord344

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoTaskMemFree

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wuuhext.dll
.dll windows:10 windows x64 arch:x64

9ffe088829e5da2999e7b16f0d614d64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wuuhext.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o__wtoi64
_o__wtol
_o_free
memmove
_o_iswalpha
_o_malloc
_o_mbstowcs
_o_mbstowcs_s
_o_memcpy_s
_o_qsort
_o_strcpy_s
_o_terminate
_o_toupper
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
wcsstr
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread
CreateThread
GetExitCodeProcess
CreateProcessW
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
GetModuleFileNameW
FreeLibraryAndExitThread
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
UnhandledExceptionFilter
GetLastError
RaiseException
GetErrorMode
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-1-0

CreateEventW
InitializeCriticalSectionAndSpinCount
SetEvent
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateSemaphoreExW
CreateMutexExW
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared
LeaveCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventProviderEnabled
EventRegister
EventUnregister
EventSetInformation

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoTaskMemAlloc
IIDFromString
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CoDisconnectContext
CoTaskMemRealloc
StringFromGUID2
CoGetMalloc
CoCreateGuid

oleaut32

SysFreeString
SysStringLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysStringByteLen

api-ms-win-core-file-l1-1-0

SetFileTime
CreateFileW
GetFileInformationByHandle
SetFileAttributesW
WriteFile
ReadFile
SetFileInformationByHandle
GetFileSizeEx
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
LocalFileTimeToFileTime
DeleteFileW
GetFileAttributesW
SetFilePointer
GetVolumePathNameW
CreateDirectoryW
GetDriveTypeW
GetFileType

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
CompareStringW
WideCharToMultiByte

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_DevNode_Status
CM_MapCrToWin32Err
CM_Locate_DevNodeW
CM_Get_Device_IDW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegEnumValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegQueryValueExW

rpcrt4

UuidToStringW
UuidCreate
UuidFromStringW
RpcStringFreeA
UuidToStringA
RpcStringFreeW

api-ms-win-devices-query-l1-1-0

DevGetObjectProperties
DevFreeObjectProperties

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

crypt32

CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertControlStore
CertCloseStore
CryptUnprotectData
CertFindCertificateInStore
CertOpenStore
CertVerifyCertificateChainPolicy
CertGetCertificateContextProperty
CryptHashPublicKeyInfo

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathStripToRootW
PathIsRelativeW
PathIsUNCW
PathFindExtensionW
PathIsRootW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-security-base-l1-1-0

FreeSid
AllocateAndInitializeSid
CheckTokenMembership
GetTokenInformation
DuplicateTokenEx

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

ntdll

RtlFreeHeap

api-ms-win-security-cryptoapi-l1-1-0

CryptCreateHash
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptHashData

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrChrW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

cabinet

ord20
ord23
ord22
ord21

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

iphlpapi

GetAdaptersInfo

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference

Exports

Exports

WUCreateDriverUtil
WUCreateExpressionEvaluator
WUCreateUpdateHandler
WUGetHardwareIdInfo

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wuuhosdeployment.dll
.dll windows:10 windows x64 arch:x64

52a8a6a923057021f58741a34ca7b156

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wuuhosdeployment.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wtoi64
_o__wtol
_o_free
_o_iswalpha
_o_iswspace
_o_malloc
_o_mbstowcs_s
_o_memcpy_s
_o_wcstoul
__C_specific_handler
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__get_errno
__CxxFrameHandler4
__std_terminate
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vsnprintf_s
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
wcsstr
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
memmove_s

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetProcAddress
LoadLibraryExW
LoadResource
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
CreateMutexW
ReleaseMutex
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
CreateMutexExW
WaitForSingleObjectEx
ReleaseSemaphore
OpenSemaphoreW
InitializeCriticalSection
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThreadId
GetCurrentProcess
GetExitCodeThread
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemWindowsDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

oleaut32

SysAllocStringLen
SysStringByteLen
VariantChangeType
VariantInit
SysFreeString
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringLen

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoRegisterClassObject
CoDisconnectContext
CoTaskMemFree
CoRevokeClassObject
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CoTaskMemRealloc
CoDisconnectObject

crypt32

CryptUnprotectData
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertControlStore
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CryptHashPublicKeyInfo

api-ms-win-core-heap-l2-1-0

LocalFree

rpcrt4

UuidToStringW
RpcStringFreeA
RpcStringFreeW
UuidCreate
UuidToStringA
UuidFromStringW

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

SetFilePointer
LocalFileTimeToFileTime
SetFileTime
GetFileAttributesW
CreateFileW
GetFileInformationByHandle
SetFileAttributesW
FindClose
GetFileType
GetDriveTypeW
SetFileInformationByHandle
FindFirstFileW
FindNextFileW
GetVolumePathNameW
GetFileSizeEx
CreateDirectoryW
RemoveDirectoryW
GetFinalPathNameByHandleW
ReadFile
WriteFile

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathStripToRootW
PathIsRootW
PathIsUNCW
PathIsRelativeW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-memory-l1-1-0

MapViewOfFileEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

profapi

ord104

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrChrW
StrRChrW

cabinet

ord23
ord20
ord21
ord22

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-security-cryptoapi-l1-1-0

CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
CryptHashData
CryptGetHashParam
CryptReleaseContext

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
WUCreateExpressionEvaluator
WUCreateUpdateHandler

Sections

.text
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wvc.dll
.dll regsvr32 windows:10 windows x64 arch:x64

f4e975b694deecd2ac58af812988eb82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wvc.pdb

Imports

mfc42u

ord624
ord1284
ord1262
ord1126
ord1287
ord1286
ord4473
ord626
ord1040

msvcrt

wcsncmp
_wtol
sin
pow
memset
memmove
memcmp
log
floor
cos
ceil
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
wcsstr
_clearfp
wcstod
_vsnwprintf
_wtoi
wcsrchr
?name@type_info@@QEBAPEBDXZ
_wcsicmp
malloc
free
_purecall
realloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
atan2
sqrt

atl

ord45
ord44
ord43
ord27
ord30
ord21
ord22
ord16
ord15
ord32
ord23
ord18
ord26
ord58
ord31

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
CloseHandle
CreateFileW
WriteFile
GetNumberFormatW
GetCurrencyFormatW
GetLocaleInfoW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
GetCurrentProcess
VirtualFree
LocalFree
FileTimeToSystemTime
GetModuleFileNameW
GetModuleHandleW
GetVersionExW
MulDiv
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
VirtualQuery
GlobalUnlock
DeleteCriticalSection
GlobalLock
GetProcAddress
GetSystemInfo
GlobalAlloc
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
EnterCriticalSection
VirtualProtect
RtlVirtualUnwind
GetTimeFormatW
SetLastError
SystemTimeToFileTime
GetDateFormatW

ole32

CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
CoGetMalloc
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemFree

oleaut32

VarDateFromStr
SystemTimeToVariantTime
LHashValOfNameSys
VariantClear
SysStringLen
OleCreatePropertyFrame
SysFreeString
LoadRegTypeLi
SetErrorInfo
CreateErrorInfo
VariantInit
VariantChangeType
SysAllocString
VariantCopy
SafeArrayCreateVector
SafeArrayUnaccessData
VariantTimeToSystemTime
VariantChangeTypeEx
SafeArrayCopy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
VariantCopyInd
SysAllocStringLen
SafeArrayCreate
SafeArrayPutElement
SafeArrayAccessData

user32

SetWindowPos
EqualRect
SetWindowLongPtrW
SetWindowRgn
UnionRect
GetWindowLongPtrW
ShowWindow
IsWindow
GetFocus
DestroyAcceleratorTable
IsChild
IntersectRect
SetFocus
PtInRect
InvalidateRect
DestroyWindow
CallWindowProcW
GetKeyState
DefWindowProcW
GetDC
ReleaseDC
LoadStringW
SystemParametersInfoW
GetSysColor
InvalidateRgn
IsRectEmpty
SetRectEmpty
CopyRect
DestroyCaret
EnableWindow
EndPaint
GetClientRect
BeginPaint
GetUpdateRgn
SetTimer
ScreenToClient
GetWindowRect
KillTimer
TrackPopupMenuEx
DestroyMenu
GetSubMenu
LoadMenuW
FillRect
ClientToScreen
SetRect
OffsetRect
CreateWindowExW

advapi32

TraceEvent
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags

gdi32

GdiFlush
CreateDIBSection
BitBlt
GetRgnBox
CreateCompatibleDC
CreateCompatibleBitmap
DPtoLP
PtVisible
CreateRectRgn
PatBlt
MoveToEx
LineTo
Polygon
SetBkColor
CreateSolidBrush
Polyline
Ellipse
Arc
ExtTextOutW
CombineRgn
LPtoDP
SetBkMode
RestoreDC
SetViewportOrgEx
DeleteDC
GetDeviceCaps
SetWindowExtEx
CreateRectRgnIndirect
SetWindowOrgEx
CloseMetaFile
SaveDC
GetObjectType
SelectPalette
RealizePalette
SelectObject
GetStockObject
SetTextColor
GetTextFaceW
GetTextMetricsW
GetOutlineTextMetricsW
GetTextExtentExPointW
GetCharWidthW
DeleteMetaFile
GetMapMode
SetMapMode
Escape
GetClipBox
IntersectClipRect
SelectClipRgn
SetViewportExtEx
SetTextAlign
GetWindowOrgEx
DeleteObject
CreateBrushIndirect
ExtCreatePen
CreatePenIndirect
CreateFontIndirectW
SetRectRgn
CreateMetaFileW

msimg32

AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 299KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wwancfg.dll
.dll windows:10 windows x64 arch:x64

49decdfb6773b3da00526a10323a4d5d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wwancfg.pdb

Imports

msvcrt

_callnewh
memcpy
memcpy_s
_wcsicmp
__C_specific_handler
_initterm
malloc
_amsg_exit
_XcptFilter
free
_wtoi
wcsstr
toupper
memcmp
__CxxFrameHandler3
iswdigit
memset

ntdll

EtwGetTraceLoggerHandle
EtwTraceMessage
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
RtlIpv4AddressToStringW
EtwGetTraceEnableLevel
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
RtlIpv6AddressToStringW
EtwRegisterTraceGuidsW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadStringW

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoCreateInstance
IIDFromString
CoUninitialize
CoInitializeEx
CLSIDFromString
CoTaskMemFree
StringFromCLSID

api-ms-win-core-synch-l1-1-0

SetEvent
CreateEventW
WaitForMultipleObjectsEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-file-l1-1-0

SetFileInformationByHandle
FileTimeToLocalFileTime
CreateFileW

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW

api-ms-win-eventing-legacy-l1-1-0

EnableTrace

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

netsh.exe

MatchTagsInCmdLine
RegisterHelper
PrintMessageFromModule
MatchEnumTag
RegisterContext

wwapi

WwanDeleteDMConfigProfile
WwanEnumerateInterfaces
WwanSetProfile
WwanGetProfile
WwanGetProfileList
WwanRegisterNotification
WwanDeleteProfile
WwanDisconnect
WwanAllocateMemory
WwanQueryInterface
WwanScan
WwanCloseHandle
WwanSetInterface
WwanOpenHandle
WwanConnect
WwanSetDMConfigProfile
WwanFreeMemory
WwanGetDMConfigProfile
WwanGetProfileState
WwanConnectAdditionalPdpContext
WwanGetProfileListByPurpose
WwanGetDMConfigProfileList

wcmapi

WcmCloseHandle
WcmSetParameter
WcmQueryProperty
WcmFreeMemory
WcmOpenHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

Exports

Exports

GetResourceString
InitHelperDll

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wwanconn.dll
.dll windows:10 windows x64 arch:x64

ec57deb7c06447a963f0a58c2a0b186e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WWanConn.pdb

Imports

msvcrt

wcsncmp
__CxxFrameHandler3
_CxxThrowException
memcpy
realloc
_errno
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_wtoi
wcschr
iswdigit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
iswspace
calloc
memmove_s
swprintf_s
_purecall
free
malloc
wcsncpy_s
__C_specific_handler
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
_wcsnicmp
memset

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
LockResource
GetModuleFileNameA
GetModuleFileNameW
FreeLibrary
LoadResource
GetProcAddress
LoadLibraryExW
SizeofResource
GetModuleHandleExW
LoadStringW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSemaphore
AcquireSRWLockShared
WaitForSingleObject
CreateMutexExW
ReleaseSRWLockShared
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

EnumSystemGeoID
GetGeoInfoW
FormatMessageW
GetUserGeoID

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SafeArrayGetElement
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayGetLBound
VariantClear
SysAllocString
SysStringLen
VarUI4FromStr
VarBstrCmp
SysAllocStringByteLen
VariantChangeType
VariantInit
SysAllocStringLen
SysFreeString
SysStringByteLen
VarBstrCat

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
StringFromIID
CoTaskMemAlloc
CoTaskMemRealloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

crypt32

CryptProtectData
CryptUnprotectMemory
CryptProtectMemory
CryptUnprotectData

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
CreateActCtxW
ActivateActCtx

wwapi

WwanFreeMemory
WwanAllocateMemory

ntdll

WinSqmAddToStreamEx
WinSqmAddToStream
WinSqmIncrementDWORD
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW

kernel32

lstrcmpW
lstrcmpiW
lstrlenW
CreateFileW
ReleaseActCtx

user32

GetParent
SendMessageW
PostMessageW
SetPropW
RemovePropW
GetPropW
KillTimer
SetWindowLongPtrW
SetTimer
UpdateWindow
UnregisterClassA
SendInput
RegisterWindowMessageW
CharUpperBuffW

ole32

StringFromGUID2
CoSetProxyBlanket
IIDFromString

shell32

ShellExecuteExW

wcmapi

WcmFreeMemory
WcmQueryProperty

duser

InitGadgets
DeleteHandle
DUserPostEvent

dui70

?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetCheckedState@TouchCheckBox@DirectUI@@QEAAJW4CheckedStateFlags@2@@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ
?SetEncodedContentString@Element@DirectUI@@QEAAJPEBG@Z
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?CreateInstance@CSafeElementProxy@@SAJPEAVElement@DirectUI@@PEAPEAV1@@Z
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ
?SetContentAlign@Element@DirectUI@@QEAAJH@Z
DuiCreateObject
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?Detach@CSafeElementProxy@@QEAAXXZ
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetSelection@TouchSelect@DirectUI@@QEAAPEAVElement@2@XZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ
?SetSheet@Element@DirectUI@@QEAAJPEAVStyleSheet@2@@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?Release@Value@DirectUI@@QEAAXXZ
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
StrToID
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?GetSheet@DUIXmlParser@DirectUI@@QEAAJPEBGPEAPEAVValue@2@@Z

mobilenetworking

PersistentRegPathGetDWORD
GetPersistentRegPath
PersistentRegPathOpenKey

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

bcrypt

BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptFinishHash

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wwanmm.dll
.dll windows:10 windows x64 arch:x64

085d30f77f85e03dcd40724f5435c85f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WWanMM.pdb

Imports

msvcrt

memcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_callnewh
_vsnprintf_s
_wtoi
vswprintf_s
swprintf_s
memmove_s
_wtoi64
??3@YAXPEAX@Z
iswdigit
_get_errno
_set_errno
memcpy_s
_vsnwprintf
malloc
free
_purecall
calloc
??_V@YAXPEAX@Z
_resetstkoflw
__C_specific_handler
__CxxFrameHandler3
memset

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
CreateEventW
WaitForSingleObject
ResetEvent
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
SetEvent

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
FreeLibrary
LockResource
LoadStringW
FindResourceExW
LoadResource
GetModuleHandleExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
StringFromIID
CoTaskMemRealloc
CoUninitialize
IIDFromString
CoCreateGuid

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

oleaut32

SafeArrayGetElement
SafeArrayLock
SysAllocString
VariantClear
SafeArrayDestroy
VariantInit
VariantChangeType
SafeArrayUnlock
SafeArrayAccessData
SysStringLen
SafeArrayRedim
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayCreate
SysFreeString
SafeArrayGetUBound

iphlpapi

ConvertInterfaceLuidToAlias
ConvertInterfaceGuidToLuid

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-sidebyside-l1-1-0

FindActCtxSectionStringW
CreateActCtxW
DeactivateActCtx
ActivateActCtx
QueryActCtxW

kernel32

lstrlenW
lstrcmpW
LocalFree
InitializeCriticalSectionEx
OutputDebugStringW
LoadLibraryExW
CreateFileW
lstrlenA
ExpandEnvironmentStringsW
DebugBreak
GetModuleHandleW
GetProcessHeap
CreateMutexExW
HeapAlloc
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
CompareStringOrdinal
IsDebuggerPresent

user32

UnregisterClassA

ntdll

RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlNtStatusToDosError
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
WinSqmAddToStream
WinSqmSetDWORD
WinSqmAddToStreamEx

shell32

ShellExecuteExW
CommandLineToArgvW

wwapi

WwanFreeMemory
WwanAllocateMemory

mobilenetworking

GetPersistentRegPath

wcmapi

WcmQueryProperty
WcmFreeMemory

datusage

CreateDataUsageHelper

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

crypt32

CryptUnprotectData
CryptProtectData

Exports

Exports

DllCanUnloadNow
DllGetClassObject
StartDiagnosticsW

Sections

.text
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wwanprotdim.dll
.dll windows:10 windows x64 arch:x64

9a5be203dbe5e5f8b8a67cc8d167d776

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wwanprotdim.pdb

Imports

msvcrt

malloc
_initterm
free
__C_specific_handler
_amsg_exit
memcpy
memcmp
_XcptFilter
toupper
sprintf_s
memcpy_s
wcsnlen
memmove
_vsnwprintf
memset

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids

rpcrt4

RpcStringFreeW
UuidToStringW
UuidFromStringW

api-ms-win-core-string-l2-1-0

CharUpperBuffW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
DeleteCriticalSection
ReleaseSRWLockExclusive

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetThreadId
GetCurrentProcessId
GetCurrentThreadId
CreateThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

ntdll

NtDeviceIoControlFile
RtlNtStatusToDosError

api-ms-win-core-heap-l2-1-0

LocalAlloc

Exports

Exports

DimInitialize

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wwansvc.dll
.dll windows:10 windows x64 arch:x64

4e935a06527aa8de53cb2dd2e5d7a14b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wwansvc.pdb

Imports

msvcp_win

?id@?$ctype@G@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1_Lockit@std@@QEAA@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?widen@?$ctype@G@std@@QEBAGD@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ

api-ms-win-crt-string-l1-1-0

wcsnlen
wcscmp
memmove_s
memset
strncmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wtoi
_o_calloc
_o_free
_o_isalpha
_o_iswalnum
_o_iswdigit
_o_iswspace
_o_malloc
_o_qsort
_o_terminate
_o_toupper
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
__CxxFrameHandler3
__C_specific_handler
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__std_type_info_compare
wcsstr
__std_terminate
__CxxFrameHandler4
memchr
memcmp
memcpy

ntdll

RtlInitUnicodeString
WinSqmAddToStreamEx
NtPowerInformation
RtlNtStatusToDosError
RtlStringFromGUID
NtDeviceIoControlFile
RtlPublishWnfStateData
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWithCompletionCallback
RtlQueryWnfStateData
WinSqmIncrementDWORD
RtlNtStatusToDosErrorNoTeb
WinSqmIsOptedIn
NtCreateWnfStateName
NtQueryWnfStateData
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
RtlQueryPackageIdentity
RtlDeriveCapabilitySidsFromName
EtwTraceMessage
NtQueryKey
RtlTestAndPublishWnfStateData
RtlWaitForWnfMetaNotification

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
WaitForSingleObject
EnterCriticalSection
CreateSemaphoreExW
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
CreateEventW
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
ReleaseSemaphore
ResetEvent
CreateEventExW
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolWait
CloseThreadpoolCleanupGroup
SetThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CallbackMayRunLong
IsThreadpoolTimerSet
TrySubmitThreadpoolCallback
SetThreadpoolWait
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThread
GetCurrentProcess
OpenThreadToken
GetCurrentThreadId
CreateThread
OpenProcessToken
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysAllocString
SysFreeString
SysReAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VariantInit
VarBstrCat
VariantChangeType
SysAllocStringLen
SysStringLen
VariantClear

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventProviderEnabled
EventWriteTransfer
EventUnregister
EventWrite
EventActivityIdControl

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-com-l1-1-0

IIDFromString
CoInitializeEx
CLSIDFromString
CoDecrementMTAUsage
CoUninitialize
StringFromGUID2
CoIncrementMTAUsage
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoCreateGuid
CoCreateInstance

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx
CreateTimerQueueTimer
UnregisterWaitEx
CreateTimerQueue
DeleteTimerQueueTimer
ChangeTimerQueueTimer

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegGetValueW
RegCreateKeyExW
RegDeleteTreeW
RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-devices-query-l1-1-0

DevGetObjectProperties
DevFreeObjectProperties
DevCloseObjectQuery

api-ms-win-core-file-l1-1-0

CreateDirectoryW
DeleteFileW
CreateFileW
GetFullPathNameW
SetFileAttributesW
GetFileAttributesW
WriteFile
ReadFile

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

devobj

DevObjGetDeviceInstanceId
DevObjDestroyDeviceInfoList
DevObjGetDeviceInterfaceDetail
DevObjGetDeviceRegistryProperty
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjEnumDeviceInfo
DevObjOpenDevRegKey
DevObjOpenDeviceInfo
DevObjGetDeviceProperty
DevObjEnumDeviceInterfaces

iphlpapi

GetAdaptersAddresses
GetIfEntry2
SetInterfaceDnsSettings
ConvertInterfaceGuidToLuid

rpcrt4

UuidFromStringW
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcExceptionFilter
RpcImpersonateClient
RpcRevertToSelfEx
UuidCreate
RpcEpUnregister
I_RpcExceptionFilter
RpcBindingSetOption
RpcStringFreeW
UuidToStringW
RpcBindingSetAuthInfoW
RpcMgmtInqServerPrincNameW
RpcServerInqCallAttributesW
RpcBindingVectorFree
NdrAsyncServerCall
RpcServerUnregisterIfEx
NdrServerCallAll
RpcServerUseProtseqW
RpcServerRegisterIf3
RpcAsyncCompleteCall
Ndr64AsyncServerCallAll
RpcServerListen
NdrServerCall2
RpcServerInqBindingHandle
RpcServerUnsubscribeForNotification
RpcServerSubscribeForNotification
RpcAsyncAbortCall
I_RpcOpenClientProcess
RpcServerRegisterAuthInfoW
RpcServerInqBindings
RpcEpRegisterW
NdrClientCall3

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemWindowsDirectoryW
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-devices-swdevice-l1-1-0

SwDeviceInterfaceRegister
SwDeviceClose
SwDeviceCreate
SwMemFree

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

winhttp

WinHttpCreateUrl
WinHttpCrackUrl

ws2_32

WSAAddressToStringW
WSACleanup
closesocket
WSAIoctl
WSAEventSelect
socket
WSAGetLastError
WSAStartup
WSAEnumNetworkEvents
ntohl

api-ms-win-oobe-notification-l1-1-0

OOBEComplete

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-security-accesshlpr-l1-1-0

QueryTransientObjectSecurityDescriptor
FreeTransientObjectSecurityDescriptor

api-ms-win-security-base-l1-1-0

CopySid
GetTokenInformation
EqualSid
AllocateAndInitializeSid
CreateWellKnownSid
FreeSid
CheckTokenMembership

api-ms-win-devices-config-l1-1-1

CM_Setup_DevNode
CM_Query_And_Remove_SubTreeW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringEx

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wmi

WmiNotificationRegistrationW

policymanager

PolicyManager_GetPolicyInt

umpdc

Pdcv2ActivationClientActivate
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRegister

mobilenetworking

PersistentRegPathCreateKey
PersistentRegPathOpenKey
PersistentRegPathSetDWORD
PersistentRegPathGetDWORD
PersistentRegPathGetValue
GetPersistentRegPath

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW
RegisterWaitForSingleObject

api-ms-win-core-file-l2-1-0

ReplaceFileW

profapi

ord104

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-capability-l1-1-0

RpcClientCapabilityCheck

api-ms-win-security-base-l1-2-0

CheckTokenCapability

bcrypt

BCryptHashData
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyHash
BCryptCreateHash
BCryptCloseAlgorithmProvider

api-ms-win-service-private-l1-1-0

UnsubscribeServiceChangeNotifications
WaitServiceState
SubscribeServiceChangeNotifications

api-ms-win-service-management-l1-1-0

StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe
CreateNamedPipeW

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

SvchostPushServiceGlobals
WwanSvcMain

Sections

.text
Size: 889KB - Virtual size: 888KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 461KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/wwapi.dll
.dll windows:10 windows x64 arch:x64

39aab269f8884da222f7a397a1bf8645

Code Sign

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:30

Not After

03-03-2021 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:72:6d:a5:6c:c5:68:85:79:a3:f8:09:1f:55:8b:f0:28:27:fc:8b:02:a7:3a:81:bd:48:50:a2:20:ab:f6:0b
Signer

Actual PE Digest

02:72:6d:a5:6c:c5:68:85:79:a3:f8:09:1f:55:8b:f0:28:27:fc:8b:02:a7:3a:81:bd:48:50:a2:20:ab:f6:0b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wwapi.pdb

Imports

msvcrt

__C_specific_handler
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_onexit
__dllonexit
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
memmove
_lock
_initterm
malloc
memcpy
_purecall
_unlock
??3@YAXPEAX@Z
__CxxFrameHandler3
free
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
RtlVirtualUnwind
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwRegisterTraceGuidsW

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
WaitForSingleObjectEx
SetEvent

rpcrt4

RpcBindingFromStringBindingW
I_RpcExceptionFilter
RpcAsyncCompleteCall
RpcAsyncGetCallStatus
RpcAsyncCancelCall
RpcSsDestroyClientContext
NdrClientCall3
Ndr64AsyncClientCall
RpcStringBindingComposeW
RpcBindingFree
RpcBindingSetAuthInfoW
RpcMgmtInqServerPrincNameW
RpcBindingSetOption
RpcEpResolveBinding
RpcStringFreeW
RpcAsyncInitializeHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

Exports

Exports

Wwan2CloseDeviceServiceCommandSession
Wwan2CloseDeviceServiceDataSession
Wwan2CloseHandle
Wwan2EnumerateDeviceServices
Wwan2OpenDeviceServiceCommandSession
Wwan2OpenDeviceServiceDataSession
Wwan2OpenHandle
Wwan2QueryDeviceServiceSupportedCommands
Wwan2QueryInterfaces
Wwan2RegisterNotification
Wwan2SendDeviceServiceCommand
Wwan2SubscribePowerStateEvents
Wwan2WriteDeviceServiceData
WwanActivateNotification
WwanAllocateMemory
WwanAuthChallenge
WwanCloseHandle
WwanConnect
WwanConnectAdditionalPdpContext
WwanConnectByActivityId
WwanConvertToInterfaceObject
WwanDeleteDMConfigProfile
WwanDeleteProfile
WwanDisconnect
WwanEnumerateInterfaces
WwanFreeMemory
WwanGetDMConfigBinary
WwanGetDMConfigProfile
WwanGetDMConfigProfileList
WwanGetInfGuidAndProfileByProfileIndex
WwanGetInterfaceGuid
WwanGetProfile
WwanGetProfileHomeProviderName
WwanGetProfileIndex
WwanGetProfileIstream
WwanGetProfileList
WwanGetProfileListByPurpose
WwanGetProfileMetaData
WwanGetProfileState
WwanModemLogging
WwanOpenHandle
WwanQueryIPv6eHRPDControl
WwanQueryInterface
WwanQueryInterfaceEx
WwanRegister
WwanRegisterNotification
WwanScan
WwanSearchProfile
WwanSetDMConfigBinary
WwanSetDMConfigProfile
WwanSetIPv6eHRPDControl
WwanSetInterface
WwanSetNetworkQuietMode
WwanSetProfile
WwanSetProfileMetaData
WwanSetSmsConfiguration
WwanSmsDelete
WwanSmsRead
WwanSmsSend
WwanUiccCloseChannel
WwanUiccOpenChannel
WwanUiccSendApdu
WwanUiccSetTerminalCapability
WwanUssdRequest

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/xboxgipsvc.dll
.dll windows:10 windows x64 arch:x64

4a503ff13a26eb1e18da1f0f73bec911

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XboxGipSvc.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__crt_atexit
memmove
_o_free
_o_malloc
__C_specific_handler
_o__callnewh
_CxxThrowException
__CxxFrameHandler3
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
_o__cexit
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlQueryWnfStateData
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
TraceMessage
GetTraceEnableFlags
RegisterTraceGuidsW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockExclusive
CreateEventW
CreateMutexExW
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObject
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ReleaseSemaphore
DeleteCriticalSection
CreateSemaphoreExW
SetEvent
CreateEventExW
ReleaseMutex

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateThread
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-l1-1-0

RoRevokeActivationFactories
RoRegisterActivationFactories
RoUninitialize
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateString
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsIsStringEmpty

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoDisconnectContext
CoReleaseServerProcess
CoAddRefServerProcess
CoRevokeClassObject
CoDecrementMTAUsage
CoRegisterClassObject
CoResumeClassObjects
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoInitializeSecurity

api-ms-win-service-core-l1-1-1

QueryServiceDynamicInformation

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx
NotifyServiceStatusChangeW

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-devices-swdevice-l1-1-0

SwDeviceCreate
SwDeviceClose

wlanapi

WlanEnumInterfaces
WlanCloseHandle
WlanRegisterNotification
WlanOpenHandle
WlanFreeMemory
WlanQueryInterface

ext-ms-win-setupapi-classinstallers-l1-1-0

SetupDiEnumDeviceInfo
SetupDiGetDevicePropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

combase

CStdStubBuffer_IsIIDSupported
ord32
CStdStubBuffer_DebugServerRelease
ord69
ord67
ord68
ord66
NdrCStdStubBuffer2_Release
CStdStubBuffer2_Connect
CStdStubBuffer_Invoke
CStdStubBuffer2_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
CStdStubBuffer_AddRef
ord33
ord34

msvcp_win

?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_Xlength_error@std@@YAXPEBD@Z

rpcrt4

NdrOleAllocate
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrOleFree
IUnknown_AddRef_Proxy
NdrDllCanUnloadNow
NdrStubForwardingFunction

Exports

Exports

DllCanUnloadNow
DllGetClassObject
ServiceMain

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/xboxgipsynthetic.dll
.dll windows:10 windows x64 arch:x64

ecbe653e175f151f0a6026b3a9679b82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XboxgipSynthetic.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
_o_terminate
__C_specific_handler
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__CxxFrameHandler3
_CxxThrowException
__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateMutexExW
ReleaseMutex
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
DeleteCriticalSection
ReleaseSemaphore
CreateEventExW
ResetEvent
CreateSemaphoreExW
SetEvent
CreateEventW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
StartThreadpoolIo
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
CloseThreadpool

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualProtect
VirtualQuery
VirtualFree

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult
CancelIoEx

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ntdll

RtlGetDeviceFamilyInfoEnum

Exports

Exports

DllMain
SyntheticController_AddAudioHeadset
SyntheticController_Connect
SyntheticController_CreateController
SyntheticController_Disconnect
SyntheticController_GetDeviceId
SyntheticController_RegisterReportCallback
SyntheticController_RemoveAudioHeadset
SyntheticController_RemoveController
SyntheticController_SendAudio
SyntheticController_SendReport
SyntheticController_SetTargetProcess
SyntheticController_UnregisterReportCallback

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/xcopy.exe
.exe windows:10 windows x64 arch:x64

1effe65a4f251e4ae9fa8551f9fcdabb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

xcopy.pdb

Imports

msvcrt

__C_specific_handler
_wcsnicmp
towupper
exit
?terminate@@YAXXZ
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_wgetenv

ulib

?Initialize@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
??0ARGUMENT_LEXEMIZER@@QEAA@XZ
?Initialize@STRING_ARRAY@@QEAAEKKK@Z
??0STRING_ARRAY@@QEAA@XZ
?ConvertToUTC@TIMEINFO@@QEAAEXZ
?Initialize@TIMEINFO@@QEAAXPEBV1@@Z
??0TIMEINFO@@QEAA@XZ
?Initialize@STRING_ARGUMENT@@QEAAEPEAD@Z
??1STRING_ARGUMENT@@UEAA@XZ
??0STRING_ARGUMENT@@QEAA@XZ
?TruncateNameAtColon@PATH@@QEAAXXZ
?AppendBase@PATH@@QEAAEPEBVWSTRING@@E@Z
??1PATH@@UEAA@XZ
?Initialize@PATH@@QEAAEPEBGE@Z
?Initialize@PATH@@QEAAEPEBVWSTRING@@E@Z
?Initialize@PATH@@QEAAEPEBV1@E@Z
??0PATH@@QEAA@XZ
?QueryString@WSTRING@@QEBAPEAV1@KK@Z
?Initialize@WSTRING@@QEAAEPEBV1@KK@Z
?Initialize@WSTRING@@QEAAEPEBGK@Z
?Initialize@WSTRING@@QEAAEPEBDK@Z
?PathWasTooBig@PATH@@QEAAEXZ
?Truncate@WSTRING@@QEAAKK@Z
?Strchr@WSTRING@@QEBAKGK@Z
?Strupr@WSTRING@@QEAAPEAV1@XZ
?Strcmp@WSTRING@@QEBAJPEBV1@@Z
?GetWSTR@WSTRING@@QEBAPEBGXZ
?QueryChAt@WSTRING@@QEBAGK@Z
?QueryChCount@WSTRING@@QEBAKXZ
?QueryResourceString@BASE_SYSTEM@@SAEPEAVWSTRING@@KPEBDZZ
?ExitProgram@PROGRAM@@SAXK@Z
?FindFirstFileW@@YAPEAXPEBVPATH@@PEAU_WIN32_FIND_DATAW@@@Z
?Copy@FSN_FILE@@QEBAEPEAVPATH@@PEAW4_COPY_ERROR@@KP6AKT_LARGE_INTEGER@@222KKPEAX33@Z3PEAH@Z
?Resize@FSTRING@@UEAAEK@Z
??0FSTRING@@QEAA@XZ
?DisplaySystemError@SYSTEM@@SAXKH@Z
?DoParsing@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
?QueryDriveType@SYSTEM@@SA?AW4DRIVE_TYPE@@PEBVWSTRING@@@Z
?RemoveNode@SYSTEM@@SAEPEAPEAVFSNODE@@E@Z
?MakeDirectory@SYSTEM@@SAPEAVFSN_DIRECTORY@@PEBVPATH@@0PEAW4_COPY_ERROR@@P6AKT_LARGE_INTEGER@@222KKPEAX33@Z3PEAHK@Z
??OTIMEINFO@@QEBAEV0@@Z
?GetNext@FSN_DIRECTORY@@QEAAPEAVFSNODE@@PEAPEAXPEAK@Z
?IsEmpty@FSN_DIRECTORY@@QEBAEXZ
?DeleteDirectory@FSN_DIRECTORY@@QEAAEXZ
?CreateDirectoryPath@FSN_DIRECTORY@@QEBAPEAV1@PEBVPATH@@@Z
??0PROGRAM@@IEAA@XZ
?ValidateVersion@PROGRAM@@UEBAXKK@Z
?Usage@PROGRAM@@UEBAXXZ
?GetStandardError@PROGRAM@@UEAAPEAVSTREAM@@XZ
?GetStandardOutput@PROGRAM@@UEAAPEAVSTREAM@@XZ
?GetStandardInput@PROGRAM@@UEAAPEAVSTREAM@@XZ
?Fatal@PROGRAM@@UEBAXXZ
?Fatal@PROGRAM@@UEBAXKKPEADZZ
?DisplayMessage@PROGRAM@@UEBAEKW4MESSAGE_TYPE@@@Z
?DisplayMessage@PROGRAM@@UEBAEKW4MESSAGE_TYPE@@PEADZZ
??1PROGRAM@@UEAA@XZ
?Initialize@PROGRAM@@QEAAEKKK@Z
?Initialize@CLASS_DESCRIPTOR@@QEAAEPEBD@Z
??0CLASS_DESCRIPTOR@@QEAA@XZ
?UseAlternateName@FSNODE@@QEAAEXZ
?SetAttributes@FSNODE@@QEAAEKPEAK@Z
?GetPFlagBreak@KEYBOARD@@QEBAQEAHXZ
?GotABreak@KEYBOARD@@SAEXZ
?EnableLineMode@KEYBOARD@@QEAAEXZ
?EnableBreakHandling@KEYBOARD@@SAEXZ
?DisableLineMode@KEYBOARD@@QEAAEXZ
?DisableBreakHandling@KEYBOARD@@SAEXZ
?Initialize@KEYBOARD@@QEAAEEE@Z
?Cast@KEYBOARD@@SAPEAV1@PEBVOBJECT@@@Z
??0KEYBOARD@@QEAA@XZ
?TruncateBase@PATH@@QEAAEXZ
?QueryFullPathString@PATH@@QEBAPEAVWSTRING@@XZ
?QueryComponentArray@PATH@@QEBAPEAVARRAY@@PEAV2@@Z
?ModifyName@PATH@@QEAAEPEBVWSTRING@@@Z
?HasWildCard@PATH@@QEBAEXZ
?EndsWithDelimiter@PATH@@QEBAEXZ
?Display@MESSAGE@@QEAAEPEBDZZ
?SetTimeInfo@FSN_FILTER@@QEAAEPEBVTIMEINFO@@W4FSN_TIME@@G@Z
?SetAttributes@FSN_FILTER@@QEAAEKKK@Z
?SetFileName@FSN_FILTER@@QEAAEPEBD@Z
?SetFileName@FSN_FILTER@@QEAAEPEBVWSTRING@@@Z
?DoesNodeMatch@FSN_FILTER@@QEAAEPEAVFSNODE@@@Z
?Initialize@FSN_FILTER@@QEAAEXZ
??0FSN_FILTER@@QEAA@XZ
?Strcat@WSTRING@@QEAAEPEBV1@@Z
??0OBJECT@@QEAA@AEBV0@@Z
??1FSTRING@@UEAA@XZ
?Initialize@FSTRING@@QEAAPEAVWSTRING@@PEAGK@Z
??9WSTRING@@QEBAEAEBV0@@Z
??8WSTRING@@QEBAEAEBV0@@Z
?Strstr@WSTRING@@QEBAKPEBV1@@Z
?Stricmp@WSTRING@@QEBAJPEBV1@@Z
?SetClassDescriptor@OBJECT@@IEAAXPEBVCLASS_DESCRIPTOR@@@Z
?SPrintfAppend@DSTRING@@UEAAEPEBGZZ
?GetLexemeAt@ARGUMENT_LEXEMIZER@@QEAAPEAVWSTRING@@K@Z
?PutMultipleSwitch@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
?PutSeparators@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
?PutSwitches@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QEAAEPEAVWSTRING@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QEAAXE@Z
?SetAllowSwitchGlomming@ARGUMENT_LEXEMIZER@@QEAAXE@Z
?SetNoSpcBetweenDstAndSwitch@ARGUMENT_LEXEMIZER@@QEAAXE@Z
?PutMultiCharSwitch@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
??1OBJECT@@UEAA@XZ
?Compare@OBJECT@@UEBAJPEBV1@@Z
?DebugDump@OBJECT@@UEBAXE@Z
?GetLexeme@ARGUMENT@@QEAAPEAVWSTRING@@XZ
?GetPattern@ARGUMENT@@QEAAPEAVWSTRING@@XZ
?IsValueSet@ARGUMENT@@QEAAEXZ
?QueryDirectory@SYSTEM@@SAPEAVFSN_DIRECTORY@@PEBVPATH@@E@Z
?QueryFile@SYSTEM@@SAPEAVFSN_FILE@@PEBVPATH@@EPEAE@Z
??0PATH_ARGUMENT@@QEAA@XZ
??1PATH_ARGUMENT@@UEAA@XZ
?Initialize@PATH_ARGUMENT@@QEAAEPEADE@Z
?ReadLine@STREAM@@QEAAEPEAVWSTRING@@E@Z
??0FLAG_ARGUMENT@@QEAA@XZ
?Initialize@FLAG_ARGUMENT@@QEAAEPEAD@Z
??0ARRAY@@QEAA@XZ
??1ARRAY@@UEAA@XZ
?Initialize@ARRAY@@QEAAEKK@Z
?DeleteAllMembers@ARRAY@@UEAAEXZ
?Put@ARRAY@@UEAAEPEAVOBJECT@@@Z
?QueryStream@FSN_FILE@@QEAAPEAVFILE_STREAM@@W4STREAMACCESS@@K@Z
??0TIMEINFO_ARGUMENT@@QEAA@XZ
??1TIMEINFO_ARGUMENT@@UEAA@XZ
?Initialize@TIMEINFO_ARGUMENT@@QEAAEPEAD@Z
??0DSTRING@@QEAA@XZ
??1DSTRING@@UEAA@XZ
?Resize@DSTRING@@UEAAEK@Z
?NewBuf@DSTRING@@UEAAEK@Z
?SPrintf@DSTRING@@UEAAEPEBGZZ
?QueryWindowsErrorMessage@SYSTEM@@SAEKPEAVWSTRING@@@Z

ifsutil

?QueryFreeDiskSpace@IFS_SYSTEM@@SAEPEBVWSTRING@@PEAVBIG_INT@@@Z

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-file-l1-1-0

GetFileTime
FindClose
SetFileTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-file-l2-1-0

CreateDirectoryExW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlAdjustPrivilege
NtSetInformationProcess

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/xmlfilter.dll
.dll regsvr32 windows:10 windows x64 arch:x64

9c6c869862163d621c2d7c68bc01df4c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

XmlFilter.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
_XcptFilter
_amsg_exit
_lock
_unlock
__dllonexit
_wcsnicmp
_onexit
_callnewh
wcscat_s
memmove
__C_specific_handler
iswspace
_purecall
free
malloc
_CxxThrowException
realloc
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
memcpy
wcsncpy_s
_errno
__CxxFrameHandler3
?terminate@@YAXXZ
wcscpy_s
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
_initterm
memset

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
SizeofResource
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleFileNameW
LoadResource

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSection
ReleaseMutex
CreateEventExW
WaitForSingleObjectEx
OpenSemaphoreW
DeleteCriticalSection
CreateSemaphoreExW
SetEvent
WaitForSingleObject
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantClear
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
SysFreeString

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2

api-ms-win-core-file-l1-1-0

GetFileAttributesW

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileEx

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExA
GetTickCount

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/xmllite.dll
.dll windows:10 windows x64 arch:x64

d2e0f3f026362c9bf4ba56fa26b36d50

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:30

Not After

03-03-2021 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:01:74:45:90:a8:77:4f:3c:2a:45:ca:4e:47:8f:6a:4b:42:bb:2e:a7:06:d1:fd:8a:8b:f2:e6:a8:08:fc:c0
Signer

Actual PE Digest

a9:01:74:45:90:a8:77:4f:3c:2a:45:ca:4e:47:8f:6a:4b:42:bb:2e:a7:06:d1:fd:8a:8b:f2:e6:a8:08:fc:c0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

XmlLite.pdb

Imports

msvcrt

_purecall
_callnewh
__C_specific_handler
_initterm
malloc
_XcptFilter
memmove
free
_amsg_exit
_vsnwprintf
memcmp
memcpy
memset

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

GetCPInfo

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-memory-l1-1-0

VirtualQuery

Exports

Exports

CreateXmlReader
CreateXmlReaderInputWithEncodingCodePage
CreateXmlReaderInputWithEncodingName
CreateXmlWriter
CreateXmlWriterOutputWithEncodingCodePage
CreateXmlWriterOutputWithEncodingName

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/xmlprovi.dll
.dll regsvr32 windows:10 windows x64 arch:x64

24d8349f9b6586bff7025b9e2cce6bac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

xmlprovi.pdb

Imports

ntdll

wcschr
__C_specific_handler
memcpy

msvcrt

free
malloc
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler3
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ

atl

ord22
ord30
ord18
ord15
ord21
ord16
ord23
ord32

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
lstrlenA
MultiByteToWideChar
lstrlenW
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
TerminateProcess
GetCurrentProcess

rtutils

TracePrintfA
TraceDeregisterW
TraceRegisterExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/libs/xolehlp.dll
.dll windows:10 windows x64 arch:x64

8c66b484e9dcdd20cbcb519baff6097e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

xolehlp.pdb

Imports

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegOpenKeyExA
RegQueryValueExW

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
LoadResource
LockResource
GetProcAddress
GetModuleHandleA
LoadStringW
LoadLibraryExA
FreeLibrary
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoGetObjectContext
CoCreateInstance

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

msvcrt

_wfopen
strchr
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
??1exception@@UEAA@XZ
_onexit
__dllonexit
_CxxThrowException
_local_unwind
?terminate@@YAXXZ
memcmp
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
memcpy
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
malloc
free
_vsnprintf
fopen
fflush
fclose
fprintf
fwprintf
__CxxFrameHandler3
_vsnwprintf
_wcsicmp
_stricmp
mbstowcs
wcsrchr
_purecall
_waccess
wcscpy_s
_ultow
memset

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlReportException
RtlCaptureContext
RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsGetValue
GetCurrentThreadId
TlsAlloc
GetCurrentProcessId
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
OpenProcessToken
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryA
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetLocalTime

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

SetFileAttributesW
DeleteFileW
CreateFileW
GetFullPathNameW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-synch-l1-1-0

ResetEvent
InitializeCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventA
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

kernel32

UnregisterWaitEx
QueueUserWorkItem

Exports

Exports

DtcGetTransactionManager
DtcGetTransactionManagerC
DtcGetTransactionManagerEx
DtcGetTransactionManagerExA
DtcGetTransactionManagerExW
FreezeLocalTransactionManagers
GetDtcLocaleResourceHandle
ThawLocalTransactionManagers

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/starksoft.aspen.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/wmcodecdspps.dll
.dll regsvr32 windows:10 windows x64 arch:x64

23ac37429bb87a2bbbdffbf395eea832

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmcodecdspps.pdb

Imports

msvcrt

_XcptFilter
__C_specific_handler
_initterm
_amsg_exit
free
malloc
memcmp

combase

CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerQueryInterface
ord2
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

rpcrt4

NdrDllCanUnloadNow
IUnknown_QueryInterface_Proxy
NdrOleAllocate
IUnknown_Release_Proxy
NdrOleFree
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/CMap/wmdrmsdk.dll
.dll regsvr32 windows:10 windows x64 arch:x64

92e98ccd6aa108e386042837a53c42f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmdrmsdk.pdb

Imports

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MFWMDRMOutputTrustAuthority_CreateInstance
WMDRMCreateProvider
WMDRMShutdown
WMDRMStartup
_WMDRMCreateProvider

Sections

.text
Size: 1024B - Virtual size: 722B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/Help.admx
Ex_PE_v3.1.9/Portable/Font/AdobePIStd.otf
Ex_PE_v3.1.9/Portable/Font/CourierStd-Bold.otf
Ex_PE_v3.1.9/Portable/Font/CourierStd-BoldOblique.otf
Ex_PE_v3.1.9/Portable/Font/CourierStd-Oblique.otf
Ex_PE_v3.1.9/Portable/Font/CourierStd.otf
Ex_PE_v3.1.9/Portable/Font/MinionPro-Bold.otf
Ex_PE_v3.1.9/Portable/Font/MinionPro-BoldIt.otf
Ex_PE_v3.1.9/Portable/Font/MinionPro-It.otf
Ex_PE_v3.1.9/Portable/Font/MinionPro-Regular.otf
Ex_PE_v3.1.9/Portable/Font/MyriadPro-Bold.otf
Ex_PE_v3.1.9/Portable/Font/MyriadPro-BoldIt.otf
Ex_PE_v3.1.9/Portable/Font/MyriadPro-It.otf
Ex_PE_v3.1.9/Portable/Font/MyriadPro-Regular.otf
Ex_PE_v3.1.9/Portable/MahApps.Metro.IconPacks.FeatherIcons.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.FeatherIcons\net47\MahApps.Metro.IconPacks.FeatherIcons.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/Portable/Portable_extension.rar
.rar
Ex_PE_v3.1.9/Portable/System.CodeDom.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-02-2021 20:09

Not After

10-02-2022 20:09

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:ef:2e:46:66:2a:68:54:c2:e5:c7:b8:43:ea:bf:88:94:f9:21:4d:7e:c1:c6:c8:77:86:e3:d4:77:cd:ca:d5
Signer

Actual PE Digest

79:ef:2e:46:66:2a:68:54:c2:e5:c7:b8:43:ea:bf:88:94:f9:21:4d:7e:c1:c6:c8:77:86:e3:d4:77:cd:ca:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/Portable/TemplateCorreoCliente.htm
.html
Ex_PE_v3.1.9/Portable/WindowsAnytimeUpgrade.admx
Ex_PE_v3.1.9/Portable/WorkplaceJoin.admx
.xml
Ex_PE_v3.1.9/ReadMe.txt
Ex_PE_v3.1.9/Sft_Extra.exe
.exe windows:5 windows x64 arch:x64

b7e244ba46aac2a40ea643244bcedc5b

Code Sign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2023 19:51

Not After

16-10-2024 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:c2:75:72:31:f2:01:c4:fe:84:98:96:a8:e9:ec:40:7c:71:ab:e8:83:35:a7:ec:5d:53:66:19:0a:42:a3:c1
Signer

Actual PE Digest

bb:c2:75:72:31:f2:01:c4:fe:84:98:96:a8:e9:ec:40:7c:71:ab:e8:83:35:a7:ec:5d:53:66:19:0a:42:a3:c1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdb

Imports

msedge_elf

GetInstallDetailsPayload
SignalInitializeCrashReporting

advapi32

BuildTrusteeWithSidW
ConvertStringSidToSidW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
EventRegister
EventSetInformation
EventUnregister
EventWrite
GetLengthSid
GetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
IsValidAcl
IsValidSecurityDescriptor
IsValidSid
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityInfo

dbghelp

SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateEventW
CreateFileMappingW
CreateFileW
CreateThread
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetFileAttributesW
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalProcessorInformation
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadId
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
PrefetchVirtualMemory
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
ResetEvent
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetProcessShutdownParameters
SetStdHandle
SetThreadInformation
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrlenA

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize

ole32

CoCreateInstance
CoTaskMemFree

shell32

CommandLineToArgvW
ord680
SHGetFolderPathW
SHGetKnownFolderPath

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
VariantClear

Exports

Exports

GetHandleVerifier
OQS_CPU_has_extension
OQS_KEM_alg_count
OQS_KEM_alg_identifier
OQS_KEM_alg_is_enabled
OQS_KEM_decaps
OQS_KEM_encaps
OQS_KEM_free
OQS_KEM_keypair
OQS_KEM_kyber_768_decaps
OQS_KEM_kyber_768_encaps
OQS_KEM_kyber_768_keypair
OQS_KEM_new
OQS_MEM_cleanse
OQS_MEM_insecure_free
OQS_MEM_secure_bcmp
OQS_MEM_secure_free
OQS_SIG_alg_count
OQS_SIG_alg_identifier
OQS_SIG_alg_is_enabled
OQS_SIG_free
OQS_SIG_keypair
OQS_SIG_new
OQS_SIG_sign
OQS_SIG_verify
OQS_destroy
OQS_init
OQS_randombytes
OQS_randombytes_custom_algorithm
OQS_randombytes_nist_kat_init_256bit
OQS_randombytes_switch_algorithm
OQS_version

Sections

.text
Size: 868KB - Virtual size: 867KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 140B

.tls
Size: 512B - Virtual size: 397B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/W32Time.admx
Ex_PE_v3.1.9/WCM.admx
Ex_PE_v3.1.9/WinEULA.txt
Ex_PE_v3.1.9/Xceed.Wpf.AvalonDock.Themes.VS2010.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/Xceed.Wpf.Toolkit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/demux/100/img_home_temp00.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp01.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp02.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp03.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp04.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp05.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp06.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp07.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp08.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp09.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp10.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp11.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp12.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp13.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp14.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp15.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp16.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp17.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp18.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp19.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp20.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp21.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp22.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp23.png
.png
Ex_PE_v3.1.9/demux/100/img_home_temp24.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_cpu_faster.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_cpu_normal.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_cpu_turbo.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_fan_auto.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_fan_custom.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_fan_max.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_gpu_faster.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_gpu_normal.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_gpu_turbo.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_launchapp.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_lcdod_off.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_lcdod_on.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_pkey.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_sticky.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_sticky_disable.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_winmenu.png
.png
Ex_PE_v3.1.9/demux/100/img_osd_winmenu_disable.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp00.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp01.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp02.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp03.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp04.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp05.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp06.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp07.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp08.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp09.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp10.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp11.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp12.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp13.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp14.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp15.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp16.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp17.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp18.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp19.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp20.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp21.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp22.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp23.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_home_temp24.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_cpu_faster.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_cpu_normal.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_cpu_turbo.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_fan_auto.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_fan_custom.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_fan_max.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_gpu_faster.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_gpu_normal.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_gpu_turbo.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_launchapp.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_lcdod_off.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_lcdod_on.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_pkey.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_sticky.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_sticky_disable.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_winmenu.png
.png
Ex_PE_v3.1.9/demux/100/splash/img_osd_winmenu_disable.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_001.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_002.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_003.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_004.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_005.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_006.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_007.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_008.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_009.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_010.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_011.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_012.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_013.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_014.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_015.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_016.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_017.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_018.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_019.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_037.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_038.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_039.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_040.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_041.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_042.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_043.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_044.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_045.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_046.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_047.png
.png
Ex_PE_v3.1.9/demux/100/splash/splash_050.png
.png
Ex_PE_v3.1.9/demux/AEFT-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/AppxPackageManager.admx
Ex_PE_v3.1.9/demux/Schemas/SchemaDoctoXML/DTE_v10.xsd
.xml
Ex_PE_v3.1.9/demux/Schemas/SchemaDoctoXML/SchemaDoctoXML.xsd
.xml
Ex_PE_v3.1.9/demux/Schemas/SchemaDoctoXML/SiiTypes_v10.xsd
.xml
Ex_PE_v3.1.9/demux/Schemas/SchemaDoctoXML/xmldsignature_v10.xsd
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-10-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-12-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-16-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-18-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-2-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-20-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-22-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-24-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-26-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-28-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-30-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-32-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-34-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-36-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-38-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-4-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-40-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-42-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-44-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-46-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-48-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-50-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-51-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-53-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-55-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-57-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-59-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-6-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-61-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-63-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-65-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-67-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-69-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-71-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-73-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-75-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-77-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-79-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-8-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-81-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-83-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-85-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-87-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-89-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-91-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-93-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-95-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-97-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/AEFT-css-generated-99-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/DRWV-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/DRWV-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/DRWV-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/DRWV-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/ESHR-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/ESHR-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/FLPR-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/FLPR-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/GoogleSlides-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/IDSN-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/IDSN-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/IDSN-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/IDSN-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/ILST-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/ILST-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/ILST-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/ILST-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/KBRG-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/KBRG-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/KBRG-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/KBRG-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PHXS-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PHXS-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PHXS-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PHXS-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-10-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-12-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-16-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-18-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-2-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-20-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-22-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-24-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-26-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-28-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-30-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-32-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-34-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-36-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-38-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-4-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-40-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-42-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-44-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-46-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-48-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-50-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-51-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-53-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-55-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-57-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-59-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-6-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-61-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-63-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-65-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-67-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-69-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-71-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-73-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-75-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-77-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-79-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-8-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-81-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-83-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-85-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-87-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-89-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-91-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-93-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-95-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-97-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PPRO-css-generated-99-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PowerPoint-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/PowerPoint-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/SPRK-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/Word-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/css/Word-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/images/[email protected]
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/images/IconLight.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/images/[email protected]
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/CSXS/manifest.xml
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/AEFT/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/DRWV/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/FLPR/jsx/brush.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/FLPR/jsx/color.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/FLPR/jsx/core.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/FLPR/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/IDSN/jsx/color.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/IDSN/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/IDSN/jsx/text.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/ILST/jsx/color.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/ILST/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/ILST/jsx/text.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/ILST/jsx/util.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/KBRG/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PHXS/jsx/brush.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PHXS/jsx/color.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PHXS/jsx/constants.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PHXS/jsx/gradient.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PHXS/jsx/layerstyle.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PHXS/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PHXS/jsx/text.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PHXS/jsx/util.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/applications/PPRO/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/ACCC-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-10-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-12-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-16-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-18-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-2-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-20-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-22-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-24-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-26-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-28-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-30-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-32-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-34-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-36-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-38-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-4-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-40-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-42-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-44-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-46-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-48-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-50-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-51-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-53-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-55-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-57-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-59-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-6-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-61-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-63-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-65-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-67-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-69-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-71-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-73-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-75-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-77-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-79-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-8-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-81-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-83-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-85-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-87-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-89-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-91-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-93-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-95-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-97-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/AEFT-css-generated-99-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/DRWV-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/DRWV-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/DRWV-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/DRWV-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/ESHR-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/ESHR-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/FLPR-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/FLPR-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/GoogleSlides-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/IDSN-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/IDSN-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/IDSN-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/IDSN-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/ILST-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/ILST-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/ILST-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/ILST-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/KBRG-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/KBRG-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/KBRG-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/KBRG-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PHXS-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PHXS-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PHXS-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PHXS-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-10-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-12-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-16-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-18-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-2-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-20-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-22-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-24-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-26-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-28-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-30-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-32-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-34-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-36-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-38-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-4-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-40-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-42-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-44-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-46-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-48-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-50-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-51-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-53-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-55-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-57-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-59-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-6-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-61-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-63-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-65-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-67-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-69-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-71-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-73-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-75-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-77-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-79-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-8-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-81-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-83-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-85-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-87-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-89-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-91-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-93-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-95-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-97-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PPRO-css-generated-99-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PowerPoint-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/PowerPoint-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/SPRK-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/Word-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/css/Word-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/CSXS/manifest.xml
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/ColorExtractor.worker.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/GradientExtractor.worker.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/ShapeExtractor.worker.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/capture.html
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/capture_main.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/cs_CZ/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/da_DK/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/de_DE/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/en_US/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/es_ES/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/fi_FI/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/fr_FR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/hu_HU/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/it_IT/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/ja_JP/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/ko_KR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/nb_NO/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/nl_NL/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/pl_PL/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/pt_BR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/ru_RU/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/sv_SE/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/tr_TR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/uk_UA/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/zh_CN/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/locale/zh_TW/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/package.json
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/resources/CornucopiaCore.wasm
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/resources/GradientCaptureCore.wasm
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/resources/VectorizeCore.wasm
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/resources/capture_merchandising.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/extensions/capture/resources/capture_sample.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/images/IconDark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/images/[email protected]
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/images/IconLight.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/images/[email protected]
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/jsx/core.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/jsx/json2.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/jsx/shims.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/cs_CZ/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/da_DK/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/de_DE/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/en_US/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/es_ES/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/es_MX/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/fi_FI/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/fr_CA/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/fr_FR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/fr_MA/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/hu_HU/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/it_IT/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/ja_JP/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/ko_KR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/nb_NO/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/nl_NL/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/pl_PL/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/pt_BR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/ru_RU/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/sv_SE/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/tr_TR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/uk_UA/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/zh_CN/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/zh_TW/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/locale/zz_ZZ/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/qtmultimedia_m3u.dll
.dll windows:6 windows x86 arch:x86

d35460b9a3baf35d1aaeb2c0ade3acc2

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-07-2009 17:25

Not After

07-12-2030 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 15:43

Not After

07-11-2030 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:34:61:50:30:94:33:f3:02:f6:ec:f2:31:43:1a:6d
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

23-11-2021 07:32

Not After

01-12-2022 07:32

Subject

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 19:19

Not After

29-12-2040 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22-07-2020 15:33

Not After

29-12-2030 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09
Signer

Actual PE Digest

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\qt\work\qt\qtmultimedia\plugins\playlistformats\qtmultimedia_m3u.pdb

Imports

qt5multimedia

?qt_metacall@QMediaPlaylistIOPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaPlaylistIOPlugin@@UAEPAXPBD@Z
?staticMetaObject@QMediaPlaylistIOPlugin@@2UQMetaObject@@B
??1QMediaPlaylistIOPlugin@@UAE@XZ
??0QMediaPlaylistIOPlugin@@QAE@PAVQObject@@@Z
??0QMediaPlaylistWriter@@QAE@XZ
??1QMediaPlaylistWriter@@UAE@XZ
??0QMediaContent@@QAE@XZ
??1QMediaPlaylistReader@@UAE@XZ
?request@QMediaContent@@QBE?AVQNetworkRequest@@XZ
?isNull@QMediaContent@@QBE_NXZ
??4QMediaContent@@QAEAAV0@ABV0@@Z
??1QMediaContent@@QAE@XZ
??0QMediaContent@@QAE@ABV0@@Z
??0QMediaContent@@QAE@ABVQUrl@@@Z
??0QMediaPlaylistReader@@QAE@XZ

qt5network

??1QNetworkRequest@@QAE@XZ
?url@QNetworkRequest@@QBE?AVQUrl@@XZ

qt5core

?trimmed@QString@@QHAE?AV1@XZ
??8QString@@QBE_NVQLatin1String@@@Z
??BQCharRef@@QBE?AVQChar@@XZ
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?dispose@QListData@@SAXPAUData@1@@Z
?append@QListData@@QAEPAPAXXZ
?isOpen@QIODevice@@QBE_NXZ
?isReadable@QIODevice@@QBE_NXZ
?isWritable@QIODevice@@QBE_NXZ
??0QTextStream@@QAE@PAVQIODevice@@@Z
??1QTextStream@@UAE@XZ
?atEnd@QTextStream@@QBE_NXZ
?readLine@QTextStream@@QAE?AVQString@@_J@Z
??6QTextStream@@QAEAAV0@ABVQString@@@Z
?endl@Qt@@YAAAVQTextStream@@AAV2@@Z
??0QUrl@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
??1QUrl@@QAE@XZ
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?fromUserInput@QUrl@@SA?AV1@ABVQString@@@Z
?isEmpty@QUrl@@QBE_NXZ
?endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z
?resolved@QUrl@@QBE?AV1@ABV1@@Z
?isRelative@QUrl@@QBE_NXZ
?fromLocalFile@QUrl@@SA?AV1@ABVQString@@@Z
?toLocalFile@QUrl@@QBE?AVQString@@XZ
??0QFile@@QAE@ABVQString@@@Z
??1QFile@@UAE@XZ
?exists@QFile@@SA_NABVQString@@@Z
??0QFileInfo@@QAE@ABVQString@@@Z
??1QFileInfo@@QAE@XZ
?isReadable@QFileInfo@@QBE_NXZ
?atEnd@QFileDevice@@UBE_NXZ
?bytesAvailable@QIODevice@@UBE_JXZ
?bytesToWrite@QIODevice@@UBE_JXZ
?canReadLine@QIODevice@@UBE_NXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?close@QFileDevice@@UAEXXZ
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?fileName@QFile@@UBE?AVQString@@XZ
?isSequential@QFileDevice@@UBE_NXZ
??AQString@@QAE?AVQCharRef@@H@Z
?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?permissions@QFile@@UBE?AV?$QFlags@W4Permission@QFileDevice@@@@XZ
?pos@QFileDevice@@UBE_JXZ
?qt_metacall@QFile@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QFile@@UAEPAXPBD@Z
?readData@QFileDevice@@MAE_JPAD_J@Z
?readLineData@QFileDevice@@MAE_JPAD_J@Z
?reset@QIODevice@@UAE_NXZ
?resize@QFile@@UAE_N_J@Z
?seek@QFileDevice@@UAE_N_J@Z
?setPermissions@QFile@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z
?size@QFile@@UBE_JXZ
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?waitForBytesWritten@QIODevice@@UAE_NH@Z
?waitForReadyRead@QIODevice@@UAE_NH@Z
?writeData@QFileDevice@@MAE_JPBD_J@Z
?shared_null@QListData@@2UData@1@B
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z
??1QString@@QAE@XZ
?qstrcmp@@YAHABVQByteArray@@PBD@Z
?toLower@QString@@QHAE?AV1@XZ
?scheme@QUrl@@QBE?AVQString@@XZ
?metaObject@QFile@@UBEPBUQMetaObject@@XZ

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
EnterCriticalSection
TerminateProcess
GetCurrentProcess
InitializeSListHead
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 90B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/CreativeCloud_icon.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/DropGraphicFiles.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/GroupOnboardingBackground_CCD.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/GroupOnboardingGraphic_CCD.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/MissingLinkedElement_Dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/MissingLinkedElement_Light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/NewUserEmpty_dark.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/NewUserEmpty_light.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/ScrollDownArrow_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/ScrollDownArrow_darker.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/ScrollDownArrow_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/ScrollDownArrow_lighter.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/ScrollUpArrow_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/ScrollUpArrow_darker.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/ScrollUpArrow_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/ScrollUpArrow_lighter.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/aac_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/aac_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/aif_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/aif_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/aiff_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/aiff_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/captureCoachMark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/checkerboard.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/coachmark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/icons.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/m4a_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/m4a_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/mp2_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/mp2_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/mp3_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/mp3_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/scroll_triangle_down_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/scroll_triangle_down_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/scroll_triangle_left_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/scroll_triangle_left_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/scroll_triangle_right_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/scroll_triangle_right_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/scroll_triangle_up_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/scroll_triangle_up_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/unlock_coachmark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/wait_32.gif
.gif
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/wav_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/resources/wav_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/META-INF/signatures.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/AEFT/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/DRWV/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/FLPR/jsx/brush.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/FLPR/jsx/color.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/FLPR/jsx/core.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/FLPR/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/IDSN/jsx/color.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/IDSN/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/IDSN/jsx/text.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/ILST/jsx/color.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/ILST/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/ILST/jsx/text.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/ILST/jsx/util.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/KBRG/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PHXS/jsx/brush.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PHXS/jsx/color.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PHXS/jsx/constants.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PHXS/jsx/gradient.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PHXS/jsx/layerstyle.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PHXS/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PHXS/jsx/text.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PHXS/jsx/util.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/applications/PPRO/jsx/main.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/ACCC-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-10-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-12-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-16-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-18-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-2-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-20-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-22-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-24-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-26-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-28-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-30-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-32-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-34-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-36-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-38-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-4-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-40-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-42-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-44-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-46-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-48-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-50-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-51-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-53-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-55-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-57-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-59-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-6-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-61-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-63-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-65-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-67-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-69-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-71-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-73-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-75-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-77-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-79-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-8-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-81-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-83-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-85-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-87-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-89-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-91-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-93-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-95-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-97-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/AEFT-css-generated-99-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/DRWV-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/DRWV-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/DRWV-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/DRWV-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/ESHR-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/ESHR-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/FLPR-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/FLPR-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/GoogleSlides-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/IDSN-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/IDSN-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/IDSN-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/IDSN-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/ILST-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/ILST-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/ILST-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/ILST-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/KBRG-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/KBRG-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/KBRG-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/KBRG-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PHXS-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PHXS-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PHXS-css-light-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PHXS-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-dark-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-10-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-12-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-14-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-16-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-18-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-2-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-20-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-22-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-24-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-26-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-28-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-30-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-32-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-34-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-36-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-38-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-4-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-40-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-42-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-44-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-46-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-48-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-50-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-51-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-53-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-55-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-57-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-59-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-6-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-61-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-63-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-65-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-67-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-69-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-71-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-73-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-75-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-77-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-79-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-8-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-81-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-83-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-85-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-87-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-89-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-91-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-93-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-95-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-97-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PPRO-css-generated-99-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PowerPoint-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/PowerPoint-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/SPRK-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/Word-css-darker-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/css/Word-css-lighter-main-scss.bundle.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/CSXS/manifest.xml
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/ColorExtractor.worker.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/GradientExtractor.worker.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/ShapeExtractor.worker.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/capture.html
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/capture_main.js
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/cs_CZ/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/da_DK/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/de_DE/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/en_US/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/es_ES/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/fi_FI/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/fr_FR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/hu_HU/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/it_IT/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/ja_JP/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/ko_KR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/nb_NO/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/nl_NL/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/pl_PL/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/pt_BR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/ru_RU/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/sv_SE/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/tr_TR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/uk_UA/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/zh_CN/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/locale/zh_TW/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/package.json
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/resources/CornucopiaCore.wasm
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/resources/GradientCaptureCore.wasm
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/resources/VectorizeCore.wasm
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/resources/capture_merchandising.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/extensions/capture/resources/capture_sample.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/images/IconDark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/images/[email protected]
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/images/IconLight.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/images/[email protected]
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/jsx/core.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/jsx/json2.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/jsx/shims.jsx
.js
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/cs_CZ/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/da_DK/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/de_DE/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/en_US/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/es_ES/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/es_MX/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/fi_FI/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/fr_CA/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/fr_FR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/fr_MA/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/hu_HU/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/it_IT/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/ja_JP/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/ko_KR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/nb_NO/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/nl_NL/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/pl_PL/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/pt_BR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/ru_RU/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/sv_SE/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/tr_TR/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/uk_UA/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/zh_CN/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/zh_TW/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/locale/zz_ZZ/messages.properties
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/qtmultimedia_m3u.dll
.dll windows:6 windows x86 arch:x86

d35460b9a3baf35d1aaeb2c0ade3acc2

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-07-2009 17:25

Not After

07-12-2030 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 15:43

Not After

07-11-2030 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:34:61:50:30:94:33:f3:02:f6:ec:f2:31:43:1a:6d
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

23-11-2021 07:32

Not After

01-12-2022 07:32

Subject

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 19:19

Not After

29-12-2040 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22-07-2020 15:33

Not After

29-12-2030 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09
Signer

Actual PE Digest

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\qt\work\qt\qtmultimedia\plugins\playlistformats\qtmultimedia_m3u.pdb

Imports

qt5multimedia

?qt_metacall@QMediaPlaylistIOPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaPlaylistIOPlugin@@UAEPAXPBD@Z
?staticMetaObject@QMediaPlaylistIOPlugin@@2UQMetaObject@@B
??1QMediaPlaylistIOPlugin@@UAE@XZ
??0QMediaPlaylistIOPlugin@@QAE@PAVQObject@@@Z
??0QMediaPlaylistWriter@@QAE@XZ
??1QMediaPlaylistWriter@@UAE@XZ
??0QMediaContent@@QAE@XZ
??1QMediaPlaylistReader@@UAE@XZ
?request@QMediaContent@@QBE?AVQNetworkRequest@@XZ
?isNull@QMediaContent@@QBE_NXZ
??4QMediaContent@@QAEAAV0@ABV0@@Z
??1QMediaContent@@QAE@XZ
??0QMediaContent@@QAE@ABV0@@Z
??0QMediaContent@@QAE@ABVQUrl@@@Z
??0QMediaPlaylistReader@@QAE@XZ

qt5network

??1QNetworkRequest@@QAE@XZ
?url@QNetworkRequest@@QBE?AVQUrl@@XZ

qt5core

?trimmed@QString@@QHAE?AV1@XZ
??8QString@@QBE_NVQLatin1String@@@Z
??BQCharRef@@QBE?AVQChar@@XZ
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?dispose@QListData@@SAXPAUData@1@@Z
?append@QListData@@QAEPAPAXXZ
?isOpen@QIODevice@@QBE_NXZ
?isReadable@QIODevice@@QBE_NXZ
?isWritable@QIODevice@@QBE_NXZ
??0QTextStream@@QAE@PAVQIODevice@@@Z
??1QTextStream@@UAE@XZ
?atEnd@QTextStream@@QBE_NXZ
?readLine@QTextStream@@QAE?AVQString@@_J@Z
??6QTextStream@@QAEAAV0@ABVQString@@@Z
?endl@Qt@@YAAAVQTextStream@@AAV2@@Z
??0QUrl@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
??1QUrl@@QAE@XZ
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?fromUserInput@QUrl@@SA?AV1@ABVQString@@@Z
?isEmpty@QUrl@@QBE_NXZ
?endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z
?resolved@QUrl@@QBE?AV1@ABV1@@Z
?isRelative@QUrl@@QBE_NXZ
?fromLocalFile@QUrl@@SA?AV1@ABVQString@@@Z
?toLocalFile@QUrl@@QBE?AVQString@@XZ
??0QFile@@QAE@ABVQString@@@Z
??1QFile@@UAE@XZ
?exists@QFile@@SA_NABVQString@@@Z
??0QFileInfo@@QAE@ABVQString@@@Z
??1QFileInfo@@QAE@XZ
?isReadable@QFileInfo@@QBE_NXZ
?atEnd@QFileDevice@@UBE_NXZ
?bytesAvailable@QIODevice@@UBE_JXZ
?bytesToWrite@QIODevice@@UBE_JXZ
?canReadLine@QIODevice@@UBE_NXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?close@QFileDevice@@UAEXXZ
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?fileName@QFile@@UBE?AVQString@@XZ
?isSequential@QFileDevice@@UBE_NXZ
??AQString@@QAE?AVQCharRef@@H@Z
?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?permissions@QFile@@UBE?AV?$QFlags@W4Permission@QFileDevice@@@@XZ
?pos@QFileDevice@@UBE_JXZ
?qt_metacall@QFile@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QFile@@UAEPAXPBD@Z
?readData@QFileDevice@@MAE_JPAD_J@Z
?readLineData@QFileDevice@@MAE_JPAD_J@Z
?reset@QIODevice@@UAE_NXZ
?resize@QFile@@UAE_N_J@Z
?seek@QFileDevice@@UAE_N_J@Z
?setPermissions@QFile@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z
?size@QFile@@UBE_JXZ
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?waitForBytesWritten@QIODevice@@UAE_NH@Z
?waitForReadyRead@QIODevice@@UAE_NH@Z
?writeData@QFileDevice@@MAE_JPBD_J@Z
?shared_null@QListData@@2UData@1@B
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z
??1QString@@QAE@XZ
?qstrcmp@@YAHABVQByteArray@@PBD@Z
?toLower@QString@@QHAE?AV1@XZ
?scheme@QUrl@@QBE?AVQString@@XZ
?metaObject@QFile@@UBEPBUQMetaObject@@XZ

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
EnterCriticalSection
TerminateProcess
GetCurrentProcess
InitializeSListHead
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 90B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/CreativeCloud_icon.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/DropGraphicFiles.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/GroupOnboardingBackground_CCD.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/GroupOnboardingGraphic_CCD.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/MissingLinkedElement_Dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/MissingLinkedElement_Light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/NewUserEmpty_dark.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/NewUserEmpty_light.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/ScrollDownArrow_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/ScrollDownArrow_darker.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/ScrollDownArrow_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/ScrollDownArrow_lighter.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/ScrollUpArrow_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/ScrollUpArrow_darker.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/ScrollUpArrow_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/ScrollUpArrow_lighter.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/aac_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/aac_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/aif_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/aif_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/aiff_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/aiff_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/captureCoachMark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/checkerboard.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/coachmark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/icons.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/m4a_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/m4a_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/mp2_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/mp2_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/mp3_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/mp3_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/scroll_triangle_down_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/scroll_triangle_down_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/scroll_triangle_left_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/scroll_triangle_left_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/scroll_triangle_right_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/scroll_triangle_right_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/scroll_triangle_up_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/scroll_triangle_up_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/unlock_coachmark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/wait_32.gif
.gif
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/wav_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/playlistformats/resources/wav_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/qtmultimedia_m3u.dll
.dll windows:6 windows x86 arch:x86

d35460b9a3baf35d1aaeb2c0ade3acc2

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-07-2009 17:25

Not After

07-12-2030 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 15:43

Not After

07-11-2030 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:34:61:50:30:94:33:f3:02:f6:ec:f2:31:43:1a:6d
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

23-11-2021 07:32

Not After

01-12-2022 07:32

Subject

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 19:19

Not After

29-12-2040 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22-07-2020 15:33

Not After

29-12-2030 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09
Signer

Actual PE Digest

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\qt\work\qt\qtmultimedia\plugins\playlistformats\qtmultimedia_m3u.pdb

Imports

qt5multimedia

?qt_metacall@QMediaPlaylistIOPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaPlaylistIOPlugin@@UAEPAXPBD@Z
?staticMetaObject@QMediaPlaylistIOPlugin@@2UQMetaObject@@B
??1QMediaPlaylistIOPlugin@@UAE@XZ
??0QMediaPlaylistIOPlugin@@QAE@PAVQObject@@@Z
??0QMediaPlaylistWriter@@QAE@XZ
??1QMediaPlaylistWriter@@UAE@XZ
??0QMediaContent@@QAE@XZ
??1QMediaPlaylistReader@@UAE@XZ
?request@QMediaContent@@QBE?AVQNetworkRequest@@XZ
?isNull@QMediaContent@@QBE_NXZ
??4QMediaContent@@QAEAAV0@ABV0@@Z
??1QMediaContent@@QAE@XZ
??0QMediaContent@@QAE@ABV0@@Z
??0QMediaContent@@QAE@ABVQUrl@@@Z
??0QMediaPlaylistReader@@QAE@XZ

qt5network

??1QNetworkRequest@@QAE@XZ
?url@QNetworkRequest@@QBE?AVQUrl@@XZ

qt5core

?trimmed@QString@@QHAE?AV1@XZ
??8QString@@QBE_NVQLatin1String@@@Z
??BQCharRef@@QBE?AVQChar@@XZ
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?dispose@QListData@@SAXPAUData@1@@Z
?append@QListData@@QAEPAPAXXZ
?isOpen@QIODevice@@QBE_NXZ
?isReadable@QIODevice@@QBE_NXZ
?isWritable@QIODevice@@QBE_NXZ
??0QTextStream@@QAE@PAVQIODevice@@@Z
??1QTextStream@@UAE@XZ
?atEnd@QTextStream@@QBE_NXZ
?readLine@QTextStream@@QAE?AVQString@@_J@Z
??6QTextStream@@QAEAAV0@ABVQString@@@Z
?endl@Qt@@YAAAVQTextStream@@AAV2@@Z
??0QUrl@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
??1QUrl@@QAE@XZ
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?fromUserInput@QUrl@@SA?AV1@ABVQString@@@Z
?isEmpty@QUrl@@QBE_NXZ
?endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z
?resolved@QUrl@@QBE?AV1@ABV1@@Z
?isRelative@QUrl@@QBE_NXZ
?fromLocalFile@QUrl@@SA?AV1@ABVQString@@@Z
?toLocalFile@QUrl@@QBE?AVQString@@XZ
??0QFile@@QAE@ABVQString@@@Z
??1QFile@@UAE@XZ
?exists@QFile@@SA_NABVQString@@@Z
??0QFileInfo@@QAE@ABVQString@@@Z
??1QFileInfo@@QAE@XZ
?isReadable@QFileInfo@@QBE_NXZ
?atEnd@QFileDevice@@UBE_NXZ
?bytesAvailable@QIODevice@@UBE_JXZ
?bytesToWrite@QIODevice@@UBE_JXZ
?canReadLine@QIODevice@@UBE_NXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?close@QFileDevice@@UAEXXZ
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?fileName@QFile@@UBE?AVQString@@XZ
?isSequential@QFileDevice@@UBE_NXZ
??AQString@@QAE?AVQCharRef@@H@Z
?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?permissions@QFile@@UBE?AV?$QFlags@W4Permission@QFileDevice@@@@XZ
?pos@QFileDevice@@UBE_JXZ
?qt_metacall@QFile@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QFile@@UAEPAXPBD@Z
?readData@QFileDevice@@MAE_JPAD_J@Z
?readLineData@QFileDevice@@MAE_JPAD_J@Z
?reset@QIODevice@@UAE_NXZ
?resize@QFile@@UAE_N_J@Z
?seek@QFileDevice@@UAE_N_J@Z
?setPermissions@QFile@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z
?size@QFile@@UBE_JXZ
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?waitForBytesWritten@QIODevice@@UAE_NH@Z
?waitForReadyRead@QIODevice@@UAE_NH@Z
?writeData@QFileDevice@@MAE_JPBD_J@Z
?shared_null@QListData@@2UData@1@B
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z
??1QString@@QAE@XZ
?qstrcmp@@YAHABVQByteArray@@PBD@Z
?toLower@QString@@QHAE?AV1@XZ
?scheme@QUrl@@QBE?AVQString@@XZ
?metaObject@QFile@@UBEPBUQMetaObject@@XZ

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
EnterCriticalSection
TerminateProcess
GetCurrentProcess
InitializeSListHead
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 90B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/CreativeCloud_icon.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/DropGraphicFiles.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/GroupOnboardingBackground_CCD.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/GroupOnboardingGraphic_CCD.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/MissingLinkedElement_Dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/MissingLinkedElement_Light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/NewUserEmpty_dark.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/NewUserEmpty_light.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/ScrollDownArrow_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/ScrollDownArrow_darker.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/ScrollDownArrow_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/ScrollDownArrow_lighter.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/ScrollUpArrow_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/ScrollUpArrow_darker.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/ScrollUpArrow_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/ScrollUpArrow_lighter.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/aac_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/aac_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/aif_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/aif_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/aiff_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/aiff_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/captureCoachMark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/checkerboard.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/coachmark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/icons.svg
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/m4a_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/m4a_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/mp2_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/mp2_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/mp3_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/mp3_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/scroll_triangle_down_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/scroll_triangle_down_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/scroll_triangle_left_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/scroll_triangle_left_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/scroll_triangle_right_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/scroll_triangle_right_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/scroll_triangle_up_dark.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/scroll_triangle_up_light.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/unlock_coachmark.png
.png
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/wait_32.gif
.gif
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/wav_filetype_256.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/playlistformats/resources/wav_filetype_64.svg
.xml
Ex_PE_v3.1.9/demux/Sourse2/qtmultimedia_m3u.dll
.dll windows:6 windows x86 arch:x86

d35460b9a3baf35d1aaeb2c0ade3acc2

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-07-2009 17:25

Not After

07-12-2030 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 15:43

Not After

07-11-2030 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:34:61:50:30:94:33:f3:02:f6:ec:f2:31:43:1a:6d
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

23-11-2021 07:32

Not After

01-12-2022 07:32

Subject

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07-05-2021 19:19

Not After

29-12-2040 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22-07-2020 15:33

Not After

29-12-2030 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09
Signer

Actual PE Digest

45:86:f7:f1:c5:65:6b:35:be:e3:c6:3c:61:d0:64:72:d1:3b:59:ab:19:38:a2:2d:0c:37:15:8c:d7:ea:b9:09

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\qt\work\qt\qtmultimedia\plugins\playlistformats\qtmultimedia_m3u.pdb

Imports

qt5multimedia

?qt_metacall@QMediaPlaylistIOPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QMediaPlaylistIOPlugin@@UAEPAXPBD@Z
?staticMetaObject@QMediaPlaylistIOPlugin@@2UQMetaObject@@B
??1QMediaPlaylistIOPlugin@@UAE@XZ
??0QMediaPlaylistIOPlugin@@QAE@PAVQObject@@@Z
??0QMediaPlaylistWriter@@QAE@XZ
??1QMediaPlaylistWriter@@UAE@XZ
??0QMediaContent@@QAE@XZ
??1QMediaPlaylistReader@@UAE@XZ
?request@QMediaContent@@QBE?AVQNetworkRequest@@XZ
?isNull@QMediaContent@@QBE_NXZ
??4QMediaContent@@QAEAAV0@ABV0@@Z
??1QMediaContent@@QAE@XZ
??0QMediaContent@@QAE@ABV0@@Z
??0QMediaContent@@QAE@ABVQUrl@@@Z
??0QMediaPlaylistReader@@QAE@XZ

qt5network

??1QNetworkRequest@@QAE@XZ
?url@QNetworkRequest@@QBE?AVQUrl@@XZ

qt5core

?trimmed@QString@@QHAE?AV1@XZ
??8QString@@QBE_NVQLatin1String@@@Z
??BQCharRef@@QBE?AVQChar@@XZ
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?dispose@QListData@@SAXPAUData@1@@Z
?append@QListData@@QAEPAPAXXZ
?isOpen@QIODevice@@QBE_NXZ
?isReadable@QIODevice@@QBE_NXZ
?isWritable@QIODevice@@QBE_NXZ
??0QTextStream@@QAE@PAVQIODevice@@@Z
??1QTextStream@@UAE@XZ
?atEnd@QTextStream@@QBE_NXZ
?readLine@QTextStream@@QAE?AVQString@@_J@Z
??6QTextStream@@QAEAAV0@ABVQString@@@Z
?endl@Qt@@YAAAVQTextStream@@AAV2@@Z
??0QUrl@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
??1QUrl@@QAE@XZ
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?fromUserInput@QUrl@@SA?AV1@ABVQString@@@Z
?isEmpty@QUrl@@QBE_NXZ
?endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z
?resolved@QUrl@@QBE?AV1@ABV1@@Z
?isRelative@QUrl@@QBE_NXZ
?fromLocalFile@QUrl@@SA?AV1@ABVQString@@@Z
?toLocalFile@QUrl@@QBE?AVQString@@XZ
??0QFile@@QAE@ABVQString@@@Z
??1QFile@@UAE@XZ
?exists@QFile@@SA_NABVQString@@@Z
??0QFileInfo@@QAE@ABVQString@@@Z
??1QFileInfo@@QAE@XZ
?isReadable@QFileInfo@@QBE_NXZ
?atEnd@QFileDevice@@UBE_NXZ
?bytesAvailable@QIODevice@@UBE_JXZ
?bytesToWrite@QIODevice@@UBE_JXZ
?canReadLine@QIODevice@@UBE_NXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?close@QFileDevice@@UAEXXZ
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?fileName@QFile@@UBE?AVQString@@XZ
?isSequential@QFileDevice@@UBE_NXZ
??AQString@@QAE?AVQCharRef@@H@Z
?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?permissions@QFile@@UBE?AV?$QFlags@W4Permission@QFileDevice@@@@XZ
?pos@QFileDevice@@UBE_JXZ
?qt_metacall@QFile@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QFile@@UAEPAXPBD@Z
?readData@QFileDevice@@MAE_JPAD_J@Z
?readLineData@QFileDevice@@MAE_JPAD_J@Z
?reset@QIODevice@@UAE_NXZ
?resize@QFile@@UAE_N_J@Z
?seek@QFileDevice@@UAE_N_J@Z
?setPermissions@QFile@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z
?size@QFile@@UBE_JXZ
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?waitForBytesWritten@QIODevice@@UAE_NH@Z
?waitForReadyRead@QIODevice@@UAE_NH@Z
?writeData@QFileDevice@@MAE_JPBD_J@Z
?shared_null@QListData@@2UData@1@B
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z
??1QString@@QAE@XZ
?qstrcmp@@YAHABVQByteArray@@PBD@Z
?toLower@QString@@QHAE?AV1@XZ
?scheme@QUrl@@QBE?AVQString@@XZ
?metaObject@QFile@@UBEPBUQMetaObject@@XZ

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
EnterCriticalSection
TerminateProcess
GetCurrentProcess
InitializeSListHead
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 90B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/demux/Xceed.Wpf.AvalonDock.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock\obj\Release\Xceed.Wpf.AvalonDock.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/demux/wmerror.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/demux/wwansvc.admx
.xml
Ex_PE_v3.1.9/halfandhalf.json
Ex_PE_v3.1.9/lockout.dbf
Ex_PE_v3.1.9/msedge_elf.dll
.dll windows:5 windows x64 arch:x64

e5e4f3f5367c0c82df24a4723fbd8a3c

Code Sign

33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2023 19:51

Not After

16-10-2024 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:f8:4a:bc:d7:d7:60:51:af:3b:32:90:96:e0:5c:97:52:94:e6:94:8b:e7:82:be:3e:68:c8:95:97:4b:d4:a6
Signer

Actual PE Digest

3d:f8:4a:bc:d7:d7:60:51:af:3b:32:90:96:e0:5c:97:52:94:e6:94:8b:e7:82:be:3e:68:c8:95:97:4b:d4:a6

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\e\src\out\Release_x64\msedge_elf.dll.pdb

Imports

kernel32

AcquireSRWLockExclusive
AddVectoredExceptionHandler
AssignProcessToJobObject
CancelIo
CloseHandle
CompareStringW
ConnectNamedPipe
CreateDirectoryW
CreateEventA
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateThread
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeClientProcessId
GetNamedPipeServerProcessId
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProductInfo
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadId
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeProcThreadAttributeList
InitializeSListHead
InitializeSRWLock
InterlockedFlushSList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetMappedFileNameW
K32GetModuleInformation
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
RemoveDirectoryW
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointerEx
SetHandleInformation
SetLastError
SetNamedPipeHandleState
SetProcessMitigationPolicy
SetStdHandle
SetThreadInformation
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SwitchToThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualProtectEx
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcmpiA
lstrcmpiW
lstrlenA

ntdll

NtClose
NtCreateKey
NtDeleteKey
NtOpenKeyEx
NtQueryValueKey
NtSetValueKey
RtlFormatCurrentUserKeyPath
RtlFreeUnicodeString
RtlGetLastNtStatus
RtlInitUnicodeString

oleaut32

GetErrorInfo
SetErrorInfo
SysAllocString
SysFreeString
SysStringLen

Exports

Exports

??0PwaHelperImpl@edge_pwahelper@@QEAA@XZ
??1PwaHelperImpl@edge_pwahelper@@UEAA@XZ
??_7PwaHelperImpl@edge_pwahelper@@6B@
?AppendMojoServerBindingInfo@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVCommandLine@base@@@Z
?BadgeNotification@PwaHelperImpl@edge_pwahelper@@UEAAXW4BadgeNotificationType@mojom@2@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@Z
?BindWidgetManager@PwaHelperImpl@edge_pwahelper@@AEAAXV?$ScopedHandleBase@VMessagePipeHandle@mojo@@@mojo@@@Z
?DigitalGoodsAbortPaymentApp@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AX_N@Z@base@@@Z
?DigitalGoodsConsume@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@@Z@base@@@Z
?DigitalGoodsGetDetails@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$StructPtr@VItemDetails@mojom@payments@@@mojo@@V?$allocator@V?$StructPtr@VItemDetails@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z
?DigitalGoodsInvokePaymentApp@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4PurchaseResponseCode@mojom@edge_pwahelper@@@Z@base@@@Z
?DigitalGoodsListPurchaseHistory@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@V?$allocator@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z
?DigitalGoodsListPurchases@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@V?$allocator@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z
?GetAppAcquisitionDetail@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4AcquisitionInfoResponseCode@mojom@edge_acquisition_info@@V?$InlinedStructPtr@VAcquisitionDetails@mojom@edge_acquisition_info@@@mojo@@@Z@base@@@Z
?InitMojo@PwaHelperImpl@edge_pwahelper@@AEAAXXZ
?InitializeAppUserModelIdForCurrentProcess@PwaHelperImpl@edge_pwahelper@@QEAA_NXZ
?OnClientConnected@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVWaitableEvent@base@@@Z
?PinTileToStart@PwaHelperImpl@edge_pwahelper@@UEAAXXZ
?PinTileToTaskbar@PwaHelperImpl@edge_pwahelper@@UEAAXXZ
?SetPwaHwnd@PwaHelperImpl@edge_pwahelper@@UEAAX_K@Z
?SetSingletonProcessId@PwaHelperImpl@edge_pwahelper@@UEAAXI@Z
?Shutdown@PwaHelperImpl@edge_pwahelper@@AEAAXI@Z
?StartAppWithIncomingMojo@PwaHelperImpl@edge_pwahelper@@QEAAXVPlatformChannelEndpoint@mojo@@@Z
?StartAppWithPlatformChannel@PwaHelperImpl@edge_pwahelper@@QEAAXV?$unique_ptr@VCommandLine@base@@U?$default_delete@VCommandLine@base@@@__Cr@std@@@__Cr@std@@@Z
?StartProcessWithMojoIPC@PwaHelperImpl@edge_pwahelper@@QEAAKPEAXV?$unique_ptr@VCommandLine@base@@U?$default_delete@VCommandLine@base@@@__Cr@std@@@__Cr@std@@V?$unique_ptr@VScopedTempDir@base@@U?$default_delete@VScopedTempDir@base@@@__Cr@std@@@45@@Z
?TryActivateInstance@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVCommandLine@base@@@Z
?ValidateHandShake@PwaHelperImpl@edge_pwahelper@@AEAAXXZ
ClearReportsBetween_ExportThunk
CrashForException_ExportThunk
DisableHook
DrainLog
DumpHungProcessWithPtype_ExportThunk
DumpProcessWithoutCrash
GetApplyHookResult
GetBlockedModulesCount
GetCrashReports_ExportThunk
GetCrashpadDatabasePath_ExportThunk
GetElfLoadThreadId
GetHandleVerifier
GetInjectionMitigationStatus
GetInstallDetailsPayload
GetUniqueBlockedModulesCount
GetUserDataDirectoryThunk
InjectDumpForHungInput_ExportThunk
IsBrowserProcess
IsExtensionPointDisableSet
IsThirdPartyInitialized
OQS_CPU_has_extension
OQS_KEM_alg_count
OQS_KEM_alg_identifier
OQS_KEM_alg_is_enabled
OQS_KEM_decaps
OQS_KEM_encaps
OQS_KEM_free
OQS_KEM_keypair
OQS_KEM_kyber_768_decaps
OQS_KEM_kyber_768_encaps
OQS_KEM_kyber_768_keypair
OQS_KEM_new
OQS_MEM_cleanse
OQS_MEM_insecure_free
OQS_MEM_secure_bcmp
OQS_MEM_secure_free
OQS_SIG_alg_count
OQS_SIG_alg_identifier
OQS_SIG_alg_is_enabled
OQS_SIG_free
OQS_SIG_keypair
OQS_SIG_new
OQS_SIG_sign
OQS_SIG_verify
OQS_destroy
OQS_init
OQS_randombytes
OQS_randombytes_custom_algorithm
OQS_randombytes_nist_kat_init_256bit
OQS_randombytes_switch_algorithm
OQS_version
RegisterLogNotification
RequestSingleCrashUpload_ExportThunk
SetMetricsClientId
SetTelemetryLevel_ExportThunk
SetUploadConsent_ExportThunk
SignalChromeElf
SignalInitializeCrashReporting
StartAppWithParameter

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 597KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.crthunk
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 196B

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

malloc_h
Size: 512B - Virtual size: 226B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ex_PE_v3.1.9/wmidx.dll
.dll windows:10 windows x64 arch:x64

fb8d0d572c7a4bc177a5f94662736d6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wmidx.pdb

Imports

msvcrt

_wcsicmp
memcmp
memcpy
__dllonexit
_onexit
_unlock
_lock
memmove
_initterm
_amsg_exit
_XcptFilter
_callnewh
strcat_s
_purecall
strcpy_s
realloc
malloc
free
__C_specific_handler
memset

rpcrt4

UuidCreate

user32

CharPrevA
CharNextA
LoadStringA

wmasf

ord13
ASFCreateMediaObjectIndexMaker
ord14
ASFReadHeaderFromFileHandle

kernel32

GetTempPathW
GetVersion
HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
MultiByteToWideChar
CreateThread
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetLastError
WideCharToMultiByte
SetFilePointer
SetEndOfFile
CreateFileW
CreateFileA
GetFileType
GetFileSizeEx
ReadFile
WriteFile
GetSystemTime
SystemTimeToFileTime
DeleteFileW
DeleteFileA
lstrlenW
GetFileSize
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleA
lstrcmpiA
lstrcpynA
RtlVirtualUnwind
SizeofResource
LoadResource
FindResourceExA
GetModuleFileNameA
DisableThreadLibraryCalls
HeapDestroy
FormatMessageA
LoadLibraryA
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
IsDBCSLeadByte

ole32

ProgIDFromCLSID
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysStringLen
VarUI4FromStr
VariantInit
LoadRegTypeLi
CreateErrorInfo
SetErrorInfo
SysAllocString
SysFreeString
VariantClear

advapi32

CryptAcquireContextA
CryptReleaseContext
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CryptGenRandom

Exports

Exports

WMCreateASFChopper

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 284KB - Virtual size: 284KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 161KB - Virtual size: 161KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

a42f73521c784fa06f1d886fcbcefcba

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30Signer

3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fdSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

wintrust

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 263KB - Virtual size: 263KB

.data Size: 17KB - Virtual size: 22KB

.pdata Size: 70KB - Virtual size: 70KB

.gfids Size: 512B - Virtual size: 156B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

dae02f32a21e03ce65412f6e56942daa

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

.text
Size: 284KB - Virtual size: 284KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 161KB - Virtual size: 161KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30
Signer

3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 263KB - Virtual size: 263KB

.data
Size: 17KB - Virtual size: 22KB

.pdata
Size: 70KB - Virtual size: 70KB

.gfids
Size: 512B - Virtual size: 156B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61
Signer

18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 162KB - Virtual size: 161KB

.data
Size: 10KB - Virtual size: 13KB

.gfids
Size: 512B - Virtual size: 168B

.rsrc
Size: 2KB - Virtual size: 2KB