AvastUI[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AvastUI.exe
Size

20.4MB
MD5

89cc1d72ea881faa9a65b998808bf298
SHA1

95f7d0505fc928e2d5b5e26f277d0b45c1486e24
SHA256

cac5c6ab7dca82ba91fa6a7a17d992b99b21c554e90ba7cf62651f9d60f8e63b
SHA512

1989a6e05af7ae890adc5aed66778e2a24379114d77ca89181bcee079cc734faa26700b25570fe1579133b6131946bc646561334258fb78ea1fd4e8fbd78290f
SSDEEP

196608:rGvoUOSeLhrUTGH1mF+iW7P+HIg2O1FIz7rxqsCTHmSRmFbU7qN:rGvoUxeLh4SHUK7P+Hx2O1mDxqsCTT

Score

1^/10

Malware Config

Signatures

Files

AvastUI.exe
.exe windows:6 windows x64 arch:x64

e7e3a101533406e0cb7e65f83cf2a8ee

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:b2:c3:80:04:a7:3e:fa:34:ee:54:17:f3:29:12:79:e2:f8:e1:26:b2:27:43:8a:7e:37:92:37:b9:57:66:c9
Signer

Actual PE Digest

b7:b2:c3:80:04:a7:3e:fa:34:ee:54:17:f3:29:12:79:e2:f8:e1:26:b2:27:43:8a:7e:37:92:37:b9:57:66:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\AvastUI.pdb

Imports

aavmrpch

AavmRpcIdpCanBePathProtected
AavmRpcProviderStop
AavmRpcProviderStart
AavmRpcUpdateSessionFlags
AavmRpcUpdateScanFlagsByRowId
AavmRpcUpdateScanFlags
AavmRpcUpdateScanResult
AavmRpcDeleteSession
AavmRpcControlFirewallService
AavmRpcAdminActivateLicense
AavmRpcAdminConnectionTest
AavmRpcAdminServiceTest
AavmRpcSafeZoneBrowserStartNg
AavmRpcSafeZoneBrowserUiSvcCommand
AavmRpcNgUserSessionSetLastInputTime
AavmRpcNgUserSessionNotification
AavmRpcAutoSnxKillSandboxedGroup
AavmRpcBccExecuteCommand
AavmRpcRestoredFromChest
AavmRpcIsPathSDProtected
AavmRpcIdpChestControl
AavmRpcTransferDataBlock
AavmRpcResetToFactorySettings
AavmRpcRunSystemComponent
AavmRpcDisableSelfDefense
AavmRpcRunComponent
AavmRpcHttpGet
AavmRpcGetMailCertificate
AavmRpcProcessActivationCode
AavmRpcNetAlert
AavmRpcBtsSchedule
AavmRpcSetProxySettings
AavmRpcGetRootKey
AavmRpcAlphaInsertLicenseFile
AavmRpcSwitchToFree
AavmRpcImexUnpackPackage
AavmRpcImexImportSettings
AavmRpcImexExportSettings
AavmRpcUnregisterRestartableProcess
AavmRpcRegisterRestartableProcess
AavmRpcChangeExcludedHash
AavmRpcAddCounter
AavmRpcCopyTaskDefinition
AavmRpcForceDeleteTask
AavmRpcDeleteTask
AavmRpcIdpGetDefaultProtectedPaths
AavmRpcCreateTaskAccordingParam
AavmRpcCreateTask
AavmRpcIsProductExpired
AavmRpcSetConnectorSessionId
AavmRpcSetProviderPropertyInt
AavmRpcSetProviderProperty
AavmRpcSetPropertyInt
AavmRpcStringDecrypt
AavmRpcSetProperty
AavmRpcSetTaskPropertyInt
AavmRpcSetTaskProperty
AavmRpcIsPasswordEmpty
AavmRpcPasswordCheck
AavmRpcDestroyBinding
AavmRpcGetProviderInfoList
AavmRpcCreateBinding
AavmRpcTimeCheckFix
AavmRpcSubmitFile
AavmRpcAutoSnxToasterResult
AavmRpcRemDeserializeToJson
AavmRpcDeleteSessionType

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertFreeCertificateChain
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFindCertificateInStore
CryptMemFree
CryptVerifyTimeStampSignature
CryptUnprotectData
CryptStringToBinaryA
CryptBinaryToStringA
CryptProtectData
CertGetCertificateChain
CertDeleteCertificateFromStore
CertFreeCertificateContext
CertCreateCertificateContext
CertAddEncodedCertificateToStore
CertOpenStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChainEngine

dnsapi

DnsQuery_W
DnsFree

advapi32

EventUnregister
RegQueryValueExA
RegEnumKeyExA
CryptAcquireContextA
CryptGenRandom
RegQueryMultipleValuesW
RegDeleteTreeW
RegDeleteKeyExW
RegEnumKeyW
ConvertStringSidToSidW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation
IsValidSid
ConvertSidToStringSidW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyW
GetUserNameW
GetSecurityInfo
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
FreeSid
RegDeleteValueW
SetEntriesInAclW
SetSecurityInfo
RegEnumValueW
OpenThreadToken
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegEnumKeyExW
TreeSetNamedSecurityInfoW
SetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
EnumServicesStatusW
QueryServiceStatus
CreateProcessAsUserW
DuplicateTokenEx
CheckTokenMembership
DuplicateToken
RegGetValueW
EventRegister
EventWriteTransfer
RegDeleteKeyW
StartServiceW
QueryServiceStatusEx
SetThreadToken
RegNotifyChangeKeyValue
RegOpenKeyExA
LookupAccountNameW
GetAce
GetSecurityDescriptorOwner
AccessCheck
GetSecurityDescriptorDacl
GetFileSecurityW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
SystemFunction036
CryptHashData
CryptCreateHash
CryptAcquireContextW
ImpersonateLoggedOnUser
AdjustTokenPrivileges
LookupPrivilegeValueW
ImpersonateSelf
EqualSid
LookupAccountSidW
SetFileSecurityW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
RegOpenCurrentUser
RevertToSelf

wininet

HttpOpenRequestW
HttpSendRequestW
InternetCloseHandle
InternetCrackUrlW
InternetSetOptionW
InternetConnectW
InternetCanonicalizeUrlW
InternetOpenW

rpcrt4

RpcServerUseProtseqEpW
RpcServerRegisterIf2
RpcServerUnregisterIf
RpcMgmtStopServerListening
I_RpcBindingInqLocalClientPID
NdrServerCallAll
NdrServerCall2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
RpcSsDestroyClientContext
NdrClientCall3
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcStringFreeA
RpcBindingSetAuthInfoExA
RpcAsyncInitializeHandle
RpcAsyncCancelCall
RpcAsyncCompleteCall
Ndr64AsyncClientCall
UuidFromStringW
RpcStringBindingParseW
UuidCreate
UuidToStringW
RpcServerListen

shell32

SHQueryUserNotificationState
ord165
SHAppBarMessage
SHChangeNotify
SHGetFolderPathW
SHGetFileInfoW
Shell_NotifyIconW
ord51
SHGetSpecialFolderPathW
SHCreateItemFromParsingName
SHGetKnownFolderPath
SHGetSpecialFolderLocation
Shell_NotifyIconGetRect
SHGetDesktopFolder
ord155
SHOpenFolderAndSelectItems
ord190
ShellExecuteExW
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc

ntdll

NtDeleteKey
NtQueryKey
NtOpenKey
VerSetConditionMask
RtlAllocateHeap
RtlInitializeCriticalSection
RtlFreeHeap
RtlNtStatusToDosError
RtlDllShutdownInProgress
RtlVirtualUnwind
RtlLookupFunctionEntry
NtSystemDebugControl
RtlSetLastWin32Error
RtlInitUnicodeString
RtlPrefixUnicodeString
RtlEqualUnicodeString
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtQueryDirectoryFile
RtlCompareMemory
NtClose
NtOpenFile
RtlIsDosDeviceName_U
RtlDosPathNameToNtPathName_U
NtSetInformationThread

shlwapi

PathIsNetworkPathW
ColorRGBToHLS
ColorHLSToRGB
PathRemoveFileSpecW
ord487
ord12
AssocQueryStringW
PathFindFileNameW
PathAppendW
PathMatchSpecW
SHStrDupW
PathFileExistsW
SHDeleteKeyW
PathIsDirectoryW

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

ws2_32

WSAResetEvent
WSAEventSelect
WSAWaitForMultipleEvents
ntohl
setsockopt
WSAIoctl
__WSAFDIsSet
getpeername
recv
ioctlsocket
gethostname
getservbyname
WSAAddressToStringW
WSAEnumNetworkEvents
WSACleanup
WSAStartup
WSACreateEvent
WSACloseEvent
getsockopt
WSASetLastError
GetAddrInfoW
FreeAddrInfoW
ntohs
getsockname
recvfrom
select
sendto
send
socket
htons
bind
htonl
connect
shutdown
WSAGetLastError
closesocket
FreeAddrInfoExW
GetAddrInfoExW
InetNtopW

ashtask

tskPackerBits
ARDeconstructListFromString
ARConstructListFromString
tskCreateFriendFileName
?aswCloseQuery@@YAKPEAX@Z
tskChangeExcludedHash
?aswGetTaskPropertyInt@@YAKPEB_W0PEAH@Z
?aswGetNextTask2@@YAKPEAXPEA_WK@Z
?aswGetFirstTask@@YAKPEAPEAXPEA_WK1K@Z
tskIsFileHashExcluded
?aswGetTaskProperty@@YAKPEB_W0PEA_W_K@Z
tskFriendlyShieldName

aswengldr

avldrCreateHandle
avldrLoadModule
avlicGetLockData
avldrCloseModule
uiextPollEvent
uiextEventDone
uiextProcessCmd
uiextFilterUrl2
avldrUpdatedDefsAvailable

aswaux

??0IaswObjectList@@QEAA@PEB_W0@Z
?EnumElements@IaswObject@@QEAA_NAEAPEAXPEA_W_KAEAW4aswElementType@1@@Z
??1IaswObjectList@@QEAA@XZ
?GetValue@IaswObject@@QEBA_NPEB_WPEA_W_K0@Z
?FreeValue@IaswObject@@QEBAXPEA_W@Z
?DeleteValue@IaswObject@@QEAAXPEB_W@Z
?GetValue@IaswObject@@QEBA_NPEB_WPEAPEA_W0@Z
??1IaswObject@@QEAA@XZ
?EnumObjects@IaswObjectList@@QEAAPEAVIaswObject@@AEAPEAX@Z

comctl32

ImageList_Draw
ImageList_GetIconSize
ord17

mpr

WNetGetConnectionW

winmm

timeSetEvent
timeKillEvent

ashbase

basGetErrorString
basEmptyAvastTempFolder
notAddEventId
notInit
basSubmitPropertyArrayToString
basInitLibrary
basFreeLibrary
notEvent
notEventId
notRemEvent
notFree

netapi32

NetLocalGroupEnum
NetGetDCName
NetApiBufferFree
NetUserGetInfo
NetUserEnum

iphlpapi

IcmpSendEcho2Ex
GetAdaptersAddresses
Icmp6SendEcho2
Icmp6CreateFile
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
GetNetworkParams
GetBestRoute2
FreeMibTable
GetIfEntry2
GetIfTable2Ex
GetUnicastIpAddressTable

aswip

?free@lib@ip@@QEAAKXZ
?free@dnsapi@ip@@QEAAKXZ
?init@dnsapi@ip@@QEAAKXZ
?names_from_address@dnsapi@ip@@SAKAEBVaddr@2@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@K@Z
?getaddrinfo@winsock2@ip@@SAKPEB_WAEAV?$vector@Vaddr@ip@@V?$allocator@Vaddr@ip@@@std@@@std@@0PEAUaddrinfoW@@@Z
?free@hlpapi@ip@@QEAAKXZ
?load@hlpapi@ip@@QEAAKXZ
?ping@hlpapi@ip@@SAKVsaddr@2@AEAU_SPingReply@12@EKGEH@Z

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptDestroySecret
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptImportKeyPair
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptExportKey
BCryptSecretAgreement
BCryptDeriveKey
BCryptGenerateSymmetricKey
BCryptEncrypt

dwmapi

DwmSetWindowAttribute
DwmExtendFrameIntoClientArea

winhttp

WinHttpSetStatusCallback
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSetCredentials
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpWriteData
WinHttpSetTimeouts
WinHttpOpen
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpQueryDataAvailable

libcrypto-3-x64

d2i_X509_CRL_bio
ASN1_STRING_length
X509_get_ext_d2i
X509_STORE_CTX_new
BN_bn2dec
PEM_write_bio_X509
d2i_X509
BIO_ctrl
X509_free
BIO_s_mem
PEM_write_bio_PUBKEY
BIO_free_all
SHA512_Final
SHA256_Final
SHA1_Final
SHA512_Update
SHA256_Update
SHA1_Update
SHA512_Init
SHA256_Init
SHA1_Init
BIO_new_mem_buf
X509_CRL_get_REVOKED
BIO_new
X509_STORE_CTX_verify
OPENSSL_sk_pop_free
ASN1_STRING_get0_data
DIST_POINT_free
BIO_write
EVP_PKEY_free
OPENSSL_sk_value
OPENSSL_sk_push
EVP_MD_CTX_free
CRYPTO_free
PEM_read_bio_PrivateKey
X509_STORE_CTX_set_time
X509_CRL_free
PEM_read_bio_X509
X509_NAME_ENTRY_get_data
GENERAL_NAME_get0_value
BN_is_zero
EVP_DigestUpdate
X509_STORE_CTX_get_error
X509_STORE_CTX_init
X509_STORE_CTX_free
EVP_sha256
X509_REVOKED_get0_serialNumber
PEM_read_bio_PUBKEY
OPENSSL_sk_num
X509_STORE_add_cert
EVP_VerifyFinal
EVP_MD_CTX_new
X509_STORE_free
X509_STORE_new
ASN1_INTEGER_cmp
OPENSSL_sk_new_null
X509_get_pubkey
ASN1_INTEGER_to_BN
RAND_seed
RAND_bytes
PKCS5_PBKDF2_HMAC_SHA1
AES_set_decrypt_key
EC_KEY_free
d2i_EC_PUBKEY_bio
EC_KEY_set_public_key
EC_KEY_get0_public_key
BIO_free
d2i_PKCS8_PRIV_KEY_INFO_bio
EVP_PKCS82PKEY
EVP_PKEY_get1_EC_KEY
EC_KEY_set_private_key
EC_KEY_get0_private_key
PKCS8_PRIV_KEY_INFO_free
d2i_ECPrivateKey_bio
i2d_EC_PUBKEY_bio
EVP_PKEY_new
EVP_PKEY_set1_EC_KEY
i2d_PKCS8PrivateKeyInfo_bio
i2d_ECPrivateKey_bio
BIO_read
EC_GROUP_new_by_curve_name
EC_GROUP_set_asn1_flag
EC_GROUP_set_point_conversion_form
EC_KEY_new
EC_KEY_set_group
EC_KEY_generate_key
EC_GROUP_free
ECDSA_size
ECDSA_sign
ECDSA_verify
HMAC_CTX_free
HMAC_CTX_new
X509_get_serialNumber
BN_free
EVP_DigestInit
HMAC_Init_ex
EVP_sha1
EVP_sha512
HMAC_Update
HMAC_Final
EC_GROUP_get_degree
EC_KEY_get0_group
ECDH_compute_key
AES_set_encrypt_key
AES_cbc_encrypt

aswcmnis

cyphSimpleCode
GetKeyData
sha256Init
sha256Update
sha256Final
DSAVerifySignature
ECDSAVerifySignature

aswcmnos

dep_fsExtractDriveRoot
dep_strFreeString
dep_strNormalToNewUnicode
dep_csRelease
dep_fsGetFileSizeHandle
dep_fsReadFile
dep_fsCloseFile
dep_osGetWinVer
dep_secGetPublicSecurity
dep_csWait
dep_fsExistFile
dep_fsOpenFileX
dep_fsWriteFile
dep_fsDeleteFileX
dep_secSetPrivilege
cmnosMiniInit
dep_csDelete
dep_strNormalToUnicode
dep_fsExistFileX
dep_csCreate

aswcmnbs

secGetProcessTrustLevel
secIsAswSP
GetHardwareIdEx
?DeleteFileW@CGenericFile@root@asw@@QEAAK_N0@Z
?writein@CGenericFile@root@asw@@QEAA_NPEBX_K@Z
?InitTempFile@CGenericFile@root@asw@@QEAAKKPEB_WPEAKK@Z
?_Close@CGenericFile@root@asw@@AEAAKXZ
?_InitFile@CGenericFile@root@asw@@AEAAXXZ
strMatchesWildcards
fsGetAvastProgramPath
fsGetAvastDataPath
secSetObjectProtection
GetFileSignatureDetails
secCreateSharedEvent
secIsProcessTrusted
secCreateSharedMutex
sha256GenerateFromName
DSA_BlockVerify
cmnbFree
cmnbInit
aswcmnbsDllMain
secIsUiProtectionEnabled
secIsSelfDefenseEnabled
secOpenSharedEvent
secIsNamedPipeClientTrusted
GetProgramModulePath
fsGetAvastTempFileName
?GetTempFile@CStr@root@asw@@QEAAKPEAK@Z
fsGetAvastLogPath
DSA_FileVerify
fsGetAvastSumpPath
fsSetAvastJournalPath
secPreventHookDllInjection
secIsRpcClientTrusted
GetHardwareId

protobuf

?DiscardUnknownFields@Message@protobuf@google@@UEAAXXZ
?SpaceUsedLong@Message@protobuf@google@@UEBA_KXZ
?SerializeAsString@MessageLite@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?SerializeToString@MessageLite@protobuf@google@@QEBA_NPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?end@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ
?begin@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ
?default_value_enum@FieldDescriptor@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@XZ
?HasField@Reflection@protobuf@google@@QEBA_NAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetMessage@Reflection@protobuf@google@@QEBAAEBVMessage@23@AEBV423@PEBVFieldDescriptor@23@PEAVMessageFactory@23@@Z
?GetDouble@Reflection@protobuf@google@@QEBANAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetFloat@Reflection@protobuf@google@@QEBAMAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetUInt64@Reflection@protobuf@google@@QEBA_KAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetUInt32@Reflection@protobuf@google@@QEBAIAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetEnum@Reflection@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@AEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetRepeatedDouble@Reflection@protobuf@google@@QEBANAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedFloat@Reflection@protobuf@google@@QEBAMAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedUInt64@Reflection@protobuf@google@@QEBA_KAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedMessage@Reflection@protobuf@google@@QEBAAEBVMessage@23@AEBV423@PEBVFieldDescriptor@23@H@Z
?GetRepeatedUInt32@Reflection@protobuf@google@@QEBAIAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedEnum@Reflection@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@AEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?SetDouble@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@N@Z
?SetFloat@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@M@Z
?SetUInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_K@Z
?CopyFrom@Message@protobuf@google@@UEAAXAEBV123@@Z
?InternalSerializeWithCachedSizesToArray@MessageLite@protobuf@google@@UEBAPEAEPEAE@Z
?SerializeWithCachedSizesToArray@MessageLite@protobuf@google@@UEBAPEAEPEAE@Z
?SerializeWithCachedSizes@Message@protobuf@google@@UEBAXPEAVCodedOutputStream@io@23@@Z
?ByteSizeLong@Message@protobuf@google@@UEBA_KXZ
?MergePartialFromCodedStream@Message@protobuf@google@@UEAA_NPEAVCodedInputStream@io@23@@Z
?CheckTypeAndMergeFrom@Message@protobuf@google@@UEAAXAEBVMessageLite@23@@Z
?SetUInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@I@Z
?FindValueByName@EnumDescriptor@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?enum_type@FieldDescriptor@protobuf@google@@QEBAPEBVEnumDescriptor@23@XZ
?FindValueByNumber@EnumDescriptor@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@H@Z
?SetEnum@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@PEBVEnumValueDescriptor@23@@Z
?AddDouble@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@N@Z
?AddFloat@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@M@Z
?AddUInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_K@Z
?AddMessage@Reflection@protobuf@google@@QEBAPEAVMessage@23@PEAV423@PEBVFieldDescriptor@23@PEAVMessageFactory@23@@Z
?AddUInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@I@Z
?AddEnum@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@PEBVEnumValueDescriptor@23@@Z
?Clear@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXXZ
?Mutable@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?CloseGap@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXHH@Z
?Get@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?ClearFallback@UnknownFieldSet@protobuf@google@@AEAAXXZ
?MergeFrom@UnknownFieldSet@protobuf@google@@QEAAXAEBV123@@Z
?default_instance@UnknownFieldSet@protobuf@google@@SAPEBV123@XZ
?SerializeWithCachedSizes@MessageLite@protobuf@google@@UEBAXPEAVCodedOutputStream@io@23@@Z
?InitializationErrorString@MessageLite@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?New@MessageLite@protobuf@google@@UEBAPEAV123@PEAVArena@23@@Z
?VerifyVersion@internal@protobuf@google@@YAXHHPEBD@Z
?DestroyMessage@internal@protobuf@google@@YAXPEBX@Z
?OnShutdownRun@internal@protobuf@google@@YAXP6AXPEBX@Z0@Z
?InitSCCImpl@internal@protobuf@google@@YAXPEAUSCCInfoBase@123@@Z
?ReadTagFallback@CodedInputStream@io@protobuf@google@@AEAAII@Z
?ReadBytes@WireFormatLite@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SkipField@WireFormat@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@IPEAVUnknownFieldSet@34@@Z
?InitializationErrorString@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?SerializeUnknownFields@WireFormat@internal@protobuf@google@@SAXAEBVUnknownFieldSet@34@PEAVCodedOutputStream@io@34@@Z
?WriteStringWithSizeToArray@CodedOutputStream@io@protobuf@google@@SAPEAEAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z
?SerializeUnknownFieldsToArray@WireFormat@internal@protobuf@google@@SAPEAEAEBVUnknownFieldSet@34@PEAE@Z
?ComputeUnknownFieldsSize@WireFormat@internal@protobuf@google@@SA_KAEBVUnknownFieldSet@34@@Z
?Merge@ReflectionOps@internal@protobuf@google@@SAXAEBVMessage@34@PEAV534@@Z
?ReadVarint64Fallback@CodedInputStream@io@protobuf@google@@AEAA?AU?$pair@_K_N@std@@XZ
?WriteInt64@WireFormatLite@internal@protobuf@google@@SAXH_JPEAVCodedOutputStream@io@34@@Z
?WriteMessageMaybeToArray@WireFormatLite@internal@protobuf@google@@SAXHAEBVMessageLite@34@PEAVCodedOutputStream@io@34@@Z
?ReadVarintSizeAsIntFallback@CodedInputStream@io@protobuf@google@@AEAAHXZ
?IncrementRecursionDepthAndPushLimit@CodedInputStream@io@protobuf@google@@QEAA?AU?$pair@HH@std@@H@Z
?DecrementRecursionDepthAndPopLimit@CodedInputStream@io@protobuf@google@@QEAA_NH@Z
?InternalExtend@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAPEAXH@Z
?OnArenaAllocation@Arena@protobuf@google@@AEBAXPEBVtype_info@@_K@Z
?AllocateAlignedAndAddCleanup@ArenaImpl@internal@protobuf@google@@QEAAPEAX_KP6AXPEAX@Z@Z
?size@?$RepeatedField@H@protobuf@google@@QEBAHXZ
?Clear@?$RepeatedField@H@protobuf@google@@QEAAXXZ
?Get@?$RepeatedField@H@protobuf@google@@QEBAAEBHH@Z
?Add@?$RepeatedField@H@protobuf@google@@QEAAXAEBH@Z
??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@XZ
??1?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@XZ
??0?$RepeatedField@H@protobuf@google@@QEAA@XZ
?IsInitialized@Message@protobuf@google@@UEBA_NXZ
?Clear@Message@protobuf@google@@UEAAXXZ
??1?$RepeatedField@H@protobuf@google@@QEAA@XZ
??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@AEBV012@@Z
?WriteString@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?WriteVarint32SlowPath@CodedOutputStream@io@protobuf@google@@AEAAXI@Z
?WriteVarint64SlowPath@CodedOutputStream@io@protobuf@google@@AEAAX_K@Z
?data@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ
?Int32Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@H@34@@Z
?MergeFrom@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXAEBV123@@Z
?MergeFrom@?$RepeatedField@H@protobuf@google@@QEAAXAEBV123@@Z
?WriteBool@WireFormatLite@internal@protobuf@google@@SAXH_NPEAVCodedOutputStream@io@34@@Z
?PushLimit@CodedInputStream@io@protobuf@google@@QEAAHH@Z
?BytesUntilLimit@CodedInputStream@io@protobuf@google@@QEBAHXZ
?ReadVarint32Fallback@CodedInputStream@io@protobuf@google@@AEAA_JI@Z
?PopLimit@CodedInputStream@io@protobuf@google@@QEAAXH@Z
?Capacity@?$RepeatedField@H@protobuf@google@@QEBAHXZ
?AddAlreadyReserved@?$RepeatedField@H@protobuf@google@@QEAAXAEBH@Z
?InitProtobufDefaults@internal@protobuf@google@@YAXXZ
??0StringOutputStream@io@protobuf@google@@QEAA@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0CodedOutputStream@io@protobuf@google@@QEAA@PEAVZeroCopyOutputStream@123@_N@Z
??1CodedOutputStream@io@protobuf@google@@QEAA@XZ
?SkipField@WireFormatLite@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@IPEAVCodedOutputStream@634@@Z
?WriteAliasedRaw@ZeroCopyOutputStream@io@protobuf@google@@UEAA_NPEBXH@Z
?WriteRaw@CodedOutputStream@io@protobuf@google@@QEAAXPEBXH@Z
?WriteUInt32@WireFormatLite@internal@protobuf@google@@SAXHIPEAVCodedOutputStream@io@34@@Z
?WriteEnum@WireFormatLite@internal@protobuf@google@@SAXHHPEAVCodedOutputStream@io@34@@Z
?WriteMessage@WireFormatLite@internal@protobuf@google@@SAXHAEBVMessageLite@34@PEAVCodedOutputStream@io@34@@Z
?WriteUInt64@WireFormatLite@internal@protobuf@google@@SAXH_KPEAVCodedOutputStream@io@34@@Z
?WriteInt32@WireFormatLite@internal@protobuf@google@@SAXHHPEAVCodedOutputStream@io@34@@Z
?WriteBytesMaybeAliased@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?AddVarint@UnknownFieldSet@protobuf@google@@QEAAXH_K@Z
??0?$RepeatedField@_J@protobuf@google@@QEAA@XZ
??1?$RepeatedField@_J@protobuf@google@@QEAA@XZ
?WriteBytes@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?ReadPackedEnumPreserveUnknowns@WireFormat@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@IP6A_NH@ZPEAVUnknownFieldSet@34@PEAV?$RepeatedField@H@34@@Z
?ReadPackedEnumPreserveUnknowns@WireFormatLite@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@HP6A_NH@ZPEAVCodedOutputStream@634@PEAV?$RepeatedField@H@34@@Z
?WriteSInt64@WireFormatLite@internal@protobuf@google@@SAXH_JPEAVCodedOutputStream@io@34@@Z
?DestroyString@internal@protobuf@google@@YAXPEBX@Z
?ShutdownProtobufLibrary@protobuf@google@@YAXXZ
?GetTypeName@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ParseFromArray@MessageLite@protobuf@google@@QEAA_NPEBXH@Z
?end@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ
?begin@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ
?size@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAHXZ
?ParseFromString@MessageLite@protobuf@google@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?JsonStringToMessage@util@protobuf@google@@YA?AVStatus@123@VStringPiece@23@PEAVMessage@23@AEBUJsonParseOptions@123@@Z
??1CodedInputStream@io@protobuf@google@@QEAA@XZ
?ListFields@Reflection@protobuf@google@@QEBAXAEBVMessage@23@PEAV?$vector@PEBVFieldDescriptor@protobuf@google@@V?$allocator@PEBVFieldDescriptor@protobuf@google@@@std@@@std@@@Z
?FieldSize@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetRepeatedInt32@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedInt64@Reflection@protobuf@google@@QEBA_JAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedBool@Reflection@protobuf@google@@QEBA_NAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedString@Reflection@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetInt32@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetInt64@Reflection@protobuf@google@@QEBA_JAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetBool@Reflection@protobuf@google@@QEBA_NAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetString@Reflection@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@23@PEBVFieldDescriptor@23@@Z
?AssignDescriptors@internal@protobuf@google@@YAXPEBUDescriptorTable@123@@Z
?message_type@FieldDescriptor@protobuf@google@@QEBAPEBVDescriptor@23@XZ
?FindFieldByNumber@Descriptor@protobuf@google@@QEBAPEBVFieldDescriptor@23@H@Z
?MutableMessage@Reflection@protobuf@google@@QEBAPEAVMessage@23@PEAV423@PEBVFieldDescriptor@23@PEAVMessageFactory@23@@Z
?AddString@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?MergeFrom@Message@protobuf@google@@UEAAXAEBV123@@Z
?AddInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@H@Z
?AddInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_J@Z
?AddBool@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_N@Z
?TypeOnceInit@FieldDescriptor@protobuf@google@@CAXPEBV123@@Z
?SetInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@H@Z
?SetInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_J@Z
?SetBool@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_N@Z
?SetString@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Reserve@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXH@Z
?WriteStringMaybeAliased@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?SerializeToArray@MessageLite@protobuf@google@@QEBA_NPEAXH@Z

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z
?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

msvcp140

?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Wcsxfrm
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$numpunct@_W@std@@2V0locale@2@A
_Query_perf_counter
_Query_perf_frequency
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Random_device@std@@YAIXZ
_Thrd_sleep
_Xtime_get_ticks
?_Xinvalid_argument@std@@YAXPEBD@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?eof@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEA_W@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Winerror_map@std@@YAHH@Z
_Lock_shared_ptr_spin_lock
_Unlock_shared_ptr_spin_lock
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_signal
_Cnd_wait
_Thrd_id
_Cnd_timedwait
_Mtx_current_owns
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
_Cnd_broadcast
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??Bios_base@std@@QEBA_NXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?toupper@?$ctype@D@std@@QEBADD@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAK@Z
?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
_Cnd_unregister_at_thread_exit
_Mtx_trylock
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?toupper@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
_Thrd_join
_Cnd_do_broadcast_at_thread_exit
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?empty@locale@std@@SA?AV12@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_J@Z
?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAPEAV12@PEAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z
?_Xruntime_error@std@@YAXPEBD@Z
?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ
??1ctype_base@std@@UEAA@XZ
??0ctype_base@std@@QEAA@_K@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@HPEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?clear@ios_base@std@@QEAAXH_N@Z
_Toupper
_Tolower
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAN@Z
_Thrd_detach
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
_Mbrtowc
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?classic@locale@std@@SAAEBV12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock

msvcp140_atomic_wait

__std_atomic_wait_direct
__std_atomic_notify_all_direct

mfc140u

ord6002
ord2273
ord2178
ord13401
ord1492
ord324
ord1040
ord2327
ord323
ord2698
ord2372
ord4726
ord12610
ord1033
ord296
ord1501
ord1503
ord2212
ord8161
ord8162
ord2903
ord286
ord2344
ord1670
ord2222
ord11921
ord2223
ord2302
ord10124
ord2187
ord2301
ord8043
ord9941
ord5555
ord11902
ord11806
ord12606
ord11901
ord7920
ord11929
ord5706
ord3731
ord6122
ord14289
ord6123
ord14290
ord6121
ord14288
ord3812
ord5916
ord7719
ord12212
ord14088
ord11665
ord11664
ord2011
ord7668
ord12625
ord3949
ord8900
ord4011
ord9089
ord14216
ord6619
ord7650
ord14210
ord12223
ord12222
ord2439
ord12600
ord5183
ord12563
ord8023
ord12544
ord8084
ord8167
ord2270
ord6285
ord14038
ord8901
ord5607
ord5636
ord7394
ord990
ord1454
ord4947
ord280
ord11771
ord1668
ord1667
ord14209
ord4721
ord4656
ord12240
ord6313
ord3756
ord6320
ord13199
ord962
ord1428
ord13761
ord3713
ord12933
ord4655
ord2921
ord13864
ord6006
ord6090
ord489
ord1121
ord3952
ord1631
ord287
ord1502
ord7744
ord12443
ord2350
ord2346
ord4946
ord2415
ord448
ord2487
ord3841
ord4181
ord2369
ord2371
ord13767
ord2414
ord8471
ord14221
ord7541
ord4511
ord8409
ord8451
ord8452
ord14218
ord1671
ord8441
ord4086
ord6361
ord3803
ord2479
ord12265
ord4669
ord277
ord13986
ord1089
ord6250
ord1091
ord3599
ord3697
ord14128
ord5240
ord878
ord1369
ord10727
ord10704
ord8926
ord11855
ord8731
ord285
ord6850
ord5709
ord450
ord7235
ord2909
ord8058
ord10163
ord4343
ord8507
ord11813
ord11085
ord10085
ord7168
ord3951
ord1442
ord528
ord1149
ord3308
ord7387
ord3307
ord4724
ord3071
ord3090
ord2514
ord4357
ord13301
ord7637
ord9156
ord3830
ord1504
ord1505
ord8050
ord12932
ord6000
ord13397
ord3212
ord12324
ord13597
ord7745
ord4510
ord14027
ord2987
ord6848
ord3209
ord7913
ord446
ord7233
ord11854
ord8416
ord1665
ord3203
ord8468
ord2697
ord6724
ord14360
ord2686
ord2316
ord9976
ord14219
ord293
ord9978
ord9977
ord2195
ord14278
ord12087
ord2340
ord12030
ord9975
ord9979
ord14225
ord5451
ord11414
ord6505
ord11415
ord8830
ord3718
ord11625
ord8656
ord6729
ord10691
ord8947
ord3173
ord13513
ord11944
ord11940
ord1700
ord1722
ord1748
ord1734
ord1755
ord4776
ord4843
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4814
ord4752
ord4767
ord4828
ord4360
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord6631
ord11406
ord13354
ord5723
ord2629
ord3279
ord3278
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339
ord5582
ord5083
ord5229
ord5062
ord7460
ord7461
ord7450
ord5227
ord7922
ord4913
ord14025
ord438
ord1086
ord2473
ord6247
ord2475
ord6549
ord12762
ord12746
ord8501
ord8063
ord7177
ord7393
ord983
ord1450
ord4445
ord11933
ord357
ord886
ord12967
ord9946
ord7813
ord4499
ord13617
ord3742
ord12761
ord13555
ord4030
ord7182
ord7837
ord1039

kernel32

ExpandEnvironmentStringsW
GetFileAttributesW
GetTempPathW
GetTempFileNameW
LocalFree
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetPrivateProfileStringW
GetExitCodeProcess
GetShortPathNameW
GlobalMemoryStatusEx
GetLocaleInfoEx
GetFileSizeEx
ReadFile
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ProcessIdToSessionId
RegisterWaitForSingleObject
GetUserDefaultLangID
GetUserDefaultLCID
IsBadReadPtr
VerifyVersionInfoW
LocalAlloc
GetLocalTime
DebugBreak
InitializeCriticalSectionAndSpinCount
WTSGetActiveConsoleSessionId
SetDllDirectoryW
GetFileSize
SetFilePointer
WriteFile
SetEndOfFile
GlobalAddAtomW
GlobalDeleteAtom
GetSystemInfo
CreateIoCompletionPort
ResetEvent
CreateNamedPipeW
ConnectNamedPipe
WaitForMultipleObjects
OpenEventW
UnregisterWaitEx
GetTickCount64
CompareFileTime
GetFileAttributesExW
GetUserDefaultLocaleName
FreeLibrary
GetCommandLineW
CreateThread
CancelIo
GetExitCodeThread
GetStringTypeExW
TlsGetValue
FindNextFileW
FindFirstFileW
GetSystemTimeAsFileTime
DeleteFileW
GetTickCount
TerminateProcess
CreateEventW
WaitForSingleObject
LoadLibraryW
GetCurrentDirectoryW
SystemTimeToFileTime
GetFileType
DuplicateHandle
GetFileInformationByHandle
WritePrivateProfileStringW
RemoveDirectoryW
OpenEventA
CreateWaitableTimerA
GetQueuedCompletionStatus
WaitForSingleObjectEx
DisconnectNamedPipe
FlushFileBuffers
FindClose
ReadProcessMemory
OpenProcess
K32EnumProcesses
CopyFileW
SleepEx
SetErrorMode
GetEnvironmentVariableW
SetEnvironmentVariableW
QueryPerformanceFrequency
QueryPerformanceCounter
OutputDebugStringW
WaitNamedPipeW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
GetTimeFormatW
GetDateFormatW
K32EnumProcessModules
GetCurrentThread
GetCurrentProcess
HeapSize
SetFileAttributesW
TlsAlloc
HeapReAlloc
HeapDestroy
TlsFree
FormatMessageA
GetProcessTimes
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetProcessIdOfThread
FindFirstFileExW
SetThreadPriority
GetComputerNameW
VirtualFree
VirtualAlloc
GetLogicalDriveStringsW
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
GetLongPathNameW
GetUserGeoID
ResumeThread
ReleaseMutex
LCMapStringW
GetCurrentProcessId
TlsSetValue
GetVersionExA
GetFullPathNameA
MulDiv
TryEnterCriticalSection
GetTimeZoneInformation
GetSystemDefaultLCID
GetVolumePathNameW
CreatePipe
GetVersionExW
LocalFileTimeToFileTime
SetFilePointerEx
ReleaseSemaphore
CreateSemaphoreW
SetThreadLocale
UnmapViewOfFile
UnlockFile
CreateFileA
CreateFileMappingW
MapViewOfFile
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
InitOnceExecuteOnce
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsDebuggerPresent
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
OutputDebugStringA
GetFullPathNameW
CreateMutexW
FindFirstVolumeW
FindVolumeClose
FindNextVolumeW
GetSystemTime
WaitForMultipleObjectsEx
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CheckRemoteDebuggerPresent
VirtualProtect
FlushInstructionCache
RaiseException
GetProcessId
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery
GetSystemTimes
QueryFullProcessImageNameW
GetThreadTimes
K32GetProcessMemoryInfo
OpenThread
GetThreadPriority
GetProcessHandleCount
CompareStringW
QueryThreadCycleTime
DeleteProcThreadAttributeList
GetThreadId
SetHandleInformation
GetPriorityClass
GetComputerNameExW
LoadLibraryExA
MoveFileExW
K32GetMappedFileNameW
ExitProcess
GetSystemDirectoryA
GetModuleHandleA
MoveFileExA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GetWindowsDirectoryA
AreFileApisANSI
GetFileInformationByHandleEx
InitOnceBeginInitialize
InitOnceComplete
ReleaseSRWLockShared
AcquireSRWLockShared
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlCaptureContext
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetGeoInfoW
GetNativeSystemInfo
FileTimeToLocalFileTime
UnlockFileEx
LockFileEx
CreateEventA
LocalUnlock
MultiByteToWideChar
GetLastError
LoadLibraryA
GetProcAddress
GetModuleHandleW
LoadLibraryExW
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetModuleFileNameW
CreateDirectoryW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
QueryDosDeviceW
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
CloseHandle
GetWindowsDirectoryW
GetSystemDirectoryW
SetLastError
CreateWaitableTimerW
SetWaitableTimer
SetEvent
GetLocaleInfoW
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
HeapAlloc
GetProcessHeap
HeapFree
TerminateThread
GetModuleFileNameA
SetProcessShutdownParameters
InitializeCriticalSectionEx
SetProcessWorkingSetSize
GetThreadLocale

user32

GetWindowTextW
GetWindowTextLengthW
ShowWindow
MoveWindow
SetFocus
SendDlgItemMessageW
GetDlgItem
DestroyWindow
CreateDialogParamW
GetSysColor
SetForegroundWindow
GetForegroundWindow
GetWindowLongW
GetParent
InvalidateRect
ReleaseDC
ActivateKeyboardLayout
InsertMenuW
CheckMenuItem
GetMenuItemID
GetSubMenu
EnableMenuItem
DeleteMenu
ModifyMenuW
IsWindowVisible
FindWindowExW
GetThreadDesktop
GetUserObjectInformationW
GetProcessWindowStation
LoadImageW
FillRect
PostMessageW
FindWindowW
TranslateMessage
GetMessageW
SetMenuDefaultItem
InSendMessage
DestroyIcon
CopyRect
DrawTextW
LoadCursorW
SetCursor
GetDlgCtrlID
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
SetWindowPos
SetWindowTextW
DefWindowProcW
GetWindowLongPtrW
GetSystemMetrics
EnableWindow
SetWindowRgn
GetWindowRect
SystemParametersInfoW
NotifyWinEvent
SendMessageW
GetClientRect
wsprintfW
KillTimer
SetTimer
LoadStringW
GetKeyboardLayoutNameW
WaitForInputIdle
InflateRect
LoadIconW
SendInput
GetAsyncKeyState
GetKeyState
GetPropW
SetPropW
GetCursorPos
BeginPaint
EndPaint
TrackMouseEvent
LoadBitmapW
RegisterClassExW
DrawIcon
EnumWindows
RegisterWindowMessageW
GetFocus
CreateWindowExW
GetMonitorInfoW
UnregisterClassW
OpenDesktopW
CloseDesktop
CreateDesktopW
IsHungAppWindow
GetGUIThreadInfo
SetRect
UnionRect
EqualRect
GetWindowRgn
RegisterClassW
GetClassInfoExW
SendMessageTimeoutW
OpenClipboard
SetClipboardData
CloseClipboard
OpenInputDesktop
TrackPopupMenu
AllowSetForegroundWindow
SwitchDesktop
SetThreadDesktop
GetWindowThreadProcessId
CharLowerW
GetDesktopWindow
MonitorFromPoint
GetLastInputInfo
SetWindowLongW
GetWindow
PostQuitMessage
EnumDesktopWindows
GetWindowDC
GetWindowPlacement
SendNotifyMessageW
GetKeyboardLayoutList
SetWindowLongPtrW
GetKeyboardLayout
MonitorFromRect
MonitorFromWindow
OffsetRect
IntersectRect
LoadMenuW
SetParent
IsWindow
DestroyMenu
ExitWindowsEx
IsIconic
MapWindowPoints
GetCapture
ReleaseCapture
keybd_event
MapVirtualKeyW
ScreenToClient
IsWindowEnabled
MessageBoxW
UpdateWindow
RedrawWindow
CallWindowProcW
CopyImage
IsGUIThread
CloseWindow
GetAncestor
SetWindowDisplayAffinity
PostThreadMessageW
GetClassNameW
PtInRect
GetDC

gdi32

RoundRect
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
SetTextColor
SetBkMode
CreateFontW
CreatePen
CreateSolidBrush
CreateFontIndirectW
SelectObject
GetDeviceCaps
AddFontResourceExW
BitBlt
GetTextAlign
GetTextExtentPointW
GetTextExtentPoint32W
CreateRoundRectRgn
AddFontResourceW
RemoveFontResourceW
CreateRectRgn
SetPixel
DeleteDC
GetObjectW
SetTextAlign
StretchBlt
ExtCreatePen
GetCurrentPositionEx
Polygon
GetClipBox
GetDIBits
GetRgnBox
GetBitmapBits
SetBitmapBits
CreateBitmap
CreatePatternBrush
DeleteObject
PatBlt

msimg32

GradientFill

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

PropVariantClear
CoTaskMemAlloc
OleRun
CoInitialize
CoInitializeEx
CoCreateInstance
CLSIDFromString
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoInitializeSecurity
CoUninitialize
StringFromCLSID

oleaut32

SafeArrayDestroy
SafeArrayLock
SysAllocString
SafeArrayUnlock
LoadTypeLi
SysStringLen
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
SafeArrayCreate

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

query

LoadIFilter

secur32

QueryContextAttributesW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_set_se_translator
strrchr
__C_specific_handler
longjmp
__current_exception
__current_exception_context
memset
__std_exception_destroy
__std_exception_copy
memcpy
memcmp
_CxxThrowException
_purecall
__std_type_info_compare
strstr
__RTDynamicCast
memchr
__intrinsic_setjmp
memmove
wcschr
wcsrchr
wcsstr
strchr
__RTtypeid
__std_type_info_name
__std_terminate

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
free
realloc
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

ceilf
_finite
floor
pow
sqrt
acos
asin
atan2
modf
cos
sin
log
log10
round
fmod
_ldsign
_fdclass
_isnan
_fdsign
log2
_fdopen
ceil
_dsign
__setusermatherr
_ldclass
_dclass

api-ms-win-crt-runtime-l1-1-0

_errno
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_exit
_initterm
_seh_filter_exe
_initterm_e
_get_wide_winmain_command_line
_c_exit
_set_app_type
_initialize_wide_environment
_configure_wide_argv
exit
abort
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
terminate
_register_thread_local_exe_atexit_callback
__p___argc
__p___wargv
_beginthreadex
strerror
__sys_nerr
__sys_errlist
_cexit

api-ms-win-crt-stdio-l1-1-0

_wfopen
__stdio_common_vfwprintf
fputs
feof
fopen_s
_open
fgets
__stdio_common_vfprintf
_wfopen_s
__stdio_common_vsprintf
fputc
__stdio_common_vsnprintf_s
_fileno
_get_osfhandle
ferror
__acrt_iob_func
__stdio_common_vfwprintf_s
fclose
ftell
fseek
_get_stream_buffer_pointers
fwrite
fputwc
_set_fmode
ungetwc
__stdio_common_vsnwprintf_s
__p__commode
ungetc
fgetc
fgetwc
fgetpos
_close
_fseeki64
fsetpos
setvbuf
fflush
_wfsopen
__stdio_common_vswprintf_s
__stdio_common_vswscanf
__stdio_common_vswprintf
__stdio_common_vsprintf_s
fopen
_ftelli64
__stdio_common_vsscanf
fread

api-ms-win-crt-string-l1-1-0

_strdup
toupper
_wcsnicmp
wcstok
_wcsupr
strcspn
strncat
wmemcpy_s
strpbrk
isspace
strncmp
_wcsdup
strspn
wcscat_s
wcsncat
wcsncmp
isupper
tolower
wcsnlen
isdigit
strcmp
strtok
wcspbrk
strncpy
strcpy_s
wcslen
strnlen
wcsncpy
isalnum
_stricmp
iswdigit
wcsncpy_s
wcscpy_s
towlower
towupper
_wcsicmp
iswalpha
iswspace
isxdigit
isalpha
iswpunct
_strnicmp

api-ms-win-crt-time-l1-1-0

_time32
_gmtime64
strftime
_time64
_localtime64
_mktime64
wcsftime
_localtime64_s
_difftime64
_mkgmtime64

api-ms-win-crt-convert-l1-1-0

wcstombs
_wtol
_wcstoui64
_itow
_strtoui64
wcstod
wcstoll
wcstoul
strtol
atoi
_i64tow
strtoull
strtof
wcstol
_ecvt_s
strtoll
_wtof
_wtoi
strtoul
_wtoi64
atof
atol
wcstoull
strtod
_itow_s
_ultow_s

api-ms-win-crt-filesystem-l1-1-0

_unlink
_wremove
_waccess
_lock_file
_unlock_file
_access
_fstat64
_stat64
_wunlink
_wstat64i32

api-ms-win-crt-utility-l1-1-0

srand
qsort
rand

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func
_wsetlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcpy
_mbsnbcmp
_mbspbrk
_mbschr

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

ncrypt

BCryptGenRandom

Exports

Exports

??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ
?RegisterSpocNotificationHandler@spoc@asw@@YA?AV?$shared_ptr@VISpocCookie@spoc@asw@@@std@@AEBUNotificationKey@12@V?$function@$$A6AXUSpocNotification@spoc@asw@@@Z@4@@Z
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?unlock@singleton_module@serialization@boost@@QEAAXXZ
asw_process_storage_allocate_connector
asw_process_storage_deallocate_connector
on_avast_dll_unload
onexit_register_connector_avast_2

Sections

.text
Size: 12.6MB - Virtual size: 12.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 535KB - Virtual size: 535KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7e3a101533406e0cb7e65f83cf2a8ee

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b7:b2:c3:80:04:a7:3e:fa:34:ee:54:17:f3:29:12:79:e2:f8:e1:26:b2:27:43:8a:7e:37:92:37:b9:57:66:c9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

aavmrpch

version

crypt32

dnsapi

advapi32

wininet

rpcrt4

shell32

ntdll

shlwapi

setupapi

ws2_32

ashtask

aswengldr

aswaux

comctl32

mpr

winmm

ashbase

netapi32

iphlpapi

aswip

bcrypt

dwmapi

winhttp

libcrypto-3-x64

aswcmnis

aswcmnos

aswcmnbs

protobuf

wtsapi32

dll_loader

msvcp140

msvcp140_atomic_wait

mfc140u

kernel32

user32

gdi32

msimg32

comdlg32

ole32

oleaut32

oleacc

query

secur32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b7:b2:c3:80:04:a7:3e:fa:34:ee:54:17:f3:29:12:79:e2:f8:e1:26:b2:27:43:8a:7e:37:92:37:b9:57:66:c9
Signer

.text
Size: 12.6MB - Virtual size: 12.6MB

.rdata
Size: 4.3MB - Virtual size: 4.3MB

.data
Size: 1.5MB - Virtual size: 1.7MB

.pdata
Size: 535KB - Virtual size: 535KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 183KB - Virtual size: 182KB