Plants vs[.] Zombies[.]zip

resource
unpack001/bass.dll

Plants vs. Zombies.zip

.zip

DynamicContentLib.dll

.dll windows:5 windows x86 arch:x86

e4618a3203c330560a6e075c95d98236

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/09/2009, 00:00

Not After

20/09/2012, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

b2:0a:77:8f:30:9d:ab:66:e9:64:3c:d4:e3:f0:7f:c0:60:d2:4f:f1
Signer

Actual PE Digest

b2:0a:77:8f:30:9d:ab:66:e9:64:3c:d4:e3:f0:7f:c0:60:d2:4f:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

C:\wrapperclient-3.0\wrapper\src\wrapper\Release - Final\DynamicContentLib.pdb

Imports

kernel32

InterlockedIncrement

InterlockedDecrement

WaitForSingleObject

CreateThread

Sleep

DeleteFileW

GetSystemTimeAsFileTime

GetCurrentProcessId

GetCurrentThreadId

GetTickCount

QueryPerformanceCounter

FindClose

FindFirstFileW

FindNextFileW

CopyFileW

GetTempPathW

SetFileAttributesW

GetTempFileNameW

MoveFileExW

InterlockedExchange

InterlockedCompareExchange

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

DisableThreadLibraryCalls

oleaut32

SysAllocString

SysStringLen

SysReAllocString

SysAllocStringLen

SysFreeString

msvcp90

?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ

?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z

?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z

?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z

?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ

?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ

??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z

??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z

?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z

??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z

??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z

??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z

?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ

?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ

?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z

?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z

?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z

?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ID@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z

?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z

?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ

?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ

?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ

?rend@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ

?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z

??0?$allocator@_W@std@@QAE@XZ

?allocate@?$allocator@_W@std@@QAEPA_WI@Z

?max_size@?$allocator@_W@std@@QBEIXZ

?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z

??0?$allocator@_W@std@@QAE@ABV01@@Z

?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z

?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z

??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z

??0?$allocator@D@std@@QAE@XZ

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z

??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z

?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ

?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ

?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ

?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z

?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ

??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z

??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z

?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ

?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z

?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z

?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB

??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z

??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z

?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

msvcr90

_CxxThrowException

fseek

memcpy

ftell

memmove_s

??_V@YAXPAX@Z

srand

rand

ferror

_purecall

_unlock

__dllonexit

_encode_pointer

_lock

_onexit

_decode_pointer

_malloc_crt

_encoded_null

_initterm

_initterm_e

_amsg_exit

_adjust_fdiv

__CppXcptFilter

?terminate@@YAXXZ

_crt_debugger_hook

?_type_info_dtor_internal_method@type_info@@QAEXXZ

_except_handler4_common

__clean_type_info_names_internal

towupper

iswspace

_vsnwprintf

realloc

free

wcscmp

fopen

fwrite

_wmkdir

__CxxFrameHandler3

memset

??0exception@std@@QAE@XZ

_invalid_parameter_noinfo

fclose

fread

feof

_wfopen

_time64

?what@exception@std@@UBEPBDXZ

??2@YAPAXI@Z

??1exception@std@@UAE@XZ

??0exception@std@@QAE@ABV01@@Z

??0exception@std@@QAE@ABQBD@Z

??3@YAXPAX@Z

malloc

Exports

CreateDynamicContentSystem

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

PlantsVsZombies.dat

PlantsVsZombies.exe

.exe windows:5 windows x86 arch:x86

c1d9c77b7a5eed8862f5372a2f716bca

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/09/2009, 00:00

Not After

20/09/2012, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

88:ff:2d:42:42:af:b7:25:70:61:ab:46:1d:17:88:e0:91:bf:28:d4
Signer

Actual PE Digest

88:ff:2d:42:42:af:b7:25:70:61:ab:46:1d:17:88:e0:91:bf:28:d4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\dfranzi\Desktop\Files\Perforce\dfranzi_SEA-10786\games\Lawn\goty\cpp\Lawn\ReleaseFinal\PlantsVsZombies.pdb

Imports

kernel32

OutputDebugStringA

GetModuleFileNameA

WinExec

GetModuleHandleA

MapViewOfFile

CreateFileMappingA

GetCurrentProcessId

QueryPerformanceFrequency

QueryPerformanceCounter

GetTickCount

GetProcessHeap

SetEndOfFile

SetEnvironmentVariableA

CreateFileW

GetLocaleInfoW

FreeLibrary

InterlockedDecrement

GetProcAddress

LoadLibraryA

CreateFileA

LeaveCriticalSection

MulDiv

FileTimeToSystemTime

GetSystemDirectoryA

EnterCriticalSection

GetFileTime

CloseHandle

GlobalLock

WaitForSingleObject

GetCurrentThread

GetCommandLineA

GlobalAlloc

Sleep

MultiByteToWideChar

SetThreadPriority

GlobalUnlock

FindFirstFileA

GetLastError

GlobalFree

FindClose

FindNextFileA

CreateMutexA

GetCurrentThreadId

GetVersionExA

DeleteFileA

UnmapViewOfFile

VirtualQuery

SetErrorMode

SetUnhandledExceptionFilter

GetCurrentProcess

InitializeCriticalSection

IsBadWritePtr

GetThreadPriority

DeleteCriticalSection

OpenFileMappingA

CreateThread

InterlockedIncrement

LoadLibraryW

GetCurrentDirectoryW

GetWindowsDirectoryA

SetEvent

CreateEventA

GetFileSize

FindResourceA

LoadResource

SizeofResource

LockResource

WideCharToMultiByte

InterlockedCompareExchange

InterlockedExchange

GetLocaleInfoA

TerminateProcess

UnhandledExceptionFilter

IsDebuggerPresent

GetSystemTimeAsFileTime

GetModuleHandleW

ExitProcess

GetStartupInfoA

HeapFree

ExitThread

ResumeThread

GetLocalTime

CreateDirectoryA

GetDriveTypeA

GetFullPathNameA

HeapReAlloc

HeapAlloc

RtlUnwind

RaiseException

GetCPInfo

LCMapStringA

LCMapStringW

GetTimeFormatA

GetDateFormatA

CompareStringA

CompareStringW

GetStringTypeW

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

SetLastError

GetACP

GetOEMCP

IsValidCodePage

ReadFile

WriteFile

GetConsoleCP

GetConsoleMode

SetFilePointer

SetHandleCount

GetStdHandle

GetFileType

InitializeCriticalSectionAndSpinCount

HeapSize

GetTimeZoneInformation

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapCreate

VirtualFree

VirtualAlloc

FlushFileBuffers

GetCurrentDirectoryA

SetCurrentDirectoryA

GetStringTypeA

GetUserDefaultLCID

EnumSystemLocalesA

IsValidLocale

SetStdHandle

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

RemoveDirectoryA

user32

HideCaret

MoveWindow

GetSystemMetrics

AdjustWindowRectEx

ReleaseDC

OffsetRect

GetDC

DrawTextExA

GetClientRect

GetWindowInfo

FillRect

ClientToScreen

RegisterClassA

DefWindowProcW

ChangeDisplaySettingsA

DialogBoxIndirectParamA

AdjustWindowRect

SetClipboardData

SetWindowTextA

IsWindowVisible

ReleaseCapture

SystemParametersInfoA

MessageBoxW

OpenClipboard

DispatchMessageA

PostMessageA

ShowWindow

GetCursorPos

DestroyCursor

DefWindowProcA

EndDialog

GetDlgItem

ShowCaret

PeekMessageA

CreateWindowExA

GetClipboardData

GetWindowLongA

InvalidateRect

SetWindowLongA

GetWindowTextA

GetWindowPlacement

TranslateMessage

EnumWindows

BeginPaint

RegisterWindowMessageA

SetFocus

WindowFromPoint

IsWindowEnabled

EnumDisplaySettingsA

LoadIconA

CreateCursor

SetForegroundWindow

SetCapture

IsIconic

SetActiveWindow

GetWindowRect

ScreenToClient

SetTimer

CloseClipboard

DestroyWindow

EndPaint

CreateWindowExW

GetSysColorBrush

GetSysColor

GetDesktopWindow

IsDialogMessageA

GetFocus

DrawTextA

GetMessageA

IsWindow

PostThreadMessageA

DestroyCaret

CreateCaret

SetCaretPos

EmptyClipboard

LoadCursorA

MessageBoxA

SendMessageA

SetCursor

GetActiveWindow

wininet

HttpQueryInfoA

InternetReadFile

HttpOpenRequestA

HttpSendRequestA

InternetOpenA

InternetCloseHandle

InternetConnectA

winmm

timeGetTime

timeBeginPeriod

mixerOpen

mixerGetLineControlsA

mixerGetLineInfoA

mixerClose

PlaySoundA

timeEndPeriod

mixerGetControlDetailsA

mixerSetControlDetails

mixerGetDevCapsA

wsock32

send

gethostbyname

closesocket

__WSAFDIsSet

socket

inet_ntoa

connect

WSAStartup

recv

WSACleanup

htons

WSAGetLastError

select

ioctlsocket

gdi32

CreateCompatibleDC

SetBkMode

GetTextMetricsA

IntersectClipRect

GetObjectA

GetStockObject

TextOutA

DeleteObject

SelectObject

CreateSolidBrush

GetTextExtentPoint32A

SetTextColor

DeleteDC

CreateDIBSection

CreateFontA

GetDeviceCaps

CreateFontIndirectA

advapi32

RegSetValueExA

RegCreateKeyExA

RegCloseKey

RegOpenKeyExA

RegDeleteValueA

RegOpenKeyA

RegQueryValueExA

shell32

ShellExecuteA

ole32

CoCreateInstance

CoInitialize

oleaut32

SysFreeString

SysAllocString

VariantClear

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 794KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

PopUninstall.exe

.exe windows:5 windows x86 arch:x86

22fd7104821646abe7cea47c01107582

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/09/2009, 00:00

Not After

20/09/2012, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

a7:b0:0d:41:e2:0c:b8:56:20:2c:bd:70:d2:de:25:41:4c:26:a6:1b
Signer

Actual PE Digest

a7:b0:0d:41:e2:0c:b8:56:20:2c:bd:70:d2:de:25:41:4c:26:a6:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

kernel32

GetModuleFileNameA

CreateFileA

GetExitCodeProcess

DeleteFileA

SetFileAttributesA

MulDiv

RemoveDirectoryA

GetProcessHeap

SetEndOfFile

SetEnvironmentVariableA

CompareStringW

CompareStringA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

WideCharToMultiByte

GetStringTypeW

GetStringTypeA

GetLocaleInfoA

SetFilePointer

FlushFileBuffers

IsValidCodePage

GetOEMCP

GetACP

ReadFile

GetConsoleMode

GetConsoleCP

WriteFile

CreateProcessA

SetThreadPriority

GetCurrentThread

SetPriorityClass

ResumeThread

GetWindowsDirectoryA

Sleep

GetSystemDirectoryA

FindFirstFileA

FindNextFileA

FindClose

GetLastError

GetCurrentProcess

CloseHandle

GetVersionExA

LoadLibraryA

GetProcAddress

FreeLibrary

InitializeCriticalSectionAndSpinCount

GetSystemTimeAsFileTime

GetCurrentProcessId

GetTickCount

QueryPerformanceCounter

GetFileType

SetHandleCount

GetEnvironmentStringsW

FreeEnvironmentStringsW

GetModuleHandleA

InterlockedIncrement

InterlockedDecrement

InterlockedExchange

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

MultiByteToWideChar

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RaiseException

RtlUnwind

HeapFree

ExitThread

CreateThread

GetCommandLineA

GetStartupInfoA

HeapReAlloc

HeapAlloc

GetCPInfo

LCMapStringA

LCMapStringW

GetModuleHandleW

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

SetLastError

GetCurrentThreadId

HeapCreate

VirtualFree

VirtualAlloc

GetFileAttributesA

ExitProcess

HeapSize

GetStdHandle

FreeEnvironmentStringsA

GetEnvironmentStrings

user32

GetWindowTextA

MessageBoxW

DialogBoxParamA

DialogBoxParamW

LoadImageA

ShowWindow

GetWindowRect

MapWindowPoints

BeginPaint

LoadIconA

DrawIcon

EndPaint

GetDlgItem

EndDialog

SetTimer

GetClientRect

AdjustWindowRect

MoveWindow

SendMessageW

EnumChildWindows

SetWindowTextW

SetWindowTextA

GetWindowLongA

GetDC

SystemParametersInfoA

ReleaseDC

GetSystemMetrics

SendMessageA

IsWindowUnicode

GetWindowTextW

gdi32

CreateFontA

CreateFontW

CreateFontIndirectA

GetStockObject

SelectObject

GetTextExtentPoint32W

DeleteObject

GetDeviceCaps

advapi32

RegOpenKeyExA

RegQueryInfoKeyA

RegOpenKeyA

RegEnumValueA

RegDeleteValueA

RegEnumKeyExA

RegDeleteKeyA

RegQueryValueExA

RegSetValueExA

RegCloseKey

shell32

ShellExecuteExA

SHChangeNotify

ole32

CoUninitialize

CoCreateInstance

CoInitialize

StringFromGUID2

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

XLayout.dll

.dll windows:5 windows x86 arch:x86

d51c3af244b9551db6f3114ab374a2d0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/09/2009, 00:00

Not After

20/09/2012, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

cb:80:c3:90:3e:04:68:76:35:f7:1c:96:bf:d9:67:c1:cc:20:32:08
Signer

Actual PE Digest

cb:80:c3:90:3e:04:68:76:35:f7:1c:96:bf:d9:67:c1:cc:20:32:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

InterlockedIncrement

InterlockedDecrement

GetSystemTimeAsFileTime

GetCurrentProcessId

GetCurrentThreadId

GetTickCount

QueryPerformanceCounter

DisableThreadLibraryCalls

IsDebuggerPresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

InterlockedCompareExchange

Sleep

InterlockedExchange

FindClose

FindFirstFileW

user32

IntersectRect

PtInRect

oleaut32

SafeArrayAccessData

SafeArrayCreateVector

SysAllocStringLen

SysFreeString

SysAllocString

SysStringLen

VariantClear

SafeArrayDestroy

SafeArrayGetUBound

SafeArrayGetLBound

SysReAllocString

SysReAllocStringLen

SafeArrayUnaccessData

VariantInit

SafeArrayGetElement

SafeArrayDestroyDescriptor