AvastUI[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

AvastUI.exe
Size

20.5MB
MD5

89ec5e6ca2fb2d5a6a3caacae05c1f1c
SHA1

098cb55f8bb7aa8ce96e0e891a2e002768ed32d4
SHA256

1190df4aa52aa9f9ba02e7c1df3eeec75e3b33acd5f048be072c1947e9243324
SHA512

d43a2a02d2fd6c3b498b8ce20bff24cec2c05d7f88e37e5bd50a5bbbb609e5aa3f6f18562b277c3fe0d0302a1fb092c53ffbd757f950832d2e78e5eb487ca265
SSDEEP

393216:M1kisVZtdCCfy9B4Lw/NIcNKFqs9PknA:Ft6Qw/PKFb

Score

1^/10

Malware Config

Signatures

Files

AvastUI.exe
.exe windows:6 windows x64 arch:x64

1087de45976b8c8cac147938e4688ad9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:11:ef:3c:1a:51:34:cd:76:e4:7e:e3:4f:c8:54:b9:69:51:b2:55:90:f4:28:d8:a4:d9:67:af:89:e5:88:85
Signer

Actual PE Digest

8d:11:ef:3c:1a:51:34:cd:76:e4:7e:e3:4f:c8:54:b9:69:51:b2:55:90:f4:28:d8:a4:d9:67:af:89:e5:88:85

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\AvastUI.pdb

Imports

aavmrpch

AavmRpcIdpCanBePathProtected
AavmRpcProviderStop
AavmRpcProviderStart
AavmRpcUpdateSessionFlags
AavmRpcUpdateScanFlagsByRowId
AavmRpcUpdateScanFlags
AavmRpcUpdateScanResult
AavmRpcDeleteSession
AavmRpcControlFirewallService
AavmRpcAdminActivateLicense
AavmRpcAdminConnectionTest
AavmRpcAdminServiceTest
AavmRpcSafeZoneBrowserStartNg
AavmRpcSafeZoneBrowserUiSvcCommand
AavmRpcNgUserSessionSetLastInputTime
AavmRpcNgUserSessionNotification
AavmRpcAutoSnxKillSandboxedGroup
AavmRpcBccExecuteCommand
AavmRpcRestoredFromChest
AavmRpcIsPathSDProtected
AavmRpcIdpChestControl
AavmRpcTransferDataBlock
AavmRpcResetToFactorySettings
AavmRpcRunSystemComponent
AavmRpcDisableSelfDefense
AavmRpcRunComponent
AavmRpcHttpGet
AavmRpcGetMailCertificate
AavmRpcProcessActivationCode
AavmRpcNetAlert
AavmRpcBtsSchedule
AavmRpcSetProxySettings
AavmRpcGetRootKey
AavmRpcAlphaInsertLicenseFile
AavmRpcSwitchToFree
AavmRpcImexUnpackPackage
AavmRpcImexImportSettings
AavmRpcImexExportSettings
AavmRpcUnregisterRestartableProcess
AavmRpcRegisterRestartableProcess
AavmRpcChangeExcludedHash
AavmRpcAddCounter
AavmRpcCopyTaskDefinition
AavmRpcForceDeleteTask
AavmRpcDeleteTask
AavmRpcIdpGetDefaultProtectedPaths
AavmRpcCreateTaskAccordingParam
AavmRpcCreateTask
AavmRpcIsProductExpired
AavmRpcSetConnectorSessionId
AavmRpcSetProviderPropertyInt
AavmRpcSetProviderProperty
AavmRpcSetPropertyInt
AavmRpcStringDecrypt
AavmRpcSetProperty
AavmRpcSetTaskPropertyInt
AavmRpcSetTaskProperty
AavmRpcIsPasswordEmpty
AavmRpcPasswordCheck
AavmRpcDestroyBinding
AavmRpcGetProviderInfoList
AavmRpcCreateBinding
AavmRpcTimeCheckFix
AavmRpcSubmitFile
AavmRpcAutoSnxToasterResult
AavmRpcRemDeserializeToJson
AavmRpcDeleteSessionType

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

crypt32

CertFreeCertificateChain
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFindCertificateInStore
CryptMemFree
CryptVerifyTimeStampSignature
CryptUnprotectData
CryptStringToBinaryA
CryptBinaryToStringA
CryptProtectData
CertGetCertificateChain
CertCloseStore
CertDeleteCertificateFromStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertCreateCertificateContext
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateChainEngine

dnsapi

DnsQuery_W
DnsFree

advapi32

EventUnregister
RegQueryValueExA
RegEnumKeyExA
CryptAcquireContextA
CryptGenRandom
RegQueryMultipleValuesW
RegDeleteTreeW
RegDeleteKeyExW
RegEnumKeyW
TreeSetNamedSecurityInfoW
SetNamedSecurityInfoW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation
IsValidSid
ConvertSidToStringSidW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyW
GetUserNameW
GetSecurityInfo
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
FreeSid
RegDeleteValueW
SetEntriesInAclW
SetSecurityInfo
RegEnumValueW
OpenThreadToken
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegEnumKeyExW
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
EnumServicesStatusW
QueryServiceStatus
GetSidSubAuthority
GetSidSubAuthorityCount
ConvertStringSidToSidW
CreateProcessAsUserW
DuplicateTokenEx
CheckTokenMembership
DuplicateToken
RegGetValueW
EventRegister
EventWriteTransfer
RegDeleteKeyW
StartServiceW
QueryServiceStatusEx
RegNotifyChangeKeyValue
RegOpenCurrentUser
RegOpenKeyExA
LookupAccountNameW
GetAce
GetSecurityDescriptorOwner
AccessCheck
GetSecurityDescriptorDacl
GetFileSecurityW
CryptReleaseContext
CryptDestroyHash
SystemFunction036
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
ImpersonateLoggedOnUser
AdjustTokenPrivileges
LookupPrivilegeValueW
ImpersonateSelf
EqualSid
SetThreadToken
RevertToSelf
SetFileSecurityW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
LookupAccountSidW

wininet

InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetCloseHandle
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetOpenW
InternetSetOptionW

rpcrt4

RpcServerUseProtseqEpW
RpcServerRegisterIf2
RpcServerUnregisterIf
RpcMgmtStopServerListening
I_RpcBindingInqLocalClientPID
NdrServerCallAll
NdrServerCall2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
RpcSsDestroyClientContext
NdrClientCall3
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcStringFreeA
RpcBindingSetAuthInfoExA
RpcAsyncInitializeHandle
RpcAsyncCancelCall
RpcAsyncCompleteCall
Ndr64AsyncClientCall
UuidFromStringW
RpcStringBindingParseW
UuidCreate
UuidToStringW
RpcServerListen

shell32

SHQueryUserNotificationState
ord165
SHAppBarMessage
SHChangeNotify
SHGetFolderPathW
SHGetFileInfoW
Shell_NotifyIconW
ord51
SHGetSpecialFolderPathW
SHCreateItemFromParsingName
SHGetKnownFolderPath
SHGetSpecialFolderLocation
Shell_NotifyIconGetRect
SHGetDesktopFolder
ord155
SHOpenFolderAndSelectItems
ord190
ShellExecuteExW
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc

ntdll

NtDeleteKey
NtQueryKey
NtOpenKey
VerSetConditionMask
RtlAllocateHeap
RtlInitializeCriticalSection
RtlFreeHeap
RtlNtStatusToDosError
RtlDllShutdownInProgress
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlSetLastWin32Error
RtlInitUnicodeString
NtSystemDebugControl
RtlPrefixUnicodeString
RtlEqualUnicodeString
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtQueryDirectoryFile
RtlCompareMemory
NtClose
NtOpenFile
RtlIsDosDeviceName_U
RtlDosPathNameToNtPathName_U
NtSetInformationThread

shlwapi

PathIsNetworkPathW
ColorRGBToHLS
ColorHLSToRGB
PathRemoveFileSpecW
ord487
ord12
AssocQueryStringW
PathFindFileNameW
PathAppendW
PathMatchSpecW
SHStrDupW
PathFileExistsW
SHDeleteKeyW
PathIsDirectoryW

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

ws2_32

WSACleanup
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
getsockopt
WSAStartup
WSAWaitForMultipleEvents
ntohl
setsockopt
WSAIoctl
WSAEnumNetworkEvents
send
WSASetLastError
GetAddrInfoW
WSAAddressToStringW
FreeAddrInfoW
ntohs
getsockname
recvfrom
getpeername
recv
ioctlsocket
gethostname
getservbyname
select
sendto
InetNtopW
socket
htons
bind
htonl
connect
shutdown
WSAGetLastError
closesocket
FreeAddrInfoExW
GetAddrInfoExW
__WSAFDIsSet

ashtask

tskPackerBits
ARDeconstructListFromString
ARConstructListFromString
tskCreateFriendFileName
?aswCloseQuery@@YAKPEAX@Z
?aswGetNextTask2@@YAKPEAXPEA_WK@Z
?aswGetFirstTask@@YAKPEAPEAXPEA_WK1K@Z
?aswGetTaskPropertyInt@@YAKPEB_W0PEAH@Z
?aswGetTaskProperty@@YAKPEB_W0PEA_W_K@Z
tskChangeExcludedHash
tskFriendlyShieldName
tskIsFileHashExcluded

aswengldr

avldrCreateHandle
avldrLoadModule
avlicGetLockData
avldrCloseModule
uiextPollEvent
uiextEventDone
uiextProcessCmd
uiextFilterUrl2
avldrUpdatedDefsAvailable

aswaux

??1IaswObjectList@@QEAA@XZ
?EnumElements@IaswObject@@QEAA_NAEAPEAXPEA_W_KAEAW4aswElementType@1@@Z
?FreeValue@IaswObject@@QEBAXPEA_W@Z
?GetValue@IaswObject@@QEBA_NPEB_WPEAPEA_W0@Z
??1IaswObject@@QEAA@XZ
?DeleteValue@IaswObject@@QEAAXPEB_W@Z
?GetValue@IaswObject@@QEBA_NPEB_WPEA_W_K0@Z
?EnumObjects@IaswObjectList@@QEAAPEAVIaswObject@@AEAPEAX@Z
??0IaswObjectList@@QEAA@PEB_W0@Z

comctl32

ImageList_Draw
ImageList_GetIconSize
ord17

mpr

WNetGetConnectionW

winmm

timeKillEvent
timeSetEvent

ashbase

notFree
notInit
notEventId
notEvent
basFreeLibrary
notAddEventId
notRemEvent
basGetErrorString
basInitLibrary
basEmptyAvastTempFolder
basSubmitPropertyArrayToString

netapi32

NetGetDCName
NetUserGetInfo
NetLocalGroupEnum
NetApiBufferFree
NetUserEnum

iphlpapi

IcmpSendEcho2Ex
GetAdaptersAddresses
Icmp6SendEcho2
Icmp6CreateFile
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
GetNetworkParams
GetBestRoute2
FreeMibTable
GetIfEntry2
GetIfTable2Ex
GetUnicastIpAddressTable

aswip

?free@lib@ip@@QEAAKXZ
?free@dnsapi@ip@@QEAAKXZ
?init@dnsapi@ip@@QEAAKXZ
?names_from_address@dnsapi@ip@@SAKAEBVaddr@2@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@K@Z
?getaddrinfo@winsock2@ip@@SAKPEB_WAEAV?$vector@Vaddr@ip@@V?$allocator@Vaddr@ip@@@std@@@std@@0PEAUaddrinfoW@@@Z
?free@hlpapi@ip@@QEAAKXZ
?load@hlpapi@ip@@QEAAKXZ
?ping@hlpapi@ip@@SAKVsaddr@2@AEAU_SPingReply@12@EKGEH@Z

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptDestroySecret
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptImportKeyPair
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptExportKey
BCryptSecretAgreement
BCryptDeriveKey
BCryptGenerateSymmetricKey
BCryptEncrypt

dwmapi

DwmSetWindowAttribute
DwmExtendFrameIntoClientArea

winhttp

WinHttpConnect
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetCredentials
WinHttpQueryHeaders
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryOption
WinHttpSetStatusCallback
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpWriteData

libcrypto-3-x64

d2i_X509_CRL_bio
ASN1_STRING_length
X509_get_ext_d2i
X509_STORE_CTX_new
BN_bn2dec
PEM_write_bio_X509
d2i_X509
BIO_ctrl
X509_free
BIO_s_mem
PEM_write_bio_PUBKEY
BIO_free_all
SHA512_Final
SHA256_Final
SHA1_Final
SHA512_Update
SHA256_Update
SHA1_Update
SHA512_Init
SHA256_Init
SHA1_Init
BIO_new_mem_buf
X509_CRL_get_REVOKED
BIO_new
X509_STORE_CTX_verify
OPENSSL_sk_pop_free
ASN1_STRING_get0_data
DIST_POINT_free
BIO_write
EVP_PKEY_free
OPENSSL_sk_value
OPENSSL_sk_push
EVP_MD_CTX_free
CRYPTO_free
PEM_read_bio_PrivateKey
X509_STORE_CTX_set_time
X509_CRL_free
PEM_read_bio_X509
X509_NAME_ENTRY_get_data
GENERAL_NAME_get0_value
BN_is_zero
EVP_DigestUpdate
X509_STORE_CTX_get_error
X509_STORE_CTX_init
X509_STORE_CTX_free
EVP_sha256
X509_REVOKED_get0_serialNumber
PEM_read_bio_PUBKEY
OPENSSL_sk_num
X509_STORE_add_cert
EVP_VerifyFinal
EVP_MD_CTX_new
X509_STORE_free
X509_STORE_new
ASN1_INTEGER_cmp
OPENSSL_sk_new_null
X509_get_pubkey
ASN1_INTEGER_to_BN
RAND_seed
RAND_bytes
PKCS5_PBKDF2_HMAC_SHA1
EC_KEY_free
d2i_EC_PUBKEY_bio
EC_KEY_set_public_key
EC_KEY_get0_public_key
BIO_free
d2i_PKCS8_PRIV_KEY_INFO_bio
EVP_PKCS82PKEY
EVP_PKEY_get1_EC_KEY
EC_KEY_set_private_key
EC_KEY_get0_private_key
PKCS8_PRIV_KEY_INFO_free
d2i_ECPrivateKey_bio
i2d_EC_PUBKEY_bio
EVP_PKEY_new
EVP_PKEY_set1_EC_KEY
i2d_PKCS8PrivateKeyInfo_bio
i2d_ECPrivateKey_bio
BIO_read
EC_GROUP_new_by_curve_name
EC_GROUP_set_asn1_flag
EC_GROUP_set_point_conversion_form
EC_KEY_new
EC_KEY_set_group
EC_KEY_generate_key
EC_GROUP_free
ECDSA_size
ECDSA_sign
ECDSA_verify
HMAC_CTX_free
HMAC_CTX_new
HMAC_Init_ex
X509_get_serialNumber
BN_free
EVP_DigestInit
EVP_sha1
EVP_sha512
HMAC_Update
HMAC_Final
EC_GROUP_get_degree
EC_KEY_get0_group
ECDH_compute_key
AES_set_encrypt_key
AES_set_decrypt_key
AES_cbc_encrypt

aswcmnis

GetKeyData
sha256Init
sha256Update
sha256Final
DSAVerifySignature
ECDSAVerifySignature
cyphSimpleCode

aswcmnos

dep_fsExtractDriveRoot
dep_strFreeString
dep_strNormalToNewUnicode
dep_fsGetFileSizeHandle
dep_fsExistFileX
dep_fsReadFile
dep_fsCloseFile
dep_osGetWinVer
dep_secGetPublicSecurity
dep_csWait
dep_fsExistFile
dep_fsOpenFileX
dep_fsWriteFile
dep_fsDeleteFileX
dep_secSetPrivilege
cmnosMiniInit
dep_csCreate
dep_csRelease
dep_csDelete
dep_strNormalToUnicode

aswcmnbs

secGetProcessTrustLevel
fsGetAvastProgramPath
fsGetAvastDataPath
secIsAswSP
GetHardwareIdEx
?DeleteFileW@CGenericFile@root@asw@@QEAAK_N0@Z
?writein@CGenericFile@root@asw@@QEAA_NPEBX_K@Z
?InitTempFile@CGenericFile@root@asw@@QEAAKKPEB_WPEAKK@Z
?_Close@CGenericFile@root@asw@@AEAAKXZ
?_InitFile@CGenericFile@root@asw@@AEAAXXZ
strMatchesWildcards
secSetObjectProtection
GetFileSignatureDetails
secIsProcessTrusted
secCreateSharedMutex
sha256GenerateFromName
DSA_BlockVerify
cmnbFree
cmnbInit
aswcmnbsDllMain
secCreateSharedEvent
secIsSelfDefenseEnabled
secOpenSharedEvent
secIsNamedPipeClientTrusted
GetProgramModulePath
fsGetAvastTempFileName
?GetTempFile@CStr@root@asw@@QEAAKPEAK@Z
fsGetAvastLogPath
DSA_FileVerify
fsGetAvastSumpPath
fsSetAvastJournalPath
secPreventHookDllInjection
secIsUiProtectionEnabled
secIsRpcClientTrusted
GetHardwareId

protobuf

?DiscardUnknownFields@Message@protobuf@google@@UEAAXXZ
?SpaceUsedLong@Message@protobuf@google@@UEBA_KXZ
?SerializeAsString@MessageLite@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?SerializeToString@MessageLite@protobuf@google@@QEBA_NPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?end@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ
?begin@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ
?default_value_enum@FieldDescriptor@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@XZ
?HasField@Reflection@protobuf@google@@QEBA_NAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetMessage@Reflection@protobuf@google@@QEBAAEBVMessage@23@AEBV423@PEBVFieldDescriptor@23@PEAVMessageFactory@23@@Z
?GetDouble@Reflection@protobuf@google@@QEBANAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetFloat@Reflection@protobuf@google@@QEBAMAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetUInt64@Reflection@protobuf@google@@QEBA_KAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetUInt32@Reflection@protobuf@google@@QEBAIAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetEnum@Reflection@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@AEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetRepeatedDouble@Reflection@protobuf@google@@QEBANAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedFloat@Reflection@protobuf@google@@QEBAMAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedUInt64@Reflection@protobuf@google@@QEBA_KAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedMessage@Reflection@protobuf@google@@QEBAAEBVMessage@23@AEBV423@PEBVFieldDescriptor@23@H@Z
?GetRepeatedUInt32@Reflection@protobuf@google@@QEBAIAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedEnum@Reflection@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@AEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?SetDouble@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@N@Z
?SetFloat@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@M@Z
?SetUInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_K@Z
?CopyFrom@Message@protobuf@google@@UEAAXAEBV123@@Z
?InternalSerializeWithCachedSizesToArray@MessageLite@protobuf@google@@UEBAPEAEPEAE@Z
?SerializeWithCachedSizesToArray@MessageLite@protobuf@google@@UEBAPEAEPEAE@Z
?SerializeWithCachedSizes@Message@protobuf@google@@UEBAXPEAVCodedOutputStream@io@23@@Z
?ByteSizeLong@Message@protobuf@google@@UEBA_KXZ
?MergePartialFromCodedStream@Message@protobuf@google@@UEAA_NPEAVCodedInputStream@io@23@@Z
?CheckTypeAndMergeFrom@Message@protobuf@google@@UEAAXAEBVMessageLite@23@@Z
?SetUInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@I@Z
?FindValueByName@EnumDescriptor@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?enum_type@FieldDescriptor@protobuf@google@@QEBAPEBVEnumDescriptor@23@XZ
?FindValueByNumber@EnumDescriptor@protobuf@google@@QEBAPEBVEnumValueDescriptor@23@H@Z
?SetEnum@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@PEBVEnumValueDescriptor@23@@Z
?AddDouble@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@N@Z
?AddFloat@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@M@Z
?AddUInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_K@Z
?AddMessage@Reflection@protobuf@google@@QEBAPEAVMessage@23@PEAV423@PEBVFieldDescriptor@23@PEAVMessageFactory@23@@Z
?AddUInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@I@Z
?AddEnum@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@PEBVEnumValueDescriptor@23@@Z
?Clear@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXXZ
?Mutable@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?CloseGap@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXHH@Z
?Get@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?ClearFallback@UnknownFieldSet@protobuf@google@@AEAAXXZ
?MergeFrom@UnknownFieldSet@protobuf@google@@QEAAXAEBV123@@Z
?default_instance@UnknownFieldSet@protobuf@google@@SAPEBV123@XZ
?SerializeWithCachedSizes@MessageLite@protobuf@google@@UEBAXPEAVCodedOutputStream@io@23@@Z
?InitializationErrorString@MessageLite@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?New@MessageLite@protobuf@google@@UEBAPEAV123@PEAVArena@23@@Z
?VerifyVersion@internal@protobuf@google@@YAXHHPEBD@Z
?DestroyMessage@internal@protobuf@google@@YAXPEBX@Z
?OnShutdownRun@internal@protobuf@google@@YAXP6AXPEBX@Z0@Z
?InitSCCImpl@internal@protobuf@google@@YAXPEAUSCCInfoBase@123@@Z
?ReadTagFallback@CodedInputStream@io@protobuf@google@@AEAAII@Z
?ReadBytes@WireFormatLite@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SkipField@WireFormat@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@IPEAVUnknownFieldSet@34@@Z
?InitializationErrorString@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?SerializeUnknownFields@WireFormat@internal@protobuf@google@@SAXAEBVUnknownFieldSet@34@PEAVCodedOutputStream@io@34@@Z
?WriteStringWithSizeToArray@CodedOutputStream@io@protobuf@google@@SAPEAEAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z
?SerializeUnknownFieldsToArray@WireFormat@internal@protobuf@google@@SAPEAEAEBVUnknownFieldSet@34@PEAE@Z
?ComputeUnknownFieldsSize@WireFormat@internal@protobuf@google@@SA_KAEBVUnknownFieldSet@34@@Z
?Merge@ReflectionOps@internal@protobuf@google@@SAXAEBVMessage@34@PEAV534@@Z
?ReadVarint64Fallback@CodedInputStream@io@protobuf@google@@AEAA?AU?$pair@_K_N@std@@XZ
?WriteInt64@WireFormatLite@internal@protobuf@google@@SAXH_JPEAVCodedOutputStream@io@34@@Z
?WriteMessageMaybeToArray@WireFormatLite@internal@protobuf@google@@SAXHAEBVMessageLite@34@PEAVCodedOutputStream@io@34@@Z
?ReadVarintSizeAsIntFallback@CodedInputStream@io@protobuf@google@@AEAAHXZ
?IncrementRecursionDepthAndPushLimit@CodedInputStream@io@protobuf@google@@QEAA?AU?$pair@HH@std@@H@Z
?DecrementRecursionDepthAndPopLimit@CodedInputStream@io@protobuf@google@@QEAA_NH@Z
?InternalExtend@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAPEAXH@Z
?OnArenaAllocation@Arena@protobuf@google@@AEBAXPEBVtype_info@@_K@Z
?AllocateAlignedAndAddCleanup@ArenaImpl@internal@protobuf@google@@QEAAPEAX_KP6AXPEAX@Z@Z
?size@?$RepeatedField@H@protobuf@google@@QEBAHXZ
?Clear@?$RepeatedField@H@protobuf@google@@QEAAXXZ
?Get@?$RepeatedField@H@protobuf@google@@QEBAAEBHH@Z
?Add@?$RepeatedField@H@protobuf@google@@QEAAXAEBH@Z
??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@XZ
??1?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@XZ
??0?$RepeatedField@H@protobuf@google@@QEAA@XZ
?IsInitialized@Message@protobuf@google@@UEBA_NXZ
?Clear@Message@protobuf@google@@UEAAXXZ
??1?$RepeatedField@H@protobuf@google@@QEAA@XZ
??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@AEBV012@@Z
?WriteString@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?WriteVarint32SlowPath@CodedOutputStream@io@protobuf@google@@AEAAXI@Z
?WriteVarint64SlowPath@CodedOutputStream@io@protobuf@google@@AEAAX_K@Z
?data@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ
?Int32Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@H@34@@Z
?MergeFrom@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXAEBV123@@Z
?MergeFrom@?$RepeatedField@H@protobuf@google@@QEAAXAEBV123@@Z
?WriteBool@WireFormatLite@internal@protobuf@google@@SAXH_NPEAVCodedOutputStream@io@34@@Z
?PushLimit@CodedInputStream@io@protobuf@google@@QEAAHH@Z
?BytesUntilLimit@CodedInputStream@io@protobuf@google@@QEBAHXZ
?ReadVarint32Fallback@CodedInputStream@io@protobuf@google@@AEAA_JI@Z
?PopLimit@CodedInputStream@io@protobuf@google@@QEAAXH@Z
?Capacity@?$RepeatedField@H@protobuf@google@@QEBAHXZ
?AddAlreadyReserved@?$RepeatedField@H@protobuf@google@@QEAAXAEBH@Z
?InitProtobufDefaults@internal@protobuf@google@@YAXXZ
??0StringOutputStream@io@protobuf@google@@QEAA@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0CodedOutputStream@io@protobuf@google@@QEAA@PEAVZeroCopyOutputStream@123@_N@Z
??1CodedOutputStream@io@protobuf@google@@QEAA@XZ
?SkipField@WireFormatLite@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@IPEAVCodedOutputStream@634@@Z
?WriteAliasedRaw@ZeroCopyOutputStream@io@protobuf@google@@UEAA_NPEBXH@Z
?WriteRaw@CodedOutputStream@io@protobuf@google@@QEAAXPEBXH@Z
?WriteUInt32@WireFormatLite@internal@protobuf@google@@SAXHIPEAVCodedOutputStream@io@34@@Z
?WriteEnum@WireFormatLite@internal@protobuf@google@@SAXHHPEAVCodedOutputStream@io@34@@Z
?WriteMessage@WireFormatLite@internal@protobuf@google@@SAXHAEBVMessageLite@34@PEAVCodedOutputStream@io@34@@Z
?WriteUInt64@WireFormatLite@internal@protobuf@google@@SAXH_KPEAVCodedOutputStream@io@34@@Z
?WriteInt32@WireFormatLite@internal@protobuf@google@@SAXHHPEAVCodedOutputStream@io@34@@Z
?WriteBytesMaybeAliased@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?AddVarint@UnknownFieldSet@protobuf@google@@QEAAXH_K@Z
??0?$RepeatedField@_J@protobuf@google@@QEAA@XZ
??1?$RepeatedField@_J@protobuf@google@@QEAA@XZ
?WriteBytes@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?ReadPackedEnumPreserveUnknowns@WireFormat@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@IP6A_NH@ZPEAVUnknownFieldSet@34@PEAV?$RepeatedField@H@34@@Z
?ReadPackedEnumPreserveUnknowns@WireFormatLite@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@HP6A_NH@ZPEAVCodedOutputStream@634@PEAV?$RepeatedField@H@34@@Z
?WriteSInt64@WireFormatLite@internal@protobuf@google@@SAXH_JPEAVCodedOutputStream@io@34@@Z
?DestroyString@internal@protobuf@google@@YAXPEBX@Z
?ShutdownProtobufLibrary@protobuf@google@@YAXXZ
?GetTypeName@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ParseFromArray@MessageLite@protobuf@google@@QEAA_NPEBXH@Z
?end@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ
?begin@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ
?size@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAHXZ
?ParseFromString@MessageLite@protobuf@google@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?JsonStringToMessage@util@protobuf@google@@YA?AVStatus@123@VStringPiece@23@PEAVMessage@23@AEBUJsonParseOptions@123@@Z
??1CodedInputStream@io@protobuf@google@@QEAA@XZ
?ListFields@Reflection@protobuf@google@@QEBAXAEBVMessage@23@PEAV?$vector@PEBVFieldDescriptor@protobuf@google@@V?$allocator@PEBVFieldDescriptor@protobuf@google@@@std@@@std@@@Z
?FieldSize@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetRepeatedInt32@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedInt64@Reflection@protobuf@google@@QEBA_JAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedBool@Reflection@protobuf@google@@QEBA_NAEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetRepeatedString@Reflection@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@23@PEBVFieldDescriptor@23@H@Z
?GetInt32@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetInt64@Reflection@protobuf@google@@QEBA_JAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetBool@Reflection@protobuf@google@@QEBA_NAEBVMessage@23@PEBVFieldDescriptor@23@@Z
?GetString@Reflection@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@23@PEBVFieldDescriptor@23@@Z
?AssignDescriptors@internal@protobuf@google@@YAXPEBUDescriptorTable@123@@Z
?message_type@FieldDescriptor@protobuf@google@@QEBAPEBVDescriptor@23@XZ
?FindFieldByNumber@Descriptor@protobuf@google@@QEBAPEBVFieldDescriptor@23@H@Z
?MutableMessage@Reflection@protobuf@google@@QEBAPEAVMessage@23@PEAV423@PEBVFieldDescriptor@23@PEAVMessageFactory@23@@Z
?AddString@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?MergeFrom@Message@protobuf@google@@UEAAXAEBV123@@Z
?AddInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@H@Z
?AddInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_J@Z
?AddBool@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_N@Z
?TypeOnceInit@FieldDescriptor@protobuf@google@@CAXPEBV123@@Z
?SetInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@H@Z
?SetInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_J@Z
?SetBool@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_N@Z
?SetString@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Reserve@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXH@Z
?WriteStringMaybeAliased@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?SerializeToArray@MessageLite@protobuf@google@@QEBA_NPEAXH@Z

wtsapi32

WTSQueryUserToken
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z
?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

msvcp140

?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Wcsxfrm
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$numpunct@_W@std@@2V0locale@2@A
_Query_perf_counter
_Query_perf_frequency
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Random_device@std@@YAIXZ
_Thrd_sleep
_Xtime_get_ticks
?_Xinvalid_argument@std@@YAXPEBD@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?eof@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEA_W@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Syserror_map@std@@YAPEBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Winerror_map@std@@YAHH@Z
_Lock_shared_ptr_spin_lock
_Unlock_shared_ptr_spin_lock
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_signal
_Cnd_wait
_Thrd_id
_Cnd_timedwait
_Mtx_current_owns
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
_Cnd_broadcast
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??Bios_base@std@@QEBA_NXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?toupper@?$ctype@D@std@@QEBADD@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAK@Z
?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
_Cnd_unregister_at_thread_exit
_Mtx_trylock
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?toupper@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
_Thrd_join
_Cnd_do_broadcast_at_thread_exit
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?empty@locale@std@@SA?AV12@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_J@Z
?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAPEAV12@PEAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z
?_Xruntime_error@std@@YAXPEBD@Z
?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ
??1ctype_base@std@@UEAA@XZ
??0ctype_base@std@@QEAA@_K@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@HPEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?clear@ios_base@std@@QEAAXH_N@Z
_Toupper
_Tolower
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAN@Z
_Thrd_detach
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
_Mbrtowc
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?classic@locale@std@@SAAEBV12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
_Mtx_unlock
_Mtx_init_in_situ

msvcp140_atomic_wait

__std_atomic_wait_direct
__std_atomic_notify_all_direct

mfc140u

ord6002
ord2273
ord2178
ord1492
ord324
ord1040
ord2327
ord323
ord2698
ord2372
ord4726
ord12610
ord1033
ord296
ord1501
ord1503
ord2212
ord8161
ord8162
ord2903
ord286
ord2344
ord1670
ord2222
ord11921
ord2223
ord4947
ord2302
ord10124
ord2187
ord2301
ord8043
ord9941
ord5555
ord11902
ord12606
ord11901
ord7920
ord11929
ord5706
ord3731
ord6122
ord14289
ord6123
ord14290
ord6121
ord14288
ord11806
ord3812
ord7719
ord12212
ord14088
ord11665
ord11664
ord2011
ord7668
ord5916
ord12625
ord3949
ord4011
ord8900
ord9089
ord14216
ord7650
ord14210
ord12223
ord6619
ord12222
ord12600
ord2439
ord5183
ord8023
ord12544
ord8084
ord12563
ord8167
ord2270
ord4913
ord14038
ord5607
ord5636
ord7394
ord990
ord1454
ord11771
ord14209
ord4721
ord6285
ord8901
ord6313
ord3756
ord6320
ord13199
ord280
ord1668
ord13761
ord1667
ord4656
ord12240
ord3713
ord962
ord13864
ord1428
ord6006
ord6090
ord489
ord1121
ord3952
ord1631
ord287
ord1502
ord7744
ord12443
ord12933
ord2350
ord2346
ord4946
ord2415
ord4655
ord2921
ord448
ord2487
ord3841
ord4181
ord2369
ord2371
ord13767
ord2414
ord8471
ord14221
ord7541
ord4511
ord8409
ord8451
ord8452
ord14218
ord8441
ord4086
ord6361
ord3803
ord2479
ord12265
ord4669
ord277
ord13986
ord1089
ord6250
ord1091
ord3599
ord3697
ord14128
ord5240
ord878
ord1369
ord10727
ord10704
ord8926
ord11855
ord8731
ord6850
ord450
ord285
ord5709
ord7235
ord10163
ord2909
ord10085
ord8058
ord4343
ord8507
ord11813
ord7168
ord11085
ord1442
ord528
ord1149
ord7387
ord3951
ord4724
ord3308
ord3090
ord3307
ord2514
ord4357
ord13301
ord7637
ord9156
ord3830
ord1504
ord1505
ord8050
ord12932
ord12324
ord3071
ord6000
ord13397
ord13597
ord7745
ord4510
ord14027
ord2987
ord6848
ord446
ord3212
ord3209
ord7233
ord11854
ord8416
ord1665
ord3203
ord8468
ord6724
ord7913
ord2686
ord2697
ord2316
ord14219
ord14360
ord293
ord1671
ord9976
ord9978
ord2195
ord14278
ord12087
ord2340
ord12030
ord9977
ord9975
ord14225
ord9979
ord5451
ord6505
ord11414
ord11415
ord8830
ord3718
ord11625
ord8656
ord6729
ord10691
ord8947
ord3173
ord13513
ord11944
ord11940
ord1700
ord1722
ord1748
ord1734
ord1755
ord4776
ord4843
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4814
ord4752
ord4767
ord4828
ord4360
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord6631
ord11406
ord13354
ord5723
ord2629
ord3279
ord3278
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339
ord5582
ord5083
ord5229
ord5062
ord7460
ord7461
ord7450
ord5227
ord7922
ord13401
ord14025
ord438
ord1086
ord2473
ord6247
ord2475
ord6549
ord12762
ord12746
ord8501
ord8063
ord7177
ord7393
ord983
ord1450
ord4445
ord11933
ord357
ord886
ord12967
ord9946
ord7813
ord4499
ord13617
ord3742
ord12761
ord13555
ord4030
ord7182
ord7837
ord1039

kernel32

GetExitCodeProcess
GetShortPathNameW
GlobalMemoryStatusEx
GetLocaleInfoEx
GetFileSizeEx
ReadFile
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ProcessIdToSessionId
CreateThread
GetUserDefaultLangID
GetUserDefaultLCID
IsBadReadPtr
VerifyVersionInfoW
LocalAlloc
GetLocalTime
GetFileSize
GetSystemDefaultUILanguage
WriteFile
SetEndOfFile
GlobalAddAtomW
GlobalDeleteAtom
GetSystemInfo
CreateIoCompletionPort
SetProcessWorkingSetSize
LoadLibraryW
WaitForSingleObject
CreateEventW
ResetEvent
CreateNamedPipeW
ConnectNamedPipe
WaitForMultipleObjects
CancelIo
GetExitCodeThread
GetQueuedCompletionStatus
WaitForSingleObjectEx
DisconnectNamedPipe
FlushFileBuffers
ReadProcessMemory
OpenProcess
GetPrivateProfileStringW
GetUserDefaultUILanguage
LocalFree
GetTempFileNameW
GetTempPathW
GetFileAttributesW
ExpandEnvironmentStringsW
OpenEventW
SetFilePointer
K32EnumProcesses
CopyFileW
GetStringTypeExW
TlsGetValue
TlsSetValue
UnregisterWaitEx
GetTickCount64
CompareFileTime
GetFileAttributesExW
GetUserDefaultLocaleName
FreeLibrary
GetCommandLineW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentDirectoryW
SystemTimeToFileTime
GetFileType
DuplicateHandle
GetFileInformationByHandle
OpenEventA
CreateWaitableTimerA
SleepEx
SetErrorMode
GetEnvironmentVariableW
RegisterWaitForSingleObject
SetEnvironmentVariableW
QueryPerformanceFrequency
QueryPerformanceCounter
OutputDebugStringW
WaitNamedPipeW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
GetTimeFormatW
GetDateFormatW
K32EnumProcessModules
HeapFree
GetProcessHeap
GetCurrentThread
HeapAlloc
GetModuleFileNameA
InitializeCriticalSectionEx
HeapSize
FormatMessageW
TerminateProcess
TlsAlloc
HeapReAlloc
WritePrivateProfileStringW
HeapDestroy
TlsFree
FormatMessageA
DebugBreak
GetProcessTimes
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetProcessIdOfThread
ResumeThread
ReleaseMutex
RemoveDirectoryW
SetFileAttributesW
FindFirstFileExW
SetThreadPriority
GetComputerNameW
VirtualFree
VirtualAlloc
GetLogicalDriveStringsW
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
LCMapStringW
GetThreadLocale
LocalUnlock
GetTickCount
GetVersionExA
GetFullPathNameA
FileTimeToLocalFileTime
MulDiv
TryEnterCriticalSection
GetTimeZoneInformation
GetSystemDefaultLCID
GetVolumePathNameW
CreatePipe
GetVersionExW
LocalFileTimeToFileTime
SetFilePointerEx
ReleaseSemaphore
CreateSemaphoreW
SetThreadLocale
UnmapViewOfFile
UnlockFile
CreateFileA
CreateFileMappingW
MapViewOfFile
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
InitOnceExecuteOnce
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsDebuggerPresent
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
OutputDebugStringA
GetFullPathNameW
CreateMutexW
FindFirstVolumeW
FindVolumeClose
FindNextVolumeW
GetSystemTime
WaitForMultipleObjectsEx
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CheckRemoteDebuggerPresent
VirtualProtect
FlushInstructionCache
RaiseException
GetProcessId
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery
GetSystemTimes
QueryFullProcessImageNameW
GetPriorityClass
OpenThread
GetThreadPriority
GetThreadTimes
K32GetProcessMemoryInfo
GetProcessHandleCount
CompareStringW
QueryThreadCycleTime
DeleteProcThreadAttributeList
GetThreadId
SetHandleInformation
GetComputerNameExW
LoadLibraryExA
MoveFileExW
K32GetMappedFileNameW
ExitProcess
GetSystemDirectoryA
GetModuleHandleA
MoveFileExA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GetWindowsDirectoryA
AreFileApisANSI
GetFileInformationByHandleEx
InitOnceBeginInitialize
InitOnceComplete
ReleaseSRWLockShared
AcquireSRWLockShared
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlCaptureContext
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetLongPathNameW
GetUserGeoID
GetGeoInfoW
GetNativeSystemInfo
UnlockFileEx
LockFileEx
CreateEventA
MultiByteToWideChar
GetLastError
LoadLibraryA
GetProcAddress
GetModuleHandleW
LoadLibraryExW
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetModuleFileNameW
CreateDirectoryW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
QueryDosDeviceW
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
CloseHandle
GetWindowsDirectoryW
GetSystemDirectoryW
SetLastError
CreateWaitableTimerW
SetWaitableTimer
SetEvent
GetLocaleInfoW
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
InitializeCriticalSectionAndSpinCount
WTSGetActiveConsoleSessionId
SetDllDirectoryW
GetCurrentProcess
GetCurrentProcessId
SetProcessShutdownParameters
DeleteFileW
TerminateThread
GetSystemTimeAsFileTime

user32

FillRect
GetWindowTextW
GetWindowTextLengthW
ShowWindow
MoveWindow
SetFocus
SendDlgItemMessageW
GetDlgItem
DestroyWindow
CreateDialogParamW
GetSysColor
SetForegroundWindow
GetForegroundWindow
GetWindowLongW
GetParent
InvalidateRect
GetKeyboardLayoutNameW
GetDC
InsertMenuW
CheckMenuItem
GetMenuItemID
GetSubMenu
EnableMenuItem
DeleteMenu
ModifyMenuW
IsWindowVisible
FindWindowExW
GetThreadDesktop
GetUserObjectInformationW
GetProcessWindowStation
InflateRect
LoadIconW
PostMessageW
FindWindowW
TranslateMessage
TrackPopupMenu
SendInput
IsWindow
InSendMessage
DestroyIcon
CopyRect
DrawTextW
LoadCursorW
SetCursor
GetDlgCtrlID
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
DrawIcon
SetWindowLongPtrW
DefWindowProcW
GetWindowLongPtrW
GetSystemMetrics
EnableWindow
SetWindowRgn
GetWindowRect
SystemParametersInfoW
NotifyWinEvent
SendMessageW
GetClientRect
wsprintfW
KillTimer
SetTimer
LoadStringW
WaitForInputIdle
IsHungAppWindow
GetFocus
LoadImageW
GetAsyncKeyState
GetKeyState
GetPropW
SetPropW
GetCursorPos
BeginPaint
EndPaint
TrackMouseEvent
LoadBitmapW
RegisterClassExW
CreateWindowExW
EnumWindows
RegisterWindowMessageW
GetWindowThreadProcessId
SetWindowTextW
GetMonitorInfoW
UnregisterClassW
OpenDesktopW
CloseDesktop
CreateDesktopW
SendMessageTimeoutW
SendMessageCallbackW
GetGUIThreadInfo
SetRect
UnionRect
EqualRect
GetWindowRgn
RegisterClassW
GetClassInfoExW
OpenClipboard
SetClipboardData
CloseClipboard
OpenInputDesktop
SwitchDesktop
AllowSetForegroundWindow
ExitWindowsEx
SetThreadDesktop
ActivateKeyboardLayout
CharLowerW
GetDesktopWindow
MonitorFromPoint
GetLastInputInfo
SetWindowLongW
GetWindow
PostQuitMessage
EnumDesktopWindows
GetWindowDC
GetWindowPlacement
GetKeyboardLayoutList
SendNotifyMessageW
GetKeyboardLayout
SetWindowPos
MonitorFromWindow
OffsetRect
IntersectRect
LoadMenuW
SetParent
DestroyMenu
GetClassNameW
SetMenuDefaultItem
IsIconic
MapWindowPoints
GetCapture
ReleaseCapture
keybd_event
MapVirtualKeyW
ScreenToClient
IsWindowEnabled
MessageBoxW
UpdateWindow
RedrawWindow
CallWindowProcW
CopyImage
IsGUIThread
CloseWindow
GetAncestor
SetWindowDisplayAffinity
PostThreadMessageW
PtInRect
GetMessageW
MonitorFromRect
ReleaseDC

gdi32

RoundRect
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
SetTextColor
SetBkMode
CreateFontW
CreatePen
CreateSolidBrush
CreateFontIndirectW
SelectObject
GetDeviceCaps
AddFontResourceExW
BitBlt
GetTextAlign
GetTextExtentPointW
GetTextExtentPoint32W
CreateRoundRectRgn
AddFontResourceW
RemoveFontResourceW
CreateRectRgn
SetPixel
DeleteDC
GetObjectW
SetTextAlign
StretchBlt
ExtCreatePen
GetCurrentPositionEx
Polygon
GetClipBox
GetDIBits
GetRgnBox
GetBitmapBits
SetBitmapBits
CreateBitmap
CreatePatternBrush
DeleteObject
PatBlt

msimg32

GradientFill

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

PropVariantClear
CoTaskMemAlloc
OleRun
CoInitialize
CoInitializeEx
CoCreateInstance
CLSIDFromString
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoInitializeSecurity
CoUninitialize
StringFromCLSID

oleaut32

SafeArrayDestroy
SafeArrayUnlock
LoadTypeLi
SysStringLen
SysAllocString
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
SafeArrayCreate
SafeArrayLock

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

query

LoadIFilter

secur32

QueryContextAttributesW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
memchr
wcsstr
strchr
longjmp
__RTtypeid
__current_exception
__current_exception_context
_CxxThrowException
__intrinsic_setjmp
__std_type_info_name
__std_terminate
memset
memcpy
_set_se_translator
_purecall
__std_exception_copy
__RTDynamicCast
strstr
strrchr
wcsrchr
__std_type_info_compare
wcschr
__std_exception_destroy
__C_specific_handler
memmove

api-ms-win-crt-heap-l1-1-0

malloc
realloc
free
_callnewh
calloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

ceilf
sqrt
acos
asin
atan2
ceil
cos
sin
floor
log10
round
modf
_dclass
_finite
_isnan
fmod
_ldsign
_fdclass
pow
_fdsign
log2
_fdopen
log
_dsign
__setusermatherr
_ldclass

api-ms-win-crt-runtime-l1-1-0

_errno
_register_onexit_function
_crt_atexit
_register_thread_local_exe_atexit_callback
_initterm
_exit
_seh_filter_exe
_get_wide_winmain_command_line
_c_exit
_set_app_type
_initialize_wide_environment
_configure_wide_argv
exit
abort
_invalid_parameter_noinfo_noreturn
terminate
__p___argc
__p___wargv
_beginthreadex
strerror
_invalid_parameter_noinfo
_initterm_e
_cexit
_initialize_onexit_table
__sys_errlist
__sys_nerr

api-ms-win-crt-stdio-l1-1-0

_wfopen
fputs
feof
ferror
fgets
fopen_s
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
_wfopen_s
_fileno
fputc
fread
__stdio_common_vsprintf
_ftelli64
_get_osfhandle
__acrt_iob_func
__stdio_common_vfwprintf_s
fclose
ftell
fseek
_get_stream_buffer_pointers
fwrite
fputwc
ungetwc
_set_fmode
__p__commode
ungetc
fgetc
__stdio_common_vfwprintf
fgetwc
fgetpos
_close
_fseeki64
fsetpos
setvbuf
fflush
__stdio_common_vswprintf_s
__stdio_common_vswscanf
__stdio_common_vswprintf
_wfsopen
fopen
__stdio_common_vsprintf_s
__stdio_common_vsscanf
_open
__stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_strdup
_wcsnicmp
strncmp
strtok
_wcsupr
strcmp
isupper
strncat
wmemcpy_s
strpbrk
isspace
_wcsdup
wcscat_s
strspn
wcsncat
wcsncmp
toupper
wcsncpy
tolower
wcsnlen
isdigit
wcstok
_wcsicmp
iswpunct
iswspace
strcspn
towupper
wcspbrk
iswalpha
wcscpy_s
wcslen
strnlen
towlower
_strnicmp
_stricmp
iswdigit
strncpy
strcpy_s
isalnum
wcsncpy_s
isalpha
isxdigit

api-ms-win-crt-time-l1-1-0

_gmtime64
_mkgmtime64
_time64
_localtime64_s
wcsftime
_time32
_mktime64
_localtime64
strftime
_difftime64

api-ms-win-crt-convert-l1-1-0

wcstoll
_wtoi64
strtol
atoi
_i64tow
_itow
wcstoul
_wtol
wcstol
_ecvt_s
wcstod
strtoul
_wcstoui64
_ultow_s
strtoll
_wtof
wcstoull
strtof
strtod
_itow_s
atol
atof
strtoull
_strtoui64
wcstombs
_wtoi

api-ms-win-crt-filesystem-l1-1-0

_access
_wremove
_unlink
_unlock_file
_wunlink
_wstat64i32
_fstat64
_lock_file
_waccess
_stat64

api-ms-win-crt-utility-l1-1-0

srand
qsort
rand

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
_wsetlocale
___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcpy
_mbschr
_mbsnbcmp
_mbspbrk

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

ncrypt

BCryptGenRandom

Exports

Exports

??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ
?RegisterSpocNotificationHandler@spoc@asw@@YA?AV?$shared_ptr@VISpocCookie@spoc@asw@@@std@@AEBUNotificationKey@12@V?$function@$$A6AXUSpocNotification@spoc@asw@@@Z@4@@Z
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?unlock@singleton_module@serialization@boost@@QEAAXXZ
asw_process_storage_allocate_connector
asw_process_storage_deallocate_connector
on_avast_dll_unload
onexit_register_connector_avast_2

Sections

.text
Size: 12.7MB - Virtual size: 12.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 541KB - Virtual size: 541KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1087de45976b8c8cac147938e4688ad9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

8d:11:ef:3c:1a:51:34:cd:76:e4:7e:e3:4f:c8:54:b9:69:51:b2:55:90:f4:28:d8:a4:d9:67:af:89:e5:88:85Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

aavmrpch

version

crypt32

dnsapi

advapi32

wininet

rpcrt4

shell32

ntdll

shlwapi

setupapi

ws2_32

ashtask

aswengldr

aswaux

comctl32

mpr

winmm

ashbase

netapi32

iphlpapi

aswip

bcrypt

dwmapi

winhttp

libcrypto-3-x64

aswcmnis

aswcmnos

aswcmnbs

protobuf

wtsapi32

dll_loader

msvcp140

msvcp140_atomic_wait

mfc140u

kernel32

user32

gdi32

msimg32

comdlg32

ole32

oleaut32

oleacc

query

secur32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

8d:11:ef:3c:1a:51:34:cd:76:e4:7e:e3:4f:c8:54:b9:69:51:b2:55:90:f4:28:d8:a4:d9:67:af:89:e5:88:85
Signer

.text
Size: 12.7MB - Virtual size: 12.7MB

.rdata
Size: 4.4MB - Virtual size: 4.4MB

.data
Size: 1.6MB - Virtual size: 1.7MB

.pdata
Size: 541KB - Virtual size: 541KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 184KB - Virtual size: 183KB