9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a.exe
Size

39.8MB
MD5

8d5ed34215ddaf7c09b15a3c137677b8
SHA1

f9c8dc1eb47dcce7c9fa8c5c2c41bec58b88dd18
SHA256

9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a
SHA512

6d7a1a480bf1b02cce154493e02ebed0c6e60a58830096e811262a0f8000537e579acb16bd150a060de1a6a1ad346df3d590706d1e592dc04521fec334ba149e
SSDEEP

786432:AkwEspy2XycvakaqBGlWOP0MG85oXglyO4+xI4EJtL5J1EPeMy3+QszDSS:AzEspXycWqBS8H8LlyO4+xI48tUY+Q+

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/mobilelink.dll	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
static1/unpack001/mobilelink.dll	vmprotect

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/7z/7z.dll
unpack001/7z/7z.exe
unpack001/audio/AudioDecoder.dll
unpack001/audio/AudioFilter.dll
unpack001/audio/AudioPlayer.dll
unpack001/language/english/ResourceLib.dll
unpack001/language/spanish/ResourceLib.dll

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a.exe
.exe windows:4 windows x86 arch:x86

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fe:b1:e6:4b:5a:fd:cb:bd:86:4b:6f:d4:12:fb:6a:b1:65:da:3c:c7
Signer

Actual PE Digest

fe:b1:e6:4b:5a:fd:cb:bd:86:4b:6f:d4:12:fb:6a:b1:65:da:3c:c7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary

user32

CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

610235b90207a63ccf481f0d4375d329

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileIntA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileStringA
SetCurrentDirectoryA
GetModuleHandleA
lstrcmpiA
WritePrivateProfileStringA
lstrcatA
lstrcpynA
GlobalFree
lstrlenA
lstrcpyA
GlobalUnlock
GlobalAlloc
GlobalLock

user32

MapWindowPoints
PtInRect
CloseClipboard
LoadCursorA
GetDlgCtrlID
OpenClipboard
GetClientRect
SetWindowRgn
DrawFocusRect
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
DrawTextA
SetCursor
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
CallWindowProcA
PostMessageA
MessageBoxA
GetSysColor
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetWindowLongA
EnableMenuItem
GetSystemMenu
GetClipboardData
LoadIconA

gdi32

DeleteObject
CombineRgn
SetTextColor
GetDIBits
SelectObject
CreateRectRgn
GetObjectA
CreateCompatibleDC

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
SHGetDesktopFolder

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

154903d617e825e7d4f76664593675fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetACP
lstrlenA
lstrcmpA
GetModuleHandleA
GlobalFree
MulDiv
lstrcpynA
GlobalAlloc
lstrcpyA

user32

SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetWindowTextA
LoadIconA
GetDC
ShowWindow
SendMessageA

gdi32

DeleteObject
CreateFontIndirectA
GetDeviceCaps

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
7z/7z.dll
.dll windows:4 windows x86 arch:x86

6121a49841bf6f5b3700c1ebbb28be41

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

CharPrevExA
CharPrevA
CharNextA
CharLowerW
CharLowerA
CharUpperW
CharUpperA

oleaut32

SysFreeString
SysAllocStringByteLen
VariantCopy
VariantClear
SysAllocString

msvcrt

_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
strcmp
memset
memcmp
_purecall
memmove
memcpy
__CxxFrameHandler
free
_CxxThrowException
malloc

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
SetEvent
CreateEventA
WaitForSingleObject
VirtualFree
VirtualAlloc
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FileTimeToLocalFileTime
DeleteCriticalSection
LocalFileTimeToFileTime
GetVersionExA
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleA
GetProcAddress
GetSystemInfo
CompareFileTime
WriteFile
ReadFile
MultiByteToWideChar
WideCharToMultiByte
GetLastError
CloseHandle
SetFileAttributesA
DeleteFileA
GetTempPathA
GetTempFileNameA
CreateFileA

Exports

Exports

CreateObject
GetHandlerProperty
GetHandlerProperty2
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetLargePageMode

Sections

.text
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
7z/7z.exe
.exe windows:5 windows x86 arch:x86

618f9c06c19f69085dd36e56c2f4e72d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\source code\7z465\CPP\7zip\UI\Console\Debug\7z.pdb

Imports

kernel32

LoadLibraryExW
LoadLibraryW
GetModuleFileNameA
GetModuleFileNameW
LocalFree
FormatMessageA
FormatMessageW
GetWindowsDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryW
GetSystemDirectoryW
CloseHandle
SetFileTime
CreateFileW
SetLastError
SetFileAttributesA
RemoveDirectoryA
MoveFileA
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryA
GetLastError
CreateDirectoryW
DeleteFileA
DeleteFileW
GetShortPathNameA
lstrlenA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
SetCurrentDirectoryW
SetCurrentDirectoryA
GetCurrentDirectoryW
SearchPathA
SearchPathW
GetTempPathA
GetTempPathW
GetTempFileNameA
GetTempFileNameW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindCloseChangeNotification
FindFirstChangeNotificationA
AreFileApisANSI
GetLogicalDriveStringsA
GetLogicalDriveStringsW
CreateFileA
GetFileSize
SetFilePointer
GetFileInformationByHandle
ReadFile
WriteFile
SetEndOfFile
GetCurrentProcess
GetProcAddress
CompareFileTime
FileTimeToSystemTime
GetSystemInfo
GlobalMemoryStatus
GetModuleHandleA
DosDateTimeToFileTime
FileTimeToDosDateTime
SystemTimeToFileTime
GetSystemTime
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
OpenEventA
GetDriveTypeA
GetStdHandle
GetTickCount
GetProcessTimes
VirtualAlloc
VirtualFree
WaitForSingleObject
CreateEventA
SetEvent
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
InitializeCriticalSection
CompareStringW
CompareStringA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
LoadLibraryExA
FreeLibrary
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExA
SetFileApisToOEM
GetCommandLineW
FileTimeToLocalFileTime
FindFirstChangeNotificationW
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
GetDateFormatA
GetTimeFormatA
GetConsoleOutputCP
WriteConsoleA
RaiseException
RtlUnwind
CreateThread
GetCurrentThreadId
ExitThread
GetCommandLineA
IsDebuggerPresent
DebugBreak
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
ExitProcess
HeapValidate
IsBadReadPtr
SetHandleCount
GetFileType
GetStartupInfoA
FatalAppExitA
FlushFileBuffers
GetConsoleCP
GetConsoleMode
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
GetProcessHeap
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
GetLocaleInfoW
GetLocaleInfoA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetStdHandle
SetEnvironmentVariableA

user32

CharLowerW
CharLowerA
CharUpperW
CharPrevA
CharNextA
CharUpperA
CharToOemA

advapi32

RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegDeleteValueW
RegDeleteValueA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExW

oleaut32

SysStringByteLen
VariantCopy
VariantClear
SysFreeString
SysAllocString

Sections

.textbss
Size: - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 798KB - Virtual size: 798KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CalcHashAB.dll
.dll windows:5 windows x86 arch:x86

54aa9d374bcf0090d1464f4737974cb2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8b:6a:cb:8f:f8:ce:a8:5b:ba:b0:e9:3a:36:b5:b2:06:87:f2:84:98
Signer

Actual PE Digest

8b:6a:cb:8f:f8:ce:a8:5b:ba:b0:e9:3a:36:b5:b2:06:87:f2:84:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\360data\重要数据\我的文档\Visual Studio 2008\Projects\CalcHashAB\Debug\CalcHashAB.pdb

Imports

kernel32

GetModuleHandleW
GetCurrentThreadId
GetCommandLineA
IsDebuggerPresent
RaiseException
DebugBreak
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetProcAddress
LoadLibraryA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThread
HeapValidate
IsBadReadPtr
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameW
HeapAlloc
GetProcessHeap
VirtualQuery
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
HeapReAlloc
VirtualAlloc
WriteFile
SetConsoleCtrlHandler
InterlockedExchange
InitializeCriticalSectionAndSpinCount
RtlUnwind
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
GetTimeFormatA
GetDateFormatA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
LCMapStringA
LCMapStringW
GetLocaleInfoW
GetTimeZoneInformation
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

CalcHashABData

Sections

.textbss
Size: - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 572KB - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 524KB - Virtual size: 535KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extxml2.dll
.dll windows:4 windows x86 arch:x86

1491d389848a4ecd93d4f1ad9e4afeb1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:eb:db:6f:a1:39:c2:2f:c1:1c:e3:9c:45:f6:23:35:75:93:40:c6
Signer

Actual PE Digest

61:eb:db:6f:a1:39:c2:2f:c1:1c:e3:9c:45:f6:23:35:75:93:40:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

WSACleanup
inet_ntoa
__WSAFDIsSet
getsockopt
WSAGetLastError
WSAStartup
getsockname
bind
listen
gethostbyname
htons
socket
connect
send
select
recv
closesocket

iconv

libiconv
libiconv_open
libiconv_close

zlib1

inflateEnd
inflateInit2_
inflate
gzopen
gzdopen
gzread
gzwrite
gzclose
deflateEnd
crc32
deflateInit2_
deflate
gzdirect

kernel32

TlsGetValue
WaitForSingleObject
CloseHandle
CreateMutexA
GetModuleHandleA
GetModuleFileNameA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
GetCurrentThreadId
TlsFree
Sleep
TlsAlloc
InterlockedIncrement
TlsSetValue
MultiByteToWideChar
GetProcAddress
FreeLibrary
LoadLibraryA
GetVersionExA
ReleaseMutex

msvcrt

_read
_close
_open
_adjust_fdiv
_initterm
_CIfmod
_CIpow
_write
_dup
_vsnprintf
fprintf
getenv
strncpy
_snprintf
_iob
fputc
fclose
fopen
sscanf
free
toupper
memmove
_errno
vfprintf
_getcwd
realloc
malloc
strchr
strncmp
strtol
fwrite
_wfopen
_wopen
strstr
_stat
_wstat
fread
fflush
printf
floor
_isnan
_fpclass

Exports

Exports

UTF8ToHtml
UTF8Toisolat1
__docbDefaultSAXHandler
__htmlDefaultSAXHandler
__oldXMLWDcompatibility
__xmlBufferAllocScheme
__xmlDefaultBufferSize
__xmlDefaultSAXHandler
__xmlDefaultSAXLocator
__xmlDeregisterNodeDefaultValue
__xmlDoValidityCheckingDefaultValue
__xmlErrEncoding
__xmlGenericError
__xmlGenericErrorContext
__xmlGetWarningsDefaultValue
__xmlIndentTreeOutput
__xmlKeepBlanksDefaultValue
__xmlLastError
__xmlLineNumbersDefaultValue
__xmlLoadExtDtdDefaultValue
__xmlOutputBufferCreateFilenameValue
__xmlParserDebugEntities
__xmlParserInputBufferCreateFilenameValue
__xmlParserVersion
__xmlPedanticParserDefaultValue
__xmlRaiseError
__xmlRegisterNodeDefaultValue
__xmlSaveNoEmptyTags
__xmlSimpleError
__xmlStructuredError
__xmlStructuredErrorContext
__xmlSubstituteEntitiesDefaultValue
__xmlTreeIndentString
attribute
attributeDecl
cdataBlock
characters
checkNamespace
comment
docbCreateFileParserCtxt
docbCreatePushParserCtxt
docbDefaultSAXHandlerInit
docbEncodeEntities
docbFreeParserCtxt
docbParseChunk
docbParseDoc
docbParseDocument
docbParseFile
docbSAXParseDoc
docbSAXParseFile
elementDecl
emptyExp
endDocument
endElement
entityDecl
externalSubset
forbiddenExp
getColumnNumber
getEntity
getLineNumber
getNamespace
getParameterEntity
getPublicId
getSystemId
globalNamespace
hasExternalSubset
hasInternalSubset
htmlAttrAllowed
htmlAutoCloseTag
htmlCreateFileParserCtxt
htmlCreateMemoryParserCtxt
htmlCreatePushParserCtxt
htmlCtxtReadDoc
htmlCtxtReadFd
htmlCtxtReadFile
htmlCtxtReadIO
htmlCtxtReadMemory
htmlCtxtReset
htmlCtxtUseOptions
htmlDefaultSAXHandlerInit
htmlDocContentDumpFormatOutput
htmlDocContentDumpOutput
htmlDocDump
htmlDocDumpMemory
htmlDocDumpMemoryFormat
htmlElementAllowedHere
htmlElementStatusHere
htmlEncodeEntities
htmlEntityLookup
htmlEntityValueLookup
htmlFreeParserCtxt
htmlGetMetaEncoding
htmlHandleOmittedElem
htmlInitAutoClose
htmlIsAutoClosed
htmlIsBooleanAttr
htmlIsScriptAttribute
htmlNewDoc
htmlNewDocNoDtD
htmlNewParserCtxt
htmlNodeDump
htmlNodeDumpFile
htmlNodeDumpFileFormat
htmlNodeDumpFormatOutput
htmlNodeDumpOutput
htmlNodeStatus
htmlParseCharRef
htmlParseChunk
htmlParseDoc
htmlParseDocument
htmlParseElement
htmlParseEntityRef
htmlParseFile
htmlReadDoc
htmlReadFd
htmlReadFile
htmlReadIO
htmlReadMemory
htmlSAXParseDoc
htmlSAXParseFile
htmlSaveFile
htmlSaveFileEnc
htmlSaveFileFormat
htmlSetMetaEncoding
htmlTagLookup
ignorableWhitespace
initGenericErrorDefaultFunc
initdocbDefaultSAXHandler
inithtmlDefaultSAXHandler
initxmlDefaultSAXHandler
inputPop
inputPush
internalSubset
isStandalone
isolat1ToUTF8
namePop
namePush
namespaceDecl
nodePop
nodePush
notationDecl
processingInstruction
reference
resolveEntity
setDocumentLocator
setNamespace
startDocument
startElement
unparsedEntityDecl
valuePop
valuePush
xlinkGetDefaultDetect
xlinkGetDefaultHandler
xlinkIsLink
xlinkSetDefaultDetect
xlinkSetDefaultHandler
xmlACatalogAdd
xmlACatalogDump
xmlACatalogRemove
xmlACatalogResolve
xmlACatalogResolvePublic
xmlACatalogResolveSystem
xmlACatalogResolveURI
xmlAddAttributeDecl
xmlAddChild
xmlAddChildList
xmlAddDocEntity
xmlAddDtdEntity
xmlAddElementDecl
xmlAddEncodingAlias
xmlAddID
xmlAddNextSibling
xmlAddNotationDecl
xmlAddPrevSibling
xmlAddRef
xmlAddSibling
xmlAllocOutputBuffer
xmlAllocParserInputBuffer
xmlAttrSerializeTxtContent
xmlAutomataCompile
xmlAutomataGetInitState
xmlAutomataIsDeterminist
xmlAutomataNewAllTrans
xmlAutomataNewCountTrans
xmlAutomataNewCountTrans2
xmlAutomataNewCountedTrans
xmlAutomataNewCounter
xmlAutomataNewCounterTrans
xmlAutomataNewEpsilon
xmlAutomataNewNegTrans
xmlAutomataNewOnceTrans
xmlAutomataNewOnceTrans2
xmlAutomataNewState
xmlAutomataNewTransition
xmlAutomataNewTransition2
xmlAutomataSetFinalState
xmlBoolToText
xmlBufferAdd
xmlBufferAddHead
xmlBufferCCat
xmlBufferCat
xmlBufferContent
xmlBufferCreate
xmlBufferCreateSize
xmlBufferCreateStatic
xmlBufferDump
xmlBufferEmpty
xmlBufferFree
xmlBufferGrow
xmlBufferLength
xmlBufferResize
xmlBufferSetAllocationScheme
xmlBufferShrink
xmlBufferWriteCHAR
xmlBufferWriteChar
xmlBufferWriteQuotedString
xmlBuildQName
xmlBuildRelativeURI
xmlBuildURI
xmlByteConsumed
xmlC14NDocDumpMemory
xmlC14NDocSave
xmlC14NDocSaveTo
xmlC14NExecute
xmlCanonicPath
xmlCatalogAdd
xmlCatalogAddLocal
xmlCatalogCleanup
xmlCatalogConvert
xmlCatalogDump
xmlCatalogFreeLocal
xmlCatalogGetDefaults
xmlCatalogGetPublic
xmlCatalogGetSystem
xmlCatalogIsEmpty
xmlCatalogLocalResolve
xmlCatalogLocalResolveURI
xmlCatalogRemove
xmlCatalogResolve
xmlCatalogResolvePublic
xmlCatalogResolveSystem
xmlCatalogResolveURI
xmlCatalogSetDebug
xmlCatalogSetDefaultPrefer
xmlCatalogSetDefaults
xmlCharEncCloseFunc
xmlCharEncFirstLine
xmlCharEncInFunc
xmlCharEncOutFunc
xmlCharInRange
xmlCharStrdup
xmlCharStrndup
xmlCheckFilename
xmlCheckHTTPInput
xmlCheckLanguageID
xmlCheckUTF8
xmlCheckVersion
xmlChildElementCount
xmlCleanupCharEncodingHandlers
xmlCleanupEncodingAliases
xmlCleanupGlobals
xmlCleanupInputCallbacks
xmlCleanupMemory
xmlCleanupOutputCallbacks
xmlCleanupParser
xmlCleanupPredefinedEntities
xmlCleanupThreads
xmlClearNodeInfoSeq
xmlClearParserCtxt
xmlConvertSGMLCatalog
xmlCopyAttributeTable
xmlCopyChar
xmlCopyCharMultiByte
xmlCopyDoc
xmlCopyDocElementContent
xmlCopyDtd
xmlCopyElementContent
xmlCopyElementTable
xmlCopyEntitiesTable
xmlCopyEnumeration
xmlCopyError
xmlCopyNamespace
xmlCopyNamespaceList
xmlCopyNode
xmlCopyNodeList
xmlCopyNotationTable
xmlCopyProp
xmlCopyPropList
xmlCreateDocParserCtxt
xmlCreateEntitiesTable
xmlCreateEntityParserCtxt
xmlCreateEnumeration
xmlCreateFileParserCtxt
xmlCreateIOParserCtxt
xmlCreateIntSubset
xmlCreateMemoryParserCtxt
xmlCreatePushParserCtxt
xmlCreateURI
xmlCreateURLParserCtxt
xmlCtxtGetLastError
xmlCtxtReadDoc
xmlCtxtReadFd
xmlCtxtReadFile
xmlCtxtReadIO
xmlCtxtReadMemory
xmlCtxtReset
xmlCtxtResetLastError
xmlCtxtResetPush
xmlCtxtUseOptions
xmlCurrentChar
xmlDOMWrapAdoptNode
xmlDOMWrapCloneNode
xmlDOMWrapFreeCtxt
xmlDOMWrapNewCtxt
xmlDOMWrapReconcileNamespaces
xmlDOMWrapRemoveNode
xmlDebugCheckDocument
xmlDebugDumpAttr
xmlDebugDumpAttrList
xmlDebugDumpDTD
xmlDebugDumpDocument
xmlDebugDumpDocumentHead
xmlDebugDumpEntities
xmlDebugDumpNode
xmlDebugDumpNodeList
xmlDebugDumpOneNode
xmlDebugDumpString
xmlDecodeEntities
xmlDefaultSAXHandlerInit
xmlDelEncodingAlias
xmlDeregisterNodeDefault
xmlDetectCharEncoding
xmlDictCleanup
xmlDictCreate
xmlDictCreateSub
xmlDictExists
xmlDictFree
xmlDictLookup
xmlDictOwns
xmlDictQLookup
xmlDictReference
xmlDictSize
xmlDocCopyNode
xmlDocCopyNodeList
xmlDocDump
xmlDocDumpFormatMemory
xmlDocDumpFormatMemoryEnc
xmlDocDumpMemory
xmlDocDumpMemoryEnc
xmlDocFormatDump
xmlDocGetRootElement
xmlDocSetRootElement
xmlDumpAttributeDecl
xmlDumpAttributeTable
xmlDumpElementDecl
xmlDumpElementTable
xmlDumpEntitiesTable
xmlDumpEntityDecl
xmlDumpNotationDecl
xmlDumpNotationTable
xmlElemDump
xmlEncodeEntities
xmlEncodeEntitiesReentrant
xmlEncodeSpecialChars
xmlErrMemory
xmlExpCtxtNbCons
xmlExpCtxtNbNodes
xmlExpDump
xmlExpExpDerive
xmlExpFree
xmlExpFreeCtxt
xmlExpGetLanguage
xmlExpGetStart
xmlExpIsNillable
xmlExpMaxToken
xmlExpNewAtom
xmlExpNewCtxt
xmlExpNewOr
xmlExpNewRange
xmlExpNewSeq
xmlExpParse
xmlExpRef
xmlExpStringDerive
xmlExpSubsume
xmlFileClose
xmlFileMatch
xmlFileOpen
xmlFileRead
xmlFindCharEncodingHandler
xmlFirstElementChild
xmlFree
xmlFreeAttributeTable
xmlFreeAutomata
xmlFreeCatalog
xmlFreeDoc
xmlFreeDocElementContent
xmlFreeDtd
xmlFreeElementContent
xmlFreeElementTable
xmlFreeEntitiesTable
xmlFreeEnumeration
xmlFreeIDTable
xmlFreeInputStream
xmlFreeMutex
xmlFreeNode
xmlFreeNodeList
xmlFreeNotationTable
xmlFreeNs
xmlFreeNsList
xmlFreeParserCtxt
xmlFreeParserInputBuffer
xmlFreePattern
xmlFreePatternList
xmlFreeProp
xmlFreePropList
xmlFreeRMutex
xmlFreeRefTable
xmlFreeStreamCtxt
xmlFreeTextReader
xmlFreeTextWriter
xmlFreeURI
xmlFreeValidCtxt
xmlGcMemGet
xmlGcMemSetup
xmlGetBufferAllocationScheme
xmlGetCharEncodingHandler
xmlGetCharEncodingName
xmlGetCompressMode
xmlGetDocCompressMode
xmlGetDocEntity
xmlGetDtdAttrDesc
xmlGetDtdElementDesc
xmlGetDtdEntity
xmlGetDtdNotationDesc
xmlGetDtdQAttrDesc
xmlGetDtdQElementDesc
xmlGetEncodingAlias
xmlGetExternalEntityLoader
xmlGetFeature
xmlGetFeaturesList
xmlGetGlobalState
xmlGetID
xmlGetIntSubset
xmlGetLastChild
xmlGetLastError
xmlGetLineNo
xmlGetNoNsProp
xmlGetNodePath
xmlGetNsList
xmlGetNsProp
xmlGetParameterEntity
xmlGetPredefinedEntity
xmlGetProp
xmlGetRefs
xmlGetThreadId
xmlGetUTF8Char
xmlHandleEntity
xmlHasFeature
xmlHasNsProp
xmlHasProp
xmlHashAddEntry
xmlHashAddEntry2
xmlHashAddEntry3
xmlHashCopy
xmlHashCreate
xmlHashCreateDict
xmlHashFree
xmlHashLookup
xmlHashLookup2
xmlHashLookup3
xmlHashQLookup
xmlHashQLookup2
xmlHashQLookup3
xmlHashRemoveEntry
xmlHashRemoveEntry2
xmlHashRemoveEntry3
xmlHashScan
xmlHashScan3
xmlHashScanFull
xmlHashScanFull3
xmlHashSize
xmlHashUpdateEntry
xmlHashUpdateEntry2
xmlHashUpdateEntry3
xmlIOFTPClose
xmlIOFTPMatch
xmlIOFTPOpen
xmlIOFTPRead
xmlIOHTTPClose
xmlIOHTTPMatch
xmlIOHTTPOpen
xmlIOHTTPOpenW
xmlIOHTTPRead
xmlIOParseDTD
xmlInitCharEncodingHandlers
xmlInitGlobals
xmlInitMemory
xmlInitNodeInfoSeq
xmlInitParser
xmlInitParserCtxt

Sections

.text
Size: 737KB - Virtual size: 737KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FatOperate.dll
.dll windows:4 windows x86 arch:x86

81ce694558e5d77bc2fe8cd5ae38fb35

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

86:f8:0c:2a:79:1c:35:55:26:0b:0c:6d:93:4d:88:f7:f8:13:63:17
Signer

Actual PE Digest

86:f8:0c:2a:79:1c:35:55:26:0b:0c:6d:93:4d:88:f7:f8:13:63:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

initialize

ord28
ord10

saveoperate

ord4

kernel32

EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
RtlUnwind
RaiseException
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetLastError
ReadFile
WriteFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FlushFileBuffers
HeapSize
WideCharToMultiByte
LCMapStringA
LCMapStringW
CloseHandle
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetCPInfo
SetStdHandle
GetStringTypeA
GetStringTypeW
CreateFileW
GetACP
GetOEMCP
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
SetEndOfFile

Exports

Exports

check_fat_format_save_data
fat_exit
fat_fmtRec_exit
fat_fmtRec_init
fat_fmtRec_readfile
fat_fmtRec_search
fat_fmtStop
fat_init
fat_open_dir
fat_readfile
fat_searchfile
fat_searchfile_dir
fat_show
free_fat_file_info
get_fat_del_info_to_save
get_folder_info
read_scan_result_fat
save_scan_result_fat
set_fat_del_info_to_save

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FileHash.dll
.dll windows:5 windows x86 arch:x86

333a010f395de6046034e510d683bfdf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e7:62:b4:35:70:e3:df:2d:29:2a:5a:1f:fd:28:20:02:f2:f5:35:47
Signer

Actual PE Digest

e7:62:b4:35:70:e3:df:2d:29:2a:5a:1f:fd:28:20:02:f2:f5:35:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

R:\code\backup\MSResampler-master\FileHash\Debug\FileHash.pdb

Imports

sqlite3

sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_exec
sqlite3_last_insert_rowid
sqlite3_column_int
sqlite3_mprintf
sqlite3_free
sqlite3_close

user32

wsprintfW

ole32

CoCreateGuid

kernel32

TlsFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
CreateFileA
SetEndOfFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
GetCurrentThreadId
GetCommandLineA
HeapValidate
IsBadReadPtr
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetLastError
CloseHandle
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
DebugBreak
lstrlenA
GetProcAddress
LoadLibraryA
WriteFile
GetConsoleCP
GetConsoleMode
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
SetLastError
GetCurrentThread
FatalAppExitA
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
SetConsoleCtrlHandler
FlushFileBuffers
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
SetStdHandle
InitializeCriticalSectionAndSpinCount
CreateFileW
GetProcessHeap
VirtualQuery
FreeLibrary
WriteConsoleA
GetConsoleOutputCP
LCMapStringA
LCMapStringW

Exports

Exports

WriteHash
addsms_sqlite

Sections

.textbss
Size: - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Initialize.dll
.dll windows:4 windows x86 arch:x86

c503d26ec8eceafb1a053e2fbefe4d0b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ea:03:2b:83:7c:bd:de:00:32:e9:d8:8e:1c:06:cb:06:5f:c3:56:b8
Signer

Actual PE Digest

ea:03:2b:83:7c:bd:de:00:32:e9:d8:8e:1c:06:cb:06:5f:c3:56:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
DeviceIoControl
CreateFileA
GetProcAddress
GetModuleHandleA
GetLastError
GetFileSize
SetFilePointer
GetDiskFreeSpaceExA
GetDriveTypeA
CloseHandle
WriteFile
FlushFileBuffers
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
GetCommandLineA
GetVersion
RtlUnwind
RaiseException
FatalAppExitA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
UnhandledExceptionFilter
GetACP
GetOEMCP
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetConsoleCtrlHandler
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

AddFoundFileCallBack
Add_Partition_List
ExportsData
FreeDiskOpera_Partition
Free_List
Free_Par
FullDevStruct
FullDevStruct_exit
FullPartitionBlock
FullPartitionBlock_exit
Full_Part_Struct
GetDiskOpera_Partition
Get_GlobOffset
Get_MAC_Type
Get_RAID_Disk
GlobPointer
GlobPointerPartiton
Init_GTP_DataOffset
Inquiry_Device_List
Inquiry_Partiton_List
Part_Head
RemoveFoundFileCallBack
RemoveList
Restore_LostDisk_Data
_Is_DiskParType
g_callbackVec
get_ExportsData
get_blocksize
m_GlobalRAID
search_EXFAT
search_EXT2
search_FAT
search_HFS
search_HFSP
search_NTFS
set_ExportsData
test_EXFAT
test_FAT
test_NTFS

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LibSearchFileName.dll
.dll windows:5 windows x86 arch:x86

8650898c76cd44710b07c9dcd7754ae1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

88:eb:9d:a5:48:19:d8:f1:36:57:29:19:51:58:9c:9c:4a:6f:d1:22
Signer

Actual PE Digest

88:eb:9d:a5:48:19:d8:f1:36:57:29:19:51:58:9c:9c:4a:6f:d1:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

K:\IPhone3GS_Recovery\trunk\components\LibSearchFileName\lib\Release\LibSearchFileName.pdb

Imports

kernel32

CreateEventW
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
EnterCriticalSection
ResetEvent
WaitForSingleObject
LeaveCriticalSection
MultiByteToWideChar
SetEvent
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
HeapAlloc
RaiseException
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

?CreateFilterObj@@YAPAVIFilterMgr@@W4tagFilterStrategy@@@Z
?FreeFilterObj@@YAXPAVIFilterMgr@@@Z

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
License.txt
NamePipe.dll
.dll windows:6 windows x86 arch:x86

7b7314789e434e80e57c55304e528450

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:fb:25:9a:56:df:e2:c3:5f:7b:9b:50:5f:0e:54:c9:1b:41:a2:b2
Signer

Actual PE Digest

2d:fb:25:9a:56:df:e2:c3:5f:7b:9b:50:5f:0e:54:c9:1b:41:a2:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\svn\iPhoneclean\Release\NamePipe.pdb

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

kernel32

WideCharToMultiByte
CloseHandle
ConnectNamedPipe
GetLastError
CreateFileW
SetNamedPipeHandleState
WaitNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
FlushFileBuffers
ReadFile
WriteFile
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
HeapSize
SetLastError
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
GetStringTypeW
SetStdHandle
WriteConsoleW

Exports

Exports

ClientPipeNew
PipeDelete
ServerPipeNew

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NtfsOperate.dll
.dll windows:4 windows x86 arch:x86

14fdc35f0afa2fdd155ceab3a6ff934b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:fd:23:ea:31:04:5a:4b:d4:a0:f9:5a:6f:8c:b0:c3:89:4a:75:b1
Signer

Actual PE Digest

b9:fd:23:ea:31:04:5a:4b:d4:a0:f9:5a:6f:8c:b0:c3:89:4a:75:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

initialize

ord10
ord28

saveoperate

ord4

kernel32

SetEnvironmentVariableA
CompareStringW
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
HeapFree
RtlUnwind
HeapReAlloc
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
RaiseException
FatalAppExitA
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetProcAddress
GetLastError
CloseHandle
FlushFileBuffers
WriteFile
HeapSize
ReadFile
SetFilePointer
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
SetStdHandle
CreateFileW
UnhandledExceptionFilter
GetACP
GetOEMCP
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
SetConsoleCtrlHandler
SetEndOfFile
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA

Exports

Exports

Initi_Ntfs_InFo
NTFS_Free_File_Info
NTFS_Free_Format_Info
NTFS_Free_Glod_Exit
Nfst_GetFormat_NameParentID
Ntfs_Decode_Run
Ntfs_Fat_Cmp
Ntfs_Find_Attribute
Ntfs_Format_BlockSize
Ntfs_Get_Data
Ntfs_Get_Del_File
Ntfs_Get_FlieSize
Ntfs_Get_MFTID
Ntfs_Get_NameParentID
Ntfs_Open_Dir
Ntfs_RWfile_Set
Ntfs_Read_ForMat_Data
Ntfs_Release_Attribute_Context
Search_Ntfs_InFo
Shwo_Ntfs_Dir
_Get_ExternUse
_Set_ExternUse
__Ntfs_list
check_ntfs_format_save_data
get_ntfs_format_info_from_save
read_scan_result_ntfs
save_scan_result_ntfs
set_info
set_ntfs_foramt_info_to_save
set_ntfs_operate

Sections

.text
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RecoveryPhoto.dll
.dll windows:5 windows x86 arch:x86

c61dfd9bf704e9c479ca115fb036082e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:ef:32:42:6c:22:6a:a8:bb:5d:76:7f:10:65:2d:c6:19:30:33:50
Signer

Actual PE Digest

0c:ef:32:42:6c:22:6a:a8:bb:5d:76:7f:10:65:2d:c6:19:30:33:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

M:\360data\重要数据\我的文档\Visual Studio 2008\Projects\uuid\Debug\RecoveryPhoto.pdb

Imports

sqlite3

sqlite3_open
sqlite3_mprintf
sqlite3_prepare
sqlite3_step
sqlite3_column_int
sqlite3_finalize
sqlite3_free
sqlite3_close

kernel32

GetModuleFileNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
SetEndOfFile
CreateFileA
GetUserDefaultLCID
WideCharToMultiByte
GetLastError
CreateDirectoryW
GetCurrentThreadId
GetCommandLineA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapValidate
IsBadReadPtr
GetModuleFileNameW
IsDebuggerPresent
RaiseException
DebugBreak
MultiByteToWideChar
lstrlenA
GetProcAddress
LoadLibraryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetConsoleCP
GetConsoleMode
CloseHandle
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
RtlUnwind
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
Sleep
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
GetProcessHeap
VirtualQuery
FreeLibrary
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileW
InterlockedExchange
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA

Exports

Exports

RecoveryPhoto

Sections

.textbss
Size: - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 386KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SaveOperate.dll
.dll windows:4 windows x86 arch:x86

4c37788802ac2f4de8d034a9a90a5e6c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:a3:87:8a:ab:dc:d0:cd:e3:e2:dc:bf:b9:49:cb:94:6a:49:e9:6b
Signer

Actual PE Digest

31:a3:87:8a:ab:dc:d0:cd:e3:e2:dc:bf:b9:49:cb:94:6a:49:e9:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeviceIoControl
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
GetCommandLineA
GetVersion
RtlUnwind
RaiseException
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetFilePointer
FlushFileBuffers
CloseHandle
SetUnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
SetStdHandle
ReadFile
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

get_disk_sequence
save_cmp_disk
save_cmp_partition
save_data_info

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoftwareLog.dll
.dll windows:5 windows x86 arch:x86

b71a87db9d246a8923984da7950b48dc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:92:76:d6:71:1e:71:05:dc:25:97:ef:6f:fa:ae:db:7f:f1:99:37
Signer

Actual PE Digest

c5:92:76:d6:71:1e:71:05:dc:25:97:ef:6f:fa:ae:db:7f:f1:99:37

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Users\APC\Documents\Visual Studio 2008\Projects\SoftwareLog\Debug\SoftwareLog.pdb

Imports

kernel32

GetTickCount
lstrlenA
GetVolumeInformationA
GetModuleHandleW
CreateThread
SetEnvironmentVariableA
CompareStringW
GetProcAddress
GetSystemInfo
GetVersionExW
GetComputerNameW
GetSystemDirectoryA
WideCharToMultiByte
CompareStringA
CreateFileA
CloseHandle
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
LCMapStringW
LCMapStringA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetStringTypeA
GetDateFormatA
GetTimeFormatA
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
RaiseException
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThread
DebugBreak
MultiByteToWideChar
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalAppExitA
HeapValidate
IsBadReadPtr
GetStdHandle
WriteFile
OutputDebugStringA
WriteConsoleW
GetFileType
OutputDebugStringW
Sleep
ExitProcess
SetConsoleCtrlHandler
LoadLibraryW
GetModuleFileNameA
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
HeapAlloc
GetProcessHeap
VirtualQuery
FreeLibrary
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
VirtualAlloc
InterlockedExchange
GetLocaleInfoW
GetLocaleInfoA
InitializeCriticalSection

user32

GetSystemMetrics

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA

ole32

CoCreateGuid

ws2_32

WSACleanup
WSAStartup
gethostbyname
inet_ntoa

wininet

InternetGetConnectedState
InternetOpenA
InternetSetOptionW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
InternetOpenUrlA

winmm

timeGetTime

Exports

Exports

CreateExportObj
DestroyExportObj
NSISLog

Sections

.textbss
Size: - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 410KB - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Tenorshare iPod Data Recovery.chm
.chm
ThreadCore.dll
.dll windows:5 windows x86 arch:x86

9e8749dbd8b45a8c1b4a6efd420d3473

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:83:aa:78:22:00:72:4f:31:c6:51:2e:12:e9:67:0a:be:f2:02:df
Signer

Actual PE Digest

4f:83:aa:78:22:00:72:4f:31:c6:51:2e:12:e9:67:0a:be:f2:02:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\MediaCore\pro\vs\Release\ThreadCore.pdb

Imports

kernel32

WaitForSingleObject
SetThreadPriority
CloseHandle
CreateThread
SetEvent
ResetEvent
CreateEventW
TryEnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
HeapAlloc
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
InitializeCriticalSectionAndSpinCount
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

Event_Check
Event_Create
Event_Release
Event_Reset
Event_Set
Event_Wait
Event_WaitInfinite
Mutex_Create
Mutex_Lock
Mutex_Release
Mutex_Trylock
Mutex_Unlock
Thread_Command
Thread_Create
Thread_GetStatus
Thread_GetStatusNolock
Thread_IsCompleted
Thread_Pause
Thread_Release
Thread_SetNextWaitTime
Thread_Start
Thread_Stop
Thread_WaitComplete

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Un7z.dll
.dll windows:5 windows x86 arch:x86

246f6f084661c606db68b9ae606b6169

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:7f:f5:34:17:f3:e5:70:79:b2:69:8e:56:d0:f8:b9:88:ac:02:6c
Signer

Actual PE Digest

47:7f:f5:34:17:f3:e5:70:79:b2:69:8e:56:d0:f8:b9:88:ac:02:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

r:\jiaojie\x86\7z922\CPP\7zip\UI\Console\Debug\Un7z.pdb

Imports

kernel32

LoadLibraryW
LoadLibraryA
GetModuleFileNameW
GetModuleFileNameA
LocalFree
FormatMessageW
FormatMessageA
GetWindowsDirectoryW
GetWindowsDirectoryA
GetSystemDirectoryW
GetSystemDirectoryA
CloseHandle
SetFileTime
CreateFileW
SetLastError
SetFileAttributesW
SetFileAttributesA
RemoveDirectoryW
RemoveDirectoryA
MoveFileW
MoveFileA
GetLastError
CreateDirectoryW
CreateDirectoryA
DeleteFileW
DeleteFileA
GetFullPathNameW
GetFullPathNameA
SetCurrentDirectoryW
SetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentDirectoryA
GetTempPathW
GetTempPathA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
FindClose
FindFirstFileW
FindFirstFileA
FindNextFileW
FindNextFileA
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstChangeNotificationA
LoadLibraryExA
GetLogicalDriveStringsA
CreateFileA
GetFileSize
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
SetEndOfFile
GetCurrentProcess
GetProcAddress
CompareFileTime
FileTimeToSystemTime
lstrlenA
GetSystemInfo
GlobalMemoryStatus
GetModuleHandleA
DosDateTimeToFileTime
FileTimeToDosDateTime
SystemTimeToFileTime
GetSystemTime
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
OpenEventA
GetProcessTimes
VirtualAlloc
VirtualFree
WaitForSingleObject
CreateEventA
SetEvent
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
InitializeCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetUserDefaultLCID
EnumSystemLocalesA
LoadLibraryExW
FreeLibrary
GetStdHandle
GetConsoleMode
SetConsoleMode
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExA
FileTimeToLocalFileTime
GetLogicalDriveStringsW
SetConsoleCtrlHandler
IsValidLocale
GetStringTypeW
GetStringTypeA
GetDateFormatA
GetTimeFormatA
GetConsoleOutputCP
WriteConsoleA
RtlUnwind
RaiseException
CreateThread
ExitThread
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DebugBreak
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
HeapValidate
IsBadReadPtr
Sleep
ExitProcess
FatalAppExitA
FlushFileBuffers
GetConsoleCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
HeapAlloc
GetProcessHeap
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
GetLocaleInfoW
GetLocaleInfoA
HeapSize
HeapReAlloc
InterlockedExchange
SetStdHandle

user32

CharToOemA
CharLowerW
CharUpperW
CharLowerA
CharUpperA
CharPrevA
CharNextA

advapi32

RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegDeleteValueW
RegDeleteValueA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExW

oleaut32

SysStringByteLen
VariantCopy
VariantClear
SysAllocStringByteLen
SysFreeString
SysAllocString

Exports

Exports

Uncompression

Sections

.textbss
Size: - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 860KB - Virtual size: 860KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
audio/AudioDecoder.dll
.dll windows:5 windows x86 arch:x86

95d98000d23897cf8e74ea0e5cc831a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\AudioRecorder\obj\AudioDecoder\Release\AudioDecoder.pdb

Imports

kernel32

GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
GetLastError
CloseHandle
FreeLibrary
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
SetUnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
Sleep
CompareStringW
CompareStringA
GetProcessHeap
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
LCMapStringA
LCMapStringW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
HeapSize
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

ole32

CoUninitialize
CoInitialize

Exports

Exports

CreateDecoder
DestroyDecoder
_FillWaveFormatEx@16
_FillWaveHeader@16

Sections

.text
Size: 446KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
audio/AudioFilter.dll
.dll windows:5 windows x86 arch:x86

025b3c90f92339c68bd856e3682821d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\AudioRecorder\obj\AudioFilter\Release\AudioFilter.pdb

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
LoadLibraryW
GetModuleFileNameW
GetProcAddress
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
HeapAlloc
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
InitializeCriticalSectionAndSpinCount
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

CreateFilter
DestroyFilter

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
audio/AudioPlayer.dll
.dll windows:5 windows x86 arch:x86

5981cd7655435a09008879e44906955d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\AudioRecorder\obj\AudioPlayer\Release\AudioPlayer.pdb

Imports

winmm

waveOutClose
waveOutWrite
waveOutPause
waveOutGetPosition
waveOutRestart
waveOutReset
waveOutUnprepareHeader
waveOutOpen
waveOutPrepareHeader

dsound

ord11

kernel32

LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSection
Sleep
SetThreadPriority
CreateEventW
WaitForMultipleObjects
DeleteCriticalSection
CloseHandle
CreateThread
FreeLibrary
LoadLibraryW
GetModuleFileNameW
GetProcAddress
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
GetModuleHandleA
HeapFree
HeapAlloc
RaiseException
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
InitializeCriticalSectionAndSpinCount

user32

GetDesktopWindow

Exports

Exports

CreatePlayer
CreatePlayer2
DestroyPlayer

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
db/verstionInfo.dat
errordump.dll
.dll windows:5 windows x86 arch:x86

00582fbf2d4612ce1cc4fa31f5e49e4d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:a1:58:0d:8c:16:20:70:2f:86:61:e9:8c:e7:fc:c5:91:28:eb:f8
Signer

Actual PE Digest

5b:a1:58:0d:8c:16:20:70:2f:86:61:e9:8c:e7:fc:c5:91:28:eb:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

M:\360data\重要数据\我的文档\Visual Studio 2008\Projects\testDump\Release\errordump.pdb

Imports

dbghelp

MiniDumpWriteDump

kernel32

VirtualFree
SetUnhandledExceptionFilter
GetCurrentProcess
CreateFileW
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

?SetdumpCall@@YAHPA_WP6AXXZ@Z

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iCloudLib.dll
.dll windows:5 windows x86 arch:x86

a56af4d9a831f53de7b6bc08f2a90a73

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cb:b1:29:c3:63:e4:0a:55:e4:fe:82:b6:71:f9:43:4a:7a:cd:03:50
Signer

Actual PE Digest

cb:b1:29:c3:63:e4:0a:55:e4:fe:82:b6:71:f9:43:4a:7a:cd:03:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\iCloudLib_10.8 - Copy\Debug\iCloudLib.pdb

Imports

threadcore

Thread_Stop
Thread_WaitComplete
Thread_Start
Thread_Create
Thread_Release

libcurl

curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_multi_setopt
curl_easy_reset
curl_slist_append
curl_easy_getinfo
curl_easy_init
curl_slist_free_all

gdi32

CreateCompatibleBitmap
GetDeviceCaps
GetObjectA
GetDIBits
DeleteObject

wsock32

shutdown
closesocket
socket
ntohl
setsockopt
WSAGetLastError

kernel32

CompareStringA
CompareStringW
GetLocaleInfoW
FreeEnvironmentStringsA
GetEnvironmentStrings
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
CreateFileMappingA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
CloseHandle
WriteFile
CreateFileW
LoadLibraryW
GetEnvironmentVariableW
GetSystemInfo
GetProcAddress
GetModuleHandleW
GetTempPathW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryW
Sleep
GetShortPathNameW
MultiByteToWideChar
FlushViewOfFile
InterlockedCompareExchange
GetProcessHeap
OutputDebugStringW
OutputDebugStringA
WaitForSingleObjectEx
WaitForSingleObject
WideCharToMultiByte
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
SetFilePointer
SetEndOfFile
ReadFile
QueryPerformanceCounter
MapViewOfFile
LockFileEx
LockFile
LocalFree
LoadLibraryA
HeapCompact
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExW
GetVersionExA
GetTickCount
GetTempPathA
GetSystemTimeAsFileTime
GetSystemTime
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FreeLibrary
FormatMessageW
FormatMessageA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
SetStdHandle
CreateFileA
AreFileApisANSI
TryEnterCriticalSection
GetCurrentThreadId
InterlockedExchange
InterlockedExchangeAdd
GetModuleHandleA
GetVersion
GetFileType
GetStdHandle
GlobalMemoryStatus
FlushConsoleInputBuffer
InterlockedIncrement
InterlockedDecrement
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
DebugBreak
lstrlenA
GetTimeFormatA
GetDateFormatA
ExitThread
CreateThread
GetTimeZoneInformation
GetCommandLineA
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
GetConsoleCP
FatalAppExitA
VirtualFree
VirtualAlloc
GetModuleFileNameA
SetHandleCount
GetStartupInfoA
GetModuleFileNameW
VirtualQuery
SetEnvironmentVariableA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA

user32

GetDC
ReleaseDC
MessageBoxA
GetDesktopWindow
wsprintfA
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation

advapi32

CryptReleaseContext
CryptAcquireContextW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CryptGenRandom

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

shlwapi

PathFileExistsW

Exports

Exports

Analyze
CleanDevice
CloseThread
DownBackupData
DownBakupInfoOS9
DownloadBackupDataOS9
GetBackupDeviceCount
GetBackupSnapshotCountForDeviceIndex
GetDownloadDataSize
GetFileListAllSize
GetiOSBackupInfo
InitLib
ParseBackupData
ParseBackupDataOS9
PrintChunkInfo
ReleaseBackupInfoOS9
ReleaseSnapshotInfo
iCloudLogin
iCloudLoginFromToken

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 474KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iPhoneClean.dll
.dll windows:5 windows x86 arch:x86

a64583bf3ecbd0193b0b04f89ef443e6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:28:7d:87:d9:e7:b2:86:7f:7d:d9:c9:5e:f8:ad:6a:d6:8d:25:fa
Signer

Actual PE Digest

39:28:7d:87:d9:e7:b2:86:7f:7d:d9:c9:5e:f8:ad:6a:d6:8d:25:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

T:\yidong\iPhoneclean\Release\iPhoneclean.pdb

Imports

shlwapi

PathAppendW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

extxml2

xmlFreeDoc
xmlNewProp
xmlNewNode
xmlNewTextChild
xmlDocGetRootElement
xmlDocSetRootElement
xmlAddChild
xmlNodeGetContent
xmlDocDumpFormatMemoryEnc
xmlParseMemory
xmlFree
xmlNewDoc

namepipe

ServerPipeNew

sqlite3

sqlite3_step
sqlite3_column_count
sqlite3_prepare_v2
sqlite3_open
sqlite3_close
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_int
sqlite3_column_text
sqlite3_column_type
sqlite3_finalize
sqlite3_column_double

shell32

ShellExecuteW
SHGetSpecialFolderPathW

advapi32

RegQueryValueExW
RegCreateKeyW
RegCloseKey
RegOpenKeyExW

user32

wsprintfW

ole32

CoCreateGuid
CoInitialize
CoUninitialize

kernel32

LoadLibraryExW
WriteConsoleW
SetStdHandle
HeapReAlloc
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetConsoleCP
WriteFile
FlushFileBuffers
GetProcessHeap
GetFileType
GetStdHandle
SetFilePointerEx
ReadConsoleW
GetConsoleMode
CreateFileW
SetEndOfFile
SetEnvironmentVariableA
GetSystemInfo
MoveFileExW
GetOEMCP
GetACP
IsValidCodePage
IsDebuggerPresent
HeapSize
MultiByteToWideChar
WideCharToMultiByte
ReleaseMutex
WaitForSingleObject
Sleep
CreateMutexW
CreateDirectoryW
GetTimeZoneInformation
OutputDebugStringW
WaitNamedPipeW
VirtualAlloc
OpenProcess
TerminateProcess
FindClose
CloseHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpiW
GetTempPathW
RemoveDirectoryW
GetFileAttributesExW
DeleteFileW
FindFirstFileW
FindNextFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetComputerNameW
GetProcAddress
GetModuleHandleW
GetEnvironmentVariableW
SetEnvironmentVariableW
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
RaiseException
RtlUnwind
GetLastError
AreFileApisANSI
GetSystemTimeAsFileTime
ReadFile
CreateThread
ExitThread
ResumeThread
HeapFree
GetCommandLineA
GetCurrentThreadId
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW

Exports

Exports

?FreePListDictionary@@YAXAAVCDicValueObj@@@Z
?readPlistFromByteArry@@YAXPAEHAAVCDicValueObj@@W4plistType@@@Z
?readPlistFromFile@@YAXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVCDicValueObj@@@Z
?readPlistFromString@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVCDicValueObj@@W4plistType@@@Z
?readPlistFromXmlUTF8@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVCDicValueObj@@@Z
?readPlistFromXmlW@@YAXAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVCDicValueObj@@@Z
?writeBinary@@YAXAAVCDicValueObj@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?writeBinaryFile@@YAXAAVCDicValueObj@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?writeXmlFile@@YAXAAVCDicValueObj@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?writeXmlW@@YAXAAVCDicValueObj@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?writeXmlutf8@@YAXAAVCDicValueObj@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
CDeviceInfoDelete
CDeviceInfoNew
CalcBackupSize
CheckDeviceBackUpEncryptionE
CheckDeviceRestoreEx
ConnectListenerDelete
ConnectListenerNew
CreateBackupInfo
CreateConfigureToolExIn
CreateInfoObjDelete
CreateInfoObjNewEx
DeepCleanComplete
DeviceBackUpDelete
DeviceBackUpNewEx
ExcludeAppKeylist
GetBackupPrepareWorkInstance
GetDeviceHandle
IsCheckInputPassEx
IsOpeniCloudEx
RestartDevice
ScanDeviceDelete
ScanDeviceNew
VerifyBackUp
WiredConnEx

Sections

.text
Size: 691KB - Virtual size: 691KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iPod Data Recovery.exe
.exe windows:5 windows x86 arch:x86

c9860c94efb9c891a6e38b18cf33371d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:b2:be:04:15:b5:9c:9d:c7:15:62:0a:4a:d7:51:ab:e7:bf:b2:33
Signer

Actual PE Digest

94:b2:be:04:15:b5:9c:9d:c7:15:62:0a:4a:d7:51:ab:e7:bf:b2:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

k:\IPhone3GS_Recovery\trunk\bin\tenorshare\ipod_full(tenorshare)\iPod Data Recovery.pdb

Imports

sqlite3

sqlite3_finalize
sqlite3_step
sqlite3_get_table
sqlite3_column_blob
sqlite3_free
sqlite3_close
sqlite3_last_insert_rowid
sqlite3_mprintf
sqlite3_column_int
sqlite3_column_text
sqlite3_free_table
sqlite3_column_count
sqlite3_open
sqlite3_exec
sqlite3_column_name
sqlite3_prepare
sqlite3_column_bytes

libexcel

?setFontBold@XLSSheet@@QAEXKKW4boldness_option_t@xlslib_core@@@Z
??0XLSFile@xlsFile@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4use_option@1@@Z
??1XLSFile@xlsFile@@UAE@XZ
?newSheet@XLSFile@xlsFile@@QAE?AVXLSSheet@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1XLSSheet@@UAE@XZ
?setText@XLSSheet@@QAEXKKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?save@XLSFile@xlsFile@@QAEXXZ

lib_iphone_recovery

searchDeleteData
FreeAnalysisData
GetNoteContentFromBin
FreeNoteData

recoveryphoto

RecoveryPhoto

itunesdecrypt

StartDecrypt
StopDecrypt

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphoneclean

DeviceBackUpNewEx

fatoperate

ord2
ord1
ord4

initialize

ord1
ord12
ord2
ord6
ord11
ord7
ord9
ord5

ntfsoperate

ord6
ord22
ord3
ord5

errordump

?SetdumpCall@@YAHPA_WP6AXXZ@Z

updataerror

?UpdataReportFile@@YAHPA_W@Z

icloudlib

GetiOSBackupInfo
ReleaseSnapshotInfo
DownBakupInfoOS9
DownloadBackupDataOS9
GetFileListAllSize
CloseThread
GetBackupSnapshotCountForDeviceIndex
GetBackupDeviceCount
ParseBackupDataOS9
GetDownloadDataSize
InitLib
iCloudLoginFromToken
DownBackupData
ReleaseBackupInfoOS9
ParseBackupData
iCloudLogin
CleanDevice

wininet

InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetOpenW

libsearchfilename

?CreateFilterObj@@YAPAVIFilterMgr@@W4tagFilterStrategy@@@Z
?FreeFilterObj@@YAXPAVIFilterMgr@@@Z

iany

GetIanyManager
IsWiFiConnect
IOSInitialize
IOSListener
DeleteIanyManager

filehash

WriteHash

softwarelog

DestroyExportObj
CreateExportObj

kernel32

GetModuleHandleA
GetThreadLocale
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
GetCurrentThread
GetPrivateProfileIntW
WritePrivateProfileStringW
SetThreadPriority
FileTimeToSystemTime
FileTimeToLocalFileTime
ReadFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationW
GlobalGetAtomNameW
lstrlenA
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalFlags
lstrcpyW
SetErrorMode
GetFileTime
GetTempFileNameW
GetTickCount
GetSystemDirectoryW
SearchPathW
GetProfileIntW
VirtualProtect
GetStartupInfoW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitProcess
HeapReAlloc
RtlUnwind
ExitThread
HeapSize
SetStdHandle
GetFileType
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
LCMapStringW
LCMapStringA
GlobalAddAtomW
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetCurrentDirectoryA
GetDriveTypeA
GetProcessHeap
SetEnvironmentVariableA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
TerminateProcess
OpenProcess
EnterCriticalSection
InterlockedExchange
LeaveCriticalSection
WinExec
GetSystemDirectoryA
SetLastError
LoadLibraryW
GetVersionExW
GetModuleHandleW
RemoveDirectoryW
GetFileSizeEx
GetFileAttributesW
FormatMessageW
GetFullPathNameW
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
LocalFree
ResumeThread
SuspendThread
WriteFile
RaiseException
OutputDebugStringW
lstrlenW
FindResourceExW
GetLastError
CreateMutexW
CreateDirectoryW
GetWindowsDirectoryW
GetDiskFreeSpaceExA
DeviceIoControl
CreateFileA
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetCurrentProcess
SetUnhandledExceptionFilter
DeleteFileW
MoveFileW
Sleep
CopyFileW
InterlockedDecrement
InterlockedIncrement
FindNextFileW
FindClose
FindFirstFileW
GetDiskFreeSpaceExW
WideCharToMultiByte
WaitForSingleObject
SetCurrentDirectoryW
GetProcAddress
GetCurrentDirectoryW
LoadLibraryExW
FreeLibrary
CreateThread
CloseHandle
CreateEventW
GetExitCodeThread
ResetEvent
MultiByteToWideChar
GetModuleFileNameW
TerminateThread
SetEvent
GetEnvironmentVariableW
LockResource
GetTempPathW
SizeofResource
LoadResource
FindResourceW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GlobalSize
FreeResource
MulDiv
SetFileAttributesW
GetExitCodeProcess
CreateProcessW
ConvertDefaultLocale

user32

GetNextDlgGroupItem
PostThreadMessageW
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
GetAsyncKeyState
DestroyAcceleratorTable
CreateAcceleratorTableW
NotifyWinEvent
GetSystemMenu
IsMenu
LockWindowUpdate
EnumChildWindows
RegisterClipboardFormatW
OpenClipboard
CopyImage
SetClipboardData
CloseClipboard
EmptyClipboard
UnregisterClassW
UnionRect
DrawIcon
CreateMenu
GetTabbedTextExtentA
DrawIconEx
DrawEdge
DrawFrameControl
DrawFocusRect
SetCursorPos
EnableScrollBar
UpdateLayeredWindow
SetMenuDefaultItem
GetMenuDefaultItem
IsCharLowerW
MapVirtualKeyExW
IsClipboardFormatAvailable
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
FrameRect
GetUpdateRect
CharUpperBuffW
CopyIcon
SubtractRect
GetIconInfo
GetDoubleClickTime
GetWindowRgn
ReleaseCapture
LoadAcceleratorsW
InsertMenuItemW
SetRectEmpty
BringWindowToTop
TranslateAcceleratorW
WindowFromPoint
CharUpperW
MessageBeep
IsZoomed
GetMessageW
ValidateRect
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
PostQuitMessage
CharNextW
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
GetWindowThreadProcessId
MapVirtualKeyW
GetKeyNameTextW
EndPaint
BeginPaint
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
CheckDlgButton
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
DestroyIcon
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
MessageBoxW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
LoadMenuW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
CheckMenuItem
GetMenuState
GetMenuStringW
GetMenuItemID
GetSubMenu
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
LoadIconW
EnableMenuItem
RemoveMenu
InsertMenuW
GetFocus
SetCursor
LoadCursorW
ExitWindowsEx
SetLayeredWindowAttributes
GetMenuItemCount
SetWindowRgn
GetDC
InflateRect
InvalidateRect
GetWindowTextW
ReleaseDC
LoadImageW
DrawTextW
TabbedTextOutW
GetClientRect
DrawTextExW
GrayStringW
GetClassLongW
SetClassLongW
GetCursorPos
DrawStateW
CopyRect
GetWindowDC
GetDesktopWindow
GetSystemMetrics
FillRect
ScreenToClient
PtInRect
SetParent
ClientToScreen
GetWindowRect
GetParent
AppendMenuW
GetSysColor
CreatePopupMenu
IsWindow
IsWindowVisible
RedrawWindow
SetTimer
KillTimer
DestroyWindow
PostMessageW
MsgWaitForMultipleObjects
TranslateMessage
GetWindowLongW
PeekMessageW
SetWindowLongW
CreateWindowExW
RegisterClassW
SendMessageW
DefWindowProcW
DispatchMessageW
EnableWindow
wsprintfW
WaitMessage
SetCapture
DeleteMenu
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
GetSysColorBrush
DestroyCursor
SetRect
UnpackDDElParam
GetTopWindow
ReuseDDElParam
LoadBitmapW

gdi32

RestoreDC
SetBkMode
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetObjectType
CreateHatchBrush
CreateRectRgnIndirect
PatBlt
SetRectRgn
CombineRgn
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
ExcludeClipRect
IntersectClipRect
GetDCOrgEx
MoveToEx
SetTextAlign
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocW
SetViewportOrgEx
CreateDCW
CopyMetaFileW
DeleteDC
SetDIBColorTable
CreateRoundRectRgn
OffsetViewportOrgEx
SetViewportExtEx
BitBlt
CreateDIBSection
DeleteObject
SelectObject
CreatePen
RoundRect
StretchBlt
LineTo
CreateBitmap
CreateCompatibleDC
CreateCompatibleBitmap
GetDIBits
GetMapMode
DPtoLP
GetBkColor
GetTextColor
GetViewportOrgEx
Rectangle
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetCharWidthW
GetRgnBox
OffsetRgn
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
RealizePalette
SetPixel
CreateEllipticRgn
LPtoDP
Ellipse
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceW
GetTextExtentPoint32A
GetWindowOrgEx
CreatePolygonRgn
Polyline
Polygon
CreatePalette
GetPaletteEntries
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
SetPixelV
GetCurrentPositionEx
ExtTextOutW
PtVisible
Escape
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
CreateFontIndirectW
CreateSolidBrush
GetTextExtentPoint32W
GetTextMetricsW
GetDeviceCaps
RectVisible
TextOutW
SelectPalette
CreatePatternBrush
ExtSelectClipRgn
GetCurrentObject
GetObjectW
ScaleViewportExtEx
GetStockObject

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
GetJobW
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
RegDeleteValueW

shell32

DragFinish
SHGetFileInfoW
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHBrowseForFolderW
SHGetSpecialFolderPathW
ShellExecuteW
SHAppBarMessage
DragQueryFileW

comctl32

ImageList_GetIconSize
InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathStripToRootW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleGetClipboard
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
RevokeDragDrop
RegisterDragDrop
CoRegisterMessageFilter
CoRevokeClassObject
CoLockObjectExternal
CoInitialize
CreateStreamOnHGlobal
StringFromGUID2
CoCreateGuid
CoTaskMemFree
OleLockRunning
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoInitializeEx
CoCreateInstance
CoUninitialize
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium

oleaut32

SystemTimeToVariantTime
SysFreeString
SysAllocString
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
OleCreateFontIndirect
VariantCopy
VariantTimeToSystemTime
SafeArrayDestroy

urlmon

URLDownloadToFileW

gdiplus

GdipDeleteBrush
GdipDrawImageRectRect
GdipFree
GdipGetImageHeight
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipBitmapLockBits
GdipGetImagePaletteSize
GdipCreateBitmapFromFile
GdipBitmapUnlockBits
GdipGetImagePixelFormat
GdipGetImagePalette
GdipCreateBitmapFromFileICM
GdipImageGetFrameCount
GdipImageRotateFlip
GdipFillRectangleI
GdipDeleteGraphics
GdipGetPropertyItemSize
GdipCreateSolidFill
GdipGetImageThumbnail
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsList
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCloneBrush
GdipImageGetFrameDimensionsCount
GdipDrawImageRect
GdipDrawImageI
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectRectI
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGetImageWidth
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipLoadImageFromFileICM
GdipLoadImageFromFile

crypt32

CryptUnprotectData

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW
timeKillEvent

Exports

Exports

??0XLSSheet@@QAE@ABV0@@Z
??4XLSSheet@@QAEAAV0@ABV0@@Z
??_7XLSSheet@@6B@
tango_decode
tango_infofree
viber
viber_infofree

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 583KB - Virtual size: 582KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 230KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iTunesDecrypt.dll
.dll windows:5 windows x86 arch:x86

a5f97a97a7ee69ccb56186d5c765d8d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:38:90:88:09:2a:b1:cf:ea:61:11:8a:75:91:d3:7a:7e:58:68:2c
Signer

Actual PE Digest

63:38:90:88:09:2a:b1:cf:ea:61:11:8a:75:91:d3:7a:7e:58:68:2c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\IPhone3GS_Recovery\trunk\components\TunesDecrypt\trunk\win\lib\release(Dynamic loading CoreFoundaion)\iTunesDecrypt.pdb

Imports

kernel32

FileTimeToLocalFileTime
GetDriveTypeA
GetProcessHeap
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetCurrentProcess
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
GetModuleFileNameA
GetStdHandle
LCMapStringW
LCMapStringA
GetCPInfo
ExitProcess
HeapReAlloc
HeapSize
RtlUnwind
HeapAlloc
GetCommandLineA
GetSystemTimeAsFileTime
GetDriveTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapFree
Sleep
GetThreadTimes
QueryPerformanceCounter
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentThread
GetLocaleInfoW
CompareStringA
InterlockedExchange
FileTimeToSystemTime
lstrlenA
lstrcmpA
InterlockedIncrement
GetModuleHandleA
GlobalFlags
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GetCurrentProcessId
SetErrorMode
lstrlenW
GetCurrentThreadId
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalAlloc
GlobalHandle
GlobalUnlock
GlobalReAlloc
GlobalLock
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedDecrement
GetModuleHandleW
SetLastError
GetProcAddress
GetCurrentDirectoryW
LoadLibraryW
FreeLibrary
CreateThread
ResetEvent
SetCurrentDirectoryW
FindClose
GetLastError
CreateFileW
GetModuleFileNameW
FormatMessageW
CreateDirectoryW
SetEnvironmentVariableA
GetEnvironmentVariableW
GetFullPathNameW
SetFileAttributesW
DeleteFileW
CloseHandle
FindNextFileW
CreateEventW
GetExitCodeThread
RaiseException
MultiByteToWideChar
CopyFileW
WideCharToMultiByte
SetEvent
WaitForSingleObject
MoveFileExW
FreeEnvironmentStringsA
FindFirstFileW

user32

RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
GetWindowTextW
GetForegroundWindow
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
DispatchMessageW
DefWindowProcW
SendMessageW
SetWindowTextW
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
PostMessageW
GetClassInfoExW
ClientToScreen
CreateWindowExW
SetWindowLongW
PeekMessageW
GetWindowLongW
TranslateMessage
MsgWaitForMultipleObjects
DestroyWindow
UnhookWindowsHookEx
ValidateRect
GetKeyState
CallNextHookEx
SetWindowsHookExW
UnregisterClassW
MessageBoxW
EnableWindow
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetDC
ReleaseDC
GetSysColorBrush
LoadCursorW
DestroyMenu
PostQuitMessage
RegisterClassW
GetClassInfoW
GetSysColor
AdjustWindowRectEx
GetDlgCtrlID
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowThreadProcessId
GetParent
GetLastActivePopup
IsWindowEnabled

gdi32

SetMapMode
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetStockObject
GetDeviceCaps

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

oleaut32

VariantClear
VariantChangeType
VariantInit

shlwapi

PathFindExtensionW
PathFindFileNameW

oleacc

CreateStdAccessibleObject
LresultFromObject

Exports

Exports

StartDecrypt
StopDecrypt

Sections

.text
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iTunesdll/CoreFP.dll
.dll windows:4 windows x86 arch:x86

b196e2215eb6f3efdcf45cda6b80c1df

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:de:2f:9f:bf:7a:1d:41:91:f4:57:73:fa:11:3e:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-05-2013 00:00

Not After

23-07-2015 23:59

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:4d:f3:22:f7:03:a6:03:bf:b2:c0:13:2d:00:2d:5d:e3:ab:5a:cc
Signer

Actual PE Digest

e4:4d:f3:22:f7:03:a6:03:bf:b2:c0:13:2d:00:2d:5d:e3:ab:5a:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

kernel32

AddAtomA
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
DeleteFileA
ExitProcess
FindAtomA
FindClose
FindFirstFileA
FindNextFileA
GetAtomNameA
GetCurrentThreadId
GetEnvironmentVariableA
GetFileAttributesA
GetLastError
GetProcessHeap
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
InterlockedCompareExchange
LocalAlloc
LocalFree
ReadFile
ReleaseMutex
ResetEvent
SetEvent
SetFileAttributesA
SetFilePointer
SetUnhandledExceptionFilter
SignalObjectAndWait
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoA
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WriteFile

Exports

Exports

WIn9UJ86JKdV4dM
X46O5IeS
YlCJ3lg
dku592fbFAj
fdjkDSAFjklaf2s
lxpgvVMLd0S7uRl

Sections

.text
Size: 12.3MB - Virtual size: 12.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iTunesdll/iTunes.dll
.dll windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:de:2f:9f:bf:7a:1d:41:91:f4:57:73:fa:11:3e:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-05-2013 00:00

Not After

23-07-2015 23:59

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e6:e9:dd:eb:ce:00:15:6b:44:6e:2d:5a:47:62:7c:5e:f8:fc:36:3d
Signer

Actual PE Digest

e6:e9:dd:eb:ce:00:15:6b:44:6e:2d:5a:47:62:7c:5e:f8:fc:36:3d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BWA\iTunesWin-1200.12.1.0.71\srcroot\BuildResults\Production32\bin\iTunes.dll.pdb

Exports

Exports

??0MsgDb@@QAE@ABV0@@Z
??0MsgDbEditor@@QAE@ABV0@@Z
??4Msg@@QAEAAU0@ABU0@@Z
??4MsgDb@@QAEAAV0@ABV0@@Z
??4MsgDbEditor@@QAEAAV0@ABV0@@Z
_iTunesMainEntryPoint@24
gwks_createdvdvideosession
gwks_createdvdvideosessionW
tk_ConvertJpegToBmp
tk_ConvertJpegToBmpW
tk_registerimgapi_ex

Sections

.text
Size: 19.1MB - Virtual size: 19.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stab
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stabstr
Size: 512B - Virtual size: 115B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iTunesdll/iTunesMobileDevice.dll
.dll windows:5 windows x86 arch:x86

e4884a7967490a7e5a7d5337c34f6dc4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:de:2f:9f:bf:7a:1d:41:91:f4:57:73:fa:11:3e:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-05-2013 00:00

Not After

23-07-2015 23:59

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:23:ed:e5:5a:a8:bc:95:c2:c2:e5:6e:f4:a7:91:6a:4e:0e:82:df
Signer

Actual PE Digest

19:23:ed:e5:5a:a8:bc:95:c2:c2:e5:6e:f4:a7:91:6a:4e:0e:82:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BWA\MobileDevice_Win-757.3.2.0.6\MobileDevice_Win-757.3.2.0.6~1\Root\AppleInternal\bin32\iTunesMobileDevice.pdb

Imports

asl

asl_add_log_file
asl_log
asl_remove_log_file
asl_open

corefoundation

CFAbsoluteTimeGetCurrent
CFNumberCreate
_CFRuntimeCreateInstance
CFDictionaryCreate
CFRunLoopWakeUp
CFRunLoopSourceSignal
CFPreferencesCopyAppValue
CFRunLoopSourceInvalidate
CFRunLoopSourceCreate
CFStringCreateWithFormatAndArguments
CFDictionaryAddValue
CFDictionaryGetKeysAndValues
CFDictionaryRemoveAllValues
CFURLCopyFileSystemPath
kCFBooleanFalse
CFDictionaryCreateMutableCopy
CFErrorGetCode
CFSocketInvalidate
CFRunLoopTimerInvalidate
CFStringGetCString
CFStringDelete
CFStringGetLength
CFStringCreateMutableCopy
CFArrayGetValues
CFStringCreateArrayBySeparatingStrings
CFRunLoopAddSource
CFSocketCreateRunLoopSource
CFSocketSetSocketFlags
CFSocketGetSocketFlags
CFSocketCreateWithNative
CFRunLoopAddTimer
CFRunLoopTimerCreate
CFRunLoopRunInMode
CFRunLoopGetCurrent
CFWriteStreamCopyProperty
kCFStreamPropertyDataWritten
CFPropertyListWriteToStream
CFWriteStreamOpen
CFWriteStreamCreateWithAllocatedBuffers
CFDataGetBytePtr
CFDataGetLength
CFGetRetainCount
CFSetAddValue
CFURLCopyScheme
CFURLCreateCopyDeletingLastPathComponent
CFURLCopyLastPathComponent
CFSetApplyFunction
CFSetGetCount
CFArrayApplyFunction
CFSetCreateMutable
kCFTypeSetCallBacks
CFDictionaryApplyFunction
CFStringAppend
CFStringAppendFormat
CFStringCreateMutable
CFStringGetBytes
CFDictionaryRemoveValue
CFPropertyListCreateXMLData
CFPropertyListCreateFromXMLData
CFDataCreateWithBytesNoCopy
kCFAllocatorNull
CFDataGetBytes
CFStringCreateCopy
CFPropertyListCreateData
CFPropertyListCreateWithData
CFPreferencesAppSynchronize
CFPreferencesSetAppValue
CFURLCreateCopyDeletingPathExtension
CFURLCreateWithFileSystemPathRelativeToBase
CFStringCreateWithCString
CFRunLoopRemoveSource
kCFRunLoopCommonModes
CFArrayRemoveValueAtIndex
CFRunLoopRun
CFPropertyListIsValid
CFDictionaryContainsKey
CFDataCreateCopy
kCFPreferencesCurrentApplication
CFStringFindAndReplace
CFNumberFormatterCreateNumberFromString
CFNumberFormatterCreate
CFBundleCopyLocalizedString
CFBundleCreate
CFURLCreateWithFileSystemPath
CFBundleGetBundleWithIdentifier
CFStringCreateWithCStringNoCopy
CFReadStreamClose
CFPropertyListCreateFromStream
CFReadStreamOpen
CFReadStreamCreateWithBytesNoCopy
CFCopyTypeIDDescription
CFURLCreateWithString
CFURLCreateCopyAppendingPathComponent
CFURLGetString
CFSetContainsValue
CFStringFindWithOptions
CFURLGetFileSystemRepresentation
CFStringCompare
CFURLCreateFromFileSystemRepresentation
_CFRuntimeRegisterClass
CFDataReplaceBytes
CFDataGetMutableBytePtr
CFDataAppendBytes
CFDataCreateMutable
CFCopyDescription
CFArrayCreate
CFURLCopyPath
CFStringHasSuffix
CFArrayInsertValueAtIndex
CFWriteStreamSetProperty
kCFStreamPropertyAppendToFile
CFWriteStreamCreateWithFile
CFWriteStreamClose
CFURLCopyPathExtension
kCFErrorUnderlyingErrorKey
CFErrorCopyUserInfo
CFErrorGetDomain
CFUUIDCreateString
CFUUIDCreate
CFErrorCopyDescription
CFStringLowercase
CFLocaleCreate
CFWriteStreamWrite
CFStringCreateExternalRepresentation
CFErrorCreate
CFPropertyListCreateDeepCopy
kCFErrorLocalizedDescriptionKey
CFURLCreateStringByReplacingPercentEscapesUsingEncoding
CFStringAppendCString
CFReadStreamGetStatus
CFReadStreamRead
CFReadStreamCreateWithFile
CFStringCompareWithOptions
CFDataCreate
CFBundleGetMainBundle
CFAllocatorDeallocate
CFAllocatorAllocate
kCFNull
kCFCopyStringDictionaryKeyCallBacks
CFStringCreateWithBytes
CFSetCreateCopy
CFSetRemoveValue
CFSocketEnableCallBacks
CFStringGetMaximumSizeForEncoding
kCFErrorDomainPOSIX
CFNumberIsFloatType
CFDataSetLength
CFDictionaryGetValueIfPresent
CFHash
CFDateGetAbsoluteTime
CFAbsoluteTimeAddGregorianUnits
CFDateCompare
CFDateCreate
CFShow
kCFBundleExecutableKey
CFReadStreamCopyError
CFReadStreamUnscheduleFromRunLoop
CFReadStreamScheduleWithRunLoop
CFStreamCreatePairWithSocketToHost
CFReadStreamSetProperty
CFReadStreamSetClient
kCFRunLoopDefaultMode
CFRunLoopStop
CFErrorGetTypeID
CFDateGetTypeID
CFURLGetBaseURL
CFUUIDCreateFromString
kCFAllocatorSystemDefault
CFStringCreateWithCharacters
CFCharacterSetCreateWithCharactersInString
CFStringFindCharacterFromSet
kCFErrorDescriptionKey
CFStringCreateFromExternalRepresentation
CFStringGetIntValue
CFStringUppercase
CFStringCreateWithFileSystemRepresentation
CFBundleGetIdentifier
CFStringGetFastestEncoding
CFStringGetCStringPtr
CFURLWriteDataAndPropertiesToResource
CFDataDeleteBytes
CFReadStreamCopyProperty
CFURLGetPortNumber
CFURLCopyHostName
CFURLHasDirectoryPath
CFDataCreateMutableCopy
CFStringGetCharacterAtIndex
CFURLCreateCopyAppendingPathExtension
CFStringHasPrefix
CFArrayGetFirstIndexOfValue
CFArrayContainsValue
CFStringCreateWithSubstring
CFNumberGetType
CFArraySetValueAtIndex
kCFAllocatorMalloc
CFArrayCreateMutableCopy
CFStringCreateByCombiningStrings
CFURLGetTypeID
CFDictionaryCreateCopy
CFStringCreateWithFormat
CFEqual
CFArrayGetTypeID
kCFTypeArrayCallBacks
CFArrayCreateMutable
CFArrayAppendValue
CFArrayCreateCopy
CFArrayGetCount
CFArrayGetValueAtIndex
CFDictionaryGetValue
CFPreferencesGetAppBooleanValue
CFNumberGetValue
CFStringFind
__CFStringMakeConstantString
kCFTypeDictionaryValueCallBacks
kCFTypeDictionaryKeyCallBacks
CFGetAllocator
CFDictionaryCreateMutable
CFGetTypeID
CFStringGetTypeID
CFDictionarySetValue
CFNumberGetTypeID
kCFBooleanTrue
CFRetain
CFDataGetTypeID
CFBooleanGetTypeID
CFBooleanGetValue
CFDictionaryGetTypeID
CFRelease
CFDictionaryGetCount
kCFAllocatorDefault
CFStringGetFileSystemRepresentation
CFPreferencesGetAppIntegerValue

pthreadvc2

pthread_mutex_init
pthread_join
pthread_mutex_destroy
pthread_mutex_unlock
pthread_once
pthread_detach
pthread_create
pthread_attr_destroy
pthread_attr_setdetachstate
pthread_mutex_lock
pthread_attr_init

ws2_32

WSACleanup
htons
setsockopt
socket
connect
select
getsockname
ntohs
closesocket
shutdown
WSAGetLastError
ntohl
recv
send
htonl
WSAStartup
ioctlsocket
WSACloseEvent
WSASetEvent
WSAWaitForMultipleEvents
getaddrinfo
inet_ntoa
gethostname
WSASetLastError
WSAIoctl
WSAAddressToStringA
inet_addr
listen
bind
accept
WSACreateEvent

zlib1

deflateInit2_
deflate
get_crc_table
inflateInit2_
inflateEnd
inflate
crc32
deflateEnd

libdispatch

dispatch_get_global_queue
dispatch_retain
dispatch_source_create
dispatch_once_f
dispatch_semaphore_signal
dispatch_semaphore_wait
dispatch_async_f
dispatch_semaphore_create
dispatch_release
dispatch_queue_create
_dispatch_source_type_timer
dispatch_source_cancel
dispatch_source_testcancel
dispatch_sync_f
dispatch_resume
dispatch_source_set_timer
dispatch_time
dispatch_set_context
dispatch_source_set_event_handler_f

kernel32

LoadLibraryW
FreeLibrary
GetProcAddress
GetVersionExW
GetFileAttributesW
CreateFileW
GetFileAttributesExW
CreateThread
GetVersion
GetFileType
GetStdHandle
FlushConsoleInputBuffer
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
LoadLibraryA
GetVersionExA
SetLastError
GetLocalTime
GetFileSizeEx
DeviceIoControl
GetOverlappedResult
CreateEventW
GetModuleHandleW
LockResource
LoadResource
FindResourceW
GetModuleHandleA
SleepEx
SetErrorMode
SetThreadPriority
CancelIo
GetFileSize
TlsGetValue
RemoveDirectoryW
GetModuleFileNameW
GetFullPathNameW
CreateProcessW
GetCurrentDirectoryW
CreateFileMappingW
OpenFileMappingW
MoveFileExW
WideCharToMultiByte
SetFileAttributesW
GetModuleFileNameA
GetFileInformationByHandle
GetFileTime
MapViewOfFile
UnmapViewOfFile
ResetEvent
SetNamedPipeHandleState
FlushFileBuffers
CreateEventA
CreateNamedPipeA
ConnectNamedPipe
FindFirstFileA
FindNextFileA
VirtualQuery
GetProcessHeap
HeapAlloc
HeapFree
lstrlenA
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsSetValue
TlsAlloc
TryEnterCriticalSection
GetSystemTimeAsFileTime
GetSystemTime
OutputDebugStringA
GetTempPathW
GetTempFileNameW
DeleteFileW
CreateDirectoryW
Sleep
FindNextFileW
FindFirstFileW
WriteFile
LocalFree
InterlockedCompareExchange
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ReadFile
CloseHandle
CreateMutexW
FindClose
LoadLibraryExW
MultiByteToWideChar
GetLastError
WaitForSingleObject
ReleaseMutex
GetCurrentThreadId
DecodePointer
EncodePointer
RaiseException
InterlockedExchange
LocalAlloc
CopyFileW

user32

wsprintfW
GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
UnregisterClassW
GetPropW
SetPropW
DestroyWindow
DefWindowProcW
UnregisterDeviceNotification
PostQuitMessage
GetMessageW
DispatchMessageW
SendMessageW
CreateWindowExW
RegisterDeviceNotificationW
RegisterClassW
MsgWaitForMultipleObjects

gdi32

CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
GetObjectA
BitBlt
GetBitmapBits
DeleteObject
DeleteDC
CreateDCA

advapi32

RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptHashData
RegQueryValueExW
RegOpenKeyExW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegQueryValueExA
RegOpenKeyExA
GetUserNameW
CryptCreateHash
CryptAcquireContextW

shell32

SHGetFolderPathAndSubDirW
SHCreateDirectoryExW
SHFileOperationW
SHGetFolderPathW

ole32

StringFromGUID2

msvcr100

_initterm_e
_wgetenv
fprintf
__iob_func
memset
strerror
free
calloc
_errno
malloc
memcpy
fread
fwrite
ftell
_ftelli64
fseek
_fseeki64
fclose
ferror
sprintf_s
realloc
_snwprintf
strncmp
_snwprintf_s
_unlink
_beginthreadex
wcschr
_localtime64
_mktime64
_time64
_strtoui64
atoi
strncpy
_endthreadex
_close
sscanf
sprintf
rand
srand
memchr
fflush
vfprintf
strerror_s
strrchr
strncpy_s
strtol
isalpha
isdigit
toupper
_snprintf_s
_snprintf
_wfopen_s
_wsopen_s
_strerror_s
wcscat_s
_write
fprintf_s
abort
_wfopen
??3@YAXPAX@Z
??2@YAPAXI@Z
printf
fopen
strchr
getenv
strtoul
wcsstr
_vsnprintf
isspace
tolower
_setmode
_fileno
_scwprintf
fgets
qsort
isupper
isalnum
strcmp
_gmtime64
isxdigit
fputs
signal
_getch
strstr
memmove
_ftime64
_fstat64i32
_stat64i32
_strtoi64
strcat_s
strncat
_ctime64
_CxxThrowException
memcpy_s
memmove_s
_strlwr_s
_strnicmp
wcscpy_s
??_V@YAXPAX@Z
_strupr_s
_wcsicmp
__CxxFrameHandler3
_strupr
strcpy
strlen
_wchmod
_wstat64i32
?_wopen@@YAHPB_WHH@Z
_wmkdir
_wrename
_waccess
_wunlink
vsprintf_s
_strdup
_localtime64_s
_isatty
_vscprintf
_vsnprintf_s
_getpid
strftime
isprint
_purecall
_read
_wstat32i64
_stricmp
_set_errno
_get_osfhandle
_malloc_crt
_encoded_null
_initterm
feof
_amsg_exit
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_CRT_RTC_INITW
_crt_debugger_hook
__clean_type_info_names_internal
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_wputenv
_mktemp

cfnetwork

CFHTTPMessageCreateRequest
CFHTTPMessageSetBody
kCFHTTPVersion1_1
CFURLRequestCreateMutableHTTPRequest
CFURLResponseGetHTTPResponse
CFReadStreamCreateForHTTPRequest
CFURLConnectionSendSynchronousRequest
CFHTTPMessageGetResponseStatusCode
kCFStreamPropertyHTTPResponseHeader
kCFStreamPropertySOCKSProxy
CFHTTPMessageSetHeaderFieldValue

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
CM_Get_Parent
CM_Get_Sibling
CM_Get_Child
CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_ID_Size
CM_Get_Device_IDA
CM_Locate_DevNodeW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInterfaceDetailA

Exports

Exports

?AFCLog@@YAXHPBDZZ
?AFCPlatformInitialize@@YAXXZ
?AFCSetLogLevel@@YAXH@Z
AFCConnectionClose
AFCConnectionCopyLastErrorInfo
AFCConnectionCreate
AFCConnectionGetContext
AFCConnectionGetFSBlockSize
AFCConnectionGetIOTimeout
AFCConnectionGetSecureContext
AFCConnectionGetSocketBlockSize
AFCConnectionGetStatus
AFCConnectionGetTypeID
AFCConnectionInvalidate
AFCConnectionIsValid
AFCConnectionOpen
AFCConnectionProcessOperation
AFCConnectionProcessOperations
AFCConnectionScheduleWithRunLoop
AFCConnectionSetCallBack
AFCConnectionSetContext
AFCConnectionSetDisposeSecureContextOnInvalidate
AFCConnectionSetFSBlockSize
AFCConnectionSetFatalError
AFCConnectionSetIOTimeout
AFCConnectionSetSecureContext
AFCConnectionSetSocketBlockSize
AFCConnectionSubmitOperation
AFCConnectionUnscheduleFromRunLoop
AFCCopyErrorString
AFCCopyPacketTypeString
AFCDeviceInfoOpen
AFCDirectoryClose
AFCDirectoryCreate
AFCDirectoryOpen
AFCDirectoryRead
AFCDiscardBodyData
AFCDiscardData
AFCErrnoToAFCError
AFCFileDescriptorCreateCloseOperation
AFCFileDescriptorCreateGetPositionOperation
AFCFileDescriptorCreateLockOperation
AFCFileDescriptorCreateReadAtPositionOperation
AFCFileDescriptorCreateReadOperation
AFCFileDescriptorCreateSetImmutableHintOperation
AFCFileDescriptorCreateSetPositionOperation
AFCFileDescriptorCreateSetSizeOperation
AFCFileDescriptorCreateUnlockOperation
AFCFileDescriptorCreateWriteAtPositionOperation
AFCFileDescriptorCreateWriteOperation
AFCFileDescriptorGetTypeID
AFCFileDescriptorInvalidate
AFCFileDescriptorIsValid
AFCFileInfoOpen
AFCFileRefClose
AFCFileRefLock
AFCFileRefOpen
AFCFileRefRead
AFCFileRefSeek
AFCFileRefSetFileSize
AFCFileRefTell
AFCFileRefUnlock
AFCFileRefWrite
AFCFlushData
AFCGetClientVersionString
AFCKeyValueClose
AFCKeyValueRead
AFCLinkPath
AFCLockCreate
AFCLockFree
AFCLockLock
AFCLockTryLock
AFCLockUnlock
AFCOperationCopyPacketData
AFCOperationCreateGetConnectionInfo
AFCOperationCreateGetDeviceInfo
AFCOperationCreateGetFileHash
AFCOperationCreateGetFileHashWithRange
AFCOperationCreateGetFileInfo
AFCOperationCreateGetSizeOfPathContents
AFCOperationCreateLinkPath
AFCOperationCreateMakeDirectory
AFCOperationCreateOpenFile
AFCOperationCreatePacketHeaderDictionary
AFCOperationCreateReadDirectory
AFCOperationCreateRemovePath
AFCOperationCreateRemovePathAndContents
AFCOperationCreateRenamePath
AFCOperationCreateSetConnectionOptions
AFCOperationCreateSetModTime
AFCOperationGetContext
AFCOperationGetResultObject
AFCOperationGetResultStatus
AFCOperationGetState
AFCOperationGetTypeID
AFCOperationSetContext
AFCReadData
AFCReadPacket
AFCReadPacketBody
AFCReadPacketHeader
AFCRemovePath
AFCRenamePath
AFCSendData
AFCSendDataPacket
AFCSendHeader
AFCSendPacket
AFCSendStatus
AFCStringCopy
AFCValidateHeader
AMDCopyArrayOfDevicesMatchingQuery
AMDCopyAuthenticationIdentityForDevice
AMDCopyErrorText
AMDCopySystemBonjourUniqueID
AMDFUModeDeviceCopyAuthInstallPreflightOptions
AMDFUModeDeviceCopyBoardConfig
AMDFUModeDeviceGetBoardID
AMDFUModeDeviceGetChipID
AMDFUModeDeviceGetECID
AMDFUModeDeviceGetLocationID
AMDFUModeDeviceGetProductID
AMDFUModeDeviceGetProductType
AMDFUModeDeviceGetProductionMode
AMDFUModeDeviceGetProgress
AMDFUModeDeviceGetSecurityDomain
AMDFUModeDeviceGetSecurityEpoch
AMDFUModeDeviceGetTypeID
AMDFUModeDeviceIsBootstrapOnly
AMDFUModeDeviceRequestAbbreviatedSendSync
AMDGetPairingRecordDirectoryPath
AMDListenForNotifications
AMDObserveNotification
AMDPostNotification
AMDSecureListenForNotifications
AMDSecureObserveNotification
AMDSecurePostNotification
AMDSecureShutdownNotificationProxy
AMDServiceConnectionCreate
AMDServiceConnectionGetSecureIOContext
AMDServiceConnectionGetSocket
AMDServiceConnectionGetTypeID
AMDServiceConnectionInvalidate
AMDServiceConnectionReceive
AMDServiceConnectionReceiveMessage
AMDServiceConnectionSend
AMDServiceConnectionSendMessage
AMDSetLogLevel
AMDShutdownNotificationProxy
AMDeviceActivate
AMDeviceArchiveApplication
AMDeviceCheckCapabilitiesMatch
AMDeviceConnect
AMDeviceCopyAuthInstallPreflightOptions
AMDeviceCopyDeviceIdentifier
AMDeviceCopyDeviceLocation
AMDeviceCopyProvisioningProfiles
AMDeviceCopyValue
AMDeviceCopyValueWithError
AMDeviceCreateHouseArrestService
AMDeviceCreateWakeupToken
AMDeviceDeactivate
AMDeviceDisconnect
AMDeviceEnterRecovery
AMDeviceExtendedPairWithOptions
AMDeviceGetConnectionID
AMDeviceGetInterfaceSpeed
AMDeviceGetInterfaceType
AMDeviceGetTypeID
AMDeviceGetUserInfo
AMDeviceGetWirelessBuddyFlags
AMDeviceInstallApplication
AMDeviceInstallProvisioningProfile
AMDeviceIsPaired
AMDeviceIsValid
AMDeviceLookupApplicationArchives
AMDeviceLookupApplications
AMDeviceNotificationSubscribe
AMDeviceNotificationUnsubscribe
AMDevicePair
AMDevicePairWithOptions
AMDevicePowerAssertionCreate
AMDevicePowerAssertionGetTypeID
AMDevicePreflightOperationCreate
AMDevicePreflightOperationGetRunLoopSource
AMDevicePreflightOperationGetTypeID
AMDevicePreflightOperationInvalidate
AMDeviceRelease
AMDeviceRemoveApplicationArchive
AMDeviceRemoveProvisioningProfile
AMDeviceRemoveValue
AMDeviceRequestAbbreviatedSendSync
AMDeviceRestoreApplication
AMDeviceRetain
AMDeviceSecureArchiveApplication
AMDeviceSecureCheckCapabilitiesMatch
AMDeviceSecureInstallApplication
AMDeviceSecureRemoveApplicationArchive
AMDeviceSecureRestoreApplication
AMDeviceSecureStartService
AMDeviceSecureTransferPath
AMDeviceSecureUninstallApplication
AMDeviceSecureUpgradeApplication
AMDeviceSetUserInfo
AMDeviceSetValue
AMDeviceSetWirelessBuddyFlags
AMDeviceStartHouseArrestService
AMDeviceStartService
AMDeviceStartServiceWithOptions
AMDeviceStartSession
AMDeviceStopSession
AMDeviceTransferApplication
AMDeviceTransferPath
AMDeviceUninstallApplication
AMDeviceUnpair
AMDeviceUpgradeApplication
AMDeviceValidatePairing
AMDeviceWakeupOperationCreateWithToken
AMDeviceWakeupOperationGetTypeID
AMDeviceWakeupOperationInvalidate
AMDeviceWakeupOperationSchedule
AMDeviceWakeupUsingToken
AMRAuthInstallCopyLocalizedStringForServerError
AMRAuthInstallCopyPreflightOptions
AMRAuthInstallFinalize
AMRAuthInstallPreflight
AMRAuthInstallRegisterProxyCredentialsCallback
AMRLog
AMRLogv
AMRecoveryModeDeviceCopyAuthInstallPreflightOptions
AMRecoveryModeDeviceCopyBoardConfig
AMRecoveryModeDeviceCopyEnvironmentVariableFromDevice
AMRecoveryModeDeviceCopyIMEI
AMRecoveryModeDeviceCopySerialNumber
AMRecoveryModeDeviceGetBoardID
AMRecoveryModeDeviceGetChipID
AMRecoveryModeDeviceGetECID
AMRecoveryModeDeviceGetLocationID
AMRecoveryModeDeviceGetProductID
AMRecoveryModeDeviceGetProductType
AMRecoveryModeDeviceGetProductionMode
AMRecoveryModeDeviceGetProgress
AMRecoveryModeDeviceGetSecurityDomain
AMRecoveryModeDeviceGetSecurityEpoch
AMRecoveryModeDeviceGetTypeID
AMRecoveryModeDeviceIsBootstrapOnly
AMRecoveryModeDeviceReboot
AMRecoveryModeDeviceRequestAbbreviatedSendSync
AMRecoveryModeDeviceSendBlindCommandToDevice
AMRecoveryModeDeviceSendCommandToDevice
AMRecoveryModeDeviceSendFileToDevice
AMRecoveryModeDeviceSetAutoBoot
AMRecoveryModeGetSoftwareBuildVersion
AMRestorableBuildCopyRestoreBundleURL
AMRestorableBuildCopySupportedBoardConfigs
AMRestorableBuildCopySupportedVariants
AMRestorableBuildCreate
AMRestorableCommitStashBag
AMRestorableDeviceCopyAMDevice
AMRestorableDeviceCopyAuthInstallPreflightOptions
AMRestorableDeviceCopyBoardConfig
AMRestorableDeviceCopyDFUModeDevice
AMRestorableDeviceCopyDefaultRestoreOptions
AMRestorableDeviceCopyRecoveryModeDevice
AMRestorableDeviceCopyRestoreModeDevice
AMRestorableDeviceCopyRestoreOptionsFromDocument
AMRestorableDeviceCopySerialDevicePath
AMRestorableDeviceCopySerialNumber
AMRestorableDeviceCreateFromAMDevice
AMRestorableDeviceEnableExtraDFUDevices
AMRestorableDeviceGetDFUModeDevice
AMRestorableDeviceGetECID
AMRestorableDeviceGetFusingInfo
AMRestorableDeviceGetLocationID
AMRestorableDeviceGetProductID
AMRestorableDeviceGetProductType
AMRestorableDeviceGetRecoveryModeDevice
AMRestorableDeviceGetState
AMRestorableDeviceRegisterForNotifications
AMRestorableDeviceRestore
AMRestorableDeviceSendBlindCommand
AMRestorableDeviceSendCommand
AMRestorableDeviceSendFile
AMRestorableDeviceSetLogFileURL
AMRestorableDeviceSetProxyCredentialsCallback
AMRestorableDeviceUnregisterForNotifications
AMRestorableEnableLogStreaming
AMRestorableGetIdentifyingErrorCode
AMRestorableLogToFile
AMRestorablePersonalizeCopyManifestTag
AMRestorablePersonalizeSendFile
AMRestorableSetGlobalLocationIDFilter
AMRestorableSetGlobalLogFileURL
AMRestorableSetLogLevel
AMRestoreCreateBootArgsByAddingArg
AMRestoreCreateBootArgsByRemovingArg
AMRestoreCreateDefaultOptions
AMRestoreCreatePathsForBundle
AMRestoreDisableFileLogging
AMRestoreEnableExtraDFUDevices
AMRestoreEnableFileLogging
AMRestoreGetSupportedPayloadVersion
AMRestoreGetTransformedDFUType
AMRestoreGetTransformedFirmwareTypeValue
AMRestoreModeDeviceCopyBoardConfig
AMRestoreModeDeviceCopyEcid
AMRestoreModeDeviceCopyIMEI
AMRestoreModeDeviceCopyRestoreLog
AMRestoreModeDeviceCopySerialNumber
AMRestoreModeDeviceCreate
AMRestoreModeDeviceGetDeviceID
AMRestoreModeDeviceGetLocationID
AMRestoreModeDeviceGetProgress
AMRestoreModeDeviceGetTypeID
AMRestoreModeDeviceReboot
AMRestoreModeGetLastFailureLog
AMRestorePerformDFURestore
AMRestorePerformRecoveryModeRestore
AMRestorePerformRestoreModeRestore
AMRestorePerformRestoreModeRestoreWithError
AMRestoreRegisterForDeviceNotifications
AMRestoreSetLogLevel
AMRestoreUnregisterForDeviceNotifications
AMSAddAppleSearchPathsToEnvironmentFromReg
AMSArchiveBackup
AMSBackupWithOptions
AMSBeginSync
AMSBeginSyncForDataClasses
AMSCancelBackupRestore
AMSCancelCrashReportCopy
AMSCancelSync
AMSCancelSyncDiagnostics
AMSChangeBackupPassword
AMSCleanup
AMSClearDataClasses
AMSConnectToCrashReportCopyTarget
AMSCopyApplicationListFromBackup
AMSCopyCrashReportPath
AMSCopyCrashReportsFromTarget
AMSCopySourcesForRestoreCompatibleWith
AMSDisconnectFromCrashReportCopyTarget
AMSEnableCloudBackup
AMSEnableSyncServices
AMSGetAOSUsername
AMSGetApplicationProviderInfo
AMSGetBackupInfo
AMSGetBackupPasswordFromKeychainForTarget
AMSGetCalendarDayLimit
AMSGetClientIdentifierAndDisplayNameForTarget
AMSGetCollectionsForDataClassName
AMSGetCrashReportCopyPreferencesForTarget
AMSGetDataChangeAlertInfo
AMSGetDataClassInfoForTarget
AMSGetDefaultOutlookCalendarMapping
AMSGetLastSyncDateForDataClass
AMSGetNewRecordCalendarName
AMSGetNewRecordGroupName
AMSGetNumberOfCrashReportsToCopy
AMSGetNumberOfCrashReportsToSubmit
AMSGetSourcesForRestore
AMSGetSupportedDataClassNames
AMSInitialize
AMSIsSyncServicesEnabled
AMSRefreshCollectionsForDataClassName
AMSRegisterCallbacks
AMSRegisterClientWithTargetIdentifierAndDisplayName
AMSResetSyncData
AMSRestoreWithApplications
AMSRunSyncDiagnostics
AMSSetBackupPasswordInKeychain
AMSSetCalendarDayLimit
AMSSetCrashReportCopyPreferencesForTarget
AMSSetDataChangeAlertInfo
AMSSetDataClassInfoForTarget
AMSSetDefaultOutlookCalendarMapping
AMSSetDesignatedProviderForDataClassName
AMSSetFilteredCollectionNamesForDataClassName
AMSSetNewRecordCalendarName
AMSSetNewRecordGroupName
AMSSubmitCrashReportsFromTarget
AMSSubmitRestoreLogFromPath
AMSUnregisterTarget
ASRServerHandleConnection
MISProfileCopyPayload
MISProfileCopySignerSubjectSummary
MISProfileCreateDataRepresentation
MISProfileCreateWithData
MISProfileCreateWithFile
MISProfileGetValue
MISProfileIsMutable
MISProfileValidateSignature
MISProfileValidateSignatureWithAnchors
MISProfileWriteToFile
MISProvisioningProfileCheckValidity
MISProvisioningProfileGetCreationDate
MISProvisioningProfileGetDeveloperCertificates
MISProvisioningProfileGetExpirationDate
MISProvisioningProfileGetName
MISProvisioningProfileGetProvisionedDevices
MISProvisioningProfileGetUUID
MISProvisioningProfileGetVersion
MISProvisioningProfileIncludesDevice
MISProvisioningProfileProvisionsAllDevices
MISProvisioningProfileValidateSignature
RCGetSystemPartitionExtrasSizeForDevice
USBMuxConnectByPort
USBMuxListenForDevices
USBMuxListenerClose
USBMuxListenerCreate
USBMuxListenerSetDebug
kAFCErrorCodeKey
kAFCErrorDebugDescriptionKey
kAFCErrorDescriptionKey
kAFCErrorDomain
kAFCErrorDomainKey
kAFCErrorExtendedInfoKey
kAFCErrorFileLineKey
kAFCErrorFileNameKey
kAFCErrorLocalizedDescriptionKey
kAFCErrorLocalizedFailureReasonKey
kAFCErrorLocalizedRecoverySuggestionKey
kAFCErrorUnderlyingErrorKey
kAFCErrorVersionKey
kAFCHeaderKeyHeaderLength
kAFCHeaderKeyPacketData
kAFCHeaderKeyPacketID
kAFCHeaderKeyPacketLength
kAFCHeaderKeyPacketType
kAFCHeaderKeySignature
kAMRestorableInvalidClientID

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 373KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iany.dll
.dll windows:5 windows x86 arch:x86

59d118a7e510ad2c0c5b4add3920e5e4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

86:3b:eb:1b:d4:6f:1a:cf:42:e4:ba:df:40:a3:5f:56:67:b4:6f:cf
Signer

Actual PE Digest

86:3b:eb:1b:d4:6f:1a:cf:42:e4:ba:df:40:a3:5f:56:67:b4:6f:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

H:\Work\iany\interface\Release\iany.pdb

Imports

ws2_32

recv
send
htons
ntohl
closesocket

shlwapi

PathFileExistsW

managercdb

itdb_photodb_write
itdb_artist_free
itdb_playlist_new
itdb_playlist_is_mpl
itdb_playlist_is_podcasts
itdb_playlist_add
itdb_photodb_parse
itdb_photo_free
itdb_add_photo_album
itdb_parse
itdb_write_file
itdb_free
itdb_add_track_new
itdb_playlist_add_track
itdb_playlist_mpl
itdb_track_free
itdb_members_track_free
itdb_playlist_free
itdb_del_photo_album
itdb_del_photos
itdb_add_photos
itdb_album_free

sqlite3

sqlite3_close
sqlite3_open
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_int64
sqlite3_column_text
sqlite3_column_type
sqlite3_finalize
sqlite3_exec
sqlite3_free_table
sqlite3_free
sqlite3_get_table

un7z

Uncompression

user32

wsprintfA
wsprintfW

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateGuid
CoUninitialize

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FlushFileBuffers
SetStdHandle
GetFullPathNameW
SetFilePointerEx
ReadConsoleW
GetACP
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCommandLineA
GetStdHandle
MoveFileExW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
SetEnvironmentVariableW
SetEnvironmentVariableA
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
CreateDirectoryW
InterlockedFlushSList
FreeLibrary
RtlUnwind
GetCommandLineW
SetEndOfFile
VirtualProtect
VirtualQuery
LoadLibraryExA
WriteConsoleW
OutputDebugStringW
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
FindClose
GetTempPathW
FindFirstFileW
FindNextFileW
GetModuleFileNameA
GetLastError
SystemTimeToFileTime
RemoveDirectoryW
DeleteFileW
GetProcAddress
CreateThread
WaitForSingleObject
Sleep
ReadFile
SetFilePointer
CloseHandle
GetSystemInfo
LoadLibraryW
GetModuleHandleW
GetEnvironmentVariableW
CreateFileW
GetComputerNameW
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
CreateEventW
LoadLibraryExW
GetModuleFileNameW
GetSystemDirectoryA
GetCurrentDirectoryW
GetLocalTime
GetTimeZoneInformation
WriteFile
SetNamedPipeHandleState
WaitNamedPipeW
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
GlobalFree
ResetEvent
GetFileTime
GetSystemTime
FileTimeToSystemTime
GetExitCodeThread
WaitForMultipleObjects
GetDiskFreeSpaceExW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

advapi32

SystemFunction036
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyW

shell32

ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHCreateDirectoryExW

gdiplus

GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageThumbnail
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipSaveImageToStream
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipSetCompositingQuality
GdipFree
GdipSetInterpolationMode
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawRectangleI
GdipGraphicsClear
GdipFillRectangleI
GdipDrawImageRectI
GdipDrawImageRectRect
GdipSaveGraphics
GdipAlloc
GdipSetSmoothingMode

Exports

Exports

DeleteIanyManager
GetIanyManager
IOSInitialize
IOSListener
IsWiFiConnect
small_irestore

Sections

.text
Size: 562KB - Virtual size: 561KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iconv.dll
.dll windows:4 windows x86 arch:x86

2fecad82d36d88ec85ac574c16ce0ddd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

35:aa:43:f6:0d:84:95:b7:83:28:c5:eb:d9:ed:97:88:5b:00:90:c9
Signer

Actual PE Digest

35:aa:43:f6:0d:84:95:b7:83:28:c5:eb:d9:ed:97:88:5b:00:90:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
memcmp
free
qsort
strlen
sprintf
memcpy
strcmp
_initterm
_adjust_fdiv
memset
_errno
strchr
abort
_strdup

kernel32

GetModuleFileNameA
GetACP
Sleep

Exports

Exports

_libiconv_version
libiconv
libiconv_close
libiconv_open
libiconv_set_relocation_prefix
libiconvctl
libiconvlist
locale_charset

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 800KB - Virtual size: 799KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
language/english/ResourceLib.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\IPhone3GS_Recovery\trunk\components\ResourceLib\english\ResourceLib.pdb

Sections

.rdata
Size: 512B - Virtual size: 187B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
language/english/image/CHN.png
.png
language/english/image/GER.png
.png
language/english/image/USA.png
.png
language/english/image/about_backgroud.png
.png
language/english/image/backgroud.png
.png
language/english/image/bg_checkupdate.png
.png
language/english/image/bg_deleted.png
.png
language/english/image/bg_deleted_scanning.png
.png
language/english/image/bg_help_center.png
.png
language/english/image/bg_icloud_list.png
.png
language/english/image/bg_itunes.png
.png
language/english/image/bg_itunes_reslut.png
.png
language/english/image/bg_limited.png
.png
language/english/image/bg_locked.png
.png
language/english/image/bg_popup.png
.png
language/english/image/bg_progress.png
.png
language/english/image/bg_register.png
.png
language/english/image/bg_report.png
.png
language/english/image/bg_solution.png
.png
language/english/image/bg_step_transparent.png
.png
language/english/image/bg_transparent.png
.png
language/english/image/bg_trust.png
.png
language/english/image/bg_unregistered.png
.png
language/english/image/btn_Apple_ID.png
.png
language/english/image/btn_Print.png
.png
language/english/image/btn_Sign_Out.png
.png
language/english/image/btn_Software_Access.png
.png
language/english/image/btn_back.png
.png
language/english/image/btn_home.png
.png
language/english/image/btn_language.png
.png
language/english/image/btn_login.png
.png
language/english/image/btn_next.png
.png
language/english/image/btn_register.png
.png
language/english/image/btn_save.png
.png
language/english/image/btn_send.png
.png
language/english/image/btn_start.png
.png
language/english/image/btn_start_scan.png
.png
language/english/image/button_Purchase.png
.png
language/english/image/button_Remind.png
.png
language/english/image/button_about.png
.png
language/english/image/button_cancel.png
.png
language/english/image/button_close.png
.png
language/english/image/button_enter_license.png
.png
language/english/image/button_freetrial.png
.png
language/english/image/button_go.png
.png
language/english/image/button_help.png
.png
language/english/image/button_help_connected.png
.png
language/english/image/button_home.png
.png
language/english/image/button_key.png
.png
language/english/image/button_learn_more.png
.png
language/english/image/button_menu_icloud.png
.png
language/english/image/button_menu_iphone.png
.png
language/english/image/button_menu_itunes.png
.png
language/english/image/button_min.png
.png
language/english/image/button_next.png
.png
language/english/image/button_ok.png
.png
language/english/image/button_open.png
.png
language/english/image/button_pause.png
.png
language/english/image/button_popup.png
.png
language/english/image/button_previous.png
.png
language/english/image/button_recover.png
.png
language/english/image/button_registration.png
.png
language/english/image/button_resume.png
.png
language/english/image/button_scan_pause.png
.png
language/english/image/button_scan_stop.png
.png
language/english/image/button_select.png
.png
language/english/image/button_start.png
.png
language/english/image/button_stop.png
.png
language/english/image/button_trust.png
.png
language/english/image/buy_now_limited.png
.png
language/english/image/buynow.png
.png
language/english/image/can_scan_bg.png
.png
language/english/image/center_icloud.png
.png
language/english/image/center_ios.png
.png
language/english/image/center_itunes.png
.png
language/english/image/check_all.png
.png
language/english/image/check_none.png
.png
language/english/image/check_segment.png
.png
language/english/image/data2device/btn_Recover_device.png
.png
language/english/image/data2device/btn_Recover_pc.png
.png
language/english/image/data2device/icon_contact.png
.png
language/english/image/data2device/icon_message.png
.png
language/english/image/data2device/icon_note.png
.png
language/english/image/data2device/main_bg.png
.png
language/english/image/data2device/search_panel_bg.png
.png
language/english/image/decrypt_btn.png
.png
language/english/image/detail_WhatsApp_Attachments.png
.png
language/english/image/detail_calls.png
.png
language/english/image/detail_camera.png
.png
language/english/image/detail_contacts.png
.png
language/english/image/detail_data.png
.png
language/english/image/detail_document.png
.png
language/english/image/detail_message_attachment.png
.png
language/english/image/detail_messages.png
.png
language/english/image/detail_messenger.png
.png
language/english/image/detail_messenger_attachment.png
.png
language/english/image/detail_note_attachment.png
.png
language/english/image/detail_notes.png
.png
language/english/image/detail_other_photos.png
.png
language/english/image/detail_photos.png
.png
language/english/image/detail_recordings.png
.png
language/english/image/detail_reminders.png
.png
language/english/image/detail_safari.png
.png
language/english/image/detail_tango.png
.png
language/english/image/detail_viber.png
.png
language/english/image/detail_viber_messages.png
.png
language/english/image/detail_voicemail.png
.png
language/english/image/device_enable.png
.png
language/english/image/device_encrypt.png
.png
language/english/image/device_icloud.png
.png
language/english/image/device_info_bg.png
.png
language/english/image/device_lock_bg.png
.png
language/english/image/device_video.png
.png
language/english/image/device_whatsapp.png
.png
language/english/image/diskInfo/disk.png
.png
language/english/image/diskInfo/disk_bg.png
.png
language/english/image/diskInfo/disk_bg_click.png
.png
language/english/image/diskInfo/disk_c.png
.png
language/english/image/diskInfo/disk_c_click.png
.png
language/english/image/diskInfo/disk_click.png
.png
language/english/image/diskInfo/disk_track.png
.png
language/english/image/diskInfo/disk_track2.png
.png
language/english/image/dll_download_bg.png
.png
language/english/image/download_bg.png
.png
language/english/image/find.gif
.gif
language/english/image/find_top_bg.png
.png
language/english/image/flow/audio_btn_paly.png
.png
language/english/image/flow/audio_btn_stop.png
.png
language/english/image/flow/incoming_bottom.png
.png
language/english/image/flow/incoming_center.png
.png
language/english/image/flow/incoming_top.png
.png
language/english/image/flow/outgoing_bottom.png
.png
language/english/image/flow/outgoing_bottom_imessage.png
.png
language/english/image/flow/outgoing_center.png
.png
language/english/image/flow/outgoing_center_imessage.png
.png
language/english/image/flow/outgoing_top.png
.png
language/english/image/flow/outgoing_top_imessage.png
.png
language/english/image/flow/view_video.png
.png
language/english/image/flow/view_video_cannot_preview.png
.png
language/english/image/flow/view_voice.png
.png
language/english/image/gif_scan.gif
.gif
language/english/image/gif_scan_completed.png
.png
language/english/image/gif_search.gif
.gif
language/english/image/iCloud_download.gif
.gif
language/english/image/icloud_select_type_bg.png
.png
language/english/image/ico_app.png
.png
language/english/image/ico_media.png
.png
language/english/image/ico_text.png
.png
language/english/image/imageViewBundle/btn_panel_bg.png
.png
language/english/image/imageViewBundle/button_actual.png
.png
language/english/image/imageViewBundle/button_clockwise.png
.png
language/english/image/imageViewBundle/button_close.png
.png
language/english/image/imageViewBundle/button_contrarotate.png
.png
language/english/image/imageViewBundle/button_max.png
.png
language/english/image/imageViewBundle/button_next.png
.png
language/english/image/imageViewBundle/button_next_preview.png
.png
language/english/image/imageViewBundle/button_previous.png
.png
language/english/image/imageViewBundle/button_previous_preview.png
.png
language/english/image/imageViewBundle/button_restore.png
.png
language/english/image/imageViewBundle/button_suitable.png
.png
language/english/image/imageViewBundle/button_zoom_in.png
.png
language/english/image/imageViewBundle/button_zoom_out.png
.png
language/english/image/imageViewBundle/center_flag.png
.png
language/english/image/imageViewBundle/message_bottom.png
.png
language/english/image/imageViewBundle/message_line_left.png
.png
language/english/image/imageViewBundle/message_line_right.png
.png
language/english/image/imageViewBundle/message_top.png
.png
language/english/image/imagelist.bmp
language/english/image/ios_help_center_bg.png
.png
language/english/image/iphoen_connect.gif
.gif
language/english/image/iphoen_connect_big.gif
.gif
language/english/image/iphone_search.swf
language/english/image/list_hearder.bmp
language/english/image/list_sort_down.png
.png
language/english/image/list_sort_up.png
.png
language/english/image/list_split.bmp
language/english/image/loading_text.png
.png
language/english/image/main_no_connct.png
.png
language/english/image/menuIcon/menu_Language.png
.png
language/english/image/menuIcon/menu_Purchase.png
.png
language/english/image/menuIcon/menu_about.png
.png
language/english/image/menuIcon/menu_contact.png
.png
language/english/image/menuIcon/menu_exit.png
.png
language/english/image/menuIcon/menu_guide.png
.png
language/english/image/menuIcon/menu_help.png
.png
language/english/image/menuIcon/menu_home.png
.png
language/english/image/menuIcon/menu_mail.png
.png
language/english/image/menuIcon/menu_updates.png
.png
language/english/image/menu_about.png
.png
language/english/image/menu_buy.png
.png
language/english/image/menu_help.png
.png
language/english/image/menu_register.png
.png
language/english/image/message_bg.png
.png
language/english/image/number.png
.png
language/english/image/number_bg.png
.png
language/english/image/output_setting_bg.png
.png
language/english/image/pic_have't_trusted.png
.png
language/english/image/pic_no_found.png
.png
language/english/image/pic_waiting.png
.png
language/english/image/preview_document.png
.png
language/english/image/preview_recording.png
.png
language/english/image/preview_video.png
.png
language/english/image/print.png
.png
language/english/image/privew.png
.png
language/english/image/railing/btn_album.png
.png
language/english/image/railing/btn_album_sel.png
.png
language/english/image/railing/btn_mid_railing.png
.png
language/english/image/railing/btn_mid_railing_sel.png
.png
language/english/image/railing/btn_railing.png
.png
language/english/image/railing/btn_railing_sel.png
.png
language/english/image/railing/btn_thumb.png
.png
language/english/image/railing/btn_thumb_sel.png
.png
language/english/image/railing/button_preview_data.png
.png
language/english/image/railing/check_all.png
.png
language/english/image/railing/check_none.png
.png
language/english/image/railing/check_segment.png
.png
language/english/image/railing/expand_flag.png
.png
language/english/image/recovery_backgroud.png
.png
language/english/image/recovery_ready_backgroud.png
.png
language/english/image/reg_fail_bg.png
.png
language/english/image/scan_now.png
.png
language/english/image/search_btn.png
.png
language/english/image/search_panel_bg.png
.png
language/english/image/search_top_bg.png
.png
language/english/image/setting.png
.png
language/english/image/sign_in_iCloud_BG.png
.png
language/english/image/top_bar_backgroud.png
.png
language/english/image/trake_slider.gif
.gif
language/english/image/version_warning.png
.png
language/english/image/wait.gif
.gif
language/english/image/wait_login.gif
.gif
language/english/pic/Success.png
.png
language/english/pic/button_Restart.png
.png
language/english/pic/button_Restart_later.png
.png
language/english/pic/button_cancel.png
.png
language/english/pic/button_close.png
.png
language/english/pic/button_min.png
.png
language/english/pic/button_no.png
.png
language/english/pic/button_ok.png
.png
language/english/pic/button_yes.png
.png
language/english/pic/error.png
.png
language/english/pic/message_bottom.png
.png
language/english/pic/message_line_left.png
.png
language/english/pic/message_line_right.png
.png
language/english/pic/message_top.png
.png
language/english/pic/msg_title_icon.png
.png
language/english/pic/warning.png
.png
language/language.xml
language/spanish/ResourceLib.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\IPhone3GS_Recovery\trunk\components\ResourceLib\Spanish\ResourceLib.pdb

Sections

.rdata
Size: 512B - Virtual size: 187B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
language/spanish/image/CHN.png
.png
language/spanish/image/GER.png
.png
language/spanish/image/SPA.png
.png
language/spanish/image/USA.png
.png
language/spanish/image/about_backgroud.png
.png
language/spanish/image/backgroud.png
.png
language/spanish/image/bg_checkupdate.png
.png
language/spanish/image/bg_deleted.png
.png
language/spanish/image/bg_deleted_scanning.png
.png
language/spanish/image/bg_help_center.png
.png
language/spanish/image/bg_icloud_list.png
.png
language/spanish/image/bg_itunes.png
.png
language/spanish/image/bg_itunes_reslut.png
.png
language/spanish/image/bg_limited.png
.png
language/spanish/image/bg_locked.png
.png
language/spanish/image/bg_popup.png
.png
language/spanish/image/bg_progress.png
.png
language/spanish/image/bg_register.png
.png
language/spanish/image/bg_report.png
.png
language/spanish/image/bg_solution.png
.png
language/spanish/image/bg_step_transparent.png
.png
language/spanish/image/bg_transparent.png
.png
language/spanish/image/bg_trust.png
.png
language/spanish/image/bg_unregistered.png
.png
language/spanish/image/btn_Apple_ID.png
.png
language/spanish/image/btn_Print.png
.png
language/spanish/image/btn_Sign_Out.png
.png
language/spanish/image/btn_Software_Access.png
.png
language/spanish/image/btn_back.png
.png
language/spanish/image/btn_home.png
.png
language/spanish/image/btn_language.png
.png
language/spanish/image/btn_login.png
.png
language/spanish/image/btn_next.png
.png
language/spanish/image/btn_panel.swf
language/spanish/image/btn_register.png
.png
language/spanish/image/btn_save.png
.png
language/spanish/image/btn_send.png
.png
language/spanish/image/btn_start.png
.png
language/spanish/image/btn_start_scan.png
.png
language/spanish/image/button_Purchase.png
.png
language/spanish/image/button_Remind.png
.png
language/spanish/image/button_about.png
.png
language/spanish/image/button_cancel.png
.png
language/spanish/image/button_close.png
.png
language/spanish/image/button_enter_license.png
.png
language/spanish/image/button_freetrial.png
.png
language/spanish/image/button_go.png
.png
language/spanish/image/button_help.png
.png
language/spanish/image/button_help_connected.png
.png
language/spanish/image/button_home.png
.png
language/spanish/image/button_key.png
.png
language/spanish/image/button_learn_more.png
.png
language/spanish/image/button_menu_icloud.png
.png
language/spanish/image/button_menu_iphone.png
.png
language/spanish/image/button_menu_itunes.png
.png
language/spanish/image/button_min.png
.png
language/spanish/image/button_next.png
.png
language/spanish/image/button_ok.png
.png
language/spanish/image/button_open.png
.png
language/spanish/image/button_pause.png
.png
language/spanish/image/button_popup.png
.png
language/spanish/image/button_previous.png
.png
language/spanish/image/button_recover.png
.png
language/spanish/image/button_registration.png
.png
language/spanish/image/button_resume.png
.png
language/spanish/image/button_scan_pause.png
.png
language/spanish/image/button_scan_stop.png
.png
language/spanish/image/button_select.png
.png
language/spanish/image/button_start.png
.png
language/spanish/image/button_stop.png
.png
language/spanish/image/button_trust.png
.png
language/spanish/image/buy_now_limited.png
.png
language/spanish/image/buynow.png
.png
language/spanish/image/can_scan_bg.png
.png
language/spanish/image/can_scan_bg_3gs.png
.png
language/spanish/image/can_scan_bg_4.png
.png
language/spanish/image/can_scan_bg_6.png
.png
language/spanish/image/center_icloud.png
.png
language/spanish/image/center_ios.png
.png
language/spanish/image/center_itunes.png
.png
language/spanish/image/check_all.png
.png
language/spanish/image/check_none.png
.png
language/spanish/image/check_segment.png
.png
language/spanish/image/data2device/btn_Recover_device.png
.png
language/spanish/image/data2device/btn_Recover_pc.png
.png
language/spanish/image/data2device/icon_contact.png
.png
language/spanish/image/data2device/icon_message.png
.png
language/spanish/image/data2device/icon_note.png
.png
language/spanish/image/data2device/main_bg.png
.png
language/spanish/image/data2device/search_panel_bg.png
.png
language/spanish/image/decrypt_btn.png
.png
language/spanish/image/detail_WhatsApp.png
.png
language/spanish/image/detail_WhatsApp_Attachments.png
.png
language/spanish/image/detail_calls.png
.png
language/spanish/image/detail_camera.png
.png
language/spanish/image/detail_contacts.png
.png
language/spanish/image/detail_data.png
.png
language/spanish/image/detail_document.png
.png
language/spanish/image/detail_message_attachment.png
.png
language/spanish/image/detail_messages.png
.png
language/spanish/image/detail_messenger.png
.png
language/spanish/image/detail_messenger_attachment.png
.png
language/spanish/image/detail_note_attachment.png
.png
language/spanish/image/detail_notes.png
.png
language/spanish/image/detail_other_photos.png
.png
language/spanish/image/detail_photos.png
.png
language/spanish/image/detail_recordings.png
.png
language/spanish/image/detail_reminders.png
.png
language/spanish/image/detail_safari.png
.png
language/spanish/image/detail_tango.png
.png
language/spanish/image/detail_viber.png
.png
language/spanish/image/detail_viber_messages.png
.png
language/spanish/image/detail_voice.png
.png
language/spanish/image/detail_voicemail.png
.png
language/spanish/image/device_enable.png
.png
language/spanish/image/device_encrypt.png
.png
language/spanish/image/device_icloud.png
.png
language/spanish/image/device_info_bg.png
.png
language/spanish/image/device_lock_bg.png
.png
language/spanish/image/device_video.png
.png
language/spanish/image/device_whatsapp.png
.png
language/spanish/image/diskInfo/disk.png
.png
language/spanish/image/diskInfo/disk_bg.png
.png
language/spanish/image/diskInfo/disk_bg_click.png
.png
language/spanish/image/diskInfo/disk_c.png
.png
language/spanish/image/diskInfo/disk_c_click.png
.png
language/spanish/image/diskInfo/disk_click.png
.png
language/spanish/image/diskInfo/disk_track.png
.png
language/spanish/image/diskInfo/disk_track2.png
.png
language/spanish/image/download_bg.png
.png
language/spanish/image/find.gif
.gif
language/spanish/image/find_top_bg.png
.png
language/spanish/image/flow/audio_btn_paly.png
.png
language/spanish/image/flow/audio_btn_stop.png
.png
language/spanish/image/flow/incoming_bottom.png
.png
language/spanish/image/flow/incoming_center.png
.png
language/spanish/image/flow/incoming_top.png
.png
language/spanish/image/flow/outgoing_bottom.png
.png
language/spanish/image/flow/outgoing_bottom_imessage.png
.png
language/spanish/image/flow/outgoing_center.png
.png
language/spanish/image/flow/outgoing_center_imessage.png
.png
language/spanish/image/flow/outgoing_top.png
.png
language/spanish/image/flow/outgoing_top_imessage.png
.png
language/spanish/image/flow/view_video.png
.png
language/spanish/image/flow/view_video_cannot_preview.png
.png
language/spanish/image/flow/view_voice.png
.png
language/spanish/image/gif_scan.gif
.gif
language/spanish/image/gif_scan_completed.png
.png
language/spanish/image/gif_search.gif
.gif
language/spanish/image/iCloud_download.gif
.gif
language/spanish/image/icloud_select_type_bg.png
.png
language/spanish/image/ico_app.png
.png
language/spanish/image/ico_media.png
.png
language/spanish/image/ico_text.png
.png
language/spanish/image/imageViewBundle/btn_panel_bg.png
.png
language/spanish/image/imageViewBundle/button_actual.png
.png
language/spanish/image/imageViewBundle/button_clockwise.png
.png
language/spanish/image/imageViewBundle/button_close.png
.png
language/spanish/image/imageViewBundle/button_contrarotate.png
.png
language/spanish/image/imageViewBundle/button_max.png
.png
language/spanish/image/imageViewBundle/button_next.png
.png
language/spanish/image/imageViewBundle/button_next_preview.png
.png
language/spanish/image/imageViewBundle/button_previous.png
.png
language/spanish/image/imageViewBundle/button_previous_preview.png
.png
language/spanish/image/imageViewBundle/button_restore.png
.png
language/spanish/image/imageViewBundle/button_suitable.png
.png
language/spanish/image/imageViewBundle/button_zoom_in.png
.png
language/spanish/image/imageViewBundle/button_zoom_out.png
.png
language/spanish/image/imageViewBundle/center_flag.png
.png
language/spanish/image/imageViewBundle/message_bottom.png
.png
language/spanish/image/imageViewBundle/message_line_left.png
.png
language/spanish/image/imageViewBundle/message_line_right.png
.png
language/spanish/image/imageViewBundle/message_top.png
.png
language/spanish/image/imagelist.bmp
language/spanish/image/ios_help_center_bg.png
.png
language/spanish/image/iphoen_connect.gif
.gif
language/spanish/image/iphoen_connect_big.gif
.gif
language/spanish/image/iphone_search.swf
language/spanish/image/iphone_search_3gs.swf
language/spanish/image/iphone_search_4.swf
language/spanish/image/iphone_search_6.swf
language/spanish/image/list_hearder.bmp
language/spanish/image/list_sort_down.png
.png
language/spanish/image/list_sort_up.png
.png
language/spanish/image/list_split.bmp
language/spanish/image/loading_text.png
.png
language/spanish/image/main_no_connct.png
.png
language/spanish/image/main_no_connct_3gs.png
.png
language/spanish/image/main_no_connct_4.png
.png
language/spanish/image/main_no_connct_6.png
.png
language/spanish/image/menuIcon/menu_Language.png
.png
language/spanish/image/menuIcon/menu_Purchase.png
.png
language/spanish/image/menuIcon/menu_about.png
.png
language/spanish/image/menuIcon/menu_contact.png
.png
language/spanish/image/menuIcon/menu_exit.png
.png
language/spanish/image/menuIcon/menu_guide.png
.png
language/spanish/image/menuIcon/menu_help.png
.png
language/spanish/image/menuIcon/menu_home.png
.png
language/spanish/image/menuIcon/menu_mail.png
.png
language/spanish/image/menuIcon/menu_updates.png
.png
language/spanish/image/menu_about.png
.png
language/spanish/image/menu_buy.png
.png
language/spanish/image/menu_help.png
.png
language/spanish/image/menu_register.png
.png
language/spanish/image/message_bg.png
.png
language/spanish/image/number.png
.png
language/spanish/image/number_bg.png
.png
language/spanish/image/output_setting_bg.png
.png
language/spanish/image/pic_have't_trusted.png
.png
language/spanish/image/pic_no_found.png
.png
language/spanish/image/pic_waiting.png
.png
language/spanish/image/preview_document.png
.png
language/spanish/image/preview_recording.png
.png
language/spanish/image/preview_video.png
.png
language/spanish/image/print.png
.png
language/spanish/image/privew.png
.png
language/spanish/image/railing/btn_album.png
.png
language/spanish/image/railing/btn_album_sel.png
.png
language/spanish/image/railing/btn_mid_railing.png
.png
language/spanish/image/railing/btn_mid_railing_sel.png
.png
language/spanish/image/railing/btn_railing.png
.png
language/spanish/image/railing/btn_railing_sel.png
.png
language/spanish/image/railing/btn_thumb.png
.png
language/spanish/image/railing/btn_thumb_sel.png
.png
language/spanish/image/railing/button_preview_data.png
.png
language/spanish/image/railing/check_all.png
.png
language/spanish/image/railing/check_none.png
.png
language/spanish/image/railing/check_segment.png
.png
language/spanish/image/railing/expand_flag.png
.png
language/spanish/image/recovery_backgroud.png
.png
language/spanish/image/recovery_ready_backgroud.png
.png
language/spanish/image/reg_fail_bg.png
.png
language/spanish/image/scan_now.png
.png
language/spanish/image/search_btn.png
.png
language/spanish/image/search_panel_bg.png
.png
language/spanish/image/search_top_bg.png
.png
language/spanish/image/setting.png
.png
language/spanish/image/sign_in_iCloud_BG.png
.png
language/spanish/image/top_bar_backgroud.png
.png
language/spanish/image/trake_slider.gif
.gif
language/spanish/image/version_warning.png
.png
language/spanish/image/wait.gif
.gif
language/spanish/image/wait_login.gif
.gif
language/spanish/pic/Success.png
.png
language/spanish/pic/button_Restart.png
.png
language/spanish/pic/button_Restart_later.png
.png
language/spanish/pic/button_cancel.png
.png
language/spanish/pic/button_close.png
.png
language/spanish/pic/button_min.png
.png
language/spanish/pic/button_no.png
.png
language/spanish/pic/button_ok.png
.png
language/spanish/pic/button_yes.png
.png
language/spanish/pic/error.png
.png
language/spanish/pic/message_bottom.png
.png
language/spanish/pic/message_line_left.png
.png
language/spanish/pic/message_line_right.png
.png
language/spanish/pic/message_top.png
.png
language/spanish/pic/msg_title_icon.png
.png
language/spanish/pic/warning.png
.png
lib_iphone_recovery.dll
.dll windows:5 windows x86 arch:x86

e165661529601fb788d1378e795f55b7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:6d:8c:1e:fa:5e:bc:1c:64:be:88:65:aa:f4:a2:92:e0:51:6c:c0
Signer

Actual PE Digest

1b:6d:8c:1e:fa:5e:bc:1c:64:be:88:65:aa:f4:a2:92:e0:51:6c:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\iphone_full(tenorshare)\lib_iphone_recovery.pdb

Imports

user32

wsprintfW
MessageBoxA

shell32

ShellExecuteExW

kernel32

GetStdHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
WaitForSingleObject
GetModuleFileNameW
GetTempPathW
GetLastError
MultiByteToWideChar
HeapFree
HeapAlloc
DeleteFileW
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetModuleHandleA
GetModuleFileNameA
RtlUnwind
ReadFile
WideCharToMultiByte
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
CloseHandle
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CreateFileW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
HeapSize
SetEndOfFile
GetProcessHeap
CreateFileA

Exports

Exports

FreeAnalysisData
FreeNoteData
GetNoteContentFromBin
searchDeleteData

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcurl.dll
.dll windows:5 windows x86 arch:x86

8176145028409aa62a5ba630fe78c43c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:c1:0a:29:e1:36:6f:a1:55:4f:d5:89:2c:da:44:b5:f8:71:95:38
Signer

Actual PE Digest

71:c1:0a:29:e1:36:6f:a1:55:4f:d5:89:2c:da:44:b5:f8:71:95:38

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

recvfrom
sendto
send
select
__WSAFDIsSet
ioctlsocket
listen
accept
WSAStartup
WSACleanup
gethostname
getaddrinfo
freeaddrinfo
WSASetLastError
connect
socket
closesocket
recv
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
WSAGetLastError
shutdown

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46

user32

MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW

advapi32

ReportEventA
RegisterEventSourceA
DeregisterEventSource

kernel32

CompareStringA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetProcessHeap
SetEndOfFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleCP
CompareStringW
GetFullPathNameA
SetStdHandle
GetModuleFileNameA
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
LCMapStringW
WideCharToMultiByte
LCMapStringA
RtlUnwind
GetStartupInfoA
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
InterlockedIncrement
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileW
GetCurrentDirectoryA
GlobalMemoryStatus
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
SleepEx
VerifyVersionInfoA
VerSetConditionMask
CloseHandle
WaitForSingleObject
ExpandEnvironmentStringsA
Sleep
FormatMessageA
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
GetCurrentThreadId
GetModuleHandleA
GetVersion
WriteFile
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentProcessId
TlsFree
FlushConsoleInputBuffer
SystemTimeToFileTime
GetSystemTime
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapReAlloc
HeapAlloc
HeapFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileA
GetCommandLineA
CreateFileA
GetModuleHandleW
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libexcel.dll
.dll windows:5 windows x86 arch:x86

9ab56d47be08171bcc5e652ab403681e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:4c:06:2d:73:18:65:b3:b7:66:fd:4e:37:a2:76:89:0c:15:4c:5b
Signer

Actual PE Digest

32:4c:06:2d:73:18:65:b3:b7:66:fd:4e:37:a2:76:89:0c:15:4c:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\IPhone3GS_Recovery\trunk\components\libexcel\lib\release\libexcel.pdb

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
GetLocaleInfoA
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetCPInfo
GetTimeFormatA
GetDateFormatA
CompareStringA
CompareStringW
GetStringTypeW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
ReadFile
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetFilePointer
CloseHandle
ExitProcess
LoadLibraryW
GetModuleFileNameA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleHandleA
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
LoadLibraryA
GetLocaleInfoW
CreateFileA
CreateFileW
SetEndOfFile
GetProcessHeap
SetEnvironmentVariableA

Exports

Exports

??0XLSFile@xlsFile@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4use_option@1@@Z
??0XLSSheet@@QAE@ABV0@@Z
??0XLSSheet@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVworkbook@xlslib_core@@@Z
??0XLSSheet@@QAE@PAVworksheet@xlslib_core@@@Z
??0workbook@xlslib_core@@QAE@XZ
??1XLSFile@xlsFile@@UAE@XZ
??1XLSSheet@@UAE@XZ
??1workbook@xlslib_core@@UAE@XZ
??4XLSSheet@@QAEAAV0@ABV0@@Z
??_7XLSFile@xlsFile@@6B@
??_7XLSSheet@@6B@
??_7workbook@xlslib_core@@6BCBinFile@1@@
??_7workbook@xlslib_core@@6BCOleFileSystem@1@@
?Dump@workbook@xlslib_core@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DumpData@workbook@xlslib_core@@AAEPAVCUnit@2@XZ
?GetSheet@workbook@xlslib_core@@QAEPAVworksheet@2@G@Z
?IsItalic@XLSSheet@@QAE_NKK@Z
?deleteContent@XLSSheet@@QAEXKK@Z
?firstTab@workbook@xlslib_core@@QAEXG@Z
?font@workbook@xlslib_core@@QAEPAVfont_t@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?font@workbook@xlslib_core@@QAEPAVfont_t@2@E@Z
?format@workbook@xlslib_core@@QAEPAVformat_t@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@workbook@xlslib_core@@QAEPAVformat_t@2@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?getBgColor@XLSSheet@@QAE?AW4color_name_t@xlslib_core@@KK@Z
?getBold@XLSSheet@@QAE?AW4boldness_option_t@xlslib_core@@KK@Z
?getCellType@XLSSheet@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KK@Z
?getColspan@XLSSheet@@QAEHKK@Z
?getFilePath@XLSFile@xlsFile@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getFontColor@XLSSheet@@QAE?AW4color_name_t@xlslib_core@@KK@Z
?getFontHeight@XLSSheet@@QAEHKK@Z
?getFontName@XLSSheet@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KK@Z
?getHAlign@XLSSheet@@QAE?AW4halign_option_t@xlslib_core@@KK@Z
?getLabel@XLSSheet@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KK@Z
?getMaxCol@XLSSheet@@QAEHXZ
?getMaxRow@XLSSheet@@QAEHXZ
?getMinCol@XLSSheet@@QAEHXZ
?getMinRow@XLSSheet@@QAEHXZ
?getName@XLSSheet@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getNbSheet@XLSFile@xlsFile@@QBEHXZ
?getNumberDouble@XLSSheet@@QAENKK@Z
?getNumberInt@XLSSheet@@QAEHKK@Z
?getOrientation@XLSSheet@@QAE?AW4txtori_option_t@xlslib_core@@KK@Z
?getRowspan@XLSSheet@@QAEHKK@Z
?getScript@XLSSheet@@QAE?AW4script_option_t@xlslib_core@@KK@Z
?getSheet@XLSFile@xlsFile@@QAE?AVXLSSheet@@H@Z
?getUnderLine@XLSSheet@@QAE?AW4underline_option_t@xlslib_core@@KK@Z
?getVAlign@XLSSheet@@QAE?AW4valign_option_t@xlslib_core@@KK@Z
?hasBorderBottom@XLSSheet@@QAE_NKK@Z
?hasBorderLeft@XLSSheet@@QAE_NKK@Z
?hasBorderRight@XLSSheet@@QAE_NKK@Z
?hasBorderTop@XLSSheet@@QAE_NKK@Z
?newSheet@XLSFile@xlsFile@@QAE?AVXLSSheet@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?openCsv2@XLSFile@xlsFile@@QAE?AVXLSSheet@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0D@Z
?openCsv@XLSFile@xlsFile@@QAE?AVXLSSheet@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D0@Z
?property@workbook@xlslib_core@@QAE_NW4property_t@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?save@XLSFile@xlsFile@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?save@XLSFile@xlsFile@@QAEXXZ
?saveToCsv@XLSFile@xlsFile@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setCellBgColor@XLSSheet@@QAEXKKW4color_name_t@xlslib_core@@W4fill_option_t@3@@Z
?setCellBorderStyle@XLSSheet@@QAEXKKW4border_side_t@xlslib_core@@W4border_style_t@3@W4color_name_t@3@@Z
?setCellFrame@XLSSheet@@QAEXKKW4color_name_t@xlslib_core@@W4border_style_t@3@@Z
?setCellMerge@XLSSheet@@QAEXKKKK@Z
?setColWidth@XLSSheet@@QAEXKI@Z
?setColor@workbook@xlslib_core@@QAE_NEEEE@Z
?setFilePath@XLSFile@xlsFile@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setFont@XLSSheet@@QAEXKKV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setFontBold@XLSSheet@@QAEXKKW4boldness_option_t@xlslib_core@@@Z
?setFontColor@XLSSheet@@QAEXKKW4color_name_t@xlslib_core@@@Z
?setFontHAlign@XLSSheet@@QAEXKKW4halign_option_t@xlslib_core@@@Z
?setFontHeight@XLSSheet@@QAEXKKI@Z
?setFontItalic@XLSSheet@@QAEXKK_N@Z
?setFontOrientation@XLSSheet@@QAEXKKW4txtori_option_t@xlslib_core@@@Z
?setFontOutline@XLSSheet@@QAEXKK_N@Z
?setFontScript@XLSSheet@@QAEXKKW4script_option_t@xlslib_core@@@Z
?setFontShadow@XLSSheet@@QAEXKK_N@Z
?setFontStrikeout@XLSSheet@@QAEXKK_N@Z
?setFontUnderline@XLSSheet@@QAEXKKW4underline_option_t@xlslib_core@@@Z
?setFontVAlign@XLSSheet@@QAEXKKW4valign_option_t@xlslib_core@@@Z
?setNumber@XLSSheet@@QAEXKKH@Z
?setNumber@XLSSheet@@QAEXKKN@Z
?setRowHeight@XLSSheet@@QAEXKI@Z
?setTabNumber@XLSSheet@@QAEXPBHKKKK@Z
?setTabNumber@XLSSheet@@QAEXPBNKKKK@Z
?setTabText@XLSSheet@@QAEXPBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KKKK@Z
?setText@XLSSheet@@QAEXKKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?sheet@workbook@xlslib_core@@QAEPAVworksheet@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?sheet@workbook@xlslib_core@@QAEPAVworksheet@2@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?tabBarWidth@workbook@xlslib_core@@QAEXG@Z
?version@workbook@xlslib_core@@QBEPBDXZ
?windPosition@workbook@xlslib_core@@QAEXGG@Z
?windSize@workbook@xlslib_core@@QAEXGG@Z
?xformat@workbook@xlslib_core@@QAEPAVxf_t@2@PAVfont_t@2@@Z
?xformat@workbook@xlslib_core@@QAEPAVxf_t@2@XZ
copyXls
copyXlstoCsv
copyXlstoHtml

Sections

.text
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
managercdb.dll
.dll windows:6 windows x86 arch:x86

55d0e0bd9c0ea3cf70b6c8da62621afb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9f:63:17:6d:a7:2a:7b:40:68:4d:09:32:12:8c:fd:b0:31:15:72:99
Signer

Actual PE Digest

9f:63:17:6d:a7:2a:7b:40:68:4d:09:32:12:8c:fd:b0:31:15:72:99

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

R:\code\vs2012\iany_connector\Release_PG\managercdb.pdb

Imports

zlib1

inflateEnd
compress2
inflate
compressBound
inflateInit_

calchashab

CalcHashABData

kernel32

GetStringTypeW
CreateFileW
GetStartupInfoW
WideCharToMultiByte
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
ReadFile
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
GetCommandLineA
GetCurrentThreadId
GetProcessHeap
EncodePointer
DecodePointer
ExitProcess
GetProcAddress
AreFileApisANSI
WriteFile
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetConsoleMode
ReadConsoleW
SetLastError
GetConsoleCP
SetFilePointerEx
DeleteCriticalSection
SetEndOfFile
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
OutputDebugStringW
LoadLibraryExW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
FlushFileBuffers
HeapSize
LCMapStringW

Exports

Exports

itdb_add_photo_album
itdb_add_photos
itdb_add_track_new
itdb_album_free
itdb_artist_free
itdb_del_photo_album
itdb_del_photos
itdb_free
itdb_members_track_free
itdb_parse
itdb_photo_free
itdb_photodb_parse
itdb_photodb_write
itdb_playlist_add
itdb_playlist_add_track
itdb_playlist_free
itdb_playlist_is_mpl
itdb_playlist_is_podcasts
itdb_playlist_mpl
itdb_playlist_new
itdb_track_free
itdb_track_new
itdb_write_file

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mobilelink.dll
.dll windows:6 windows x86 arch:x86

ed10cfcdc231268299beb836a75b092c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:34:a3:fc:80:45:42:43:f8:49:56:09:b1:ad:d3:00:61:68:c6:ba
Signer

Actual PE Digest

1f:34:a3:fc:80:45:42:43:f8:49:56:09:b1:ad:d3:00:61:68:c6:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BWA\ProtectedCloudStorageWin-15\srcroot\PCS\Release\PCS.pdb

Imports

msvcr120

_unlock

kernel32

GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

bcrypt

BCryptDecrypt

msvcp120

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

asl

asl_send

corefoundation

CFArrayInsertValueAtIndex

libdispatch

dispatch_async_f

shlwapi

PathAppendW

ws2_32

ntohl

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

aoskit

kAOSPersonIDKey

cfnetwork

kCFStreamPropertyHTTPResponseHeader

sqlite3

sqlite3_extended_errcode

Exports

Exports

PCSCopyUnwrappedKey
PCSCopyUnwrappedWithFDEServiceKey
PCSCopyWrappedKey
PCSCopyWrappedWithFDEServiceKey
PCSFPAddPrivateKey
PCSFPAddPublicIdentity
PCSFPAddSharePCS
PCSFPCopyDecryptedData
PCSFPCopyDiagnostic
PCSFPCopyEncryptedData
PCSFPCopyExported
PCSFPCopyKeyIDs
PCSFPCopyPrivateKey
PCSFPCopyPublicIdentities
PCSFPCopyRecoverPCS
PCSFPCopyUnwrappedKey
PCSFPCopyWrappedKey
PCSFPCreatePEMData
PCSFPCreatePrivateKey
PCSFPCreateUniqueID
PCSFPCreateWithExported
PCSFPCreateWithExportedAndIdentitySet
PCSFPRemovePublicIdentity
PCSFPRemoveSharePCS
PCSFPStatus
PCSIdentityCollectionCopyCurrent
PCSIdentityCollectionCopyPublicKeyInfo
PCSIdentityCollectionDestroy
PCSIdentityCollectionSave
PCSIdentityCollectionSetup
PCSIdentityCollectionStatus
PCSIdentityCopyCurrentKeyFingerprint
PCSIdentityCopyDiagnostic
PCSIdentityCopyExternalForm
PCSIdentityCopyPublicIdentity
PCSIdentityCopyPublicKeyInfo
PCSIdentityCreate
PCSIdentityCreateCollection
PCSIdentityCreateExportedRawCompact
PCSIdentityCreateFromData
PCSIdentityCreateFromRaw
PCSIdentityCreateRandomCompactRaw
PCSIdentityCreateService
PCSIdentityForeachService
PCSIdentityGetPublicID
PCSIdentityGetPublicKey
PCSIdentityGetService
PCSIdentityGetType
PCSIdentityGetTypeID
PCSIdentitySetAddIdentity
PCSIdentitySetCreate
PCSIdentitySetCreateMutable
PCSIdentitySetGetCurrentIdentity
PCSIdentitySetGetCurrentPublicIdentity
PCSIdentitySetGetIdentity
PCSIdentitySetGetIdentityByKeyID
PCSIdentitySetIsCurrentIdentity
PCSIdentitySetRemoveIdentity
PCSIdentitySetSetCurrentIdentity
PCSObjectCreateFromExportedWithIdentities
PCSObjectCreateFromExportedWithKeyedPCS
PCSPublicIdentityCollectionCopyCurrent
PCSPublicIdentityCopyCurrentKeyFingerprint
PCSPublicIdentityCopyPublicKey
PCSPublicIdentityCreateFromCollection
PCSPublicIdentityCreateFromKeyData
PCSPublicIdentityForeachService
PCSPublicIdentityGetPublicID
PCSPublicIdentityGetService
PCSPublicIdentityGetType
PCSPublicIdentityGetTypeID
PCSPublicIdentityImportPublicKeyInfo
PCSPublicServiceIdentityCopyWrappedKey
PCSServiceIdentityCopyExportedPublicKey
PCSServiceIdentityCopyPublicKeyInfo
PCSServiceIdentityCopyUnwrappedKey
PCSShareProtectionCopyKeys
PCSShareProtectionCreate
PCSShareProtectionDeletePCSKey
PCSShareProtectionGetAvailableKeyID
PCSShareProtectionGetTypeID
SecRandomCopyBytes
_PCSIdentityCacheReset
_PCSIdentitySetGetIdentities
__PCSIdentityCreateWithName
kPCSErrorDomain
kPCSServiceBladerunner
kPCSServiceFDE
kPCSServiceHyperion
kPCSServiceLiverpool
kPCSServiceMaster
kPCSServicePianoMover
kPCSServiceiMessage
kPCSSetupAuthToken
kPCSSetupDSID
kPCSSetupEnvionment
kPCSSetupEscrowURL
kPCSSetupForceNewIdentity
kPCSSetupKeychain
kPCSSetupPassword
kPCSSetupRecoverMode
kPCSSetupStingray
kPCSSetupTimeout
kPCSSetupUsername

Sections

.text
Size: - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
sqlite3.dll
.dll windows:5 windows x86 arch:x86

31552e8967da01fae4dbb6dca841c0cc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:d7:46:10:57:a6:8c:a9:ad:37:79:d3:1f:8d:e5:49:43:56:20:52
Signer

Actual PE Digest

5d:d7:46:10:57:a6:8c:a9:ad:37:79:d3:1f:8d:e5:49:43:56:20:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\IPhone3GS_Recovery\trunk\components\sqlite-3.7.13\lib\release\sqlite3.pdb

Imports

kernel32

FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleW
ExitProcess
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
VirtualFree
VirtualAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetModuleFileNameA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleHandleA

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_stricmp
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_sleep
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_write_debug

Sections

.text
Size: 460KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tango_decode.dll
.dll windows:5 windows x86 arch:x86

caeafb746cce229ca23c95eb20ac13f7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

97:fb:b6:ff:7d:36:06:84:a0:3a:24:6a:1f:c3:ea:a0:85:6c:8e:f4
Signer

Actual PE Digest

97:fb:b6:ff:7d:36:06:84:a0:3a:24:6a:1f:c3:ea:a0:85:6c:8e:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

T:\code\base64_op\Release\tango_decode.pdb

Imports

sqlite3

sqlite3_close
sqlite3_free
sqlite3_finalize
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_step
sqlite3_prepare
sqlite3_mprintf
sqlite3_open

kernel32

CloseHandle
ReadFile
GetProcessHeap
SetEndOfFile
LCMapStringW
WideCharToMultiByte
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
CreateFileA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA

Exports

Exports

tango_decode
tango_infofree
viber
viber_infofree

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninst.exe.nsis
updataError.dll
.dll windows:5 windows x86 arch:x86

e8fa3e2f25d7b247b10afeac9182c9ba

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f2:29:d2:3b:f4:34:23:19:58:c7:3e:f5:9d:7f:8b:39:12:2b:73:e6
Signer

Actual PE Digest

f2:29:d2:3b:f4:34:23:19:58:c7:3e:f5:9d:7f:8b:39:12:2b:73:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\hook\Myhook\updataError\Release\updataError.pdb

Imports

kernel32

GetVersionExA
lstrcmpW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetWindowLongW

gdi32

DeleteObject

winspool.drv

DocumentPropertiesW

oleaut32

VariantInit

wininet

InternetOpenW

Exports

Exports

?UpdataReportFile@@YAHPA_W@Z

Sections

.text
Size: - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.asp10
Size: - Virtual size: 687KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.asp11
Size: 889KB - Virtual size: 889KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
zlib1.dll
.dll windows:4 windows x86 arch:x86

fd348b107c9a12537c4d666dc366ec5f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-05-2015 00:00

Not After

06-06-2018 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:24:8c:ef:2e:32:87:2b:3a:6b:19:3f:e8:1c:0f:32:8c:9d:9f:69
Signer

Actual PE Digest

39:24:8c:ef:2e:32:87:2b:3a:6b:19:3f:e8:1c:0f:32:8c:9d:9f:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

_close
_open
_read
_write
__dllonexit
__mb_cur_max
_amsg_exit
_errno
_initterm
_iob
_lock
_lseeki64
_onexit
_unlock
_vsnprintf
_wopen
abort
atoi
calloc
fputc
free
getenv
localeconv
malloc
memchr
memcpy
memset
setlocale
strchr
strerror
strlen
strncmp
wcslen
wcstombs

Exports

Exports

adler32
adler32_combine
adler32_combine64
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine64
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

fe:b1:e6:4b:5a:fd:cb:bd:86:4b:6f:d4:12:fb:6a:b1:65:da:3c:c7Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 149KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 103KB - Virtual size: 102KB

610235b90207a63ccf481f0d4375d329

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

154903d617e825e7d4f76664593675fd

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 697B

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 364B

6121a49841bf6f5b3700c1ebbb28be41

Headers

File Characteristics

Imports

user32

oleaut32

msvcrt

kernel32

Exports

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

fe:b1:e6:4b:5a:fd:cb:bd:86:4b:6f:d4:12:fb:6a:b1:65:da:3c:c7
Signer

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 149KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 103KB - Virtual size: 102KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 697B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 364B

.text
Size: 520KB - Virtual size: 520KB

.rdata
Size: 66KB - Virtual size: 65KB

.data
Size: 18KB - Virtual size: 38KB

.rsrc
Size: 76KB - Virtual size: 76KB

.reloc
Size: 26KB - Virtual size: 26KB

.textbss
Size: - Virtual size: 380KB

.text
Size: 798KB - Virtual size: 798KB

.rdata
Size: 119KB - Virtual size: 119KB

.data
Size: 11KB - Virtual size: 21KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

8b:6a:cb:8f:f8:ce:a8:5b:ba:b0:e9:3a:36:b5:b2:06:87:f2:84:98
Signer

.textbss
Size: - Virtual size: 277KB

.text
Size: 572KB - Virtual size: 572KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 524KB - Virtual size: 535KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 19KB - Virtual size: 18KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:fc:1e:4b:bb:cf:bb:b7:ae:84:4e:a4:50:ca:f1:f3
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:eb:db:6f:a1:39:c2:2f:c1:1c:e3:9c:45:f6:23:35:75:93:40:c6
Signer