iisutil.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
iisutil.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
iisutil.dll
-
Size
285KB
-
MD5
b7d6712c8a099622cdf3a25f2378aa71
-
SHA1
5d6b1e417693837a1e8ce1a7ab0cf0f082fc24d4
-
SHA256
a776db5e2f6e4d1bee261a02814354eb42eab3dbe2114c8c0e2b8dc5a765c83b
-
SHA512
3bd096124b3bada49e130c3791acf1d6ac021b8b60843efe099368a3c3101d751464e811d3272c11e68e1d67c6445e221e461f5355baa60003b4b7e85e807327
-
SSDEEP
6144:tMQ4eE+wJXUDRIutoBMp61wrr+gKtC0WeIQnxV7d8:t0eE9JXuRQBn1MRKIe1f7
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource iisutil.dll
Files
-
iisutil.dll.dll windows:10 windows x64 arch:x64
68148e389e486767bc9703a3b8392335
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_wcsnicmp
_vsnprintf
atof
isdigit
strtok
isalnum
isalpha
atoi
tolower
toupper
_itoa_s
wcsstr
_wcslwr
__C_specific_handler
_aligned_free
_snprintf_s
swprintf_s
_vsnprintf_s
_lock
strrchr
strcpy_s
_purecall
_unlock
__dllonexit
wcsrchr
strcat_s
sprintf_s
isxdigit
??1type_info@@UEAA@XZ
strchr
_vscwprintf
iswalnum
memmove
iswxdigit
_CxxThrowException
_onexit
wcsnlen
wcschr
_aligned_malloc
wcsncpy_s
_vsnwprintf_s
strncpy_s
_initterm
strnlen
_stricmp
_wcsicmp
memcpy
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetThreadPreferredUILanguages
RtlGetCurrentPeb
RtlUpcaseUnicodeChar
RtlNtStatusToDosError
RtlMultiByteToUnicodeN
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwLogTraceEvent
RtlAddMandatoryAce
RtlCreateAcl
RtlGetNtProductType
RtlCaptureStackBackTrace
api-ms-win-core-errorhandling-l1-1-1
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-2
OpenProcess
TerminateProcess
CreateThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
OpenThreadToken
SetThreadToken
OpenProcessToken
GetCurrentProcess
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
LocalFree
LocalAlloc
api-ms-win-core-synch-l1-2-0
Sleep
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
WaitForSingleObject
ReleaseSemaphore
CreateEventA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjectsEx
SetEvent
CreateMutexA
CreateEventW
api-ms-win-core-sysinfo-l1-2-1
GetSystemInfo
GetVersionExW
GetWindowsDirectoryA
GetTickCount
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
GetSystemWindowsDirectoryW
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleHandleA
LoadStringA
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryExW
api-ms-win-core-debug-l1-1-1
OutputDebugStringA
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-2-0
GetProcessHeaps
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree
HeapSetInformation
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-processenvironment-l1-2-0
ExpandEnvironmentStringsW
GetStdHandle
api-ms-win-core-localization-l1-2-1
FormatMessageA
IsDBCSLeadByteEx
IsDBCSLeadByte
GetSystemDefaultLangID
GetThreadPreferredUILanguages
GetLocaleInfoEx
api-ms-win-core-file-l1-2-1
GetTempPathW
CreateFileA
ReadFile
FileTimeToLocalFileTime
FlushFileBuffers
WriteFile
CreateFileW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegSetValueExA
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
RegQueryValueExA
api-ms-win-core-interlocked-l1-2-0
InterlockedPushEntrySList
InitializeSListHead
QueryDepthSList
InterlockedPopEntrySList
api-ms-win-core-com-l1-1-1
CoUninitialize
CoInitializeEx
CoDisconnectObject
api-ms-win-security-base-l1-2-0
InitializeSid
GetSidSubAuthority
GetSidLengthRequired
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
AdjustTokenPrivileges
AddAccessDeniedAce
InitializeAcl
DuplicateTokenEx
GetLengthSid
GetTokenInformation
FreeSid
AllocateAndInitializeSid
AddAce
GetAce
CreateWellKnownSid
GetAclInformation
SetKernelObjectSecurity
SetSecurityDescriptorDacl
MakeAbsoluteSD
RevertToSelf
GetSecurityDescriptorDacl
GetKernelObjectSecurity
SetTokenInformation
SetSecurityDescriptorGroup
AddAccessAllowedAce
api-ms-win-security-lsalookup-l2-1-1
LookupAccountSidW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-datetime-l1-1-1
GetDateFormatA
GetTimeFormatA
bcrypt
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
api-ms-win-core-io-l1-1-1
GetOverlappedResult
CancelIoEx
api-ms-win-core-namedpipe-l1-2-0
SetNamedPipeHandleState
ConnectNamedPipe
DisconnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
ws2_32
GetHostNameW
WSACleanup
FreeAddrInfoW
WSAStartup
GetAddrInfoW
WSAGetLastError
ntohl
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-localization-obsolete-l1-3-0
EnumUILanguagesW
GetSystemDefaultUILanguage
api-ms-win-core-kernel32-legacy-l1-1-1
RegisterWaitForSingleObject
UnregisterWait
api-ms-win-eventlog-legacy-l1-1-0
RegisterEventSourceW
ReportEventW
DeregisterEventSource
api-ms-win-core-threadpool-l1-1-0
DeleteTimerQueueTimer
CreateTimerQueueTimer
RegisterWaitForSingleObjectEx
CreateTimerQueue
UnregisterWaitEx
DeleteTimerQueueEx
api-ms-win-core-delayload-l1-1-1
DelayLoadFailureHook
ResolveDelayLoadedAPI
Exports
Exports
??0?$CDataCache@UDATETIME_FORMAT_ENTRY@@@@QEAA@XZ
??0?$CDataCache@VCDateTime@@@@QEAA@XZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
??0ASCLOG_DATETIME_CACHE@@QEAA@XZ
??0BIG_REF_TRACE@@QEAA@XZ
??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
??0CACHED_DATETIME_FORMATS@@QEAA@XZ
??0CCritSec@@QEAA@XZ
??0CDFTCache@@QEAA@XZ
??0CDateTime@@QEAA@AEBU_FILETIME@@@Z
??0CDateTime@@QEAA@AEBU_FILETIME@@AEBU_SYSTEMTIME@@@Z
??0CDateTime@@QEAA@AEBU_SYSTEMTIME@@@Z
??0CDateTime@@QEAA@XZ
??0CDoubleList@@QEAA@XZ
??0CEtwTracer@@QEAA@XZ
??0CFakeLock@@QEAA@XZ
??0CHUNK_BUFFER@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CLKRHashTableStats@@QEAA@XZ
??0CLKRHashTable_Iterator@@IEAA@PEAVCLKRHashTable@@F@Z
??0CLKRHashTable_Iterator@@QEAA@$$QEAV0@@Z
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
??0CLKRHashTable_Iterator@@QEAA@XZ
??0CLKRLinearHashTable@@AEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKPEAVCLKRHashTable@@_N@Z
??0CLKRLinearHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CLKRLinearHashTable_Iterator@@IEAA@PEAVCLKRLinearHashTable@@PEAVCNodeClump@@KF@Z
??0CLKRLinearHashTable_Iterator@@QEAA@AEBV0@@Z
??0CLKRLinearHashTable_Iterator@@QEAA@XZ
??0CLockedDoubleList@@QEAA@$$QEAV0@@Z
??0CLockedDoubleList@@QEAA@AEBV0@@Z
??0CLockedDoubleList@@QEAA@XZ
??0CLockedSingleList@@QEAA@$$QEAV0@@Z
??0CLockedSingleList@@QEAA@AEBV0@@Z
??0CLockedSingleList@@QEAA@XZ
??0CReaderWriterLock2@@QEAA@AEBV0@@Z
??0CReaderWriterLock2@@QEAA@XZ
??0CReaderWriterLock3@@QEAA@AEBV0@@Z
??0CReaderWriterLock3@@QEAA@XZ
??0CReaderWriterLock@@QEAA@AEBV0@@Z
??0CReaderWriterLock@@QEAA@XZ
??0CRtlResource@@QEAA@AEBV0@@Z
??0CRtlResource@@QEAA@XZ
??0CSecurityDispenser@@QEAA@XZ
??0CShareLock@@QEAA@XZ
??0CSharelock@@QEAA@HH@Z
??0CSingleList@@QEAA@XZ
??0CSmallSpinLock@@QEAA@AEBV0@@Z
??0CSmallSpinLock@@QEAA@XZ
??0CSpinLock@@QEAA@AEBV0@@Z
??0CSpinLock@@QEAA@XZ
??0EVENT_LOG@@QEAA@PEBG@Z
??0EXTLOG_DATETIME_CACHE@@QEAA@XZ
??0IPM2_MESSAGE_PIPE@@AEAA@XZ
??0IPM2_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??0IPM_MESSAGE_PIPE@@AEAA@XZ
??0IPM_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??0LANG_STRING@@QEAA@XZ
??0MB@@QEAA@PEAUIMSAdminBaseW@@@Z
??0MB_BASE_NOTIFICATION_SINK@@QEAA@XZ
??0MULTISZ@@QEAA@AEBV0@@Z
??0MULTISZ@@QEAA@PEAGK@Z
??0MULTISZ@@QEAA@PEBG@Z
??0MULTISZ@@QEAA@XZ
??0MULTISZA@@QEAA@AEBV0@@Z
??0MULTISZA@@QEAA@PEADK@Z
??0MULTISZA@@QEAA@PEBD@Z
??0MULTISZA@@QEAA@XZ
??0MULTI_IPM@@QEAA@XZ
??0STRA@@AEAA@AEBV0@@Z
??0STRA@@AEAA@PEAD@Z
??0STRA@@AEAA@PEBD@Z
??0STRA@@QEAA@PEADK@Z
??0STRA@@QEAA@XZ
??0STRAU@@QEAA@AEAV0@@Z
??0STRAU@@QEAA@PEBD@Z
??0STRAU@@QEAA@PEBDH@Z
??0STRAU@@QEAA@PEBG@Z
??0STRAU@@QEAA@XZ
??0STRU@@AEAA@AEBV0@@Z
??0STRU@@AEAA@PEAG@Z
??0STRU@@AEAA@PEBG@Z
??0STRU@@QEAA@PEAGK@Z
??0STRU@@QEAA@XZ
??0STRU_PATH@@QEAA@G@Z
??0STRU_PATH@@QEAA@PEAGKG@Z
??0TREE_HASH_TABLE@@QEAA@AEBV0@@Z
??0TREE_HASH_TABLE@@QEAA@H@Z
??0TREE_HASH_TABLE@@QEAA@HH@Z
??0TS_RESOURCE@@QEAA@AEBV0@@Z
??0TS_RESOURCE@@QEAA@XZ
??0W3_DATETIME_CACHE@@QEAA@XZ
??0W3_TRACE_LOG@@QEAA@PEAVW3_TRACE_LOG_FACTORY@@@Z
??0W3_TRACE_LOG_FACTORY@@AEAA@XZ
??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??1ASCLOG_DATETIME_CACHE@@UEAA@XZ
??1BIG_REF_TRACE@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1CACHED_DATETIME_FORMATS@@UEAA@XZ
??1CCritSec@@QEAA@XZ
??1CDoubleList@@QEAA@XZ
??1CEtwTracer@@QEAA@XZ
??1CFakeLock@@QEAA@XZ
??1CHUNK_BUFFER@@QEAA@XZ
??1CLKRHashTable@@QEAA@XZ
??1CLKRHashTable_Iterator@@QEAA@XZ
??1CLKRLinearHashTable@@QEAA@XZ
??1CLKRLinearHashTable_Iterator@@QEAA@XZ
??1CLockedDoubleList@@QEAA@XZ
??1CLockedSingleList@@QEAA@XZ
??1CReaderWriterLock2@@QEAA@XZ
??1CReaderWriterLock3@@QEAA@XZ
??1CReaderWriterLock@@QEAA@XZ
??1CRtlResource@@QEAA@XZ
??1CSecurityDispenser@@QEAA@XZ
??1CShareLock@@QEAA@XZ
??1CSharelock@@QEAA@XZ
??1CSingleList@@QEAA@XZ
??1CSmallSpinLock@@QEAA@XZ
??1CSpinLock@@QEAA@XZ
??1EXTLOG_DATETIME_CACHE@@UEAA@XZ
??1IPM2_MESSAGE_PIPE@@EEAA@XZ
??1IPM_MESSAGE_PIPE@@EEAA@XZ
??1MB@@QEAA@XZ
??1MB_BASE_NOTIFICATION_SINK@@UEAA@XZ
??1MULTISZ@@QEAA@XZ
??1MULTISZA@@QEAA@XZ
??1MULTI_IPM@@QEAA@XZ
??1STRA@@QEAA@XZ
??1STRAU@@QEAA@XZ
??1STRU@@QEAA@XZ
??1STRU_PATH@@QEAA@XZ
??1TREE_HASH_TABLE@@QEAA@XZ
??1TS_RESOURCE@@QEAA@XZ
??1W3_DATETIME_CACHE@@UEAA@XZ
??1W3_TRACE_LOG@@AEAA@XZ
??1W3_TRACE_LOG_FACTORY@@AEAA@XZ
??2CLKRLinearHashTable@@SAPEAX_K@Z
??3CLKRLinearHashTable@@SAXPEAX@Z
??4?$CLockBase@$00$00$02$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$00$00$02$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$01$00$00$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$01$00$00$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$02$00$00$00$00$00@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$02$00$00$00$00$00@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$03$00$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$03$00$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$04$01$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$04$01$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$05$01$00$01$02$02@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$05$01$00$01$02$02@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$06$01$01$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$06$01$01$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$07$01$01$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$07$01$01$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4?$CLockBase@$08$01$00$00$02$01@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockBase@$08$01$00$00$02$01@@QEAAAEAV0@AEBV0@@Z
??4ALLOC_CACHE_HANDLER@@QEAAAEAV0@AEBV0@@Z
??4BIG_REF_TRACE@@QEAAAEAV0@AEBV0@@Z
??4BUFFER@@QEAAAEAV0@AEBV0@@Z
??4CCritSec@@QEAAAEAV0@AEBV0@@Z
??4CDateTime@@QEAAAEAV0@$$QEAV0@@Z
??4CDateTime@@QEAAAEAV0@AEBV0@@Z
??4CDoubleList@@QEAAAEAV0@AEBV0@@Z
??4CFakeLock@@QEAAAEAV0@AEBV0@@Z
??4CHUNK_BUFFER@@QEAAAEAV0@AEBV0@@Z
??4CLKRHashTableStats@@QEAAAEAV0@$$QEAV0@@Z
??4CLKRHashTableStats@@QEAAAEAV0@AEBV0@@Z
??4CLKRHashTable_Iterator@@QEAAAEAV0@$$QEAV0@@Z
??4CLKRHashTable_Iterator@@QEAAAEAV0@AEBV0@@Z
??4CLKRLinearHashTable_Iterator@@QEAAAEAV0@AEBV0@@Z
??4CLockedDoubleList@@QEAAAEAV0@$$QEAV0@@Z
??4CLockedDoubleList@@QEAAAEAV0@AEBV0@@Z
??4CLockedSingleList@@QEAAAEAV0@$$QEAV0@@Z
??4CLockedSingleList@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock2@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock3@@QEAAAEAV0@AEBV0@@Z
??4CReaderWriterLock@@QEAAAEAV0@AEBV0@@Z
??4CRtlResource@@QEAAAEAV0@AEBV0@@Z
??4CSecurityDispenser@@QEAAAEAV0@AEBV0@@Z
??4CSingleList@@QEAAAEAV0@AEBV0@@Z
??4CSmallSpinLock@@QEAAAEAV0@AEBV0@@Z
??4CSpinLock@@QEAAAEAV0@AEBV0@@Z
??4DATETIME_FORMAT_ENTRY@@QEAAAEAU0@$$QEAU0@@Z
??4DATETIME_FORMAT_ENTRY@@QEAAAEAU0@AEBU0@@Z
??4EVENT_LOG@@QEAAAEAV0@$$QEAV0@@Z
??4EVENT_LOG@@QEAAAEAV0@AEBV0@@Z
??4IPM2_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??4IPM_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??4LANG_STRING@@QEAAAEAV0@$$QEAV0@@Z
??4LANG_STRING@@QEAAAEAV0@AEBV0@@Z
??4MB@@QEAAAEAV0@AEBV0@@Z
??4MULTISZ@@QEAAAEAV0@AEBV0@@Z
??4MULTISZA@@QEAAAEAV0@AEBV0@@Z
??4STRA@@AEAAAEAV0@AEBV0@@Z
??4STRAU@@QEAAAEAV0@AEBV0@@Z
??4STRU@@AEAAAEAV0@AEBV0@@Z
??4TREE_HASH_TABLE@@QEAAAEAV0@AEBV0@@Z
??4TS_RESOURCE@@QEAAAEAV0@AEBV0@@Z
??4W3_TRACE_LOG@@QEAAAEAV0@AEBV0@@Z
??4W3_TRACE_LOG_FACTORY@@QEAAAEAV0@AEBV0@@Z
??8CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
??8CLKRLinearHashTable_Iterator@@QEBA_NAEBV0@@Z
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
??9CLKRLinearHashTable_Iterator@@QEBA_NAEBV0@@Z
??_7ASCLOG_DATETIME_CACHE@@6B@
??_7CACHED_DATETIME_FORMATS@@6B@
??_7EXTLOG_DATETIME_CACHE@@6B@
??_7IPM2_MESSAGE_PIPE@@6B@
??_7IPM_MESSAGE_PIPE@@6B@
??_7TREE_HASH_TABLE@@6B@
??_7W3_DATETIME_CACHE@@6B@
??_FCSharelock@@QEAAXXZ
??_FSTRU_PATH@@QEAAXXZ
?ActiveUsers@CSharelock@@QEAAHXZ
?AddNewBlock@CHUNK_BUFFER@@AEAAJK@Z
?AddNodeInternal@TREE_HASH_TABLE@@AEAAJPEBGKPEAXPEAUTREE_HASH_NODE@@PEAPEAU2@@Z
?AddObject@MB@@QEAAHPEBG@Z
?AddRef@MB_BASE_NOTIFICATION_SINK@@UEAAKXZ
?AddTrace@BIG_REF_TRACE@@AEAAJPEAXHH@Z
?AdjustTokenForAdministrators@CSecurityDispenser@@QEAAKPEAX@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
?AllocateEntry@BIG_REF_TRACE@@AEAAPEAU_REF_TRACE_ENTRY@@XZ
?AllocateHeadEntry@BIG_REF_TRACE@@AEAAPEAU_REF_TRACE_HEAD_ENTRY@@PEAX@Z
?AllocateNode@TREE_HASH_TABLE@@AEAAJPEBGKPEAXPEAUTREE_HASH_NODE@@PEAPEAU2@@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJKPEAPEAD@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJKPEAPEAG@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJKPEAPEAX@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJPEADKPEAPEAD@Z
?AllocateSpace@CHUNK_BUFFER@@QEAAJPEAGKPEAPEAG@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Append@MULTISZ@@QEAAHPEBG@Z
?Append@MULTISZ@@QEAAHPEBGK@Z
?Append@MULTISZA@@QEAAHAEAVSTRA@@@Z
?Append@MULTISZA@@QEAAHPEBD@Z
?Append@MULTISZA@@QEAAHPEBDK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Append@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@STRAU@@QEAAHAEAV1@@Z
?Append@STRAU@@QEAAHPEBD@Z
?Append@STRAU@@QEAAHPEBDK@Z
?Append@STRAU@@QEAAHPEBG@Z
?Append@STRAU@@QEAAHPEBGK@Z
?Append@STRU@@QEAAJAEBV1@@Z
?Append@STRU@@QEAAJG@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJPEBGK@Z
?AppendA@STRU@@QEAAJPEBD@Z
?AppendA@STRU@@QEAAJPEBDK@Z
?AppendA_ACP@STRU@@QEAAJPEBD@Z
?AppendA_ACP@STRU@@QEAAJPEBDK@Z
?AppendData@W3_TRACE_LOG_FACTORY@@QEAAJPEAXK@Z
?AppendW@MULTISZA@@QEAAHPEBG@Z
?AppendW@MULTISZA@@QEAAHPEBGK@Z
?AppendW@STRA@@QEAAJPEBG@Z
?AppendW@STRA@@QEAAJPEBGK@Z
?AppendWSimple@STRA@@QEAAJPEBGK@Z
?AppendWTruncate@STRA@@QEAAJPEBG@Z
?AppendWTruncate@STRA@@QEAAJPEBGK@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?Apply@CLKRLinearHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@CLKRLinearHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@TREE_HASH_TABLE@@QEAAXP6AXPEAX0@Z0@Z
?AuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?AuxAppend@MULTISZA@@AEAAHPEBEIH@Z
?AuxAppend@STRA@@AEAAJPEBEKK_N@Z
?AuxAppend@STRAU@@AEAAHPEBDIH@Z
?AuxAppend@STRAU@@AEAAHPEBGIH@Z
?AuxAppend@STRU@@AEAAJPEBEKK_N@Z
?AuxAppendA@STRU@@AEAAJPEBEKK_N1@Z
?AuxAppendW@MULTISZA@@AEAAHPEBGIH@Z
?AuxAppendW@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWSimple@STRA@@AEAAJPEBGKK_N@Z
?AuxAppendWTruncate@STRA@@AEAAJPEBGKK_N@Z
?AuxInit@MULTISZ@@AEAAXPEBG@Z
?AuxInit@MULTISZA@@AEAAXPEBE@Z
?AuxInit@STRAU@@AEAAXPEBD@Z
?AuxInit@STRAU@@AEAAXPEBG@Z
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?Begin@CLKRLinearHashTable@@QEAA?AVCLKRLinearHashTable_Iterator@@XZ
?BucketIndex@CLKRHashTableStats@@SAJJ@Z
?BucketSize@CLKRHashTableStats@@SAJJ@Z
?BucketSizes@CLKRHashTableStats@@SAPEBJXZ
?CalcHash@TREE_HASH_TABLE@@QEAAJPEBGPEAK@Z
?CalcLength@MULTISZ@@SAKPEBGPEAK@Z
?CalcLength@MULTISZA@@SAKPEBDPEAK@Z
?ChangeExclusiveLockToSharedLock@CSharelock@@QEAAXXZ
?ChangeSharedLockToExclusiveLock@CSharelock@@QEAAEH@Z
?CheckSignature@BIG_REF_TRACE@@AEBAHXZ
?CheckTable@CLKRHashTable@@QEBAHXZ
?CheckTable@CLKRLinearHashTable@@QEBAHXZ
?ClaimExclusiveLock@CSharelock@@QEAAEH@Z
?ClaimShareLock@CSharelock@@QEAAEH@Z
?ClassName@CCritSec@@SAPEBGXZ
?ClassName@CFakeLock@@SAPEBGXZ
?ClassName@CLKRHashTable@@SAPEBGXZ
?ClassName@CLKRLinearHashTable@@SAPEBGXZ
?ClassName@CReaderWriterLock2@@SAPEBGXZ
?ClassName@CReaderWriterLock3@@SAPEBGXZ
?ClassName@CReaderWriterLock@@SAPEBGXZ
?ClassName@CRtlResource@@SAPEBDXZ
?ClassName@CShareLock@@SAPEBDXZ
?ClassName@CSmallSpinLock@@SAPEBGXZ
?ClassName@CSpinLock@@SAPEBGXZ
?Cleanup@ALLOC_CACHE_HANDLER@@SAHH@Z
?CleanupAllLookasides@ALLOC_CACHE_HANDLER@@SAXPEAXE@Z
?CleanupLookaside@ALLOC_CACHE_HANDLER@@QEAAXH@Z
?Clear@CLKRHashTable@@QEAAXXZ
?Clear@CLKRLinearHashTable@@QEAAXXZ
?Clear@TREE_HASH_TABLE@@QEAAXXZ
?ClearBuffer@W3_TRACE_LOG@@QEAAXXZ
?Clone@MULTISZ@@QEBAHPEAV1@@Z
?Clone@MULTISZA@@QEBAHPEAV1@@Z
?Clone@STRA@@QEBAJPEAV1@@Z
?Close@MB@@QEAAHXZ
?Convert@TS_RESOURCE@@QEAAXW4TSRES_CONV_TYPE@@@Z
?ConvertExclusiveToShared@CCritSec@@QEAAXXZ
?ConvertExclusiveToShared@CFakeLock@@QEAAXXZ
?ConvertExclusiveToShared@CLKRHashTable@@QEBAXXZ
?ConvertExclusiveToShared@CLKRLinearHashTable@@QEBAXXZ
?ConvertExclusiveToShared@CReaderWriterLock2@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock3@@QEAAXXZ
?ConvertExclusiveToShared@CReaderWriterLock@@QEAAXXZ
?ConvertExclusiveToShared@CRtlResource@@QEAAXXZ
?ConvertExclusiveToShared@CShareLock@@QEAAXXZ
?ConvertExclusiveToShared@CSmallSpinLock@@QEAAXXZ
?ConvertExclusiveToShared@CSpinLock@@QEAAXXZ
?ConvertSharedToExclusive@CCritSec@@QEAAXXZ
?ConvertSharedToExclusive@CFakeLock@@QEAAXXZ
?ConvertSharedToExclusive@CLKRHashTable@@QEBAXXZ
?ConvertSharedToExclusive@CLKRLinearHashTable@@QEBAXXZ
?ConvertSharedToExclusive@CReaderWriterLock2@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock3@@QEAAXXZ
?ConvertSharedToExclusive@CReaderWriterLock@@QEAAXXZ
?ConvertSharedToExclusive@CRtlResource@@QEAAXXZ
?ConvertSharedToExclusive@CShareLock@@QEAAXXZ
?ConvertSharedToExclusive@CSmallSpinLock@@QEAAXXZ
?ConvertSharedToExclusive@CSpinLock@@QEAAXXZ
?Copy@MULTISZ@@QEAAHAEBV1@@Z
?Copy@MULTISZ@@QEAAHPEBGK@Z
?Copy@MULTISZA@@QEAAHAEBV1@@Z
?Copy@MULTISZA@@QEAAHPEBDK@Z
?Copy@STRA@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJPEBD@Z
?Copy@STRA@@QEAAJPEBDK@Z
?Copy@STRAU@@QEAAHAEAV1@@Z
?Copy@STRAU@@QEAAHPEBD@Z
?Copy@STRAU@@QEAAHPEBDK@Z
?Copy@STRAU@@QEAAHPEBG@Z
?Copy@STRAU@@QEAAHPEBGK@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?CopyA@STRU@@QEAAJPEBD@Z
?CopyA@STRU@@QEAAJPEBDK@Z
?CopyA_ACP@STRU@@QEAAJPEBD@Z
?CopyA_ACP@STRU@@QEAAJPEBDK@Z
?CopyBinary@STRA@@QEAAJPEAXK@Z
?CopyFormattedData@CDFTCache@@QEBAHPEBU_SYSTEMTIME@@PEAD@Z
?CopyFormattedData@DATETIME_FORMAT_ENTRY@@QEBAXPEBU_SYSTEMTIME@@PEAD@Z
?CopyToBuffer@MULTISZ@@QEBAHPEAGPEAK@Z
?CopyToBuffer@MULTISZA@@QEBAHPEADPEAK@Z
?CopyToBuffer@STRA@@QEBAJPEADPEAK@Z
?CopyToBuffer@STRU@@QEBAJPEAGPEAK@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyW@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Escaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBGK@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SAJPEAVIPM2_MESSAGE_ACCEPTOR@@PEBGHHKPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@PEAH@Z
?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SAJPEAVIPM2_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
?CreateIpmMessagePipe@IPM_MESSAGE_PIPE@@SAJPEAVIPM_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
?CreateServer@MULTI_IPM@@QEAAJPEBGKPEAU_SECURITY_ATTRIBUTES@@@Z
?CreateTraceLog@W3_TRACE_LOG_FACTORY@@QEAAJPEAPEAVW3_TRACE_LOG@@@Z
?CreateTraceLogFactory@W3_TRACE_LOG_FACTORY@@SAJPEAPEAV1@PEAX@Z
?DateTimeChars@CDFTCache@@QEBAKXZ
?DecrementAcceptorInUse@IPM2_MESSAGE_PIPE@@AEAAXXZ
?DecrementAcceptorInUse@IPM_MESSAGE_PIPE@@AEAAXXZ
?DeleteData@MB@@QEAAHPEBGKKK@Z
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?DeleteIf@CLKRLinearHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?DeleteIf@TREE_HASH_TABLE@@QEAAXP6AHPEAX0@Z0@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?DeleteKey@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?DeleteNode@TREE_HASH_TABLE@@AEAAXPEAUTREE_HASH_NODE@@@Z
?DeleteNodeInternal@TREE_HASH_TABLE@@AEAAXPEAPEAUTREE_HASH_NODE@@PEAU2@@Z
?DeleteObject@MB@@QEAAHPEBG@Z
?DeletePath@TREE_HASH_TABLE@@QEAAXPEBG@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?DeleteRecord@CLKRLinearHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?DestroyEventLogSource@EVENT_LOG@@CAXPEAU_EVENT_LOG_SOURCE@@@Z
?DestroyIpmMessagePipe@IPM2_MESSAGE_PIPE@@QEAAXXZ
?DestroyIpmMessagePipe@IPM_MESSAGE_PIPE@@QEAAXXZ
?DestroyTraceLog@W3_TRACE_LOG@@QEAAXXZ
?DestroyTraceLogFactory@W3_TRACE_LOG_FACTORY@@QEAAXXZ
?DisableEventsCallbackCustomHandler@CEtwTracer@@UEAAKXZ
?DisableFreeList@ALLOC_CACHE_HANDLER@@QEAAXXZ
?DumpStatsToHtml@ALLOC_CACHE_HANDLER@@SAHPEADPEAK@Z
?EmptyAndFreeHeadEntry@BIG_REF_TRACE@@AEAAJPEAU_REF_TRACE_HEAD_ENTRY@@@Z
?EnableEventsCallbackCustomHandler@CEtwTracer@@UEAAKXZ
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?End@CLKRLinearHashTable@@QEAA?AVCLKRLinearHashTable_Iterator@@XZ
?EnumObjects@MB@@QEAAHPEBGPEAGK@Z
?EnumUILanguagesProc@LANG_STRING@@CAHPEAG_J@Z
?EqualRange@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@1@Z
?EqualRange@CLKRLinearHashTable@@QEAA_N_KAEAVCLKRLinearHashTable_Iterator@@1@Z
?Equals@MULTISZ@@QEAAHPEAV1@@Z
?Equals@STRA@@QEBA_NAEBV1@@Z
?Equals@STRA@@QEBA_NPEBD@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
?Equals@STRU@@QEBA_NPEBG@Z
?EqualsNoCase@STRA@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRA@@QEBA_NPEBD@Z
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@0@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRLinearHashTable@@QEAA_NAEAVCLKRLinearHashTable_Iterator@@0@Z
?Erase@CLKRLinearHashTable@@QEAA_NAEAVCLKRLinearHashTable_Iterator@@@Z
?Escape@STRA@@QEAAJ_N0@Z
?Escape@STRU@@QEAAJXZ
?EtwTraceEvent@CEtwTracer@@QEAAKPEAU_ETW_TRACE_EVENT@@@Z
?EtwTraceEvent@CEtwTracer@@QEAAKPEAU_EVENT_TRACE_HEADER@@@Z
?EtwTraceEvent@CEtwTracer@@QEAAKPEBU_GUID@@KZZ
?ExpandEnvironmentVariables@STRU@@SAJPEBGPEAV1@@Z
?ExpandEnvironmentVariables@STRU_PATH@@QEAAJPEAG@Z
?ExpandEnvironmentVariables@STRU_PATH@@QEAAJXZ
?FastAppend@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FastAppend@MULTISZ@@QEAAHPEBG@Z
?FastAppend@MULTISZ@@QEAAHPEBGK@Z
?FastAuxAppend@MULTISZ@@AEAAHPEBGIH@Z
?FastCopy@MULTISZ@@QEAAHAEBV1@@Z
?FastCopy@MULTISZ@@QEAAHPEBGK@Z
?Find@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@@Z
?Find@CLKRLinearHashTable@@QEAA_N_KAEAVCLKRLinearHashTable_Iterator@@@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?FindKey@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?FindNodeInternal@TREE_HASH_TABLE@@AEAAHPEBGKPEAPEAUTREE_HASH_NODE@@PEAPEAPEAU2@@Z
?FindRecord@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?FindRecord@CLKRLinearHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?FindRecord@TREE_HASH_TABLE@@QEAAXPEBGPEAPEAX@Z
?FindRefTraceHeadEntry@BIG_REF_TRACE@@SAPEAU_REF_TRACE_HEAD_ENTRY@@PEAV1@PEAX@Z
?FindString@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindString@MULTISZ@@QEAAHPEBG@Z
?FindString@MULTISZA@@QEAAHAEAVSTRA@@@Z
?FindString@MULTISZA@@QEAAHPEBD@Z
?FindStringNoCase@MULTISZ@@QEAAHAEAVSTRU@@@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
?First@CDoubleList@@QEBAQEAVCListEntry@@XZ
?First@CLockedDoubleList@@QEAAQEAVCListEntry@@XZ
?First@MULTISZ@@QEBAPEBGXZ
?First@MULTISZA@@QEBAPEBDXZ
?FormatString@STRA@@QEAAJKQEAPEBDPEBDK@Z
?FormattedBuffer@CDFTCache@@QEBAPEBDXZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
?FreeAllAllocatedSpace@CHUNK_BUFFER@@QEAAXXZ
?FreeEntry@BIG_REF_TRACE@@AEAAXPEAU_REF_TRACE_ENTRY@@@Z
?FreeHeadEntry@BIG_REF_TRACE@@AEAAXPEAU_REF_TRACE_HEAD_ENTRY@@@Z
?FreeMemory@BUFFER@@QEAAXXZ
?FreeMemoryInternal@BUFFER@@AEAAXXZ
?GenerateDateTimeString@ASCLOG_DATETIME_CACHE@@UEAAXPEAUDATETIME_FORMAT_ENTRY@@PEBU_SYSTEMTIME@@@Z
?GenerateDateTimeString@EXTLOG_DATETIME_CACHE@@UEAAXPEAUDATETIME_FORMAT_ENTRY@@PEBU_SYSTEMTIME@@@Z
?GenerateDateTimeString@W3_DATETIME_CACHE@@UEAAXPEAUDATETIME_FORMAT_ENTRY@@PEBU_SYSTEMTIME@@@Z
?GetAll@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAK2@Z
?GetBucketLockSpinCount@CLKRHashTable@@QEBAGXZ
?GetBucketLockSpinCount@CLKRLinearHashTable@@QEBAGXZ
?GetBuffer@MB@@QEAAHPEBGKKPEAVBUFFER@@PEAKK@Z
?GetChildPaths@MB@@QEAAHPEBGPEAVBUFFER@@@Z
?GetData@MB@@QEAAHPEBGKKKPEAXPEAKK@Z
?GetDataPaths@MB@@QEAAHPEBGKKPEAVBUFFER@@@Z
?GetDataSetNumber@MB@@QEAAHPEBGPEAK@Z
?GetDefaultSpinAdjustmentFactor@CCritSec@@SANXZ
?GetDefaultSpinAdjustmentFactor@CFakeLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SANXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CRtlResource@@SANXZ
?GetDefaultSpinAdjustmentFactor@CShareLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SANXZ
?GetDefaultSpinAdjustmentFactor@CSpinLock@@SANXZ
?GetDefaultSpinCount@CCritSec@@SAGXZ
?GetDefaultSpinCount@CFakeLock@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock2@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock3@@SAGXZ
?GetDefaultSpinCount@CReaderWriterLock@@SAGXZ
?GetDefaultSpinCount@CRtlResource@@SAGXZ
?GetDefaultSpinCount@CShareLock@@SAGXZ
?GetDefaultSpinCount@CSmallSpinLock@@SAGXZ
?GetDefaultSpinCount@CSpinLock@@SAGXZ
?GetDword@MB@@QEAAHPEBGKKPEAKK@Z
?GetDword@MB@@QEAAXPEBGKKKPEAKK@Z
?GetFallbackLanguage@LANG_STRING@@QEAAJPEAPEBD@Z
Sections
.text Size: 155KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ