uihelper.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
uihelper.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
uihelper.dll
-
Size
188KB
-
MD5
8e5fdab5f953a64ad2eb97a7e3bb83b3
-
SHA1
b344a2294696afa8fd4c93c42deb034b50d8e23d
-
SHA256
88aa922bc0d5d77111d0ad1e8c4b7d0ff48c88a58a356b87e4105b9bd770fd04
-
SHA512
70bb6dc772f91b81d253b51fdc50049a33574d2130fbbe731149f09908121302b01cf539249c164f9a705923fcb6aee3b145a1ff255a18a23e6622bf9534aa92
-
SSDEEP
3072:goB28HD6yt5SAvPuS+gVtmEMyIRSFKdeYRBrxsFA:l2ED6k53Gcsi+
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource uihelper.dll
Files
-
uihelper.dll.dll windows:10 windows x64 arch:x64
5da84e56ee763a939b83cf7fda96afd1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memcmp
wcsncmp
_purecall
memcpy
memset
memmove
_wcsicmp
wcscoll
towupper
towlower
iswspace
_vsnwprintf_s
_wcsnicmp
swprintf_s
??0exception@@QEAA@AEBV0@@Z
iswdigit
_wtol
_ltow
_wtoi
wcscpy_s
wcscat_s
malloc
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
__CxxFrameHandler3
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
free
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
wcscmp
atl
ord45
ord44
ord43
ord21
ord16
kernel32
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
SetUnhandledExceptionFilter
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
VirtualAlloc
VirtualFree
GetDriveTypeW
GetFileAttributesW
FindClose
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
InterlockedPopEntrySList
TerminateProcess
GetLastError
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
DisableThreadLibraryCalls
LoadLibraryExA
GetProcAddress
FreeLibrary
GetSystemTimeAsFileTime
GetModuleHandleA
GetUserDefaultUILanguage
GetLocaleInfoW
ExpandEnvironmentStringsW
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
LoadLibraryExW
FormatMessageW
MultiByteToWideChar
LocalFree
GetCurrentProcess
CloseHandle
GetComputerNameW
lstrcmpiW
GetVolumeInformationW
LocalAlloc
GetCurrentDirectoryW
FindFirstFileW
user32
GetClientRect
GetWindowRect
ReleaseDC
SetFocus
CharNextW
MessageBoxW
GetFocus
LoadStringW
SetWindowTextW
EndDialog
GetActiveWindow
DialogBoxParamW
GetWindowTextW
GetParent
GetCaretPos
CallWindowProcW
DestroyWindow
SetWindowLongPtrW
GetWindowLongPtrW
CreateWindowExW
GetDlgItem
SendMessageW
GetAncestor
DefWindowProcW
GetDC
SetTimer
RedrawWindow
UpdateWindow
InvalidateRect
IsWindow
GetWindowThreadProcessId
KillTimer
gdi32
GetTextMetricsW
advapi32
RegOpenKeyW
AdjustTokenPrivileges
LogonUserW
OpenProcessToken
RegCloseKey
RegQueryValueExW
LookupPrivilegeValueW
shell32
SHBrowseForFolderW
SHGetFolderLocation
SHGetPathFromIDListW
SHGetMalloc
DoEnvironmentSubstW
ole32
CoInitialize
CoCreateInstanceEx
CoSetProxyBlanket
CoQueryProxyBlanket
CoUninitialize
oleaut32
SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString
shlwapi
PathAddBackslashW
PathFindExtensionW
PathCompactPathW
PathMakePrettyW
PathGetCharTypeW
PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
PathIsNetworkPathW
StrPBrkW
StrDupW
PathIsUNCW
PathFileExistsW
PathIsDirectoryW
PathIsRelativeW
PathIsUNCServerW
PathIsUNCServerShareW
PathIsRootW
PathGetDriveNumberW
PathBuildRootW
StrCmpIW
StrChrW
PathRemoveArgsW
PathUnquoteSpacesW
PathGetArgsW
PathFindFileNameW
PathQuoteSpacesW
SHAutoComplete
crypt32
CryptUnprotectMemory
CryptProtectMemory
comdlg32
GetOpenFileNameW
GetSaveFileNameW
comctl32
ord412
ord410
ord413
Exports
Exports
??0?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAA@AEBV01@@Z
??0?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAA@XZ
??0?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA@AEBV01@@Z
??0?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA@XZ
??0?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA@AEBV01@@Z
??0?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA@XZ
??0?$_List_nod@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@IEAA@V?$allocator@VCString@IIS@@@1@@Z
??0?$_List_nod@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV01@@Z
??0?$_List_ptr@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@IEAA@V?$allocator@VCString@IIS@@@1@@Z
??0?$_List_ptr@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV01@@Z
??0?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV01@@Z
??0?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@V?$allocator@VCString@IIS@@@1@@Z
??0?$_String_val@GV?$allocator@G@std@@@std@@IEAA@V?$allocator@G@1@@Z
??0?$_String_val@GV?$allocator@G@std@@@std@@QEAA@AEBV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@AEBV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@AEBV01@_K1@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@AEBV01@_K1AEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@AEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBG0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBGAEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBG_K@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@PEBG_KAEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@1@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@_KG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@_KGAEBV?$allocator@G@1@@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV01@@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@AEBV?$allocator@VCString@IIS@@@1@@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@XZ
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@_K@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@_KAEBVCString@IIS@@@Z
??0?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@_KAEBVCString@IIS@@AEBV?$allocator@VCString@IIS@@@1@@Z
??0CBlob@@QEAA@AEBV0@@Z
??0CBlob@@QEAA@KPEAEH@Z
??0CBlob@@QEAA@XZ
??0CComAuthInfo@@QEAA@AEAV0@@Z
??0CComAuthInfo@@QEAA@PEAV0@@Z
??0CComAuthInfo@@QEAA@PEBG00@Z
??0CError@@QEAA@AEBV0@@Z
??0CError@@QEAA@J@Z
??0CError@@QEAA@K@Z
??0CError@@QEAA@XZ
??0CFileChooser@@QEAA@AEBV0@@Z
??0CFileChooser@@QEAA@XZ
??0CIISApplication@@QEAA@$$QEAV0@@Z
??0CIISApplication@@QEAA@AEAV0@@Z
??0CIISApplication@@QEAA@PEAVCComAuthInfo@@PEBG@Z
??0CIISInterface@@QEAA@AEAV0@@Z
??0CIISInterface@@QEAA@PEAVCComAuthInfo@@J@Z
??0CIISSvcControl@@QEAA@AEAV0@@Z
??0CIISSvcControl@@QEAA@PEAV0@@Z
??0CIISSvcControl@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetaBack@@QEAA@$$QEAV0@@Z
??0CMetaBack@@QEAA@AEAV0@@Z
??0CMetaBack@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetaEnumerator@@QEAA@$$QEAV0@@Z
??0CMetaEnumerator@@QEAA@AEAV0@@Z
??0CMetaEnumerator@@QEAA@HPEAVCMetaKey@@@Z
??0CMetaEnumerator@@QEAA@PEAVCComAuthInfo@@PEBGK@Z
??0CMetaEnumerator@@QEAA@PEAVCMetaInterface@@PEBGK@Z
??0CMetaInterface@@IEAA@PEAV0@@Z
??0CMetaInterface@@IEAA@PEAVCComAuthInfo@@@Z
??0CMetaInterface@@QEAA@AEAV0@@Z
??0CMetaKey@@QEAA@AEAV0@@Z
??0CMetaKey@@QEAA@HPEAV0@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@@Z
??0CMetaKey@@QEAA@PEAVCComAuthInfo@@PEBGKK@Z
??0CMetaKey@@QEAA@PEAVCMetaInterface@@@Z
??0CMetaKey@@QEAA@PEAVCMetaInterface@@PEBGKK@Z
??0CMetabasePath@@QEAA@$$QEAV0@@Z
??0CMetabasePath@@QEAA@AEBV0@@Z
??0CMetabasePath@@QEAA@HPEBG000@Z
??0CMetabasePath@@QEAA@PEBGK00@Z
??0CStrPassword@@QEAA@AEAV0@@Z
??0CStrPassword@@QEAA@PEAG@Z
??0CStrPassword@@QEAA@PEBG@Z
??0CStrPassword@@QEAA@XZ
??0CString@IIS@@QEAA@AEBV01@@Z
??0CString@IIS@@QEAA@AEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@@Z
??0CString@IIS@@QEAA@AEBVCComBSTR@ATL@@@Z
??0CString@IIS@@QEAA@GH@Z
??0CString@IIS@@QEAA@PEBD@Z
??0CString@IIS@@QEAA@PEBG@Z
??0CString@IIS@@QEAA@XZ
??0CStringListEx@@QEAA@AEBV0@@Z
??0CStringListEx@@QEAA@XZ
??0CWamInterface@@IEAA@PEAV0@@Z
??0CWamInterface@@IEAA@PEAVCComAuthInfo@@@Z
??0CWamInterface@@QEAA@AEAV0@@Z
??1?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAA@XZ
??1?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA@XZ
??1?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAA@XZ
??1?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAA@XZ
??1CBlob@@QEAA@XZ
??1CComAuthInfo@@QEAA@XZ
??1CError@@QEAA@XZ
??1CFileChooser@@QEAA@XZ
??1CIISApplication@@UEAA@XZ
??1CIISInterface@@QEAA@XZ
??1CIISSvcControl@@UEAA@XZ
??1CMetaBack@@UEAA@XZ
??1CMetaEnumerator@@UEAA@XZ
??1CMetaInterface@@UEAA@XZ
??1CMetaKey@@UEAA@XZ
??1CMetabasePath@@QEAA@XZ
??1CStrPassword@@QEAA@XZ
??1CString@IIS@@QEAA@XZ
??1CStringListEx@@QEAA@XZ
??1CWamInterface@@UEAA@XZ
??2CComAuthInfo@@SAPEAX_K@Z
??3CComAuthInfo@@SAXPEAX@Z
??4?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAAAEAV01@$$QEAV01@@Z
??4?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAAEAV01@$$QEAV01@@Z
??4?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$_List_nod@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_List_nod@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$_List_ptr@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_List_ptr@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$_String_val@GV?$allocator@G@std@@@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_String_val@GV?$allocator@G@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@AEBV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@G@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@PEBG@Z
??4?$list@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAAEAV01@AEBV01@@Z
??4CBlob@@QEAAAEAV0@AEBV0@@Z
??4CComAuthInfo@@QEAAAEAV0@AEAV0@@Z
??4CComAuthInfo@@QEAAAEAV0@PEAV0@@Z
??4CComAuthInfo@@QEAAAEAV0@PEBG@Z
??4CError@@QEAAAEBV0@AEBV0@@Z
??4CError@@QEAAAEBV0@J@Z
??4CFileChooser@@QEAAAEAV0@AEBV0@@Z
??4CIISApplication@@QEAAAEAV0@$$QEAV0@@Z
??4CIISApplication@@QEAAAEAV0@AEAV0@@Z
??4CIISInterface@@QEAAAEAV0@AEAV0@@Z
??4CIISSvcControl@@QEAAAEAV0@AEAV0@@Z
??4CMetaBack@@QEAAAEAV0@$$QEAV0@@Z
??4CMetaBack@@QEAAAEAV0@AEAV0@@Z
??4CMetaEnumerator@@QEAAAEAV0@$$QEAV0@@Z
??4CMetaEnumerator@@QEAAAEAV0@AEAV0@@Z
??4CMetaInterface@@QEAAAEAV0@AEAV0@@Z
??4CMetaKey@@QEAAAEAV0@AEAV0@@Z
??4CMetabasePath@@QEAAAEAV0@$$QEAV0@@Z
??4CMetabasePath@@QEAAAEAV0@AEBV0@@Z
??4CStrPassword@@QEAAAEBV0@AEAV0@@Z
??4CStrPassword@@QEAAAEBV0@PEBG@Z
??4CString@IIS@@QEAAAEBV01@AEBV01@@Z
??4CString@IIS@@QEAAAEBV01@D@Z
??4CString@IIS@@QEAAAEBV01@G@Z
??4CString@IIS@@QEAAAEBV01@PEBE@Z
??4CString@IIS@@QEAAAEBV01@PEBG@Z
??4CStringListEx@@QEAAAEAV0@AEBV0@@Z
??4CWamInterface@@QEAAAEAV0@AEAV0@@Z
??8CBlob@@QEBAHAEBV0@@Z
??8CError@@QEAA?BHAEAV0@@Z
??8CError@@QEAA?BHJ@Z
??8CStrPassword@@QEAA_NAEAV0@@Z
??9CBlob@@QEBAHAEBV0@@Z
??9CError@@QEAA?BHAEAV0@@Z
??9CError@@QEAA?BHJ@Z
??9CStrPassword@@QEAA_NAEAV0@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAG_K@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEBAAEBG_K@Z
??ACString@IIS@@QEBAGH@Z
??BCComAuthInfo@@QEAAPEAGXZ
??BCComAuthInfo@@QEAAPEAV0@XZ
??BCError@@QEAAPEBGXZ
??BCError@@QEBA?BHXZ
??BCError@@QEBA?BJXZ
??BCError@@QEBA?BKXZ
??BCIISInterface@@QEBAHXZ
??BCIISInterface@@QEBAJXZ
??BCMetaKey@@QEBAHXZ
??BCMetaKey@@QEBAKXZ
??BCMetaKey@@QEBAPEBGXZ
??BCMetabasePath@@QEBAPEBGXZ
??BCStrPassword@@QEAA?AVCString@IIS@@XZ
??BCString@IIS@@QEBAPEBGXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@AEBV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@V_STL70@@@std@@QEAAAEAV01@PEBG@Z
??YCString@IIS@@QEAAAEBV01@AEBV01@@Z
??YCString@IIS@@QEAAAEBV01@D@Z
??YCString@IIS@@QEAAAEBV01@G@Z
??YCString@IIS@@QEAAAEBV01@PEBG@Z
??_7CFileChooser@@6B@
??_7CIISApplication@@6BCMetaKey@@@
??_7CIISApplication@@6BCWamInterface@@@
??_7CIISInterface@@6B@
??_7CIISSvcControl@@6B@
??_7CMetaBack@@6BCMetaInterface@@@
??_7CMetaBack@@6BCWamInterface@@@
??_7CMetaEnumerator@@6B@
??_7CMetaInterface@@6B@
??_7CMetaKey@@6B@
??_7CWamInterface@@6B@
??_F?$_List_val@VCString@IIS@@V?$allocator@VCString@IIS@@@std@@@std@@QEAAXXZ
??_F?$_String_val@GV?$allocator@G@std@@@std@@QEAAXXZ
??_FCComAuthInfo@@QEAAXXZ
??_FCMetabasePath@@QEAAXXZ
?AddExtension@CFileChooser@@QEAAXPEAUHINSTANCE__@@II@Z
?AddExtension@CFileChooser@@QEAAXPEBG0@Z
?AddKey@CMetaInterface@@IEAAJKPEBG@Z
?AddKey@CMetaKey@@QEAAJPEBG@Z
?AddOverride@CError@@QEAAIJI@Z
?AddStyle@CFileChooser@@QEAAXK@Z
?AllocateStatics@CError@@KAHXZ
?AppCreate@CWamInterface@@IEAAJPEBGK@Z
?AppDelete@CWamInterface@@IEAAJPEBGH@Z
?AppDeleteRecoverable@CWamInterface@@IEAAJPEBGH@Z
?AppGetStatus@CWamInterface@@IEAAJPEBGPEAK@Z
?AppRecover@CWamInterface@@IEAAJPEBGH@Z
?AppUnLoad@CWamInterface@@IEAAJPEBGH@Z
?AppendPath@CMetabasePath@@IEAAXK@Z
?AppendPath@CMetabasePath@@IEAAXPEBG@Z
?ApplyProxyBlanket@CComAuthInfo@@QEAAJPEAUIUnknown@@@Z
?ApplyProxyBlanket@CComAuthInfo@@QEAAJPEAUIUnknown@@K@Z
?ApplyProxyBlanket@CIISSvcControl@@MEAAJXZ
?ApplyProxyBlanket@CMetaBack@@MEAAJXZ
?ApplyProxyBlanket@CMetaInterface@@MEAAJXZ
?ApplyProxyBlanket@CWamInterface@@MEAAJXZ
?AreStaticsAllocated@CError@@KAHXZ
?Backup@CMetaBack@@QEAAJPEBG@Z
?Backup@CMetaInterface@@IEAAJPEBGKK@Z
?BrowseForFile@CFileChooser@@IEAAHAEAVCString@IIS@@0@Z
?BrowseForFolder@CFileChooser@@IEAAHAEAVCString@IIS@@@Z
?BrowseForFolderCallback@CFileChooser@@QEAAHPEAUHWND__@@I_J@Z
?BuildMetaPath@CMetabasePath@@IEAAXPEBG000@Z
?BuildMetaPath@CMetabasePath@@IEAAXPEBGK00@Z
?ChangeProxyBlanket@CIISInterface@@UEAAJPEBG0@Z
?CheckDescendants@CMetaKey@@QEAAJKPEAVCComAuthInfo@@PEBG@Z
?CleanMetaPath@CMetabasePath@@SAPEBGAEAV1@@Z
?CleanMetaPath@CMetabasePath@@SAPEBGAEAVCString@IIS@@@Z
?CleanUp@CBlob@@QEAAXXZ
?Clear@CStringListEx@@QEAAXXZ
?ClearPasswordBuffers@CStrPassword@@AEAAXXZ
?Close@CMetaKey@@QEAAJXZ
?CloseKey@CMetaInterface@@IEAAJK@Z
?Collate@CString@IIS@@QEBAHPEBG@Z
?CommonConstruct@CIISApplication@@IEAAXXZ
?Compare@CStrPassword@@QEBAHAEAV1@@Z
?Compare@CStrPassword@@QEBAHAEAVCString@IIS@@@Z
?Compare@CStrPassword@@QEBAHPEBG@Z
?Compare@CString@IIS@@QEBAHPEBG@Z
?CompareNoCase@CString@IIS@@QEBAHPEBG@Z
?Construct@CError@@IEAAAEBV1@AEBV1@@Z
?Construct@CError@@IEAAAEBV1@J@Z
?ConvertFromDoubleNullList@CStringListEx@@QEAAKPEBGH@Z
?ConvertToDoubleNullList@CStringListEx@@QEAAKAEAKAEAPEAG@Z
?ConvertToParentPath@CMetaKey@@QEAAJH@Z
?ConvertToParentPath@CMetabasePath@@SAPEBGAEAV1@@Z
?ConvertToParentPath@CMetabasePath@@SAPEBGAEAVCString@IIS@@@Z
?CopyData@CMetaInterface@@IEAAJKPEBGK0KKKH@Z
?CopyKey@CMetaInterface@@IEAAJKPEBGK0HH@Z
?CopyTo@CStrPassword@@QEAAXAEAV1@@Z
?CopyTo@CStrPassword@@QEAAXAEAVCString@IIS@@@Z
?Create@?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@QEAAPEAUHWND__@@PEAU3@AEAUtagRECT@@PEBGKKIPEAX@Z
?Create@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAPEAUHWND__@@PEAU3@AEAUtagRECT@@PEBGKKIGPEAX@Z
?Create@CIISApplication@@QEAAJPEBGK@Z
?Create@CIISInterface@@IEAAJHQEBU_GUID@@0PEAHPEAPEAUIUnknown@@@Z
?Create@CIISSvcControl@@IEAAJXZ
?Create@CMetaInterface@@IEAAJXZ
?Create@CWamInterface@@IEAAJXZ
?CreateAuthInfoForAuthnLevel@CComAuthInfo@@QEBAJPEAU_COSERVERINFO@@K@Z
?CreateDefaultPathForRead@CFileChooser@@IEAAXXZ
?CreateFilter@CFileChooser@@IEAAXAEAVCString@IIS@@0@Z
?CreatePathFromFailedOpen@CMetaKey@@QEAAJXZ
?CreateServerInfoStruct@CComAuthInfo@@QEBAPEAU_COSERVERINFO@@K@Z
?CreateServerInfoStruct@CComAuthInfo@@QEBAPEAU_COSERVERINFO@@XZ
?CvtToInternalFormat@CError@@KAJJ@Z
?DeAllocateStatics@CError@@KAXXZ
?DefWindowProcW@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA_JI_K_J@Z
?DefWindowProcW@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAA_JXZ
?DefaultReflectionHandler@?$CWindowImplRoot@VCWindow@ATL@@@ATL@@SAHPEAUHWND__@@I_K_JAEA_J@Z
?Delete@CIISApplication@@QEAAJH@Z
?Delete@CMetaBack@@QEAAJPEBGK@Z
?DeleteAllData@CMetaInterface@@IEAAJKPEBGKK@Z
?DeleteBackup@CMetaInterface@@IEAAJPEBGK@Z
?DeleteChildKeys@CMetaInterface@@IEAAJKPEBG@Z
?DeleteData@CMetaInterface@@IEAAJKPEBGKK@Z
?DeleteKey@CMetaInterface@@IEAAJKPEBG@Z
?DeleteKey@CMetaKey@@QEAAJPEBG@Z
?DeleteRecoverable@CIISApplication@@QEAAJH@Z
?DeleteValue@CMetaKey@@QEAAJKPEBG@Z
?DestroyClearTextPassword@CStrPassword@@QEBAXPEAG@Z
?DestroyWindow@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAHXZ
?DoesPathExist@CMetaKey@@QEAAJPEBG@Z
?EditShowBalloon@@YAXPEAUHWND__@@PEAUHINSTANCE__@@I@Z
?EditShowBalloon@@YAXPEAUHWND__@@PEBG@Z
?Empty@CStrPassword@@QEAAXXZ
?Empty@CString@IIS@@QEAAXXZ
?EnumBackups@CMetaInterface@@IEAAJPEAGPEAKPEAU_FILETIME@@K@Z
?EnumData@CMetaInterface@@IEAAJKPEBGPEAU_METADATA_RECORD@@KPEAK@Z
?EnumKeys@CMetaInterface@@IEAAJKPEBGPEAGK@Z
?ExpandEscapeCode@CError@@IEBAHPEAGKAEAPEAGAEAVCString@IIS@@AEAJ@Z
?ExtractArgs@CFileChooser@@IEAAHPEAG@Z
?ExtractPath@CFileChooser@@IEAAHPEAG@Z
?Failed@CError@@QEBAHXZ
?Failed@CError@@SAHJ@Z
?Find@CString@IIS@@QEBAHG@Z
?Find@CString@IIS@@QEBAHPEBG@Z
?FindFacility@CError@@KAPEBGK@Z
?FindOneOf@CString@IIS@@QEBAHPEBG@Z
?Format@CString@IIS@@QEAAXPEAUHINSTANCE__@@IZZ
?Format@CString@IIS@@QEAAXPEBGZZ
?FormatMessageW@CString@IIS@@QEAAHPEAUHINSTANCE__@@IZZ
?FormatMessageW@CString@IIS@@QEAAHPEBGZZ
?FormatV@CString@IIS@@QEAAXPEBGPEAD@Z
?FreeServerInfoStruct@CComAuthInfo@@QEBAXPEAU_COSERVERINFO@@@Z
?GenerateRegistryKey@@YAPEBGAEAVCString@IIS@@PEBG@Z
?GetAdminInterface2@CMetaInterface@@QEAAJPEAPEAUIMSAdminBase2W@@@Z
?GetAllData@CMetaInterface@@IEAAJKPEBGKKKPEAK1KPEAE1@Z
?GetAllData@CMetaKey@@IEAAJKKKPEAK0PEAPEAEPEBG@Z
?GetAt@CString@IIS@@QEBAGH@Z
?GetBase@CMetaKey@@QEBAKXZ
?GetByteLength@CStrPassword@@QEBAHXZ
?GetClearTextPassword@CStrPassword@@QEAAPEAGXZ
?GetCurrentMessage@?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEBAPEBUtagMSG@@XZ
?GetData@CBlob@@QEAAPEAEXZ
?GetData@CMetaInterface@@IEAAJKPEBGPEAU_METADATA_RECORD@@PEAK@Z
?GetDataPaths@CMetaInterface@@IEAAJKPEBGKKKPEAGPEAK@Z
?GetDataPaths@CMetaKey@@QEAAJAEAVCStringListEx@@KKPEBG@Z
?GetFileName@CFileChooser@@QEAAKAEAVCString@IIS@@@Z
?GetFilterIndex@CFileChooser@@IEAAHAEBVCString@IIS@@@Z
?GetHandle@CMetaKey@@QEBAKXZ
?GetIndex@CMetaEnumerator@@QEAAKXZ
?GetInstanceNumber@CMetabasePath@@SAKPEBG@Z
?GetInstancePath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@PEAV23@@Z
?GetInterface@CMetaInterface@@QEAAPEAUIMSAdminBaseW@@XZ
?GetLastChangeTime@CMetaInterface@@IEAAJKPEBGPEAU_FILETIME@@H@Z
?GetLastNodeName@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@@Z
?GetLastWinError@CError@@QEAAXXZ
?GetLength@CStrPassword@@QEBAHXZ
?GetLength@CString@IIS@@QEBAHXZ
?GetMDFieldDef@CMetaKey@@SAHKAEAK000@Z
?GetMachinePath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@PEAV23@@Z
?GetOfnFlags@CFileChooser@@QEAAKXZ
?GetPropertyDescription@CMetaKey@@SAHKAEAVCString@IIS@@@Z
?GetPropertyValue@CMetaKey@@IEAAJKAEAKAEAPEAXPEAKPEAHPEBG2@Z
?GetRootPath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@PEAV23@@Z
?GetServiceInfoPath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@0@Z
?GetServicePath@CMetabasePath@@SAPEBGPEBGAEAVCString@IIS@@PEAV23@@Z
?GetSize@CBlob@@QEBAKXZ
?GetSpecialPathRealPath@@YAHAEBVCString@IIS@@AEAV12@@Z
?GetStyle@CFileChooser@@QEBAKXZ
?GetText@CFileChooser@@IEAAXPEAG@Z
?GetWindowProc@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@UEAAP6A_JPEAUHWND__@@I_K_J@ZXZ
?GetWndClassInfo@?$CWindowImpl@VCFileChooser@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@SAAEAU_ATL_WNDCLASSINFOW@@XZ
?GetWndExStyle@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@SAKK@Z
?GetWndStyle@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@SAKK@Z
?HResult@CError@@QEBAJXZ
?HResult@CError@@SAJJ@Z
?HasEditFocus@CFileChooser@@IEAAHXZ
?HasInterface@CIISSvcControl@@IEBAHXZ
?HasInterface@CMetaInterface@@IEBAHXZ
?HasInterface@CWamInterface@@IEBAHXZ
?HasOverride@CError@@IEBAHPEAI@Z
?Init@CFileChooser@@QEAAHPEAVCWindow@ATL@@KII@Z
?IsDevicePath@@YAHAEBVCString@IIS@@@Z
?IsEmpty@CBlob@@QEBAHXZ
?IsEmpty@CStrPassword@@QEBAHXZ
?IsEmpty@CString@IIS@@QEBA_NXZ
?IsEnabledApplication@CIISApplication@@QEBAHXZ
?IsHomeDirectoryPath@CMetaKey@@QEBAHXZ
?IsHomeDirectoryPath@CMetabasePath@@QEBAHXZ
?IsHomeDirectoryPath@CMetabasePath@@SAHPEBG@Z
?IsInproc@CIISApplication@@QEBAHXZ
?IsLocal@CComAuthInfo@@QEBAHXZ
?IsLocal@CIISInterface@@QEBAHXZ
?IsMasterInstance@CMetabasePath@@SAHPEBG@Z
?IsOpen@CMetaKey@@QEBAHXZ
?IsOutOfProc@CIISApplication@@QEBAHXZ
?IsPooledProc@CIISApplication@@QEBAHXZ
?IsPropertyInheritable@CMetaKey@@SAHK@Z
?IsSeparator@CMetabasePath@@SAHG@Z
?IsSpecialPath@@YAHAEBVCString@IIS@@H@Z
?IsValidChar@CFileChooser@@IEAAHIH@Z
?IsValidPath@@YAHPEBG@Z
?IsValidPath@CFileChooser@@IEAAHPEBG@Z
?Kill@CIISSvcControl@@QEAAJXZ
?Left@CString@IIS@@QEBA?AV12@H@Z
?LoadStringW@CString@IIS@@QEAAHPEAUHINSTANCE__@@I@Z
?MakeLower@CString@IIS@@QEAAXXZ
?MakeReverse@CString@IIS@@QEAAXXZ
?MakeUpper@CString@IIS@@QEAAXXZ
?MapMDIDToTableIndex@CMetaKey@@SAHK@Z
?MessageBoxFormat@CError@@QEBAHPEAUHINSTANCE__@@IIIZZ
?MessageBoxOnFailure@CError@@QEBAHII@Z
?MessageBoxW@CError@@QEBAHII@Z
?Mid@CString@IIS@@QEBA?AV12@H@Z
?Mid@CString@IIS@@QEBA?AV12@HH@Z
?Next@CMetaBack@@QEAAJPEAKPEAGPEAU_FILETIME@@@Z
?Next@CMetaEnumerator@@QEAAJAEAKAEAVCString@IIS@@PEBG@Z
?Next@CMetaEnumerator@@QEAAJAEAVCString@IIS@@PEBG@Z
?OnBrowseBtn@CFileChooser@@IEAAXXZ
?OnEditChange@CFileChooser@@QEAAXXZ
?OnEditChar@CFileChooser@@IEAA_JI_K_JAEAH@Z
?OnEditKillFocus@CFileChooser@@IEAA_JI_K_JAEAH@Z
?OnEditSetFocus@CFileChooser@@IEAA_JI_K_JAEAH@Z
?OnFinalMessage@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@UEAAXPEAUHWND__@@@Z
?OnPaste@CFileChooser@@QEAAXXZ
?OnSetBrowseState@CFileChooser@@IEAA_JI_K_JAEAH@Z
?Open@CMetaKey@@QEAAJKPEBGK@Z
?OpenForRead@CFileChooser@@QEAAHXZ
?OpenKey@CMetaInterface@@IEAAJKPEBGKPEAK@Z
?Pop@CMetaEnumerator@@QEAAXXZ
?ProcessWindowMessage@CFileChooser@@UEAAHPEAUHWND__@@I_K_JAEA_JK@Z
?Push@CMetaEnumerator@@QEAAXXZ
?PushBack@CStringListEx@@QEAAXPEBG@Z
?QueryAppState@CIISApplication@@QEBAKXZ
?QueryAuthInfo@CIISInterface@@QEAAPEAVCComAuthInfo@@XZ
?QueryFlags@CMetaKey@@QEBAKXZ
?QueryMetaPath@CMetaKey@@QEBAPEBGXZ
?QueryMetaPath@CMetabasePath@@QEBAPEBGXZ
?QueryPassword@CComAuthInfo@@QEBAPEAGXZ
?QueryResult@CIISApplication@@UEBAJXZ
?QueryResult@CIISInterface@@UEBAJXZ
?QueryResult@CMetaBack@@UEBAJXZ
?QueryResult@CMetaKey@@UEBAJXZ
?QueryServerName@CComAuthInfo@@QEBAPEAGXZ
?QueryServerName@CIISInterface@@QEBAPEBGXZ
?QueryUserName@CComAuthInfo@@QEBAPEAGXZ
?QueryValue@CMetaKey@@QEAAJKAEAHPEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAKPEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCBlob@@PEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCComBSTR@ATL@@PEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCStrPassword@@PEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCString@IIS@@PEAHPEBGPEAK@Z
?QueryValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBGPEAK@Z
?QueryWamPath@CIISApplication@@QEBAPEBGXZ
?ReOpen@CMetaKey@@QEAAJK@Z
?ReOpen@CMetaKey@@QEAAJXZ
?Reboot@CIISSvcControl@@QEAAJKH@Z
?Recover@CIISApplication@@QEAAJH@Z
?ReflectNotifications@?$CWindowImplRoot@VCWindow@ATL@@@ATL@@QEAA_JI_K_JAEAH@Z
?RefreshAppState@CIISApplication@@QEAAJXZ
?Regenerate@CMetaInterface@@QEAAJXZ
?RegisterFacility@CError@@SAXKPEBD@Z
?RemoveAllOverrides@CError@@QEAAXXZ
?RemoveImpersonation@CComAuthInfo@@QEAAXXZ
?RemoveOverride@CError@@QEAAXJ@Z
?RemoveStyle@CFileChooser@@QEAAXK@Z
?RenameKey@CMetaInterface@@IEAAJKPEBG0@Z
?RenameKey@CMetaKey@@QEAAJPEBG0@Z
?Reset@CError@@QEAAXXZ
?Reset@CMetaBack@@QEAAXXZ
?Reset@CMetaEnumerator@@QEAAXK@Z
?Restore@CMetaBack@@QEAAJPEBGK@Z
?Restore@CMetaInterface@@IEAAJPEBGKK@Z
?ReverseFind@CString@IIS@@QEBAHG@Z
?Right@CString@IIS@@QEBA?AV12@H@Z
?SaveData@CMetaInterface@@QEAAJXZ
?SetAt@CString@IIS@@QEAAXHG@Z
?SetCompactedPath@CFileChooser@@IEAAXPEBG@Z
?SetComputerNameW@CComAuthInfo@@IEAAXPEBG@Z
?SetData@CMetaInterface@@IEAAJKPEBGPEAU_METADATA_RECORD@@@Z
?SetDialogTitle@CFileChooser@@QEAAXPEBG@Z
?SetImpersonation@CComAuthInfo@@QEAAXPEBG0@Z
?SetLastChangeTime@CMetaInterface@@IEAAJKPEBGPEAU_FILETIME@@H@Z
?SetLastWinError@CError@@QEBAXXZ
?SetOfnFlags@CFileChooser@@QEAAXK@Z
?SetPath@CFileChooser@@QEAAXAEBVCString@IIS@@@Z
?SetPathToEdit@CFileChooser@@IEAAXPEBG@Z
?SetPropertyValue@CMetaKey@@IEAAJKKPEAXPEAHPEBG@Z
?SetStyle@CFileChooser@@QEAAKK@Z
?SetValue@CBlob@@QEAAXKPEAEH@Z
?SetValue@CMetaKey@@QEAAJKAEAVCBlob@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCStrPassword@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCString@IIS@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKAEAVCStringListEx@@PEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKHPEAHPEBG@Z
?SetValue@CMetaKey@@QEAAJKKPEAHPEBG@Z
?SpanExcluding@CString@IIS@@QEBA?AV12@PEBG@Z
?SpanIncluding@CString@IIS@@QEBA?AV12@PEBG@Z
?SplitMetaPathAtInstance@CMetabasePath@@SAXPEBGAEAVCString@IIS@@1@Z
?SplitUserNameAndDomain@CComAuthInfo@@SAHAEAVCString@IIS@@0@Z
?Start@CIISSvcControl@@QEAAJK@Z
?StartWindowProc@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@SA_JPEAUHWND__@@I_K_J@Z
?Status@CIISSvcControl@@QEAAJKPEAEPEAK1@Z
?Stop@CIISSvcControl@@QEAAJKH@Z
?StorePassword@CComAuthInfo@@QEAAXPEBG@Z
?StyleBitSet@CFileChooser@@QEAAHK@Z
?SubclassWindow@?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@QEAAHPEAUHWND__@@@Z
?Succeeded@CError@@QEBAHXZ
?Succeeded@CError@@SAHJ@Z
?Succeeded@CIISApplication@@UEBAHXZ
?Succeeded@CIISInterface@@UEBAHXZ
?Succeeded@CMetaBack@@UEBAHXZ
?Succeeded@CMetaKey@@UEBAHXZ
?SupportsPooledProc@CWamInterface@@QEBAHXZ
?TextFromHRESULT@CError@@QEBAJAEAVCString@IIS@@@Z
?TextFromHRESULT@CError@@QEBAJPEAGK@Z
?TextFromHRESULTExpand@CError@@QEBAPEBGAEAVCString@IIS@@@Z
?TextFromHRESULTExpand@CError@@QEBAPEBGPEAGKPEAJ@Z
?TrimLeft@CString@IIS@@QEAAXXZ
Sections
.text Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ