x64___installer___x32___[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

x64___installer___x32___.zip
Size

25.6MB
MD5

ab9e29ab494c66b296e4daed62636f89
SHA1

124fbfef4a702294eed4841667b260fdc741f6cb
SHA256

3e140194986655c52144a27d4cc2860727406e3e3ef41e0392c56b0a49485c74
SHA512

01d49e86d36d6da9571604b78e6a7500e220d847dfea796d92a8a33bdcc27db0f538e993000ed80b12b4b2fea0d44d33721a09dd46c4bb0494096362054f5852
SSDEEP

393216:aH+NZOy0KISOXKC3XA4AbpZR74fTHRB1s03zMg7YecNFMHSLygSto4FTX0yH5:CeIPXKC3w4v31s03zMgqPWScFX0yZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 17 IoCs

Checks for missing Authenticode signature.

resource
unpack002/ReAgent/mlang.dll
unpack002/ReAgent/rdpviewerax.dll
unpack002/Windows.Graphics/cloudAP.dll
unpack002/Windows.Graphics/winhttpcom.dll
unpack002/Windows.Graphics/wshelper.dll
unpack002/msaatext/SpaceControl.dll
unpack002/msaatext/TDLMigration.dll
unpack002/msaatext/msaatext.dll
unpack002/msaatext/wcnwiz.dll
unpack002/tpmvsc/hotplug.dll
unpack002/tpmvsc/tpmvsc.dll
unpack002/tpmvsc/traffic.dll
unpack002/umpo/EnterpriseAppVMgmtCSP.dll
unpack002/umpo/ErrorDetails.dll
unpack002/umpo/MapControlCore.dll
unpack002/umpo/tapi3.dll
unpack002/umpo/umpo.dll

Files

x64___installer___x32___.zip
.zip

Password: 2024
___x64___setup___x32___.zip
.zip

Password: 2024
ReAgent/ReAgent.dll
.dll windows:10 windows x64 arch:x64

Password: 2024

69b8547cc70479063e783239d816f920

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8b:26:d3:ce:fc:97:3c:60:a9:d3:0a:be:0a:8c:9f:6e:ee:61:3b:f8:19:97:05:91:79:61:b2:e9:75:25:2b:96
Signer

Actual PE Digest

8b:26:d3:ce:fc:97:3c:60:a9:d3:0a:be:0a:8c:9f:6e:ee:61:3b:f8:19:97:05:91:79:61:b2:e9:75:25:2b:96

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ReAgent.pdb

Imports

msvcrt

wcschr
??1type_info@@UEAA@XZ
_purecall
?terminate@@YAXXZ
_CxxThrowException
_wcsnicmp
atol
_atoi64
_vsnprintf
wcsrchr
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z
memcmp
memcpy
memmove
?what@exception@@UEBAPEBDXZ
strcmp
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
_wtoi64
_wcsicmp
_vsnwprintf
free
_onexit
__dllonexit
_unlock
_lock
swscanf_s
wcsncmp
wcsnlen
wcsstr
memcpy_s
_wcslwr
qsort
towupper
strcpy_s
_wcsupr
wcstoul
memmove_s
iswspace
wcscpy_s
wcscat_s
swprintf_s
_ultow_s
_vsnwprintf_s
_snwscanf_s
strncmp
wprintf
_vscwprintf
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
memset
wcscmp

ntdll

ZwOpenMutant
ZwClose
RtlAppendUnicodeToString
ZwQueryAttributesFile
RtlLengthSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetDaclSecurityDescriptor
ZwCreateKey
ZwLoadKey
RtlAddAccessAllowedAceEx
RtlAllocateAndInitializeSid
RtlLengthSid
ZwDeleteValueKey
RtlFreeSid
ZwDeleteKey
ZwEnumerateKey
ZwQueryValueKey
RtlCreateAcl
ZwSetSecurityObject
ZwUnloadKey
RtlCreateSecurityDescriptor
ZwSetValueKey
ZwOpenKey
ZwAllocateUuids
LdrGetProcedureAddress
LdrGetDllHandle
ZwQueryInformationProcess
RtlInitAnsiString
ZwQueryInformationFile
ZwOpenProcess
ZwQuerySymbolicLinkObject
ZwDeviceIoControlFile
ZwQueryDirectoryObject
ZwOpenSymbolicLinkObject
ZwOpenDirectoryObject
ZwOpenFile
NtOpenProcessTokenEx
NtSetInformationThread
NtOpenThreadTokenEx
NtOpenSymbolicLinkObject
NtOpenKey
NtQuerySymbolicLinkObject
NtDeviceIoControlFile
NtQueryValueKey
NtQueryBootEntryOrder
NtQueryBootOptions
NtTranslateFilePath
NtOpenDirectoryObject
NtQueryDirectoryObject
NtEnumerateBootEntries
RtlCompareMemory
NtYieldExecution
ZwQueryKey
ZwWaitForSingleObject
RtlStringFromGUID
RtlFreeUnicodeString
ZwQuerySystemInformation
NtQuerySystemInformation
NtAdjustPrivilegesToken
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
RtlGUIDFromString
RtlRaiseStatus
NtClose
RtlInitUnicodeString
RtlAdjustPrivilege
RtlFreeHeap
RtlGetLastNtStatus
RtlSetControlSecurityDescriptor
RtlFindAceByType
RtlReAllocateHeap
DbgPrintEx
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlImpersonateSelf
NtSetEaFile
NtCreateFile
NtSetInformationFile
NtQueryInformationProcess
NtQueryVolumeInformationFile
NtQueryInformationFile
RtlAllocateHeap
NtOpenFile
RtlDosPathNameToNtPathName_U
NtSetSecurityObject
ZwReleaseMutant

kernel32

GetFileInformationByHandleEx
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetLongPathNameW
IsDebuggerPresent
DebugBreak
AcquireSRWLockShared
CreateMutexExW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
GetLastError
SetLastError
GetProcessHeap
HeapFree
TlsGetValue
HeapAlloc
GetSystemDirectoryW
CreateFileW
CloseHandle
GetFileAttributesExW
GetVolumeNameForVolumeMountPointW
DeviceIoControl
FindFirstVolumeW
GetDriveTypeW
GetDiskFreeSpaceExW
FindNextVolumeW
FindVolumeClose
GetFileAttributesW
GetFullPathNameW
GetVolumePathNameW
MultiByteToWideChar
GetFileSize
ReadFile
SetEndOfFile
WriteFile
FlushFileBuffers
MoveFileExW
SetFileAttributesW
DeleteFileW
OpenSemaphoreW
CopyFileW
GetVersionExW
CopyFileExW
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
GetTempPathW
CreateDirectoryW
GetFileSizeEx
GetModuleHandleW
GetProcAddress
GetTickCount64
CompareStringW
FindFirstFileW
FindNextFileW
FindClose
GetVolumePathNamesForVolumeNameW
WaitForSingleObject
WritePrivateProfileStringW
GetPrivateProfileStringW
GetFileInformationByHandle
SetFirmwareEnvironmentVariableW
LoadLibraryExW
FreeLibrary
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleExW
GetHandleInformation
SetFilePointerEx
GetEnvironmentVariableW
GetOverlappedResult
EnterCriticalSection
SleepConditionVariableSRW
LocalFree
DeleteCriticalSection
RaiseException
SetThreadIdealProcessor
GetCurrentThread
SetFilePointer
InitializeCriticalSection
HeapReAlloc
SetFileInformationByHandle
GetVolumeInformationW
GetFinalPathNameByHandleW
CreateEventW
InitializeCriticalSectionAndSpinCount
LockFileEx
UnlockFileEx
LocalAlloc
GetModuleFileNameW
FormatMessageW
ReleaseMutex
WideCharToMultiByte
OpenProcess
DuplicateHandle
GetPrivateProfileSectionW
WaitForMultipleObjects
ReleaseSemaphore
SetEvent
CreateSemaphoreW
CreateThread
GetVolumeInformationByHandleW
GlobalMemoryStatusEx
WaitForMultipleObjectsEx
ResetEvent
CreateSemaphoreExW
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
LoadLibraryW
CreateProcessW
GetExitCodeProcess
SetVolumeMountPointW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
VirtualProtect
GetFirmwareEnvironmentVariableW
LoadLibraryExA
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
TlsFree
TlsSetValue
TlsAlloc
VirtualQuery
GetSystemInfo
WakeAllConditionVariable
LeaveCriticalSection
VirtualFree
RemoveDirectoryW
VirtualAlloc

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider

cabinet

ord20
ord22
ord23

advapi32

OpenThreadToken
GetAclInformation
GetSecurityDescriptorLength
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegEnumValueW
EventWriteTransfer
EventUnregister
EventRegister
ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
SetNamedSecurityInfoW
AddAccessAllowedAceEx
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteKeyW
RegCreateKeyExW
InitiateSystemShutdownExW
RegUnLoadKeyW
RegLoadKeyW
RegSetValueExW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegGetValueW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
DuplicateTokenEx
RegDeleteTreeW
TraceMessage
SetThreadToken
EventWrite
RegDeleteKeyExW
RevertToSelf
CloseEncryptedFileRaw
WriteEncryptedFileRaw
OpenEncryptedFileRawW

user32

CharUpperW
LoadStringW

imagehlp

ImageNtHeader

ole32

CoCreateInstance
CoUninitialize
StringFromCLSID
CoInitializeEx
CoCreateGuid
CoInitialize
CoTaskMemFree
CLSIDFromString

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

rpcrt4

UuidCompare
UuidToStringW
RpcStringFreeW
UuidCreate

Exports

Exports

WinRECheckGuid
WinREUseNewPBRImage
WinRE_Generalize
WinRE_Specialize
WinRE_Specialize_Offline
WinReAddTrustedBootApp
WinReClearBootApp
WinReClearError
WinReClearOemImagePath
WinReConfigureTask
WinReCopyDiagnosticFiles
WinReCopyLogFilesToRamdisk
WinReCreateLogInstance
WinReCreateLogInstanceEx
WinReDeleteLogFiles
WinReGetConfig
WinReGetCustomization
WinReGetError
WinReGetLogDirPath
WinReGetTrustedBootApps
WinReGetWIMInfo
WinReHashBootApp
WinReHashWimFile
WinReInitiateOfflineScanning
WinReInstall
WinReInstallOnTargetOS
WinReIsInstalledOnSystemPartition
WinReIsWimBootEnabled
WinReIsWinPE
WinReOobeInstall
WinReOpenLogInstance
WinRePostBCDRepair
WinReQueueRecoveryBoot
WinReReinstall
WinReRemoveTrustedBootApp
WinReRepair
WinReRestoreConfigAfterPBR
WinReRestoreLogFiles
WinReSetBootApp
WinReSetConfig
WinReSetCustomization
WinReSetError
WinReSetNarratorScheduled
WinReSetRecoveryAction
WinReSetTriggerFile
WinReSetupBackupWinRE
WinReSetupCheckWinRE
WinReSetupInstall
WinReSetupMigrateData
WinReSetupRemoveWinRE
WinReSetupRestoreWinREEx
WinReSetupSetImage
WinReUnInstall
WinReUpdateLogInstance
WinReValidateRecoveryWim
WinReValidateWimFile
winreFindInstallMedia
winreGetBinaryArch

Sections

.text
Size: 752KB - Virtual size: 751KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ReAgent/evr.dll
.dll regsvr32 windows:10 windows x64 arch:x64

Password: 2024

106eff8863e919898a072d6127fa9cff

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:53:ce:78:da:32:ad:3b:98:78:95:70:b8:38:2f:ad:85:9e:45:63:c7:ee:d9:3f:14:15:95:ed:bc:e7:3f:6f
Signer

Actual PE Digest

98:53:ce:78:da:32:ad:3b:98:78:95:70:b8:38:2f:ad:85:9e:45:63:c7:ee:d9:3f:14:15:95:ed:bc:e7:3f:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EVR.pdb

Imports

msvcrt

___lc_handle_func
___lc_codepage_func
__pctype_func
isupper
calloc
___mb_cur_max_func
_unlock
_lock
setlocale
islower
__uncaught_exception
_wcsdup
??8type_info@@QEBAHAEBV0@@Z
??9type_info@@QEBAHAEBV0@@Z
memmove
memcpy
__crtLCMapStringA
_wsetlocale
_CxxThrowException
_vsnprintf_s
??0exception@@QEAA@AEBQEBDH@Z
realloc
??0exception@@QEAA@XZ
__CxxFrameHandler3
memcpy_s
memset
strcspn
localeconv
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
sprintf_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
floor
ceil
memcmp
sqrt
_XcptFilter
_amsg_exit
_initterm
_vsnwprintf
__dllonexit
__C_specific_handler
sqrtf
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_vsnwprintf_s
_callnewh
malloc
free
_ismbblead
_purecall
_onexit
wcscmp

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
LeaveCriticalSection
SetEvent
CreateEventW
InitializeCriticalSectionEx
CreateEventA
EnterCriticalSection
ReleaseMutex
ResetEvent
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibraryAndExitThread
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameA
LoadLibraryExA

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
SetThreadPriority
GetExitCodeThread
GetCurrentProcessId
GetCurrentThreadId
CreateThread

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-com-l1-1-0

CoFreeUnusedLibraries
CoTaskMemFree
CoInitializeEx
PropVariantCopy
CoUninitialize
CoTaskMemAlloc
PropVariantClear
CoCreateInstance
StringFromGUID2

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-power-setting-l1-1-0

PowerReadACValue
PowerReadDCValue
PowerGetActiveScheme

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

rtworkq

RtwqCancelDeadline
RtwqSetLongRunning
RtwqSetDeadline

ntdll

RtlNtStatusToDosError

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptDestroyKey
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptImportKeyPair
BCryptVerifySignature
BCryptFinishHash
BCryptCreateHash

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MFConvertColorInfoFromDXVA
MFConvertColorInfoToDXVA
MFConvertFromFP16Array
MFConvertToFP16Array
MFCopyImage
MFCreateDXSurfaceBuffer
MFCreateVideoMediaType
MFCreateVideoMediaTypeFromBitMapInfoHeader
MFCreateVideoMediaTypeFromSubtype
MFCreateVideoMediaTypeFromVideoInfoHeader
MFCreateVideoMediaTypeFromVideoInfoHeader2
MFCreateVideoMixer
MFCreateVideoMixerAndPresenter
MFCreateVideoOTA
MFCreateVideoPresenter
MFCreateVideoPresenter2
MFCreateVideoSampleAllocator
MFCreateVideoSampleFromSurface
MFGetPlaneSize
MFGetStrideForBitmapInfoHeader
MFGetUncompressedVideoFormat
MFInitVideoFormat
MFInitVideoFormat_RGB
MFIsFormatYUV

Sections

.text
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ReAgent/mlang.dll
.dll windows:10 windows x64 arch:x64

Password: 2024

8c5ef934f2973563a30d41bd42a4cd00

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

mlang.pdb

Imports

msvcrt

_initterm
free
memcmp
_callnewh
??1type_info@@UEAA@XZ
_XcptFilter
_onexit
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
wcsstr
_amsg_exit
malloc
??0exception@@QEAA@AEBV0@@Z
__dllonexit
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memmove
memcpy
__C_specific_handler
_CxxThrowException
_unlock
__CxxFrameHandler3
strstr
strchr
atoi
_ultoa_s
_vsnprintf
strncmp
wcschr
memcpy_s
strrchr
_purecall
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
_lock
memset

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapDestroy

api-ms-win-core-libraryloader-l1-2-0

LockResource
GetModuleHandleA
GetModuleFileNameW
FindResourceExW
LoadStringA
LoadResource
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-localization-l1-2-0

IsValidCodePage
IsDBCSLeadByte
IsDBCSLeadByteEx
GetCPInfo
GetACP
GetSystemDefaultLangID
GetLocaleInfoA

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-file-l1-1-0

GetFileSize
CreateFileA
GetFileAttributesA
WriteFile

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExA
GetSystemDirectoryA

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0

RegCreateKeyExA
RegEnumValueW
RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumKeyExA
RegCloseKey
RegQueryInfoKeyA

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-kernel32-legacy-l1-1-0

GetStringTypeExA
CreateFileMappingA
FindResourceExA

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionA
PathFindFileNameW
PathRenameExtensionA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
lstrcmpiA

api-ms-win-core-stringansi-l1-1-0

CharLowerA
CharNextExA
CharNextA

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICA

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ConvertINetMultiByteToUnicode
ConvertINetReset
ConvertINetString
ConvertINetUnicodeToMultiByte
DllCanUnloadNow
DllGetClassObject
GetGlobalFontLinkObject
IsConvertINetStringAvailable
LcidToRfc1766A
LcidToRfc1766W
Rfc1766ToLcidA
Rfc1766ToLcidW

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ReAgent/rdpviewerax.dll
.dll regsvr32 windows:10 windows x64 arch:x64

Password: 2024

e9d0d94890a6a7c1a25a46c3d80f2b38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

rdpviewerax.pdb

Imports

msvcrt

_onexit
__dllonexit
_unlock
mbstowcs
_wcsicmp
_vsnwprintf
__C_specific_handler
wcscat_s
wcsrchr
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
wcsncpy_s
malloc
free
swprintf_s
_purecall
memcpy_s
calloc
_aligned_malloc
_aligned_free
_resetstkoflw
memmove
memcmp
memcpy
memset

oleaut32

SysAllocStringByteLen
OleCreateFontIndirect
VarBstrCmp
RegisterTypeLi
OleCreatePropertyFrame
SysAllocStringLen
UnRegisterTypeLi
DispCallFunc
SysFreeString
LoadTypeLi
VarBstrCat
VarUI4FromStr
VariantInit
VariantClear
VariantChangeType
VariantCopy
SysStringLen
SysAllocString
LoadRegTypeLi
SysStringByteLen

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
LoadResource
LoadLibraryExA
SizeofResource
GetModuleHandleExW
FindResourceExW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameW
FreeLibrary
GetModuleHandleExA

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
DeleteCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoCreateInstance
StringFromGUID2

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-heap-l2-1-0

GlobalAlloc

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc
VirtualQuery

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-ntuser-rectangle-l1-1-0

SetRect
UnionRect
SetRectEmpty
IntersectRect
CopyRect
IsRectEmpty
PtInRect
EqualRect
OffsetRect

rdpbase

PAL_System_AtomicDecrement
PAL_System_AtomicIncrement
RDPENCHLPREG_ReadValueDWORD
TsCreateRegion
PAL_System_CritSecLeave
PAL_System_CritSecEnter
PAL_System_CritSecInit
PAL_System_CritSecTerminate
TSAlloc
TsDestroyRegion
TSFree
TsSetRegionFromRects
TsAddRectsToRegion
TsGetRegionRectCount
MemCopyAligned_SSE
MemMoveReverseAligned_SSE
TsGetRegionRects
GetSupportedSSELevel_SSE
RDPBASE_CreateInstance

rdpserverbase

RDPSERVERBASE_CreateInstance

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventActivityIdControl
EventUnregister
EventWriteTransfer

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

ws2_32

closesocket

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

crypt32

CryptBinaryToStringW

api-ms-win-core-file-l1-1-0

CreateFileW
WriteFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

cryptsp

CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextW
CryptCreateHash

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows.Graphics/Windows.Graphics.dll
.dll windows:10 windows x64 arch:x64

Password: 2024

67e017ee26a48ed652efdca3e950c52a

Code Sign

33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

84:e4:5e:6e:e1:7b:9d:b3:b9:07:64:d8:5e:40:9a:dd:d0:f7:31:c4:38:cb:b4:90:92:63:5c:fe:e2:12:4b:d9
Signer

Actual PE Digest

84:e4:5e:6e:e1:7b:9d:b3:b9:07:64:d8:5e:40:9a:dd:d0:f7:31:c4:38:cb:b4:90:92:63:5c:fe:e2:12:4b:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Windows.Graphics.pdb

Imports

msvcrt

_CxxThrowException
memcpy
memmove
??0exception@@QEAA@XZ
memcmp
memset
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
_purecall
_callnewh
_amsg_exit
free
?what@exception@@UEBAPEBDXZ
__C_specific_handler
?terminate@@YAXXZ
_lock
__CxxFrameHandler3
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
pow
??0exception@@QEAA@AEBQEBDH@Z
toupper
??_V@YAXPEAX@Z
realloc
??1exception@@UEAA@XZ
malloc
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBD@Z
_XcptFilter
memcpy_s
_vsnwprintf
_initterm
sqrt

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
CreateSemaphoreExW
InitializeSRWLock
AcquireSRWLockShared
LeaveCriticalSection
CreateMutexExW
WaitForSingleObject
CreateEventExW
AcquireSRWLockExclusive
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockShared
ReleaseMutex
ReleaseSemaphore
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister
EventProviderEnabled

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime

shcore

ord251
ord255
ord246
ord250
ord252
ord240
ord253
CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
CreateRandomAccessStreamOnFile
GetDpiForMonitor
ord244
GetScaleFactorForMonitor

ntdll

RtlWakeAllConditionVariable
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlSleepConditionVariableSRW
RtlCaptureStackBackTrace
wcsrchr
RtlIsMultiSessionSku
memmove_s
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlLoadString

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegGetValueW

api-ms-win-core-file-l1-1-0

SetFilePointer
CreateFileW
GetFileAttributesW
ReadFile

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-devices-query-l1-1-0

DevGetObjectProperties
DevFreeObjectProperties

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 370KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows.Graphics/cloudAP.dll
.dll windows:10 windows x64 arch:x64

Password: 2024

7f1cba2fd182a632dac0888cf984bded

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

cloudAP.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

memset
wcsnlen
wcscmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__wcsicmp
memmove
_o_free
_o_malloc
_o_memcpy_s
_o_tolower
_o_toupper
_o_wcscpy_s
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
WaitForSingleObject
InitializeSRWLock
EnterCriticalSection
ReleaseMutex
TryAcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TlsGetValue
SetThreadToken
TlsFree
TlsAlloc
TerminateProcess
GetCurrentProcess
TlsSetValue
SetThreadStackGuarantee
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

GetACP
FormatMessageW
LCMapStringEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventProviderEnabled
EventSetInformation
EventActivityIdControl

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
Sleep
InitOnceBeginInitialize

userenv

GetProfileType
ord217
GetUserProfileDirectoryW

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
CreateDirectoryW
FindClose
CreateFileW
CompareFileTime
FindNextFileW
FindFirstFileW
SetFileAttributesW
GetFileSizeEx
FindFirstFileExW
GetFileAttributesW
ReadFile
GetFileTime
WriteFile
DeleteFileW

bcrypt

BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptExportKey
BCryptFinishHash
BCryptHashData
BCryptFinalizeKeyPair
BCryptCloseAlgorithmProvider
BCryptImportKeyPair
BCryptEncrypt
BCryptDecrypt
BCryptDeriveKeyPBKDF2
BCryptDestroyKey
BCryptKeyDerivation
BCryptGetProperty
BCryptSetProperty
BCryptVerifySignature
BCryptCreateHash
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW
GetComputerNameW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-registry-l1-1-0

RegFlushKey
RegQueryInfoKeyW
RegOpenKeyExW
RegGetValueW
RegSetValueExW
RegDeleteKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

rpcrt4

NdrMesTypeEncode3
MesDecodeBufferHandleCreate
MesHandleFree
I_RpcExceptionFilter
MesBufferHandleReset
MesEncodeFixedBufferHandleCreate
NdrMesTypeAlignSize3
UuidToStringW
UuidCreate
UuidFromStringW
UuidEqual
NdrMesTypeDecode3
RpcStringFreeW
RpcExceptionFilter
RpcBindingFree
RpcBindingFromStringBindingW
I_RpcMapWin32Status
RpcStringBindingComposeW
NdrClientCall3

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

sspicli

LsaLogonUser
LsaCallAuthenticationPackage
SeciFreeCallContext
SeciAllocateAndSetCallFlags
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
SspiCopyAuthIdentity
SspiIsAuthIdentityEncrypted
LsaLookupAuthenticationPackage
SspiDecryptAuthIdentityEx
SspiFreeAuthIdentity
SspiUnmarshalAuthIdentity
LsaConnectUntrusted

api-ms-win-security-base-l1-1-0

CheckTokenMembership
CreateWellKnownSid
GetLengthSid
RevertToSelf
CopySid

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

ncrypt

NCryptSetProperty
NCryptOpenKey
NCryptImportKey
NCryptDeriveKey
NCryptExportKey
NCryptSecretAgreement
NCryptDeleteKey
NCryptSignHash
NCryptFreeObject
NCryptGetProperty
NCryptOpenStorageProvider

crypt32

CryptExportPublicKeyInfoFromBCryptKeyHandle
CertCreateCertificateContext
CertComparePublicKeyInfo
CertCloseStore
CertGetCertificateContextProperty
CertSetCertificateContextProperty
CertFindCertificateInStore
CertOpenStore
CertCompareCertificateName
CertGetNameStringW
CryptAcquireCertificatePrivateKey
CertFreeCertificateContext
CryptImportPublicKeyInfoEx2
CertGetPublicKeyLength

api-ms-win-security-cryptoapi-l1-1-0

CryptDestroyHash
CryptSetHashParam
CryptDecrypt
CryptHashData
CryptCreateHash
CryptSetProvParam
CryptDeriveKey
CryptAcquireContextW
CryptGetKeyParam
CryptGetUserKey
CryptDestroyKey
CryptSignHashW
CryptGetHashParam
CryptGetProvParam
CryptEncrypt
CryptReleaseContext

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-security-credentials-l1-1-0

CredIsProtectedW

ntdll

RtlReleaseResource
RtlInitializeResource
NtQueryInformationToken
RtlLengthSid
RtlCopySid
RtlEqualSid
RtlValidSid
RtlInitUnicodeString
RtlEqualUnicodeString
RtlIsMultiSessionSku
RtlAcquireResourceShared
RtlAvlRemoveNode
RtlAvlInsertNodeEx
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlConvertSharedToExclusive
RtlConvertExclusiveToShared
NtAllocateLocallyUniqueId
NtClose
NtOpenThreadToken
RtlInitString
NtSetInformationThread
RtlAcquireResourceExclusive
NtDuplicateToken
RtlDeleteResource
RtlNtStatusToDosError
RtlCompareUnicodeString
RtlGetDeviceFamilyInfoEnum
RtlIsMultiUsersInSessionSku
RtlAllocateHeap
RtlFreeHeap
RtlImageNtHeader

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-security-credentials-l2-1-1

CredUnprotectEx

lsasrv

LsarQuerySecret
LsarDeleteObject
LsarSetSecret
LsarClose
LsaICallPackage
LsapDbLookupGetDomainInfo
LsaIFlushIdentityCacheForSid
LsaIFree_LSAPR_CR_CIPHER_VALUE
LsaIAddNamesToLogonSession
LsaICheckRestrictedMode
LsaIWasLogonNotifiedOfProfileLoad
LsaISetLogonInfo
LsaINotifyNewPassword
LsaIGetNameFromLuid
LsarOpenSecret
LsarCreateSecret
LsaISanitizeSAMName
LsaIOpenPolicyTrusted

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect
VirtualAlloc

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA
lstrlenW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-lsalookup-l1-1-2

LsaLookupUserAccountType

cryptdll

CDGenerateRandomBits
CDLocateCSystem

msasn1

ASN1EncSetError
ASN1BERDecBitString
ASN1charstring_free
ASN1BEREncS32
ASN1DEREncOctetString
ASN1DEREncCharString
ASN1BEREncObjectIdentifier
ASN1BERDecS32Val
ASN1BERDecZeroCharString
ASN1_Decode
ASN1objectidentifier_free
ASN1DEREncBitString
ASN1BEREncOpenType
ASN1BERDecU32Val
ASN1_CreateDecoder
ASN1_CreateModule
ASN1intx_free
ASN1BERDecCharString
ASN1BERDecObjectIdentifier
ASN1_CloseDecoder
ASN1bitstring_free
ASN1BEREncSX
ASN1BERDecBool
ASN1BERDecEndOfContents
ASN1DecAlloc
ASN1Free
ASN1BERDecOpenType2
ASN1BERDecSXVal
ASN1octetstring_free
ASN1ztcharstring_free
ASN1BEREncExplicitTag
ASN1BERDecNotEndOfContents
ASN1BERDecSkip
ASN1DecSetError
ASN1BEREncBool
ASN1BERDecExplicitTag
ASN1DEREncGeneralizedTime
ASN1BEREncEndOfContents
ASN1BERDecOctetString
ASN1BEREncU32
ASN1BERDecPeekTag
ASN1BERDecGeneralizedTime

api-ms-win-eventlog-legacy-l1-1-0

ReportEventW
RegisterEventSourceW
DeregisterEventSource

Exports

Exports

SpLsaModeInitialize
SpUserModeInitialize

Sections

.text
Size: 509KB - Virtual size: 509KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows.Graphics/winhttpcom.dll
.dll windows:10 windows x64 arch:x64

Password: 2024

5313b02dc7795ebe1aa20a507a2396b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

winhttpcom.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__ltow
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
wcschr
_o___std_type_info_destroy_list
_o__cexit
_o__callnewh

ntdll

EtwGetTraceLoggerHandle
RtlLookupFunctionEntry
EtwRegisterTraceGuidsW
RtlVirtualUnwind
EtwTraceMessageVa
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
RtlCaptureContext
RtlNtStatusToDosError
EtwUnregisterTraceGuids

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
ResetEvent
WaitForSingleObjectEx
CreateEventA
SetEvent

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
OpenThreadToken
SetThreadToken
GetCurrentThread

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-com-l1-1-0

GetHGlobalFromStream
CreateStreamOnHGlobal
CoCreateInstance

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW
StrChrW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWait
FreeLibraryWhenCallbackReturns

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows.Graphics/wshelper.dll
.dll windows:10 windows x64 arch:x64

4ad269847d4bf63ee25269e5521b2812

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wshelper.pdb

Imports

msvcrt

__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcsstr
wcstok
fprintf
wcstoul
__iob_func
wprintf
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

ws2_32

WSAEnumNameSpaceProvidersW
WSCGetProviderPath32
WSCGetProviderPath
WSCDeinstallProvider
WSCEnumNameSpaceProviders32
WSCEnumProtocols32
WSAStartup
WahWriteLSPEvent
WSCEnumProtocols

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-com-l1-1-0

StringFromCLSID
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegEnumKeyExA
RegSetValueExW
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

netsh.exe

PrintMessageFromModule
RegisterContext
RegisterHelper
MakeString
FreeString
MatchEnumTag
MatchToken
PrintError

wevtapi

EvtFormatMessage
EvtClose
EvtCreateRenderContext
EvtOpenPublisherMetadata
EvtQuery
EvtNext
EvtRender

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA
RegCopyTreeA

mswsock

MigrateWinsockConfiguration

Exports

Exports

InitHelperDll

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msaatext/SpaceControl.dll
.dll windows:10 windows x64 arch:x64

bb5da508519db0e54da5e3455eaedf4c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

SpaceControl.pdb

Imports

msvcrt

_vsnprintf_s
memcmp
memcpy
_purecall
memset
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnwprintf
wcscmp

bcrypt

BCryptGenRandom

ntdll

RtlLoadString
NtQueryObject
RtlPcToFileHeader
RtlEqualUnicodeString
LdrAddRefDll
EtwLogTraceEvent
EtwEventWriteTransfer
EtwEventSetInformation
EtwEventRegister
EtwEventUnregister
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
memmove_s
memcpy_s
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvlEx
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlNtStatusToDosError

kernel32

TlsAlloc
FindNextVolumeW
FindVolumeClose
FindFirstVolumeW
TlsSetValue
GetVolumeInformationW
ExpandEnvironmentStringsW
GetVolumePathNamesForVolumeNameW
GetProcessMitigationPolicy
ReadFile
PeekNamedPipe
SetEvent
TlsFree
TlsGetValue
CreatePipe
HeapReAlloc
IsDebuggerPresent
DebugBreak
GetModuleHandleW
AcquireSRWLockShared
CreateMutexExW
GetProcAddress
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
CloseThreadpoolTimer
OutputDebugStringW
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
GetModuleHandleExW
ReleaseSemaphore
CreateSemaphoreExW
CancelIo
GetModuleFileNameA
CreateThreadpoolWork
SubmitThreadpoolWork
GetOverlappedResult
CloseHandle
GetCurrentThread
SetThreadpoolThreadMaximum
CreateEventW
SetThreadpoolThreadMinimum
WaitForThreadpoolWorkCallbacks
CreateFileW
LocalAlloc
DeviceIoControl
CreateThreadpool
CloseThreadpool
CloseThreadpoolWork
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
GetDiskFreeSpaceW
FindAtomW
GetLogicalDrives
MulDiv
FormatMessageW
LocalFree
DeleteAtom
AddAtomW
SetNamedPipeHandleState
InitOnceExecuteOnce
GetLastError
HeapFree
GetProcessHeap
HeapAlloc
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WriteFile
GetLocaleInfoEx
EnumResourceNamesExW
GetExitCodeProcess
GetExitCodeThread
SetLastError
InitOnceComplete
InitOnceBeginInitialize
CompareStringOrdinal
LoadLibraryExW
GetModuleFileNameW
ResetEvent
DeactivateActCtx
ActivateActCtx
WaitForMultipleObjectsEx
DuplicateHandle
CreateEventExW
ReleaseActCtx
CreateActCtxW

rpcrt4

UuidCreate

ole32

CoTaskMemFree
CoCreateInstance
StringFromGUID2

gdi32

SelectObject
GetTextExtentPoint32W
GetDeviceCaps

user32

GetParent
SetWindowLongW
GetWindowLongW
RegisterDeviceNotificationW
SetTimer
KillTimer
UnregisterDeviceNotification
DestroyWindow
GetWindowLongPtrW
SystemParametersInfoW
DefWindowProcW
GetSystemMetrics
SetCursor
GetFocus
CopyIcon
LoadImageW
ShowWindow
IsWindowVisible
DestroyIcon
LoadStringW
SendMessageW
IsProcessDPIAware
GetDC
ReleaseDC
GetWindowTextW

propsys

PSPropertyBag_WriteUnknown
PSPropertyBag_WriteGUID
PSPropertyBag_ReadGUID
PSPropertyBag_Delete
PSPropertyBag_ReadStr
PSPropertyBag_ReadInt
PSPropertyBag_ReadUnknown

advapi32

EventSetInformation
OpenThreadToken
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister

dui70

InitProcessPriv
InitThread
UnInitProcessPriv
UnInitThread
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ
?SetActive@Element@DirectUI@@QEAAJH@Z
?GetDirty@Edit@DirectUI@@QEAA_NXZ
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ
?GetClassInfoPtr@Macro@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?SetYOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z
?UpdateLayout@Element@DirectUI@@QEAAXXZ
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z
?GetYOffset@BaseScrollViewer@DirectUI@@QEAAHXZ
StrToID
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetSelection@Combobox@DirectUI@@QEAAJH@Z
?AddString@Combobox@DirectUI@@QEAAHPEBG@Z
?GetSelection@Combobox@DirectUI@@QEAAHXZ
?SetWidth@Element@DirectUI@@QEAAJH@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z
?GetExpanded@Expandable@DirectUI@@QEAA_NXZ
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?SetExpand@Macro@DirectUI@@QEAAJPEBG@Z
?Create@Macro@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z
?GetExpand@Macro@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z
?Release@Value@DirectUI@@QEAAXXZ
?SetAccHelp@Element@DirectUI@@QEAAJPEBG@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?Click@Button@DirectUI@@SA?AVUID@@XZ
?EndDefer@Element@DirectUI@@QEAAXK@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z
?GetUnset@Value@DirectUI@@SAPEAV12@XZ
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z
?AddRef@XProvider@DirectUI@@UEAAKXZ
?Register@Repeater@DirectUI@@SAJXZ
??0Repeater@DirectUI@@QEAA@XZ
??1Repeater@DirectUI@@UEAA@XZ
?OnPropertyChanged@Macro@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?Add@Macro@DirectUI@@UEAAJPEAPEAVElement@2@I@Z
?BuildElement@Repeater@DirectUI@@MEAAJXZ
?Initialize@Repeater@DirectUI@@QEAAJPEAVElement@2@PEAK@Z
?GetClassInfoPtr@Repeater@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SAJXZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
??1CritSecLock@DirectUI@@QEAA@XZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??0ClassInfoBase@DirectUI@@QEAA@XZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
??0Element@DirectUI@@QEAA@XZ
??1Element@DirectUI@@UEAA@XZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ
??0XProvider@DirectUI@@QEAA@XZ
??1XProvider@DirectUI@@UEAA@XZ
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z
??1ClassInfoBase@DirectUI@@UEAA@XZ
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z

shlwapi

ord219
ord176
ord278
StrFormatByteSizeW
ord618
ord156
ord24
ord514
ord174
ord158
ord199
PathParseIconLocationW
ord204
StrToIntW
ord172
StrCmpNW
SHStrDupW

shell32

SHParseDisplayName
SHGetFileInfoW
SHGetStockIconInfo
ShellExecuteW
ord727
ord155
ShellExecuteExW
SHBindToObject
ord25
ord18

setupapi

SetupDiGetClassDevsExA
SetupDiDeleteDeviceInterfaceData
SetupDiDeleteDeviceInfo
SetupDiOpenDeviceInterfaceW
SetupDiCreateDeviceInfoListExW
SetupDiGetDevicePropertyW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInfoW
SetupDiEnumDeviceInterfaces
SetupDiGetClassPropertyW
SetupDiDestroyDeviceInfoList

api-ms-win-devices-query-l1-1-0

DevGetObjectProperties
DevFreeObjectProperties

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msaatext/TDLMigration.dll
.dll windows:10 windows x64 arch:x64

9e914b66e4f8704c416b0735fbcba3fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

TdlMigration.pdb

Imports

msvcp110_win

??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_BADOFF@std@@3_JB
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

msvcrt

memcpy
memcmp
_CxxThrowException
memmove
__dllonexit
__CxxFrameHandler3
_vsnwprintf
memcpy_s
??3@YAXPEAX@Z
_purecall
_wcsicmp
wcsstr
wcstok_s
wcsnlen
toupper
ldiv
_get_errno
_set_errno
??_V@YAXPEAX@Z
??1exception@@UEAA@XZ
??1type_info@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_onexit
_vsnprintf_s
memset
memmove_s
malloc
_unlock
_lock
_callnewh
?terminate@@YAXXZ
__C_specific_handler
_initterm
free
_XcptFilter
_amsg_exit

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateEventW
ReleaseSemaphore
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSRWLockShared
InitializeCriticalSectionEx
EnterCriticalSection
CreateSemaphoreExW
InitializeSRWLock
WaitForSingleObject
LeaveCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
GetProcessId
ProcessIdToSessionId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoRevertToSelf
CoGetCallContext
CoTaskMemFree
CoTaskMemAlloc
CoImpersonateClient
CoCreateGuid
CoTaskMemRealloc

api-ms-win-security-base-l1-1-0

GetLengthSid
CopySid
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchCombine

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation
EventProviderEnabled
EventActivityIdControl

esent

JetDetachDatabaseW
JetAttachDatabaseW
JetInit
JetSetSystemParameterW
JetCreateInstanceW
JetRetrieveColumns
JetMove
JetSeek
JetMakeKey
JetGetTableColumnInfoW
JetCreateTableColumnIndexW
JetCreateIndex2W
JetSetCurrentIndexW
JetDeleteIndexW
JetGetTableIndexInfoW
JetAddColumnW
JetOpenTableW
JetCommitTransaction
JetCloseTable
JetCloseDatabase
JetEndSession
JetTerm2
JetBeginSessionW
JetOpenDatabaseW
JetGetErrorInfoW

shcore

SHCreateMemStream
IStream_Reset
IStream_Size
ord1
IStream_Read

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

ntdll

RtlExpandEnvironmentStrings
RtlDetermineDosPathNameType_U
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlLengthSid
NtQueryInformationToken
RtlCopySid

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-file-l1-1-0

FindNextFileW
FindFirstFileW
CreateFileW
FindClose
SetFileInformationByHandle
GetFileAttributesW
GetFinalPathNameByHandleW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

rpcrt4

I_RpcBindingInqLocalClientPID
RpcServerInqCallAttributesW
I_RpcOpenClientProcess

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage

api-ms-win-appmodel-runtime-l1-1-1

ParseApplicationUserModelId

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-appmodel-runtime-l1-1-0

GetApplicationUserModelId

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateTdlMigrator
CreateTdlMigratorForUser

Sections

.text
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msaatext/msaatext.dll
.dll regsvr32 windows:10 windows x64 arch:x64

9ddf7d8ffc4dd644eb79aa3e771dd787

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

msaatext.pdb

Imports

msvcrt

__C_specific_handler
memcpy_s
_ultow
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
_vsnwprintf_s
wcstombs
memmove_s
sprintf_s
wcscat_s
??0exception@@QEAA@XZ
swprintf_s
_purecall
realloc
wcscpy_s
free
malloc
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
memset
__CxxFrameHandler3
?what@exception@@UEBAPEBDXZ
memcmp
memcpy
sqrt

user32

CloseDesktop
CharPrevW
CharNextW
OpenInputDesktop
WindowFromPoint

oleaut32

LoadTypeLi
BSTR_UserSize
SysStringLen
VarUI4FromStr
SysStringByteLen
VariantCopy
VariantClear
SysAllocString
SysAllocStringLen
SysFreeString
BSTR_UserMarshal64
BSTR_UserSize64
BSTR_UserFree64
VARIANT_UserUnmarshal64
VARIANT_UserFree64
BSTR_UserMarshal
VARIANT_UserMarshal
BSTR_UserUnmarshal
VARIANT_UserSize
VARIANT_UserUnmarshal
VARIANT_UserFree
BSTR_UserUnmarshal64
BSTR_UserFree
VARIANT_UserMarshal64
VARIANT_UserSize64
RegisterTypeLi

kernel32

Sleep
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
OutputDebugStringA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryExW
VirtualQuery
lstrcmpiW
lstrcpyW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
HeapDestroy
GetSystemInfo
DisableThreadLibraryCalls
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
VirtualAlloc
lstrcpynW
EnterCriticalSection
VirtualProtect
SizeofResource
CreateEventW
lstrcmpW
FreeLibrary
FindResourceW
LoadResource
FindResourceExW
EnumResourceLanguagesW
LockResource
GetLocaleInfoW
GetThreadLocale
MapViewOfFile
CreateFileMappingW
GetCurrentProcessId
CloseHandle
SetEvent
GetLastError
FormatMessageW
OpenEventW
GetCurrentThreadId
WaitForSingleObject

advapi32

RegDeleteValueW
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
GetUserNameW
RegEnumValueW
RegCloseKey
RegOpenKeyExW

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
NdrCStdStubBuffer2_Release
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
NdrStubCall3
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrDllRegisterProxy
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc
CoQueryClientBlanket
CoTaskMemFree
CoTaskMemRealloc

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient4
ObjectStublessClient11
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction8
ObjectStublessClient3
NdrProxyForwardingFunction6
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient5
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
NdrProxyForwardingFunction10
ObjectStublessClient9
NdrProxyForwardingFunction3
NdrProxyForwardingFunction7
CStdStubBuffer2_Connect
NdrProxyForwardingFunction9

api-ms-win-core-marshal-l1-1-0

HWND_UserUnmarshal
HWND_UserFree
HWND_UserFree64
HWND_UserSize64
HWND_UserSize
HWND_UserMarshal
HWND_UserMarshal64
HWND_UserUnmarshal64

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msaatext/wcnwiz.dll
.dll windows:10 windows x64 arch:x64

7cc9674f1fe1aac8b915612754a34067

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wcnwiz.pdb

Imports

msvcrt

memcmp
memset
towlower
iswctype
wcsncmp
_vsnprintf_s
_wtol
rand_s
vswprintf_s
swprintf_s
wcscat_s
pow
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_callnewh
memmove_s
malloc
free
_purecall
memcpy_s
??_V@YAXPEAX@Z
__C_specific_handler
__CxxFrameHandler3
__RTDynamicCast
_vsnwprintf
_wcsdup
??3@YAXPEAX@Z
wcscmp

oleaut32

BSTR_UserMarshal
BSTR_UserMarshal64
SysFreeString
BSTR_UserSize
SysAllocString
BSTR_UserFree
BSTR_UserUnmarshal64
BSTR_UserSize64
BSTR_UserFree64
BSTR_UserUnmarshal

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadResource
LoadStringW
LoadLibraryExA
FindResourceExW
SizeofResource
DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoWaitForMultipleHandles
IIDFromString
StringFromGUID2

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

rpcrt4

CStdStubBuffer_DebugServerRelease
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrDllGetClassObject
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
NdrOleAllocate
NdrDllCanUnloadNow

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient4

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapReAlloc
HeapSize
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
EtwEventUnregister
EtwEventRegister
RtlNtStatusToDosError
EtwEventWriteTransfer
WinSqmSetDWORD

kernel32

QueryActCtxW
DeactivateActCtx
FindActCtxSectionStringW
ActivateActCtx
FormatMessageW
LockResource
LocalFree
GetComputerNameW
lstrcmpW
CreateActCtxW
MulDiv
GetSystemDirectoryW
RegGetValueW
GetFileSizeEx
ReadFile
GlobalAlloc
WriteFile
IsDebuggerPresent
DebugBreak
CreateMutexExW
GlobalFree
RegQueryValueExW
CreateFileW
CloseHandle
OpenSemaphoreW
FindResourceW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
SetEvent
OutputDebugStringW
CreateThread
ResetEvent
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx

user32

SetDlgItemTextW
ShowWindow
GetClientRect
GetWindowTextW
EnableWindow
GetAncestor
SetWindowTextW
SetWindowPos
GetDC
GetWindowRect
GetWindowTextLengthW
SystemParametersInfoW
IsWindowVisible
LoadImageW
DestroyIcon
GetSystemMetrics
GetWindowLongPtrW
EndPaint
BeginPaint
InvalidateRect
SetRect
IntersectRect
DrawFocusRect
UnregisterClassA
TrackMouseEvent
PostMessageW
GetPropW
SetWindowLongPtrW
InflateRect
SetTimer
SetFocus
ReleaseDC
GetParent
KillTimer
GetDlgItem
SetPropW
RemovePropW
SendMessageW

wlanapi

WlanStringToSsid
WlanGetNetworkBssList
WlanScan
WlanUtf8SsidToDisplayName
WFDGetDefaultGroupProfileInt
WFDParseProfileXmlInt
WFDGetProfileKeyInfoInt
WlanParseProfileXmlBasicSettings
WFDFreeMemoryInt
WlanGenerateProfileXmlBasicSettings
WlanGetAvailableNetworkList
WlanFreeMemory
WlanCloseHandle
WlanHostedNetworkQueryStatus
WlanOpenHandle
WlanGetProfile
WlanHostedNetworkQueryProperty
WFDLowPrivIsWfdSupportedInt
WlanInternalScan
WlanQueryInterface
WlanGetProfileList
WlanSetProfile
WlanEnumInterfaces
WlanRegisterNotification

dui70

?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?Release@Value@DirectUI@@QEAAXXZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
DuiCreateObject
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
StrToID

crypt32

CryptProtectData
CryptUnprotectData

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

shell32

SHGetKnownFolderPath

gdi32

CreateFontIndirectW
CreateDIBSection
StartDocW
StartPage
EndDoc
GetDeviceCaps
GetTextMetricsW
DeleteDC
TextOutW
SetBkColor
DeleteObject
GetObjectW
GetTextExtentPoint32W
SelectObject
EndPage
CreateFontW
CreateSolidBrush

ole32

CoGetObject

uxtheme

OpenThemeData
IsAppThemed
DrawThemeParentBackground
DrawThemeBackground
GetThemeMetric
SetWindowTheme
CloseThemeData
ord121
ord120

xmllite

CreateXmlReader

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

windowscodecs

WICCreateImagingFactory_Proxy

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setup.msi
.msi
tpmvsc/hotplug.dll
.dll windows:10 windows x64 arch:x64

3341bc2ede2baeeaf8f8cfa9cad95970

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

HOTPLUG.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
__CxxFrameHandler3
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
__C_specific_handler
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
wcschr
_callnewh
_vsnwprintf
?what@exception@@UEBAPEBDXZ
memset

ntdll

NtClose
NtOpenThreadToken
NtOpenProcessToken
NtQueryInformationToken
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

GetLastError
GetModuleHandleW
lstrcmpiW
WaitNamedPipeW
GetModuleHandleExW
FreeLibraryAndExitThread
GetExitCodeThread
Sleep
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetVolumeNameForVolumeMountPointW
LoadLibraryW
lstrcmpW
LocalFree
LocalAlloc
ReadFile
GetProcAddress
CreateFileW
GetCurrentProcess
CloseHandle
DisableThreadLibraryCalls
ResolveDelayLoadedAPI
SetEvent
CreateEventW
WaitForSingleObject
TerminateProcess
FreeLibrary
DelayLoadFailureHook
OpenEventW

advapi32

RegQueryValueExW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegCloseKey
GetTokenInformation
GetServiceDisplayNameW
RegCreateKeyW
LookupPrivilegeValueW
OpenProcessToken

user32

GetClassInfoW
ShowWindow
GetWindowLongPtrW
EndDialog
ScreenToClient
CreateWindowExW
SetWindowLongPtrW
DestroyWindow
PostMessageW
GetMessagePos
DefWindowProcW
SetProcessDPIAware
FindWindowW
TranslateMessage
PeekMessageW
IsWindow
MsgWaitForMultipleObjects
GetMessageW
ReleaseDC
InvalidateRect
LoadImageW
GetProcessDefaultLayout
GetDC
GetWindow
PostQuitMessage
IsDialogMessageW
MessageBoxW
GetParent
DialogBoxParamW
EnableWindow
LoadStringW
SendMessageW
GetSystemMetrics
CheckDlgButton
SetDlgItemTextW
RegisterClassW
GetSysColor
IsDlgButtonChecked
LoadIconW
LoadCursorW
SetCursor
GetDlgItem
DispatchMessageW
KillTimer
DestroyIcon
SetTimer

gdi32

GetDeviceCaps

comctl32

ImageList_Destroy
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Remove
ImageList_GetImageCount
ImageList_SetOverlayImage
ImageList_Create

cfgmgr32

CM_Locate_DevNodeW
CM_Request_Device_Eject_ExW
CM_Is_Dock_Station_Present
CM_Get_Parent_Ex
CM_Get_Device_Interface_List_SizeW
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Registry_Property_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_List_ExW
CM_Get_Device_ID_List_Size_ExW
CM_Get_Device_ID_ExW
CM_Locate_DevNode_ExW
CM_Get_Child_Ex
CM_Open_DevNode_Key_Ex
CM_Get_Sibling_Ex
CM_Get_Device_Interface_ListW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiLoadDeviceIcon
SetupDiOpenDeviceInfoW
pSetupGuidFromString

shell32

ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW

shlwapi

StrChrW
ord219

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoInitializeEx

Exports

Exports

CPlApplet
DllGetClassObject
HotPlugChildWithInvalidIdW
HotPlugDriverBlockedW
HotPlugEjectDevice
HotPlugEjectDeviceEx
HotPlugEjectVetoedW
HotPlugHibernateVetoedW
HotPlugRemovalVetoedW
HotPlugSafeRemovalDriveNotificationW
HotPlugSafeRemovalNotificationW
HotPlugStandbyVetoedW
HotPlugWarmEjectVetoedW

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tpmvsc/msv1_0.dll
.dll windows:10 windows x64 arch:x64

d587caa6c41bedc077c38d95913041a0

Code Sign

33:00:00:03:8b:79:45:c1:8b:0e:b6:87:ec:00:00:00:00:03:8b
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/05/2022, 19:23

Not After

04/05/2023, 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:0c:72:cf:df:5a:7d:78:93:34:46:25:e4:ea:64:27:b3:25:11:70:4d:23:44:23:5e:86:a4:84:d7:48:03:c1
Signer

Actual PE Digest

ac:0c:72:cf:df:5a:7d:78:93:34:46:25:e4:ea:64:27:b3:25:11:70:4d:23:44:23:5e:86:a4:84:d7:48:03:c1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

msv1_0.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcscmp
strncmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ultow
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wsplitpath_s
_o_free
_o_malloc
_o_strcpy_s
_o_toupper
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsrchr
wcschr
__std_terminate
__CxxFrameHandler4
__C_specific_handler
memcmp
memcpy

api-ms-win-security-base-l1-1-0

GetLengthSid
ImpersonateAnonymousToken
GetTokenInformation
IsValidSid
RevertToSelf
CheckTokenMembership
AdjustTokenPrivileges

api-ms-win-core-file-l1-1-0

WriteFile
SetFilePointer
CreateFileW
FlushFileBuffers
CompareFileTime

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
SetThreadToken
TerminateProcess
SetThreadStackGuarantee

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
GetWindowsDirectoryW
GetLocalTime
GetSystemInfo
GetVersionExW
GetTickCount64

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
LoadLibraryExA
GetModuleHandleExW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCompareMemory
RtlCaptureContext

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseMutex
InitializeSRWLock
WaitForSingleObject
CreateMutexExW
InitializeCriticalSectionEx
InitializeCriticalSection
CreateEventW
TryAcquireSRWLockExclusive
DeleteCriticalSection
ReleaseSemaphore
EnterCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockShared
CreateSemaphoreExW
SetEvent
LeaveCriticalSection
OpenEventW
AcquireSRWLockExclusive
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-localization-l1-2-0

FormatMessageW
FormatMessageA

bcrypt

BCryptDestroyHash
BCryptGenRandom
BCryptDecrypt
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDuplicateKey
BCryptDestroyKey
BCryptKeyDerivation
BCryptImportKey
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptExportKey

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

rpcrt4

RpcStringBindingComposeW
RpcStringFreeW
NdrMesTypeEncode3
RpcBindingFromStringBindingW
RpcExceptionFilter
NdrClientCall3
I_RpcMapWin32Status
MesHandleFree
MesEncodeDynBufferHandleCreate
MesBufferHandleReset
MesDecodeBufferHandleCreate
NdrMesTypeDecode3
RpcBindingFree
NdrMesTypeAlignSize3

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualAlloc
VirtualProtect

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-security-activedirectoryclient-l1-1-0

DsFreeNameResultW
DsBindWithSpnExW
DsUnBindW
DsCrackNamesW

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-privateprofile-l1-1-0

GetProfileIntW

ntlmshared

NtlmSharedInit
MsvpComputeSaltedHashedPassword
MsvpCachePasswordsToCredential
MsvpValidateSupplementalCreds
MsvpPasswordValidate
MsvpGMSACred
MsvpLm3Response
MsvpPutClearOwfsInPrimaryCredential
MsvpMakeSecretPasswordNT5
NtlmSharedFree
MsvpUpdateSharedConfiguration
MsvpCredentialToCachePasswords
MsvpDeriveSecureCredKey
MsvpCompareCredentials
MsvpDecryptDpapiMasterKey
NtLmAlterRtlEqualUnicodeString
MsvpLm20GetNtlm3ChallengeResponse

ntdll

RtlEraseUnicodeString
NtQuerySystemTime
RtlInitializeSid
RtlSubAuthoritySid
RtlIdentifierAuthoritySid
RtlSubAuthorityCountSid
RtlLengthSid
RtlLengthRequiredSid
RtlDowncaseUnicodeString
EtwLogTraceEvent
RtlEqualSid
WinSqmIncrementDWORD
RtlIntegerToChar
RtlInitializeResource
RtlAcquireResourceExclusive
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
NtAllocateLocallyUniqueId
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
NtOpenEvent
RtlUpcaseUnicodeString
RtlGetNtProductType
RtlCopyUnicodeString
RtlDuplicateUnicodeString
RtlCheckTokenMembershipEx
EtwEventWriteTransfer
RtlCopySid
NtCreateEvent
RtlConvertSharedToExclusive
NtWaitForSingleObject
RtlAvlInsertNodeEx
RtlAvlRemoveNode
RtlEqualDomainName
NtDeleteValueKey
NtCreateKey
RtlIntegerToUnicodeString
DbgPrint
NtSetValueKey
NtQueryValueKey
EtwEventActivityIdControl
NtQuerySystemInformation
NtOpenKey
RtlCreateServiceSid
RtlUpperChar
WinSqmSetDWORD
RtlFreeOemString
RtlInitializeCriticalSection
RtlUpcaseUnicodeStringToOemString
EtwEventUnregister
EtwEventRegister
RtlOemStringToUnicodeString
RtlNtStatusToDosError
NtOpenProcessToken
RtlSetDaclSecurityDescriptor
NtQueryInformationToken
NtSetSecurityObject
RtlAddAccessAllowedAce
NtDuplicateObject
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlIpv6StringToAddressExW
RtlInitializeGenericTable
NtDuplicateToken
NtQueryInformationProcess
NtOpenProcess
RtlDeleteElementGenericTable
RtlNumberGenericTableElements
RtlEnterCriticalSection
RtlInsertElementGenericTable
RtlLeaveCriticalSection
RtlGetElementGenericTable
RtlLookupElementGenericTable
RtlSystemTimeToLocalTime
RtlEqualString
RtlTimeToTimeFields
EtwEventEnabled
EtwEventWrite
RtlAllocateHeap
RtlFreeHeap
RtlImageNtHeader
NtOpenThreadToken
NtFilterToken
RtlFreeSid
NtClose
RtlReleaseResource
RtlRunDecodeUnicodeString
RtlAcquireResourceShared
RtlAllocateAndInitializeSid
NtSetInformationThread
RtlFreeUnicodeString
RtlEqualUnicodeString
RtlInitString
RtlInitUnicodeString
EtwTraceMessage
RtlImpersonateSelf
RtlDeleteResource
RtlPrefixUnicodeString

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllMain
LsaApCallPackage
LsaApCallPackagePassthrough
LsaApCallPackageUntrusted
LsaApInitializePackage
LsaApLogonTerminated
LsaApLogonUserEx2
Msv1_0ExportSubAuthenticationRoutine
Msv1_0SubAuthenticationPresent
MsvGetLogonAttemptCount
MsvIsIpAddressLocal
MsvIsLocalhostAliases
MsvSamLogoff
MsvSamValidate
MsvValidateTarget
SpInitialize
SpInstanceInit
SpLsaModeInitialize
SpUserModeInitialize

Sections

.text
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tpmvsc/tpmvsc.dll
.dll regsvr32 windows:10 windows x64 arch:x64

2c802a794179a752a3c24e19cc580660

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

tpmvsc.pdb

Imports

msvcp_win

_Query_perf_counter
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??Bid@locale@std@@QEAA_KXZ
?_Xout_of_range@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Xbad_function_call@std@@YAXXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
_Query_perf_frequency
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MEBA_NXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ

api-ms-win-crt-string-l1-1-0

wcsncmp
wcscmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswlower
_o_iswpunct
_o_iswspace
_o_iswupper
_o_malloc
_o_terminate
_o_toupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_CxxThrowException
__C_specific_handler
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

certenroll

ord43
ord44

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
ReleaseSRWLockExclusive
WaitForSingleObject
EnterCriticalSection
ReleaseSemaphore
InitializeCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
LeaveCriticalSection
DeleteCriticalSection
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread

api-ms-win-core-localization-l1-2-0

GetThreadLocale
FormatMessageW
SetThreadLocale

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

UnRegisterTypeLi
SysFreeString
SysAllocString
RegisterTypeLi
LoadTypeLi
SysStringLen

rpcrt4

UuidToStringW
UuidCreate
NdrCStdStubBuffer_Release
RpcStringFreeW
NdrDllUnregisterProxy
NdrOleAllocate
NdrDllCanUnloadNow
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Connect
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrOleFree
IUnknown_Release_Proxy
NdrDllRegisterProxy
CStdStubBuffer_CountRefs

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient4

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel

ncrypt

NCryptOpenStorageProvider
NCryptFinalizeKey
NCryptGetProperty
NCryptImportKey
NCryptSignHash
NCryptCreateClaim
NCryptExportKey
NCryptOpenKey
NCryptDecrypt
NCryptCreatePersistedKey
NCryptSetProperty
NCryptDeleteKey
NCryptFreeObject
NCryptEncrypt

bcrypt

BCryptEncrypt
BCryptGetProperty
BCryptDestroyKey
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptGenerateSymmetricKey
BCryptDecrypt

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl
EventProviderEnabled
EventWriteTransfer

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-com-l1-1-0

CoRevertToSelf
StringFromGUID2
CoImpersonateClient
CoCreateInstance

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
CheckTokenMembership
GetSecurityDescriptorLength
FreeSid

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

crypt32

CryptProtectMemory
CryptUnprotectMemory
CryptUnprotectData
CryptProtectData

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
SetFileAttributesW
CreateDirectoryW
WriteFile
DeleteFileW
ReadFile
GetFileSizeEx
CreateFileW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-downlevel-kernel32-l2-1-0

LocalSize

ntdll

NtFlushBuffersFileEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TpmVCardCreate
TpmVCardCreateInProc
TpmVCardDestroy
TpmVCardDestroyInProc
VCardAuthenticatePin
VCardChangePin
VCardClose
VCardCloseChannel
VCardCreateClaim
VCardCreateKey
VCardDeauthenticate
VCardDecrypt
VCardDeinitialize
VCardDeleteKey
VCardEncrypt
VCardExportRsaPubKey
VCardGetAikCertificate
VCardGetAikContainerName
VCardGetChallenge
VCardGetKeyType
VCardGetPinLength
VCardGetRemainingRetryCount
VCardGetTransportKeyAlg
VCardImportRsaKey
VCardImportSymKey
VCardInitialize
VCardInvalidateChallenge
VCardOpen
VCardOpenChannel
VCardResetPin
VCardSetResponse
VCardSignHash
VCardUnblockPin

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tpmvsc/traffic.dll
.dll windows:10 windows x64 arch:x64

7b078d34c99d27e405dc6d91df22b88b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

traffic.pdb

Imports

msvcrt

_initterm
memset
_amsg_exit
_XcptFilter
__C_specific_handler
wcstombs
mbstowcs
malloc
free
memcpy
wcscmp

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObject
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
SetEvent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetThreadPriority
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
SetThreadPriority

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

iphlpapi

GetIpAddrTable

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

ws2_32

WSAGetLastError
WSAIoctl

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

wmiclnt

WmiCloseBlock
WmiQueryAllDataW
WmiQuerySingleInstanceW
WmiOpenBlock
WmiNotificationRegistrationW
WmiSetSingleInstanceW

ntdll

NtClose
NtDeviceIoControlFile
ShipAssert
NtCreateFile
RtlInitUnicodeString

Exports

Exports

TcAddFilter
TcAddFlow
TcCloseInterface
TcDeleteFilter
TcDeleteFlow
TcDeregisterClient
TcEnumerateFlows
TcEnumerateInterfaces
TcGetFlowNameA
TcGetFlowNameW
TcGetInterfaceList
TcModifyFlow
TcOpenInterfaceA
TcOpenInterfaceW
TcQueryFlowA
TcQueryFlowW
TcQueryInterface
TcRegisterClient
TcSetFlowA
TcSetFlowW
TcSetInterface
TcSetSocketFlow

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
umpo/EnterpriseAppVMgmtCSP.dll
.dll windows:10 windows x64 arch:x64

83fe49c586e7e1dc695ec3ff21d4c58a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EnterpriseAppVMgmtCSP.pdb

Imports

msvcrt

_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
free
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler3
_wcsicmp
_initterm
__C_specific_handler
?what@exception@@UEBAPEBDXZ
_vsnprintf_s
??0exception@@QEAA@AEBQEBD@Z
_lock
_purecall
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
_callnewh
_onexit
malloc
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
toupper
__dllonexit
_unlock
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
ReleaseSRWLockExclusive
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantClear
SafeArrayUnaccessData
SysAllocString
SafeArrayDestroy
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SafeArrayAccessData

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc
CoSetProxyBlanket

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

advapi32

EventProviderEnabled
RegDeleteKeyW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
umpo/ErrorDetails.dll
.dll windows:10 windows x64 arch:x64

480b280558008b77cc754f1d03cd9fd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ErrorDetails.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__towlower_l
_o__wcsicmp
_o__wtol
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__create_locale
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
_o__configure_narrow_argv
_o__execute_onexit_table
_o__errno
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcspbrk

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

rpcrt4

UuidCreate
CStdStubBuffer_AddRef
NdrCStdStubBuffer2_Release
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
NdrStubCall3
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrStubForwardingFunction
NdrOleFree
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDuplicateString
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
HSTRING_UserFree
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient15
CStdStubBuffer2_Connect
ObjectStublessClient13
ObjectStublessClient9
ObjectStublessClient12
NdrProxyForwardingFunction3
ObjectStublessClient14
ObjectStublessClient10
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
ObjectStublessClient3
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient17
ObjectStublessClient11
CStdStubBuffer2_QueryInterface
ObjectStublessClient16
ObjectStublessClient7

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoTransformError
RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
SetEvent
CreateEventW
WaitForSingleObject
InitializeSRWLock
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoGetInterfaceAndReleaseStream
CoTaskMemAlloc
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoTaskMemFree
CoCreateInstance

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegGetValueW

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-path-l1-1-0

PathCchCombineEx

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-1-0

GetFileSizeEx
ReadFile

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

ntdll

RtlPublishWnfStateData

api-ms-win-core-url-l1-1-0

UrlEscapeW
GetAcceptLanguagesW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
umpo/MapControlCore.dll
.dll windows:10 windows x64 arch:x64

fe972f74ddafdc1f7f02652b8ef06f7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MapControlCore.pdb

Imports

msvcp_win

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?eof@ios_base@std@@QEBA_NXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?fail@ios_base@std@@QEBA_NXZ
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o__wcsnicmp
_o__execute_onexit_table
_o_bsearch
_o_free
_o_malloc
_o_terminate
_o_toupper
__CxxFrameHandler3
_CxxThrowException
_o__errno
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_type_info_compare
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_o__crt_atexit
_o__configure_narrow_argv
memcpy

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FindResourceExW
GetModuleFileNameA
FreeLibrary
LoadStringW
FreeLibraryAndExitThread
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
LoadResource
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateMutexExW
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateSemaphoreExW
OpenSemaphoreW
CreateEventW
InitializeCriticalSection
SetWaitableTimer
CreateWaitableTimerExW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
InitializeCriticalSectionEx
WaitForSingleObject
CreateEventExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
CreateThread

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageW
GetLocaleInfoEx
GetUserPreferredUILanguages

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoGetCallContext

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventProviderEnabled

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext
GetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-winrt-error-l1-1-1

RoReportUnhandledError

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData

moshostclient

MosHostFree
MosHostClose
MosGetCopyrightString
MosHostOpen

ztrace_maps

ZTraceReportPropagationNoThis
ZTraceReportOriginationNoThis
ZTraceHelperNoThis
ZTraceHelper
ZTraceReportOrigination
ZTraceReportIgnoreNoThis
ZTraceClose
ZTraceInit
ZTraceReportPropagation
ZTraceReportIgnore

maprouter

??0GeoRect@ngeo@Microsoft@@QEAA@XZ
??0GeoCoordinates@ngeo@Microsoft@@QEAA@XZ
??0GeoCoordinates@ngeo@Microsoft@@QEAA@NNM@Z
??1DynamicPenalty@ngeo@Microsoft@@QEAA@XZ
??0IRouterEngineListener@nmacore@Microsoft@@QEAA@XZ
??1RouteWaypoint@ngeo@Microsoft@@UEAA@XZ
?on_end@RouterEngine@nmacore@Microsoft@@UEAAXW4ErrorCode@errorcodes@msngeo@@AEBV?$vector@V?$bitset@$08@std@@V?$allocator@V?$bitset@$08@std@@@2@@std@@@Z
?on_result@RouterEngine@nmacore@Microsoft@@UEAAXAEBV?$vector@VRoute@ngeo@Microsoft@@V?$allocator@VRoute@ngeo@Microsoft@@@std@@@std@@@Z
?on_progress@RouterEngine@nmacore@Microsoft@@UEAAXI@Z
?getPollInterval@RouterEngine@nmacore@Microsoft@@MEAAHXZ
?resumeEngine@RouterEngine@nmacore@Microsoft@@UEAA_NXZ
?suspendEngine@BaseEngine@nmacore@Microsoft@@UEAA_NXZ
?stop@RouterEngine@nmacore@Microsoft@@UEAAXXZ
?start@BaseEngine@nmacore@Microsoft@@UEAAXXZ
?poll@RouterEngine@nmacore@Microsoft@@MEAAXXZ
?getEngineId@RouterEngine@nmacore@Microsoft@@MEBA?AW4TEngineID@BaseEngine@23@XZ
?getAlternativeRoutes@RouterEngine@nmacore@Microsoft@@QEBAAEBV?$vector@U?$pair@VRoute@nmacore@Microsoft@@H@std@@V?$allocator@U?$pair@VRoute@nmacore@Microsoft@@H@std@@@2@@std@@XZ
?getViolatedOptions@RouterEngine@nmacore@Microsoft@@QEBAHXZ
?set_latitude@GeoCoordinates@ngeo@Microsoft@@QEAAXN@Z
?cancel@RouterEngine@nmacore@Microsoft@@QEAAXXZ
??8ngeo@Microsoft@@YA_NAEBVGeoCoordinates@01@0@Z
?set_longitude@GeoCoordinates@ngeo@Microsoft@@QEAAXN@Z
?calculate@RouterEngine@nmacore@Microsoft@@QEAA?AW4TErrorCode@@AEBVRoutePlan@ngeo@3@AEBVDynamicPenalty@63@@Z
?setFallbackMode@RouterEngine@nmacore@Microsoft@@QEAAXW4TFallbackMode@123@@Z
?setBingMapsKey@RouterEngine@nmacore@Microsoft@@SAXAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?set_altitude@GeoCoordinates@ngeo@Microsoft@@QEAAXM@Z
?setUseTraffic@RouterEngine@nmacore@Microsoft@@QEAAX_N@Z
?routeOptions@RouteOptions@nmacore@Microsoft@@QEBAAEBV1ngeo@3@XZ
?set_route_options@RoutePlan@ngeo@Microsoft@@QEAAXAEBVRouteOptions@23@@Z
?setStartDirection@RouteOptions@nmacore@Microsoft@@QEAAXI@Z
?setRouteDepartureTime@RouteOptions@nmacore@Microsoft@@QEAAX_J@Z
?setRouteAlternativesCount@RouteOptions@nmacore@Microsoft@@QEAAXI@Z
?setAllowParks@RouteOptions@nmacore@Microsoft@@QEAAX_N@Z
?setAllowRailFerries@RouteOptions@nmacore@Microsoft@@QEAAX_N@Z
?setAllowDirtRoads@RouteOptions@nmacore@Microsoft@@QEAAX_N@Z
?setAllowTunnels@RouteOptions@nmacore@Microsoft@@QEAAX_N@Z
?setAllowBoatFerries@RouteOptions@nmacore@Microsoft@@QEAAX_N@Z
?setAllowTollRoads@RouteOptions@nmacore@Microsoft@@QEAAX_N@Z
?setAllowHighways@RouteOptions@nmacore@Microsoft@@QEAAX_N@Z
?setRouteType@RouteOptions@nmacore@Microsoft@@QEAAXW4TRouteType@123@@Z
?setRouteMode@RouteOptions@nmacore@Microsoft@@QEAAXW4TRouteMode@123@@Z
?insert_stopover@RoutePlan@ngeo@Microsoft@@QEAA?AW4ErrorCode@errorcodes@msngeo@@AEBVRouteWaypoint@23@I@Z
??1Location@ngeo@Microsoft@@UEAA@XZ
??0GeoRect@ngeo@Microsoft@@QEAA@AEBVGeoCoordinates@12@0@Z
??0GeoRect@ngeo@Microsoft@@QEAA@NNNN@Z
??0DynamicPenalty@ngeo@Microsoft@@QEAA@XZ
??AGeoPolyline@ngeo@Microsoft@@QEBAAEBVGeoCoordinates@12@_K@Z
??1LocationInfo@ngeo@Microsoft@@QEAA@XZ
??0LocationInfo@ngeo@Microsoft@@QEAA@XZ
??0Location@ngeo@Microsoft@@QEAA@AEBVGeoCoordinates@12@AEBVLocationInfo@12@@Z
??0RouteWaypoint@ngeo@Microsoft@@QEAA@AEBVLocation@12@W4Type@012@@Z
??1RouteOptions@nmacore@Microsoft@@QEAA@XZ
??0RouteOptions@nmacore@Microsoft@@QEAA@XZ
??1RoutePlan@ngeo@Microsoft@@QEAA@XZ
??0RoutePlan@ngeo@Microsoft@@QEAA@XZ
??1RouterEngine@nmacore@Microsoft@@UEAA@XZ
?setListener@RouterEngine@nmacore@Microsoft@@QEAAXPEAVIRouterEngineListener@23@@Z
??0RouterEngine@nmacore@Microsoft@@QEAA@XZ
?createRoutingGridLoader@Runtime@nmacore@Microsoft@@UEBA?AV?$PresentSharedPtr@$$CBVRoutingGridLoader@smart5@Microsoft@@@Core@@AEBV?$PresentSharedPtr@$$CBVIGridLoader@MapControl@@@5@@Z
?set_online@MapModel@ngeo@Microsoft@@QEAA?AW4ErrorCode@errorcodes@msngeo@@_N@Z
?getMapModel@Runtime@nmacore@Microsoft@@QEAAAEAVMapModel@ngeo@3@XZ
?is_online@MapModel@ngeo@Microsoft@@QEBA_NXZ
?resume@Runtime@nmacore@Microsoft@@QEAA?AW4TErrorCode@@XZ
?suspend@Runtime@nmacore@Microsoft@@QEAA?AW4TErrorCode@@XZ
?setTimerSource@Runtime@nmacore@Microsoft@@QEAAXAEBV?$shared_ptr@VITimerSource@msnma@@@std@@@Z
?doInit@Runtime@nmacore@Microsoft@@QEAA?AW4TErrorCode@@AEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
??1Runtime@nmacore@Microsoft@@UEAA@XZ
??0Runtime@nmacore@Microsoft@@QEAA@XZ
?deserialize@Route@nmacore@Microsoft@@SAIAEAVIInStream@msnma@@PEAPEAV123@@Z
?get_top_left@GeoRect@ngeo@Microsoft@@QEBAAEBVGeoCoordinates@23@XZ
?number_of_points@GeoPolyline@ngeo@Microsoft@@QEBA_KXZ
?push_back@GeoPolyline@ngeo@Microsoft@@QEAAXAEBVGeoCoordinates@23@@Z
?reserve@GeoPolyline@ngeo@Microsoft@@QEAAX_K@Z
??0GeoPolyline@ngeo@Microsoft@@QEAA@XZ
??0GeoCoordinates@ngeo@Microsoft@@QEAA@AEBVIGeoCoordinates@msngeo@@@Z
??0GeoRect@ngeo@Microsoft@@QEAA@AEBVIGeoRect@msngeo@@@Z
??1ItineraryWarning@nmacore@Microsoft@@UEAA@XZ
??0ItineraryWarning@nmacore@Microsoft@@QEAA@XZ
?is_valid@GeoCoordinates@ngeo@Microsoft@@UEBA_NXZ
?get_altitude@GeoCoordinates@ngeo@Microsoft@@UEBAMXZ
?get_longitude@GeoCoordinates@ngeo@Microsoft@@UEBANXZ
?get_latitude@GeoCoordinates@ngeo@Microsoft@@UEBANXZ
??1ITimerSource@msnma@@UEAA@XZ
??0ITimerSource@msnma@@QEAA@XZ
??1GeoCoordinates@ngeo@Microsoft@@UEAA@XZ
??0GeoCoordinates@ngeo@Microsoft@@QEAA@AEBV012@@Z
??0GeoCoordinates@ngeo@Microsoft@@QEAA@$$QEAV012@@Z
??4GeoCoordinates@ngeo@Microsoft@@QEAAAEAV012@AEBV012@@Z
??4GeoCoordinates@ngeo@Microsoft@@QEAAAEAV012@$$QEAV012@@Z
??1GeoRect@ngeo@Microsoft@@UEAA@XZ
??0GeoRect@ngeo@Microsoft@@QEAA@AEBV012@@Z
??0GeoRect@ngeo@Microsoft@@QEAA@$$QEAV012@@Z
??4GeoRect@ngeo@Microsoft@@QEAAAEAV012@AEBV012@@Z
??4GeoRect@ngeo@Microsoft@@QEAAAEAV012@$$QEAV012@@Z
??1GeoPolyline@ngeo@Microsoft@@UEAA@XZ
??0GeoPolyline@ngeo@Microsoft@@QEAA@AEBV012@@Z
??4GeoPolyline@ngeo@Microsoft@@QEAAAEAV012@AEBV012@@Z
?get_center@GeoRect@ngeo@Microsoft@@QEBA?AVGeoCoordinates@23@XZ
?get_bottom_right@GeoRect@ngeo@Microsoft@@QEBAAEBVGeoCoordinates@23@XZ

mapconfiguration

ConfigurationManager_Create
ConfigurationManager_GetLocaleMapConfiguration

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

bcp47langs

GetUserLanguages

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-core-processenvironment-l1-1-0

SearchPathW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegGetValueW
RegCloseKey

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

Exports

Exports

??0?$BackedType@V?$shared_ptr@VIManeuver@msnma@@@std@@@core@@QEAA@$$QEAV01@@Z
??0?$BackedType@V?$shared_ptr@VIManeuver@msnma@@@std@@@core@@QEAA@AEBV01@@Z
??0?$BackedType@V?$shared_ptr@VIManeuver@msnma@@@std@@@core@@QEAA@XZ
??0?$BackedType@V?$shared_ptr@VIRoute@msnma@@@std@@@core@@QEAA@$$QEAV01@@Z
??0?$BackedType@V?$shared_ptr@VIRoute@msnma@@@std@@@core@@QEAA@AEBV01@@Z
??0?$BackedType@V?$shared_ptr@VIRoute@msnma@@@std@@@core@@QEAA@XZ
??0?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@QEAA@$$QEAV01@@Z
??0?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@QEAA@AEBV01@@Z
??0?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@QEAA@XZ
??0?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@QEAA@$$QEAV01@@Z
??0?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@QEAA@AEBV01@@Z
??0?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@QEAA@XZ
??0?$UIThreadCore@UIRouterUI@@@@IEAA@XZ
??0DoublePoint@core@@QEAA@NN@Z
??0GeoCoordinates@core@@QEAA@AEBV01@@Z
??0GeoCoordinates@core@@QEAA@NN@Z
??0GeoCoordinates@core@@QEAA@XZ
??0GeoRect@core@@QEAA@AEBV01@@Z
??0GeoRect@core@@QEAA@NNNN@Z
??0GeoRect@core@@QEAA@PEBVGeoCoordinates@1@0@Z
??0GeoRect@core@@QEAA@XZ
??0OperationAdapterCore@@IEAA@XZ
??0OperationAdapterCore@@QEAA@AEBV0@@Z
??0QueryAdapterCore@@IEAA@XZ
??0QueryAdapterCore@@QEAA@AEBV0@@Z
??0Route@core@@QEAA@AEBV01@@Z
??0Route@core@@QEAA@XZ
??0RouteLeg@core@@QEAA@AEBV01@@Z
??0RouteLeg@core@@QEAA@XZ
??0RouteManeuver@core@@QEAA@AEBV01@@Z
??0RouteManeuver@core@@QEAA@XZ
??0RouterAdapterCore@@IEAA@XZ
??1?$BackedType@V?$shared_ptr@VIManeuver@msnma@@@std@@@core@@QEAA@XZ
??1?$BackedType@V?$shared_ptr@VIRoute@msnma@@@std@@@core@@QEAA@XZ
??1?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@QEAA@XZ
??1?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@QEAA@XZ
??1?$UIThreadCore@UIRouterUI@@@@MEAA@XZ
??1GeoCoordinates@core@@UEAA@XZ
??1GeoRect@core@@UEAA@XZ
??1OperationAdapterCore@@MEAA@XZ
??1QueryAdapterCore@@MEAA@XZ
??1Route@core@@UEAA@XZ
??1RouteLeg@core@@UEAA@XZ
??1RouteManeuver@core@@UEAA@XZ
??1RouterAdapterCore@@MEAA@XZ
??4?$BackedType@V?$shared_ptr@VIManeuver@msnma@@@std@@@core@@QEAAAEAV01@$$QEAV01@@Z
??4?$BackedType@V?$shared_ptr@VIManeuver@msnma@@@std@@@core@@QEAAAEAV01@AEBV01@@Z
??4?$BackedType@V?$shared_ptr@VIRoute@msnma@@@std@@@core@@QEAAAEAV01@$$QEAV01@@Z
??4?$BackedType@V?$shared_ptr@VIRoute@msnma@@@std@@@core@@QEAAAEAV01@AEBV01@@Z
??4?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@QEAAAEAV01@$$QEAV01@@Z
??4?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@QEAAAEAV01@AEBV01@@Z
??4?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@QEAAAEAV01@$$QEAV01@@Z
??4?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@QEAAAEAV01@AEBV01@@Z
??4DoublePoint@core@@QEAAAEAU01@$$QEAU01@@Z
??4DoublePoint@core@@QEAAAEAU01@AEBU01@@Z
??4GeoCoordinates@core@@QEAAAEAV01@AEBV01@@Z
??4GeoRect@core@@QEAAAEAV01@AEBV01@@Z
??4OperationAdapterCore@@QEAAAEAV0@AEBV0@@Z
??4QueryAdapterCore@@QEAAAEAV0@AEBV0@@Z
??4Route@core@@QEAAAEAV01@AEBV01@@Z
??4RouteLeg@core@@QEAAAEAV01@AEBV01@@Z
??4RouteManeuver@core@@QEAAAEAV01@AEBV01@@Z
??8DoublePoint@core@@QEBA_NAEBU01@@Z
??8GeoCoordinates@core@@QEBA_NAEBV01@@Z
??9DoublePoint@core@@QEBA_NAEBU01@@Z
??9GeoCoordinates@core@@QEBA_NAEBV01@@Z
??_7?$UIThreadCore@UIRouterUI@@@@6B@
??_7GeoCoordinates@core@@6B@
??_7GeoRect@core@@6B@
??_7OperationAdapterCore@@6B@
??_7QueryAdapterCore@@6B@
??_7Route@core@@6B@
??_7RouteLeg@core@@6B@
??_7RouteManeuver@core@@6B@
??_7RouterAdapterCore@@6B?$UIThreadCore@UIRouterUI@@@@@
??_7RouterAdapterCore@@6BIRouterUI@@@
??_7RouterAdapterCore@@6BQueryAdapterCore@@@
??_FDoublePoint@core@@QEAAXXZ
?CalculateGeoRect@GeoRect@core@@SAJAEAV?$vector@PEAVGeoCoordinates@core@@V?$allocator@PEAVGeoCoordinates@core@@@std@@@std@@PEAV12@@Z
?CalculateRoute@RouterAdapterCore@@QEAAJ$$QEAV?$vector@URoutePoint@engine@@V?$allocator@URoutePoint@engine@@@std@@@std@@W4TravelMode@engine@@W4RouteOptimization@5@KIPEAURouteOptions@5@@Z
?CalculateRoute@RouterAdapterCore@@QEAAJ$$QEAV?$vector@URoutePoint@engine@@V?$allocator@URoutePoint@engine@@@std@@@std@@W4TravelMode@engine@@W4RouteOptimization@5@KI_JPEAURouteOptions@5@@Z
?CalculateRoute@RouterAdapterCore@@QEAAJAEBV?$vector@VGeoCoordinates@core@@V?$allocator@VGeoCoordinates@core@@@std@@@std@@W4TravelMode@engine@@W4RouteOptimization@5@KPEAURouteOptions@5@@Z
?CalculateRoute@RouterAdapterCore@@QEAAJAEBV?$vector@VGeoCoordinates@core@@V?$allocator@VGeoCoordinates@core@@@std@@@std@@W4TravelMode@engine@@W4RouteOptimization@5@K_JPEAURouteOptions@5@@Z
?Cancel@RouterAdapterCore@@QEAAXXZ
?Contains@GeoRect@core@@QEAA_NPEBVGeoCoordinates@2@@Z
?CopyFrom@GeoRect@core@@QEAAXAEBV12@@Z
?Deserialize@Route@core@@SAJAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@PEAV12@@Z
?FormatString@RouteManeuver@core@@SAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@KZZ
?GetAlternateRoute@RouterAdapterCore@@QEAAJIPEAVRoute@core@@@Z
?GetAlternateRouteCount@RouterAdapterCore@@QEAAJPEAI@Z
?GetAlternateRouteViolatedOption@RouterAdapterCore@@QEAAJIPEAH@Z
?GetAltitude@GeoCoordinates@core@@UEBANXZ
?GetBackingObject@?$BackedType@V?$shared_ptr@VIManeuver@msnma@@@std@@@core@@QEBA?AV?$shared_ptr@VIManeuver@msnma@@@std@@XZ
?GetBackingObject@?$BackedType@V?$shared_ptr@VIRoute@msnma@@@std@@@core@@QEBA?AV?$shared_ptr@VIRoute@msnma@@@std@@XZ
?GetBackingObjectRef@?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@IEAAAEAVGeoCoordinates@ngeo@Microsoft@@XZ
?GetBackingObjectRef@?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@QEBAAEBVGeoCoordinates@ngeo@Microsoft@@XZ
?GetBackingObjectRef@?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@IEAAAEAVGeoRect@ngeo@Microsoft@@XZ
?GetBackingObjectRef@?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@QEBAAEBVGeoRect@ngeo@Microsoft@@XZ
?GetBingAuthenticationKey@MapsSettings@@SAJPEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetBingMapsKey@MapsSettings@@SAJPEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetBottom@GeoRect@core@@QEBANXZ
?GetBottomRight@GeoRect@core@@QEBAJPEAVGeoCoordinates@2@@Z
?GetBoundingBox@Route@core@@UEBAJPEAVGeoRect@2@@Z
?GetBoundingBox@RouteLeg@core@@UEBAJPEAVGeoRect@2@@Z
?GetCenter@GeoRect@core@@QEBAJPEAVGeoCoordinates@2@@Z
?GetConnectivityType@RouterAdapterCore@@QEAAJPEAW4ConnectivityType@engine@@@Z
?GetContinueFreewayInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetCurrentRoadName@RouteManeuver@core@@QEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetDataAttribution@MapsSettings@@SAJPEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetDefaultCenterFromTimezone@MapsSettings@@SAPEBVGeoCoordinates@core@@XZ
?GetDistanceInMetersFromPreviousManeuver@RouteManeuver@core@@QEBAKXZ
?GetDistanceInMetersToNextManeuver@RouteManeuver@core@@QEBAKXZ
?GetDurationInSeconds@Route@core@@UEBAKXZ
?GetDurationInSeconds@RouteLeg@core@@UEBAKXZ
?GetDurationWithoutTrafficInSeconds@Route@core@@UEBAKXZ
?GetDurationWithoutTrafficInSeconds@RouteLeg@core@@UEBAKXZ
?GetEnableManeuverCondensing@MapsSettings@@SA_NXZ
?GetEndInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetEnterFreewayInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetErrorCode@OperationAdapterCore@@QEBAJXZ
?GetFreewayExitNumber@RouteManeuver@core@@QEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetGenerationNumber@?$UIThreadCore@UIRouterUI@@@@UEBAJXZ
?GetGeometryCoordinates@Route@core@@UEBAJKPEAVGeoCoordinates@2@@Z
?GetGeometryCoordinates@RouteLeg@core@@UEBAJKPEAVGeoCoordinates@2@@Z
?GetGeometryCoordinatesCount@Route@core@@UEBAKXZ
?GetGeometryCoordinatesCount@RouteLeg@core@@UEBAKXZ
?GetGoStraightInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetHeading@RouteManeuver@core@@QEBA?AW4CompassHeading@2@XZ
?GetInflatedGeoRect@GeoRect@core@@QEBA?AV12@XZ
?GetInstanceId@OperationAdapterCore@@QEBAHXZ
?GetInstructionText@RouteManeuver@core@@QEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetInstructionTextFromBacking@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
?GetInstructionWithTarget@RouteManeuver@core@@AEBAJKAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetInstructionWithTargetAndReplacement@RouteManeuver@core@@AEBAJKAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
?GetKeyValidationStatus@MapsSettings@@SAJPEAH@Z
?GetLatitude@GeoCoordinates@core@@UEBANXZ
?GetLeaveFreewayInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
?GetLeft@GeoRect@core@@QEBANXZ
?GetLeg@Route@core@@UEBAJKPEAVRouteLeg@2@@Z
?GetLegCount@Route@core@@UEBAKXZ
?GetLengthInMeters@Route@core@@UEBAKXZ
?GetLengthInMeters@RouteLeg@core@@UEBAKXZ
?GetLimitNetworkUsage@MapsSettings@@SAJPEA_N@Z
?GetLocaleMapConfiguration@MapsSettings@@SAJPEAPEAUILocaleMapConfiguration@@@Z
?GetLongitude@GeoCoordinates@core@@UEBANXZ
?GetManeuver@RouteLeg@core@@UEBAJKPEAVRouteManeuver@2@@Z
?GetManeuverCount@RouteLeg@core@@UEBAKXZ
?GetManeuverNotice@RouteManeuver@core@@QEBAJPEAH@Z
?GetManeuverType@RouteManeuver@core@@QEBA?AW4RouteManeuverType@2@XZ
?GetManeuverWarningCount@RouteManeuver@core@@QEBAKXZ
?GetManeuverWarnings@RouteManeuver@core@@QEBAAEBVIItineraryWarning@msnma@@K@Z
?GetMaxLatitude@GeoCoordinates@core@@SANXZ
?GetMaxLongitude@GeoCoordinates@core@@SANXZ
?GetMinLatitude@GeoCoordinates@core@@SANXZ
?GetMinLongitude@GeoCoordinates@core@@SANXZ
?GetProgress@OperationAdapterCore@@QEBAKXZ
?GetProvider@RouterAdapterCore@@QEAAJPEAW4Provider@engine@@@Z
?GetResultSqmId@OperationAdapterCore@@MEBAKXZ
?GetResultSqmId@RouterAdapterCore@@UEBAKXZ
?GetRight@GeoRect@core@@QEBANXZ
?GetRoute@RouterAdapterCore@@QEAAJPEAVRoute@core@@@Z
?GetSnappedCompassHeading@RouteManeuver@core@@CA?AW4CompassHeading@2@K@Z
?GetStartCoordinates@RouteManeuver@core@@QEBAJPEAVGeoCoordinates@2@@Z
?GetStartInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetStatus@QueryAdapterCore@@QEBA?AW4QueryStatus@@XZ
?GetStopoverInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetStringResource@RouteManeuver@core@@SAJKAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetTakeFerryInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetTargetRoadName@RouteManeuver@core@@QEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetTop@GeoRect@core@@QEBANXZ
?GetTopLeft@GeoRect@core@@QEBAJPEAVGeoCoordinates@2@@Z
?GetTrafficCircleExitNumber@RouteManeuver@core@@QEBAKXZ
?GetTrafficCircleInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetTrafficCongestion@Route@core@@UEBA?AW4TrafficCongestionType@IRoute@msnma@@XZ
?GetTrafficCongestion@RouteLeg@core@@UEBA?AW4TrafficCongestionType@IRoute@msnma@@XZ
?GetTurnInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetUndefinedInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetUserGeoRegion@MapsSettings@@SAJPEAPEAUHSTRING__@@@Z
?GetUserGeoRegion@MapsSettings@@SAJPEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetUserGeoRegionAsThreeLetterCode@MapsSettings@@SAJPEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetUserPreferredUILanguage@MapsSettings@@SAJPEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetUserProfileLanguage@MapsSettings@@SAJPEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetUserProfileLanguages@MapsSettings@@SAJPEAPEAUHSTRING__@@@Z
?GetUserProfileLanguages@MapsSettings@@SAJPEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetUturnInstruction@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetViolatedOptions@RouterAdapterCore@@QEAAJPEAH@Z
?IncrementGeneration@?$UIThreadCore@UIRouterUI@@@@IEAAJXZ
?Initialize@?$UIThreadCore@UIRouterUI@@@@IEAAJV?$unique_ptr@UIThreadSignal@@U?$destroy_delete@UIThreadSignal@@@@@std@@@Z
?Initialize@Route@core@@QEAAJV?$shared_ptr@VIRoute@msnma@@@std@@@Z
?Initialize@RouteLeg@core@@AEAAJV?$shared_ptr@VIRoute@msnma@@@std@@K@Z
?Initialize@RouteManeuver@core@@AEAAJAEBV?$vector@V?$shared_ptr@VIManeuver@msnma@@@std@@V?$allocator@V?$shared_ptr@VIManeuver@msnma@@@std@@@2@@std@@H@Z
?InitializeGeometryCoordinates@RouteLeg@core@@AEAAJXZ
?InitializeInstructionText@RouteManeuver@core@@AEBAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
?InitializeLegs@Route@core@@AEAAJXZ
?InitializeManeuverCondensingContexts@RouteLeg@core@@AEAAJ_N@Z
?InitializeManeuvers@RouteLeg@core@@AEAAJXZ
?Intersects@GeoRect@core@@QEAA_NPEBV12@@Z
?IsChinaVariant@MapsSettings@@SA_NXZ
?IsDegenerate@GeoRect@core@@QEBA_NXZ
?IsDeserialized@Route@core@@QEBA_NXZ
?IsDispatchEnabled@?$UIThreadCore@UIRouterUI@@@@IEAA_NXZ
?IsOldChinaRegKeySet@MapsSettings@@SA_NXZ
?IsValid@GeoCoordinates@core@@UEBA_NXZ
?IsValid@GeoRect@core@@UEBA_NXZ
?IsValid@Route@core@@QEBA_NXZ
?IsValid@RouteLeg@core@@AEBA_NXZ
?IsWatermarkEnabled@MapsSettings@@SA_NXZ
?OnRouteDone@RouterAdapterCore@@UEAAXAEBURouteResult@engine@@@Z
?OnRouteProgress@RouterAdapterCore@@UEAAXK@Z
?Post@?$UIThreadCore@UIRouterUI@@@@UEAAXPEAV?$TDispatchItem@UIRouterUI@@@@@Z
?ProcessDispatchQueue@?$UIThreadCore@UIRouterUI@@@@QEAAXPEAUIRouterUI@@@Z
?RegisterListener@SuspendResumeDispatcher@@SAJPEAVISuspendResumeListener@@PEA_N@Z
?ResetProgress@OperationAdapterCore@@IEAAXXZ
?RestrictedAPIAccessCheck@ApiAccessCheck@@SAJXZ
?Serialize@Route@core@@QEBAJAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?SetAltitude@GeoCoordinates@core@@UEAAXN@Z
?SetBackingObject@?$BackedType@V?$shared_ptr@VIManeuver@msnma@@@std@@@core@@QEAAXAEBV?$shared_ptr@VIManeuver@msnma@@@std@@@Z
?SetBackingObject@?$BackedType@V?$shared_ptr@VIRoute@msnma@@@std@@@core@@QEAAXAEBV?$shared_ptr@VIRoute@msnma@@@std@@@Z
?SetBackingObject@?$BackedType@VGeoCoordinates@ngeo@Microsoft@@@core@@QEAAXAEBVGeoCoordinates@ngeo@Microsoft@@@Z
?SetBackingObject@?$BackedType@VGeoRect@ngeo@Microsoft@@@core@@QEAAXAEBVGeoRect@ngeo@Microsoft@@@Z
?SetBingAuthenticationKey@MapsSettings@@SAJAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetBingMapsKey@MapsSettings@@SAJAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetDispatchEnabled@?$UIThreadCore@UIRouterUI@@@@IEAAX_N@Z
?SetEnableManeuverCondensing@MapsSettings@@SAX_N@Z
?SetErrorCode@OperationAdapterCore@@IEAAXJ@Z
?SetInstanceId@OperationAdapterCore@@IEAAXH@Z
?SetKeyValidationStatus@MapsSettings@@SAJH@Z
?SetLatitude@GeoCoordinates@core@@UEAAXN@Z
?SetLimitNetworkUsage@MapsSettings@@SAJ_N@Z
?SetLongitude@GeoCoordinates@core@@UEAAXN@Z
?SetProgress@OperationAdapterCore@@MEAAXK@Z
?SetProgress@QueryAdapterCore@@MEAAXK@Z
?SetStatus@QueryAdapterCore@@IEAAXW4QueryStatus@@@Z
?UnregisterListener@SuspendResumeDispatcher@@SAXPEAVISuspendResumeListener@@@Z
?WaitOnClose@MosThread@@SAXXZ
?_CoreInitialize@RouterAdapterCore@@IEAAJHV?$unique_ptr@UIThreadSignal@@U?$destroy_delete@UIThreadSignal@@@@@std@@@Z
?_CoreUninitialize@RouterAdapterCore@@IEAAXXZ
?c_DefaultDrivingRouteOptions@RouterAdapterCore@@2URouteOptions@engine@@B
?c_DefaultWalkingRouteOptions@RouterAdapterCore@@2URouteOptions@engine@@B
GetMosThreadInstance
GetMosThreadInstanceWithoutWait
IsDebugThread
IsMosThread
IsRenderThread
IsUIThread
SetDebugThreadId
SetRenderThreadId
SetUIThreadChecksEnabled
SetUIThreadId
WaitForMosThreadToClose

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
umpo/tapi3.dll
.dll regsvr32 windows:10 windows x64 arch:x64

9b088dddcf3f73129d70e32770939b90

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

tapi3.pdb

Imports

msvcrt

__C_specific_handler
_vsnwprintf
wcsrchr
_wcsicmp
strstr
free
malloc
_vsnprintf
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??_V@YAXPEAX@Z
_purecall
??3@YAXPEAX@Z
_CxxThrowException
memcpy
memmove
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
_amsg_exit
_initterm
__RTDynamicCast
__CxxFrameHandler3
memset

atl

ord22
ord18
ord15
ord32
ord21
ord16
ord23

advapi32

RegCloseKey
StartServiceA
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
GetUserNameW
RegOpenKeyExA
RegQueryValueExA

kernel32

GetSystemInfo
RaiseException
GetCurrentProcess
HeapCreate
GetProcessHeap
HeapDestroy
ReleaseMutex
FindResourceA
LoadResource
LockResource
HeapFree
VirtualFree
LoadLibraryExA
EncodePointer
HeapAlloc
DecodePointer
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
GetCurrentThreadId
lstrlenA
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
LocalFree
SetEvent
UnregisterWaitEx
CloseHandle
CompareStringW
lstrcmpiW
CreateEventA
RegisterWaitForSingleObject
UnregisterWait
Sleep
WaitForSingleObject
MultiByteToWideChar
GetACP
WideCharToMultiByte
TlsAlloc
TlsSetValue
CreateMutexA
TlsFree
TlsGetValue
LoadLibraryA
FreeLibraryAndExitThread
ExitThread
GetLastError
LoadLibraryW
GetProcAddress
CreateThread
FreeLibrary
GetModuleHandleA
GetVersion
GetModuleFileNameA
GetModuleFileNameW
WaitForMultipleObjectsEx
CreateSemaphoreA
ReleaseSemaphore
GetCurrentProcessId
GetComputerNameW
LocalAlloc
FormatMessageA
CreateTimerQueue
DeleteTimerQueue
DeleteTimerQueueTimer
GetTickCount
CreateTimerQueueTimer
TryEnterCriticalSection
ChangeTimerQueueTimer
VirtualAlloc

oleaut32

VariantClear
VariantInit
SysAllocString
VariantCopy
SysAllocStringByteLen
SysFreeString
SafeArrayGetDim
SafeArrayGetElement
SetErrorInfo
LoadRegTypeLi
SysStringByteLen
SysStringLen
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound

rpcrt4

RpcBindingFromStringBindingA
RpcBindingFree
RpcStringFreeA
NdrClientCall3
RpcStringBindingComposeA
I_RpcExceptionFilter

user32

SetDlgItemTextA
GetSystemMetrics
GetActiveWindow
DialogBoxParamA
LoadStringA
IsDlgButtonChecked
SetWindowLongPtrA
EndDialog
LoadStringW
IsWindow

wininet

InternetGetCookieA
InternetSetCookieA

winmm

waveInMessage
waveOutMessage
midiInMessage
midiOutMessage
waveOutReset
waveOutPrepareHeader
waveOutWrite
waveOutOpen
waveOutClose
mixerOpen
mixerGetLineControlsA
mixerClose
mixerSetControlDetails
mixerGetControlDetailsA

rtutils

TraceVprintfExA
TraceRegisterExA
TraceDeregisterA

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance
StringFromIID
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
CoInitializeEx
CoWaitForMultipleHandles
CoUninitialize
IIDFromString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 455KB - Virtual size: 454KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
umpo/umpo.dll
.dll windows:10 windows x64 arch:x64

b2a6a504ebef58a43b8808d7ddcd3c2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

umpo.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_toupper
_o___stdio_common_vswprintf
_o__errno
_o___std_type_info_destroy_list
_o__configure_narrow_argv
_o__cexit
__C_specific_handler
wcsrchr
wcsstr
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlFreeHeap
RtlInitializeGenericTableAvl
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlLengthSid
NtQueryInformationProcess
RtlAllocateHeap
EtwEventEnabled
RtlCreateHeap
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlCopySid
RtlDestroyHeap
RtlIsStateSeparationEnabled
NtSetIRTimer
RtlEqualString
RtlGUIDFromString
NtAlpcSendWaitReceivePort
NtAlpcDisconnectPort
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
RtlEnumerateGenericTableAvl
RtlInsertElementGenericTableAvl
NtQueryInformationToken
TpWaitForAlpcCompletion
NtAlpcQueryInformation
NtClose
RtlInitUnicodeString
NtAlpcCancelMessage
NtAlpcConnectPort
TpReleaseAlpcCompletion
TpAllocAlpcCompletion
RtlCompareMemory
DbgPrint
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
NtPowerInformation
RtlLoadString
RtlAllocateWnfSerializationGroup
NtQuerySystemTime
NtQueryWnfStateData
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
NtCreateIRTimer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlGetPersistedStateLocation
RtlIsMultiSessionSku

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeSRWLock
WaitForSingleObject
CreateEventW
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSection
AcquireSRWLockShared

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser
GetLengthSid
CreateWellKnownSid
AdjustTokenPrivileges
AccessCheck
AllocateAndInitializeSid
FreeSid
CheckTokenMembership

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetProcessId
TlsFree
TlsGetValue
GetCurrentThreadId
GetCurrentProcessId
TlsSetValue
TlsAlloc
GetCurrentThread
OpenThreadToken
GetCurrentProcess
TerminateProcess
OpenProcessToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

FindFirstFileW
FindClose
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
DeleteFileW

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteTreeW
RegCloseKey
RegLoadAppKeyW
RegGetValueW
RegSetValueExW
RegDeleteValueW

rpcrt4

I_RpcOpenClientProcess
NdrServerCall2
RpcRevertToSelf
RpcImpersonateClient
RpcServerRegisterIf3
I_RpcBindingIsClientLocal
RpcAsyncInitializeHandle
NdrServerCallAll
RpcBindingFree
RpcServerUseProtseqEpW
RpcBindingFromStringBindingW
UuidCreate
UuidFromStringW
RpcStringBindingComposeW
UuidEqual
Ndr64AsyncClientCall
RpcStringFreeW
RpcAsyncCancelCall
NdrClientCall3
RpcServerUnregisterIfEx
UuidToStringW
RpcAsyncCompleteCall

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventProviderEnabled
EventWriteTransfer

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-service-private-l1-1-0

I_QueryTagInformation
I_ScSendPnPMessage

umpdc

PdcPpmProfileClientUnregister
PdcPpmProfileEnable
PdcPpmProfileClientRegister
PdcPpmProfileDisable

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

kernelbase

WTSGetServiceSessionId
WTSIsServerContainer

api-ms-win-core-apiquery-l2-1-0

IsApiSetImplemented

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

PtrUmpoFullPowerPlanSupportDisabled
PtrUmpoOnAcPower
PtrUmpoProviderHandle
PtrUmpoSchemeLock
UmpoAllocate
UmpoAlpcSendPowerMessage
UmpoFree
UmpoGetActiveScheme
UmpoInternalCloseUserPowerKey
UmpoInternalConvertGuidToString
UmpoInternalDataAccessorToString
UmpoInternalGetKeyValueGuid
UmpoInternalOpenGUIDSubKey
UmpoInternalOpenUserPowerKey
UmpoMain
UmpoNotificationHandler
UmpoNotifyKernelAllPowerPolicyChanged
UmpoSendKernelPowerPolicyNotification
UmpoWriteToUserPowerKey

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
password.jpg
.jpg

Sharing

General

Malware Config

Signatures

Files

Password: 2024

Password: 2024

Password: 2024

69b8547cc70479063e783239d816f920

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

8b:26:d3:ce:fc:97:3c:60:a9:d3:0a:be:0a:8c:9f:6e:ee:61:3b:f8:19:97:05:91:79:61:b2:e9:75:25:2b:96Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

bcrypt

cabinet

advapi32

user32

imagehlp

ole32

oleaut32

rpcrt4

Exports

Exports

Sections

.text Size: 752KB - Virtual size: 751KB

.rdata Size: 296KB - Virtual size: 296KB

.data Size: 13KB - Virtual size: 18KB

.pdata Size: 25KB - Virtual size: 24KB

.didat Size: 512B - Virtual size: 144B

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 1KB - Virtual size: 1KB

Password: 2024

106eff8863e919898a072d6127fa9cff

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

98:53:ce:78:da:32:ad:3b:98:78:95:70:b8:38:2f:ad:85:9e:45:63:c7:ee:d9:3f:14:15:95:ed:bc:e7:3f:6fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

8b:26:d3:ce:fc:97:3c:60:a9:d3:0a:be:0a:8c:9f:6e:ee:61:3b:f8:19:97:05:91:79:61:b2:e9:75:25:2b:96
Signer

.text
Size: 752KB - Virtual size: 751KB

.rdata
Size: 296KB - Virtual size: 296KB

.data
Size: 13KB - Virtual size: 18KB

.pdata
Size: 25KB - Virtual size: 24KB

.didat
Size: 512B - Virtual size: 144B

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 1KB - Virtual size: 1KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

98:53:ce:78:da:32:ad:3b:98:78:95:70:b8:38:2f:ad:85:9e:45:63:c7:ee:d9:3f:14:15:95:ed:bc:e7:3f:6f
Signer

.text
Size: 549KB - Virtual size: 549KB

.rdata
Size: 145KB - Virtual size: 144KB

.data
Size: 5KB - Virtual size: 10KB

.pdata
Size: 31KB - Virtual size: 30KB

.didat
Size: 1024B - Virtual size: 712B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 20KB - Virtual size: 22KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 192B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 3KB - Virtual size: 3KB