SuperNano2000-ENG[.]iso

Sharing

Copy URL

Twitter E-mail

General

Target

SuperNano2000-ENG.iso
Size

51.6MB
MD5

64153098382f09481ee9369fa745f182
SHA1

10c5e3edadfcdfd42aec86547a530a80df4f38c8
SHA256

914401789c623bbfc608ce1574838a7e3e39fbbbe24c34c15483f67200942c9b
SHA512

a7c7ee4216d855f73418c14ba11bc33af70b447ef75b2f2f31578cb40c2a14f07510f51f39f7ff9040c1f37839263dd2ddc12c8e60470f66cf3359fad718f72d
SSDEEP

786432:gZJGg/iJcQ82m0bbBiCshpnHv3ivb+gqmEkWN7JqmEIk4V0PR198jfnT2l:gZJx3K8Cshpey6EkWBJ/EIk/R1Mng

Score

3^/10

Malware Config

Signatures

Unsigned PE 21 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack002/I386/AUTOCHK.EXE
unpack002/I386/AUTOFMT.EXE
unpack002/I386/CABINET.DLL
unpack002/I386/DBGHELP.DLL
unpack002/I386/DSSBASE.DLL
unpack002/I386/EXPAND.EXE
unpack002/I386/HALBORG.DLL
unpack002/I386/HPMON.DLL
unpack002/I386/IMAGEHLP.DLL
unpack002/I386/KBDUS.DLL
unpack002/I386/MSVCP50.DLL
unpack002/I386/NTDLL.DLL
unpack002/I386/NTFS40.SYS
unpack002/I386/PIDGEN.DLL
unpack002/I386/REGEDIT.EXE
unpack002/I386/RSABASE.DLL
unpack002/I386/SCHANNEL.DLL
unpack002/I386/SPCMDCON.SYS
unpack002/I386/SYSTEM32/NTDLL.DLL
unpack002/I386/SYSTEM32/SMSS.EXE
unpack002/I386/UNIPROC/NTDLL.DLL

Files

SuperNano2000-ENG.iso
.iso
out.iso
.iso
CDROM_IP.5
CDROM_NT.5
I386/0401.CS_
.cab
0401.csv
I386/0404.CS_
.cab
0404.csv
I386/0405.CS_
.cab
0405.csv
I386/0406.CS_
.cab
0406.csv
I386/0407.CS_
.cab
0407.csv
I386/0408.CS_
.cab
0408.csv
I386/040B.CS_
.cab
040B.csv
I386/040C.CS_
.cab
I386/040D.CS_
.cab
I386/040E.CS_
.cab
I386/0410.CS_
.cab
I386/0411.CS_
.cab
I386/0412.CS_
.cab
I386/0413.CS_
.cab
I386/0414.CS_
.cab
I386/0415.CS_
.cab
I386/0416.CS_
.cab
I386/0419.CS_
.cab
I386/041D.CS_
.cab
I386/041F.CS_
.cab
I386/0804.CS_
.cab
I386/0C0A.CS_
.cab
I386/8514FIX.FO_
.cab
I386/8514OEM.FO_
.cab
I386/8514SYS.FO_
.cab
I386/ACCESSOR.IN_
.cab
I386/ACLEDIT.DL_
.cab
I386/ACLUI.DL_
.cab
I386/ACPI.IN_
.cab
I386/ACPI.SY_
.cab
I386/ACPIEC.SY_
.cab
I386/ACSETUPC.DL_
.cab
I386/ACSMIB.DL_
.cab
I386/ACTIVEDS.DL_
.cab
I386/ADOD6522.IC_
.cab
I386/ADSLDPC.DL_
.cab
I386/ADVAPI32.DL_
.cab
I386/ADVPACK.DL_
.cab
I386/AFD.SY_
.cab
I386/AMOVIE.IN_
.cab
I386/APCOMPAT.IN_
.cab
I386/APP850.FO_
.cab
I386/APPD6518.IC_
.cab
I386/APPMGMTS.DL_
.cab
I386/APPS.IN_
.cab
I386/APPWIZ.CP_
.cab
I386/ARCLDR.EXE
I386/ARCSETUP.EXE
I386/ARIAL.TT_
.cab
I386/ARIALBD.TT_
.cab
I386/ARIALBI.TT_
.cab
I386/ARIALI.TT_
.cab
I386/ASYCFILT.DL_
.cab
I386/ASYNCMAC.SY_
.cab
I386/ATABOOT.SY_
.cab
I386/ATAPI.SY_
.cab
I386/ATL.DL_
.cab
I386/ATMFD.DL_
.cab
I386/ATMLIB.DL_
.cab
I386/ATTRIB.EX_
.cab
I386/AUTOCHK.EXE
.sys windows:5 windows x86 arch:x86

cbeb585dc924cd0684fa3daaf8e0dd29

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntdll

_chkstk
wcslen
wcsstr
NtClose
NtQueryValueKey
NtOpenKey
RtlInitUnicodeString
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlPrefixUnicodeString
RtlEqualUnicodeString
NtQueryDirectoryObject
NtOpenDirectoryObject
NtDelayExecution
isprint
swprintf
memmove
qsort
RtlDosPathNameToNtPathName_U
NtShutdownSystem
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQuerySystemTime
NtQuerySystemInformation
RtlExpandEnvironmentStrings_U
_allmul
_alldiv
NtSetInformationFile
NtQueryInformationFile
NtOpenFile
NtWriteFile
RtlConvertLongToLargeInteger
NtCreateFile
NtFsControlFile
RtlLengthSid
RtlValidSid
RtlMultiByteToUnicodeN
RtlOemToUnicodeN
sprintf
atol
wcsspn
RtlUnicodeToOemN
RtlUnicodeToMultiByteN
_wcsupr
_wcslwr
wcscmp
NtDisplayString
NtWaitForSingleObject
NtReadFile
NtSetThreadExecutionState
NtCreateEvent
NtDeviceIoControlFile
RtlAllocateHeap
RtlFreeHeap
RtlSizeHeap
_wcsicmp
RtlFreeUnicodeString
RtlFormatMessage
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFindMessage
wcscpy
wcsncmp
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlAddAce
RtlCopySid
RtlQueryInformationAcl
RtlCreateAcl
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
RtlNewSecurityObject
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
NtQueryInformationThread
NtSetEvent
RtlCreateUserThread
NtTerminateThread
_allrem
RtlUpcaseUnicodeString
DbgPrint
_allshl
RtlRaiseStatus
RtlDecompressBuffer
RtlTimeToTimeFields
RtlSystemTimeToLocalTime
RtlSetBits
RtlInitializeBitMap
RtlInsertElementGenericTable
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlFindSetBits
RtlClearBits
RtlLookupElementGenericTable
RtlNumberOfSetBits
RtlEnumerateGenericTableWithoutSplaying
RtlQueryRegistryValues
RtlWriteRegistryValue
RtlUnwind
NtTerminateProcess
DbgBreakPoint
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams
_aulldiv

Sections

.text
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/AUTOFMT.EXE
.sys windows:5 windows x86 arch:x86

d187783b1b368c4a8d7a7c7c3605ca5a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntdll

RtlCopySid
RtlConvertLongToLargeInteger
_wcsicmp
_wcsupr
_stricmp
atoi
_allmul
_alldiv
RtlDosPathNameToNtPathName_U
NtClose
NtShutdownSystem
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQuerySystemTime
NtQuerySystemInformation
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlInitUnicodeString
RtlExpandEnvironmentStrings_U
wcslen
NtSetInformationFile
NtQueryInformationFile
NtOpenFile
NtWriteFile
NtCreateFile
NtFsControlFile
RtlLengthSid
RtlValidSid
NtSetThreadExecutionState
NtReadFile
NtDeviceIoControlFile
_chkstk
memmove
RtlMultiByteToUnicodeN
RtlOemToUnicodeN
sprintf
RtlUnicodeToOemN
RtlUnicodeToMultiByteN
_wcslwr
wcscmp
isprint
swprintf
NtDisplayString
NtWaitForSingleObject
NtCreateEvent
RtlAllocateHeap
RtlFreeHeap
RtlSizeHeap
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlAddAce
NtDelayExecution
RtlQueryInformationAcl
RtlCreateAcl
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
RtlNewSecurityObject
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
wcscpy
RtlTimeToTimeFields
RtlSystemTimeToLocalTime
RtlPrefixUnicodeString
NtQueryValueKey
NtOpenKey
NtSetVolumeInformationFile
NtQueryVolumeInformationFile
RtlQueryRegistryValues
RtlWriteRegistryValue
RtlUpcaseUnicodeString
_allshl
RtlRaiseStatus
_allrem
RtlDecompressBuffer
RtlFreeUnicodeString
RtlFormatMessage
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFindMessage
wcsncmp
NtQueryInformationThread
NtSetEvent
RtlCreateUserThread
NtTerminateThread
DbgPrint
RtlSetBits
RtlInitializeBitMap
RtlInsertElementGenericTable
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlFindSetBits
RtlClearBits
RtlLookupElementGenericTable
RtlNumberOfSetBits
RtlEnumerateGenericTableWithoutSplaying
RtlUnwind
NtTerminateProcess
DbgBreakPoint
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams
_aulldiv

Sections

.text
Size: 299KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/AUTOLFN.EX_
.cab
I386/AVICAP32.DL_
.cab
I386/AVIFIL32.DL_
.cab
I386/AVSHELL.DL_
.cab
I386/BASESRV.DL_
.cab
I386/BASICDC.IN_
.cab
I386/BASICSV.IN_
.cab
I386/BASICWK.IN_
.cab
I386/BATMETER.DL_
.cab
I386/BIOSINFO.INF
I386/BLANK.HT_
.cab
I386/BLUMON16.BM_
.cab
I386/BOOTFIX.BAK
I386/BOOTOK.EX_
.cab
I386/BOOTVID.DL_
.cab
I386/BOOTVRFY.EX_
.cab
I386/BR549.DL_
.cab
I386/BROWSELC.DL_
.cab
I386/BROWSER.DL_
.cab
I386/BROWSEUI.DL_
.cab
I386/BUSMOUSE.SY_
.cab
I386/CABINET.DLL
.dll windows:5 windows x86 arch:x86

ea4cbf3c305bfb43c7e36a485e58acb4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CreateDirectoryA
ReadFile
WriteFile
CloseHandle
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
lstrcatA
lstrcpyA
lstrlenA
CreateFileA
SetFileAttributesA
lstrcmpiA
GetLastError
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteFileA

ole32

CoTaskMemFree
CoTaskMemAlloc

Exports

Exports

DeleteExtractedFiles
DllGetVersion
Extract
FCIAddFile
FCICreate
FCIDestroy
FCIFlushCabinet
FCIFlushFolder
FDICopy
FDICreate
FDIDestroy
FDIIsCabinet
FDITruncateCabinet
GetDllVersion

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/CABVIEW.DL_
.cab
I386/CACLS.EX_
.cab
I386/CAPESNPN.DL_
.cab
I386/CDFS.SY_
.cab
I386/CDMODEM.DL_
.cab
I386/CDROM.IN_
.cab
I386/CDROM.SY_
.cab
I386/CERTCERT.GI_
.cab
I386/CERTCLAS.IN_
.cab
I386/CERTCLI.DL_
.cab
I386/CFGMGR32.DL_
.cab
I386/CGA40850.FO_
.cab
I386/CGA40WOA.FO_
.cab
I386/CGA80850.FO_
.cab
I386/CGA80WOA.FO_
.cab
I386/CHKDSK.EX_
.cab
I386/CHKNTFS.EX_
.cab
I386/CHKUPGRD.BAT
I386/CIC.DL_
.cab
I386/CJIME.CA_
.cab
I386/CLASS2.SY_
.cab
I386/CLASSES.CA_
.cab
I386/CLASSPNP.SY_
.cab
I386/CLB.DL_
.cab
I386/CLUSAPI.DL_
.cab
I386/CLUSTER.EX_
.cab
I386/CMD.EX_
.cab
I386/CMNQUERY.DL_
.cab
I386/COMCAT.DL_
.cab
I386/COMCTL32.DL_
.cab .ps1 polyglot
I386/COMDLG32.DL_
.cab
I386/COMMAND.CO_
.cab
I386/COMPACT.EX_
.cab
I386/COMPATWS.IN_
.cab
I386/COMPLUS.FL_
.cab
I386/COMPMGMT.MS_
.cab
I386/CONSOLE.DL_
.cab
I386/CONTROL.EX_
.cab
I386/CORELIST.IN_
.cab
I386/COUR.TT_
.cab
I386/COURBD.TT_
.cab
I386/COURBI.TT_
.cab
I386/COURE.FO_
.cab
I386/COURF.FO_
.cab
I386/COURI.TT_
.cab
I386/CRTDLL.DL_
.cab
I386/CRYPT32.DL_
.cab
I386/CRYPTDLG.DL_
.cab
I386/CRYPTDLL.DL_
.cab
I386/CRYPTEXT.DL_
.cab
I386/CRYPTNET.DL_
.cab
I386/CRYPTSVC.DL_
.cab
I386/CRYPTUI.DL_
.cab
I386/CSAPI3T1.DL_
.cab
I386/CSCDLL.DL_
.cab
I386/CSCRIPT.EX_
.cab
I386/CSRSRV.DL_
.cab
I386/CSRSS.EX_
.cab
I386/CTL3D32.DL_
.cab
I386/CTYPE.NL_
.cab
I386/C_037.NL_
.cab
I386/C_10000.NL_
.cab
I386/C_10079.NL_
.cab
I386/C_1026.NL_
.cab
I386/C_1047.NL_
.cab
I386/C_1140.NL_
.cab
I386/C_1141.NL_
.cab
I386/C_1142.NL_
.cab
I386/C_1143.NL_
.cab
I386/C_1144.NL_
.cab
I386/C_1145.NL_
.cab
I386/C_1146.NL_
.cab
I386/C_1147.NL_
.cab
I386/C_1148.NL_
.cab
I386/C_1149.NL_
.cab
I386/C_1250.NL_
.cab
I386/C_1251.NL_
.cab
I386/C_1252.NL_
.cab
I386/C_1253.NL_
.cab
I386/C_1254.NL_
.cab
I386/C_1255.NL_
.cab
I386/C_1256.NL_
.cab
I386/C_1257.NL_
.cab
I386/C_20001.NL_
.cab
I386/C_20002.NL_
.cab
I386/C_20003.NL_
.cab
I386/C_20004.NL_
.cab
I386/C_20005.NL_
.cab
I386/C_20105.NL_
.cab
I386/C_20106.NL_
.cab
I386/C_20107.NL_
.cab
I386/C_20108.NL_
.cab
I386/C_20127.NL_
.cab
I386/C_20261.NL_
.cab
I386/C_20269.NL_
.cab
I386/C_20273.NL_
.cab
I386/C_20277.NL_
.cab
I386/C_20278.NL_
.cab
I386/C_20280.NL_
.cab
I386/C_20284.NL_
.cab
I386/C_20285.NL_
.cab
I386/C_20297.NL_
.cab
I386/C_20420.NL_
.cab
I386/C_20423.NL_
.cab
I386/C_20424.NL_
.cab
I386/C_20833.NL_
.cab
I386/C_20838.NL_
.cab
I386/C_20866.NL_
.cab
I386/C_20871.NL_
.cab
I386/C_20880.NL_
.cab
I386/C_20905.NL_
.cab
I386/C_20924.NL_
.cab
I386/C_20930.NL_
.cab
I386/C_20931.NL_
.cab
I386/C_20933.NL_
.cab
I386/C_20935.NL_
.cab
I386/C_20937.NL_
.cab
I386/C_20939.NL_
.cab
I386/C_20950.NL_
.cab
I386/C_21025.NL_
.cab
I386/C_21866.NL_
.cab
I386/C_28591.NL_
.cab
I386/C_28592.NL_
.cab
I386/C_28593.NL_
.cab
I386/C_28605.NL_
.cab
I386/C_437.NL_
.cab
I386/C_500.NL_
.cab
I386/C_850.NL_
.cab
I386/C_858.NL_
.cab
I386/C_860.NL_
.cab
I386/C_861.NL_
.cab
I386/C_863.NL_
.cab
I386/C_865.NL_
.cab
I386/C_870.NL_
.cab
I386/D3DREF.DL_
.cab
I386/DAJAVAC.CA_
.cab
I386/DBGHELP.DLL
.dll windows:5 windows x86 arch:x86

29ba6cfb5bc74e73404bb0c1dc60e0db

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
_adjust_fdiv
__dllonexit
_except_handler3
_strlwr
malloc
_initterm
strstr
_ftol
strncmp
_vsnprintf
_ltoa
_itoa
_makepath
tolower
strncat
wcsncpy
sprintf
qsort
free
wcslen
calloc
_splitpath
_mbsnbcpy
time
fflush
_iob
_purecall
_fullpath
_close
_read
_sopen
_memicmp
_open_osfhandle
_lseek
_errno
_write
_chsize
_mbsicmp
_mbsrchr
printf
_access
bsearch
memmove
_mbscmp
_stricmp
_strnicmp
strncpy
strchr

kernel32

WideCharToMultiByte
IsDBCSLeadByte
CopyFileA
GetVersion
FindClose
ReadProcessMemory
VirtualAlloc
OutputDebugStringA
VirtualFree
GetCurrentProcessId
VirtualProtect
lstrcpyA
DuplicateHandle
ExpandEnvironmentStringsA
LoadLibraryA
FreeLibrary
GetFileSize
MapViewOfFile
lstrlenA
CreateFileMappingA
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
GetCurrentProcess
UnmapViewOfFile
GetEnvironmentVariableA
GetFileAttributesA
SetLastError
CloseHandle
CreateFileA
GetFullPathNameA
GetLastError
HeapCreate
HeapDestroy
FindNextFileA
FindFirstFileA
CreateDirectoryA
HeapAlloc
HeapFree
DisableThreadLibraryCalls
GetVersionExA
HeapReAlloc

Exports

Exports

EnumerateLoadedModules
EnumerateLoadedModules64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindExecutableImage
FindExecutableImageEx
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
SearchTreeForFile
StackWalk
StackWalk64
SymCleanup
SymEnumerateModules
SymEnumerateModules64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromName
SymGetLineFromName64
SymGetLineNext
SymGetLineNext64
SymGetLinePrev
SymGetLinePrev64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoEx
SymGetModuleInfoEx64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOptions
SymGetSearchPath
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolInfo
SymGetSymbolInfo64
SymInitialize
SymLoadModule
SymLoadModule64
SymMatchFileName
SymRegisterCallback
SymRegisterCallback64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSetOptions
SymSetSearchPath
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnmapDebugInformation
WinDbgExtensionDllInit
sym

Sections

.text
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/DBMSSOCN.DL_
.cab
I386/DBMSSPXN.DL_
.cab
I386/DBMSVINN.DL_
.cab
I386/DCIMAN32.DL_
.cab
I386/DCOMCNFG.EX_
.cab
I386/DDMPRXY.EX_
.cab
I386/DDRAW.DL_
.cab
I386/DEFLTSV.IN_
.cab
I386/DEFLTWK.IN_
.cab
I386/DELTTSUL.EX_
.cab
I386/DESK.CP_
.cab
I386/DESKADP.DL_
.cab
I386/DESKMON.DL_
.cab
I386/DESKPERF.DL_
.cab
I386/DESKTOP.IN_
.cab
I386/DEVENUM.DL_
.cab
I386/DEVMGMT.MS_
.cab
I386/DEVMGR.DL_
.cab
I386/DG18D50.IC_
.cab
I386/DG18D65.IC_
.cab
I386/DG18D93.IC_
.cab
I386/DG22D50.IC_
.cab
I386/DG22D65.IC_
.cab
I386/DG22D93.IC_
.cab
I386/DHCPCSVC.DL_
.cab
I386/DIGEST.DL_
.cab
I386/DISK.IN_
.cab
I386/DISK.SY_
.cab
I386/DISK1
I386/DISKDUMP.SY_
.cab
I386/DISKPERF.SY_
.cab
I386/DISPLAY.IN_
.cab
I386/DLC.SY_
.cab
I386/DLCAPI.DL_
.cab
I386/DLLHST3G.EX_
.cab
I386/DMOCX.DL_
.cab
I386/DNSAPI.DL_
.cab
I386/DNSMGMT.MS_
.cab
I386/DOCPROP.DL_
.cab
I386/DOCPROP2.DL_
.cab
I386/DOS869.FO_
.cab
I386/DOSAPP.FO_
.cab
I386/DOSNET.INF
I386/DRIVER.CAB
.cab
I386/DRVINDEX.INF
I386/DSCTL.DL_
.cab
I386/DSFOLDER.DL_
.cab
I386/DSHOWEXT.IN_
.cab
I386/DSSBASE.DLL
.dll regsvr32 windows:5 windows x86 arch:x86

98e35e16b753386463b746ee6beee217

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

RtlUnwind
HeapFree
GetDiskFreeSpaceA
GlobalMemoryStatus
QueryPerformanceCounter
GetLocalTime
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetComputerNameA
GetProcAddress
DeviceIoControl
GetModuleHandleW
Sleep
lstrcpyA
IsBadWritePtr
SetFileAttributesW
CreateDirectoryW
GetCurrentProcess
GetCurrentThread
GetSystemDirectoryW
LoadLibraryW
CreateFileW
FindFirstFileExW
WriteFile
DeleteFileW
MoveFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
WideCharToMultiByte
FindNextFileW
LoadLibraryExA
LocalReAlloc
_lclose
SetFilePointer
OpenFile
RtlMoveMemory
GetSystemDirectoryA
lstrlenA
lstrcatA
CreateFileA
GetFileSize
CloseHandle
VirtualAlloc
ReadFile
VirtualFree
FindResourceA
LoadResource
SizeofResource
FreeLibrary
lstrcmpA
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
lstrlenW
EnterCriticalSection
GetLastError
LeaveCriticalSection
RaiseException
FindClose
SetLastError
InitializeCriticalSection
DeleteCriticalSection
LocalFree
LocalAlloc
GetProcessHeap
HeapAlloc
MultiByteToWideChar

user32

wsprintfA
wsprintfW
LoadStringA
LoadStringW
MessageBoxA

ole32

CoTaskMemFree

advapi32

GetSecurityDescriptorSacl
GetAclInformation
GetAce
ImpersonateSelf
AdjustTokenPrivileges
RegQueryInfoKeyA
RegEnumKeyA
RegDeleteKeyW
RegOpenKeyExW
LookupPrivilegeValueA
PrivilegeCheck
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenThreadToken
RevertToSelf
OpenProcessToken
SetThreadToken
GetTokenInformation
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
FreeSid
GetSecurityDescriptorDacl
MakeSelfRelativeSD
RegOpenKeyExA
RegGetKeySecurity
RegQueryValueExA
RegCloseKey
RegDeleteValueA
GetUserNameA
GetFileSecurityW
SetFileSecurityW
GetSecurityDescriptorControl
RegCreateKeyExA
RegSetValueExA
GetSecurityDescriptorLength

crypt32

CryptEncodeObjectEx
CryptProtectData
CryptUnprotectData

userenv

GetProfileType

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/DSSEC.DL_
.cab
I386/DSUIEXT.DL_
.cab
I386/DSUP.IN_
.cab
I386/DSUPT.IN_
.cab
I386/DTCSETUP.CA_
.cab
I386/DX3.CA_
.cab
I386/DXAPI.SY_
.cab
I386/ECLANDD.IN_
.cab
I386/ECWANDD.IN_
.cab
I386/EFS.SY_
.cab
I386/EGA.CP_
.cab
I386/EGA40850.FO_
.cab
I386/EGA40WOA.FO_
.cab
I386/EGA80850.FO_
.cab
I386/EGA80WOA.FO_
.cab
I386/EICONA.CA_
.cab
I386/EICONP.CA_
.cab
I386/EICVIRTA.IN_
.cab
I386/ELS.DL_
.cab
I386/ENCINST.EX_
.cab
I386/ENCINST.IN_
.cab
I386/ESENT.DL_
.cab
I386/EULA.TXT
I386/EVENTLOG.DL_
.cab
I386/EVENTVWR.EX_
.cab
I386/EVENTVWR.MS_
.cab
I386/EXPAND.EXE
.exe windows:5 windows x86 arch:x86

cc7deb629b8ef60be772cd3f2c2c4b20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

_initterm
__p___initenv
exit
_XcptFilter
_exit
toupper
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
printf
__getmainargs

kernel32

_lread
_llseek
_lopen
GlobalAlloc
GlobalFree
GetFileTime
CreateFileA
lstrcpynA
IsDBCSLeadByte
SetThreadLocale
GetSystemDefaultLangID
GetConsoleOutputCP
GetThreadLocale
lstrcpyA
lstrcmpiA
GetFullPathNameA
_lcreat
CloseHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
lstrcatA
_lclose
LocalAlloc
LocalFree
GetFileAttributesA
GetFileSize
GetLastError
_lwrite
DeleteFileA
lstrcmpA
lstrlenA

user32

CharNextA
CharLowerA
LoadStringA
CharToOemA
CharPrevA
IsCharUpperA
IsCharLowerA

cabinet

ord23
ord20
ord21
ord22

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
I386/EXPLORER.EX_
.cab
I386/EXPLORER.SC_
.cab
I386/EXTRAC32.EX_
.cab
I386/FASTFAT.SY_
.cab
I386/FDE.DL_
.cab
I386/FDEPLOY.DL_
.cab
I386/FILELIST.DA_
.cab
I386/FILEMGMT.DL_
.cab
I386/FLPYDISK.SY_
.cab
I386/FMIFS.DL_
.cab
I386/FONT.IN_
.cab
I386/FONTEXT.DL_
.cab
I386/FONTSUB.DL_
.cab
I386/FONTVIEW.EX_
.cab
I386/FRAMEBUF.DL_
.cab
I386/FRAMEDYN.DL_
.cab
I386/FS2.DE_
.cab
I386/FSCONINS.DL_
.cab
I386/FSMGMT.MS_
.cab
I386/FSVGA.IN_
.cab
I386/FSVGAADD.IN_
.cab
I386/FSVGADEL.IN_
.cab
I386/FS_REC.SY_
.cab
I386/FTDISK.SY_
.cab
I386/G723CODC.AX_
.cab
I386/GDI32.DL_
.cab
I386/GEND9318.IC_
.cab
I386/GEND9322.IC_
.cab
I386/GENERAL.ID_
.cab
I386/GETSTART.GI_
.cab
I386/GPKCSP.DL_
.cab
I386/GRAPHICS.PR_
.cab
I386/GRPCONV.EX_
.cab
I386/H261_32.AX_
.cab
I386/H263_32.AX_
.cab
I386/HAL.DL_
.cab
I386/HAL.IN_
.cab
I386/HALAACPI.DL_
.cab
I386/HALACPI.DL_
.cab
I386/HALAPIC.DL_
.cab
I386/HALBORG.DLL
.dll windows:5 windows x86 arch:x86

94307cd79ee94621139538b22deb8e15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoDeleteDevice
KeUpdateRunTime
Kei386EoiHelper
DbgPrint
DbgBreakPoint
KeBugCheck
KiIpiServiceRoutine
KiDeliverApc
KiDispatchInterrupt
KeProfileInterrupt
KeBugCheckEx
KeSetEventBoostPriority
KeWaitForSingleObject
KeFindConfigurationEntry
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
KeSetTimeIncrement
_aulldiv
KeRegisterBugCheckCallback
KeSetProfileIrql
HalDispatchTable
KeInitializeSpinLock
strncpy
strncmp
strstr
RtlZeroMemory
ExAllocatePoolWithTag
InbvAcquireDisplayOwnership
RtlMoveMemory
MmMapLockedPages
MmGetPhysicalAddress
MmAllocateContiguousMemorySpecifyCache
MmFreeContiguousMemory
ExFreePool
InterlockedDecrement
InterlockedIncrement
_allmul
RtlFindClearBitsAndSet
KeRemoveDeviceQueue
RtlClearBits
ObfDereferenceObject
IoAllocateAdapterChannel
MmUnlockPagableImageSection
MmLockPagableDataSection
MmMapIoSpace
RtlSetAllBits
RtlInitializeBitMap
KeInitializeDeviceQueue
ZwClose
ObInsertObject
ObReferenceObjectByPointer
ObCreateObject
IoAdapterObjectType
IoCreateDriver
RtlInitUnicodeString
IoReportDetectedDevice
_snwprintf
KeUpdateSystemTime
IoAttachDeviceToDeviceStack
IoCreateDevice
IofCallDriver
IofCompleteRequest
PoStartNextPowerIrp
ObfReferenceObject
RtlIntegerToUnicodeString
RtlCompareMemory
ZwEnumerateValueKey
ZwQueryKey
ZwEnumerateKey
ZwSetValueKey
ZwOpenKey
ZwCreateKey
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
KeInitializeEvent
ExAllocatePool
sprintf
ZwQueryValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ExQueueWorkItem
KeInsertDeviceQueue
KeSetEvent
RtlSetBits
_allshr
IoAssignResources
KiAcquireSpinLock
KiReleaseSpinLock
IoReportHalResourceUsage
_allshl
InbvDisplayString
vsprintf
RtlFreeUnicodeString
MmUnmapIoSpace
KeInsertQueueDpc
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
_stricmp
RtlAnsiStringToUnicodeSize
RtlInitString
swprintf
_allrem
RtlFillMemory
WRITE_REGISTER_ULONG
READ_REGISTER_UCHAR
ZwPowerInformation
MmIsAddressValid
toupper
HalPrivateDispatchTable

Exports

Exports

ExAcquireFastMutex
ExReleaseFastMutex
ExTryToAcquireFastMutex
HalAcquireDisplayOwnership
HalAdjustResourceList
HalAllProcessorsStarted
HalAllocateAdapterChannel
HalAllocateCommonBuffer
HalAllocateCrashDumpRegisters
HalAssignSlotResources
HalBeginSystemInterrupt
HalCalibratePerformanceCounter
HalClearSoftwareInterrupt
HalDisableSystemInterrupt
HalDisplayString
HalEnableSystemInterrupt
HalEndSystemInterrupt
HalFlushCommonBuffer
HalFreeCommonBuffer
HalGetAdapter
HalGetBusData
HalGetBusDataByOffset
HalGetEnvironmentVariable
HalGetInterruptVector
HalHandleNMI
HalInitSystem
HalInitializeProcessor
HalMakeBeep
HalProcessorIdle
HalQueryDisplayParameters
HalQueryRealTimeClock
HalReadDmaCounter
HalReportResourceUsage
HalRequestIpi
HalRequestSoftwareInterrupt
HalReturnToFirmware
HalSetBusData
HalSetBusDataByOffset
HalSetDisplayParameters
HalSetEnvironmentVariable
HalSetProfileInterval
HalSetRealTimeClock
HalSetTimeIncrement
HalStartNextProcessor
HalStartProfileInterrupt
HalStopProfileInterrupt
HalSystemVectorDispatchEntry
HalTranslateBusAddress
HalxFlushMdl
HalxFlushPhysicalBuffer
HalxFlushVirtualBuffer
IoAssignDriveLetters
IoFlushAdapterBuffers
IoFreeAdapterChannel
IoFreeMapRegisters
IoMapTransfer
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
KdComPortInUse
KdPortGetByte
KdPortInitialize
KdPortPollByte
KdPortPutByte
KdPortRestore
KdPortSave
KeAcquireQueuedSpinLock
KeAcquireQueuedSpinLockRaiseToSynch
KeAcquireSpinLock
KeAcquireSpinLockRaiseToSynch
KeFlushWriteBuffer
KeGetCurrentIrql
KeLowerIrql
KeQueryPerformanceCounter
KeRaiseIrql
KeRaiseIrqlToDpcLevel
KeRaiseIrqlToSynchLevel
KeReleaseQueuedSpinLock
KeReleaseSpinLock
KeStallExecutionProcessor
KeTryToAcquireQueuedSpinLock
KeTryToAcquireQueuedSpinLockRaiseToSynch
KfAcquireSpinLock
KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock
READ_PORT_BUFFER_UCHAR
READ_PORT_BUFFER_ULONG
READ_PORT_BUFFER_USHORT
READ_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
WRITE_PORT_BUFFER_UCHAR
WRITE_PORT_BUFFER_ULONG
WRITE_PORT_BUFFER_USHORT
WRITE_PORT_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_USHORT

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_INIT16
Size: 96B - Virtual size: 69B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGELK
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 960B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/HANDLER.SR_
.cab
I386/HARDWARE.IN_
.cab
I386/HDWWIZ.CP_
.cab
I386/HG18D50.IC_
.cab
I386/HG18D65.IC_
.cab
I386/HG18D93.IC_
.cab
I386/HG22D50.IC_
.cab
I386/HG22D65.IC_
.cab
I386/HG22D93.IC_
.cab
I386/HHSETUP.DL_
.cab
I386/HIDCLASS.SY_
.cab
I386/HIDPARSE.SY_
.cab
I386/HIDSERV.IN_
.cab
I386/HIDUSB.SY_
.cab
I386/HINDERED.ID_
.cab
I386/HIVECLS.INF
I386/HIVEDEF.INF
I386/HIVESFT.INF
I386/HIVESYS.INF
I386/HIVEUSD.INF
I386/HLINK.DL_
.cab
I386/HOSTNAME.EX_
.cab
I386/HOSTS
I386/HOTPLUG.DL_
.cab
I386/HP1600MP.IC_
.cab
I386/HPCRDP.CA_
.cab
I386/HPMON.DLL
.dll windows:5 windows x86 arch:x86

0fa97ed3942c7c626bd69f5a12f79902

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt

strcspn
wcscpy
_snwprintf
_wcsicmp
wcslen
strncmp

dlcapi

AcsLan

kernel32

Sleep
InitializeCriticalSection
lstrcatW
lstrlenW
HeapCreate
GetTickCount
ResetEvent
WaitForSingleObject
WritePrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
lstrcpyW
HeapDestroy
OutputDebugStringW
ExitThread
WaitForMultipleObjects
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
lstrcpynA
CloseHandle
DeleteCriticalSection
SetEvent
CreateThread
GetLastError
lstrcpynW
lstrcmpW
HeapAlloc
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
SetLastError
lstrcmpiW
HeapFree

user32

wsprintfA
GetClientRect
PtInRect
SetCapture
GetFocus
CharUpperBuffW
IsCharAlphaW
IsCharAlphaNumericW
GetWindowPlacement
DefWindowProcW
GetWindowTextLengthW
GetSysColor
BeginPaint
RegisterClassW
LoadCursorW
CharNextW
KillTimer
SetTimer
IsDlgButtonChecked
GetDlgItemInt
DestroyWindow
SetFocus
EndDialog
SendDlgItemMessageW
CreateWindowExW
WinHelpW
UnregisterClassW
GetDlgItem
SetWindowTextW
GetParent
GetWindowTextW
ReleaseCapture
UpdateWindow
InvalidateRect
EndPaint
EnableWindow
PostMessageW
MessageBeep
LoadStringW
DialogBoxParamW
MessageBoxW
wsprintfW
GetWindowLongW
SetDlgItemInt
SendMessageW
SetWindowLongW

spoolss

SetJobW
ClosePrinter
RevertToPrinterSelf
ImpersonatePrinterClient
OpenPrinterW
GetJobW

advapi32

RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegCreateKeyW
RegSetValueExW
DeregisterEventSource
RegQueryValueExW
RegisterEventSourceW
RegCloseKey
ReportEventW

gdi32

CreateSolidBrush
GetStockObject
CreatePen
DeleteObject
Polygon
SetPixel
LineTo
MoveToEx
Rectangle
SelectObject

Exports

Exports

AddPortW
ClosePort
ConfigurePortW
DeletePortW
EndDocPort
EnumPortsW
InitializeMonitor
LibMain
OpenPort
ReadPort
StartDocPort
WritePort

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/HTUI.DL_
.cab
I386/HWCOMP.DAT
I386/I8042PRT.SY_
.cab
I386/IAS.MS_
.cab
I386/IASPERF.H_
.cab
I386/IASPERF.IN_
.cab
I386/IBMSYNC.IN_
.cab
I386/ICCVID.DL_
.cab
I386/ICMINST.IN_
.cab
I386/ICMP.DL_
.cab
I386/IERNONCE.DL_
.cab
I386/IESHWIZ.EX_
.cab
I386/IFSUTIL.DL_
.cab
I386/IGMPAGNT.DL_
.cab
I386/IISDBG.IN_
.cab
I386/IMAGEHLP.DLL
.dll windows:5 windows x86 arch:x86

06f7390f61d8d66a488d08b35a7c7caa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
__dllonexit
_adjust_fdiv
malloc
_initterm
strncmp
strrchr
_makepath
_splitpath
_ultoa
memmove
atoi
_stricmp
_except_handler3
strchr
_mbsnbcpy
sprintf
time
fflush
_iob
_purecall
_fullpath
_close
_read
_sopen
_memicmp
_open_osfhandle
_lseek
_errno
_write
_chsize
qsort
_mbsicmp
_mbsrchr
printf
_access
_strnicmp
bsearch
_mbscmp
strncpy
free

kernel32

lstrcatA
GetModuleFileNameA
VirtualFree
GetVersion
VirtualAlloc
lstrlenA
CloseHandle
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
CopyFileA
SetFileAttributesA
WriteFile
DeleteFileA
SetFilePointer
SetEndOfFile
SearchPathA
HeapDestroy
HeapCreate
DisableThreadLibraryCalls
GetVersionExA
HeapAlloc
HeapFree
SetLastError
WideCharToMultiByte
IsDBCSLeadByte
GetProcAddress
GetModuleHandleA
LoadLibraryA
MapViewOfFileEx
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingA
GetFileSize
SetFileTime
SystemTimeToFileTime
GetSystemTime
GetLastError
MapViewOfFile
CreateFileA
lstrcmpiA
lstrcpyA

Exports

Exports

BindImage
BindImageEx
CheckSumMappedFile
EnumerateLoadedModules
EnumerateLoadedModules64
FindDebugInfoFile
FindDebugInfoFileEx
FindExecutableImage
FindExecutableImageEx
FindFileInSearchPath
GetImageConfigInformation
GetImageUnusedHeaderBytes
GetTimestampForLoadedLibrary
ImageAddCertificate
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageEnumerateCertificates
ImageGetCertificateData
ImageGetCertificateHeader
ImageGetDigestStream
ImageLoad
ImageNtHeader
ImageRemoveCertificate
ImageRvaToSection
ImageRvaToVa
ImageUnload
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapAndLoad
MapDebugInformation
MapFileAndCheckSumA
MapFileAndCheckSumW
ReBaseImage
ReBaseImage64
RemovePrivateCvSymbolic
RemovePrivateCvSymbolicEx
RemoveRelocations
SearchTreeForFile
SetImageConfigInformation
SplitSymbols
StackWalk
StackWalk64
SymCleanup
SymEnumerateModules
SymEnumerateModules64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromName
SymGetLineFromName64
SymGetLineNext
SymGetLineNext64
SymGetLinePrev
SymGetLinePrev64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoEx
SymGetModuleInfoEx64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOptions
SymGetSearchPath
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolInfo
SymGetSymbolInfo64
SymInitialize
SymLoadModule
SymLoadModule64
SymMatchFileName
SymRegisterCallback
SymRegisterCallback64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSetOptions
SymSetSearchPath
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
TouchFileTimes
UnDecorateSymbolName
UnMapAndLoad
UnmapDebugInformation
UpdateDebugInfoFile
UpdateDebugInfoFileEx

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/IMM32.DL_
.cab
I386/INDICDLL.DL_
.cab
I386/INETMIB1.DL_
.cab
I386/INITPKI.DL_
.cab
I386/INPUT.IN_
.cab
I386/INSTDSS5.DL_
.cab
I386/INSTIPS5.DL_
.cab
I386/INSTLSA5.DL_
.cab
I386/INSTNDI5.DL_
.cab
I386/INSTRSA5.DL_
.cab
I386/INSTSCH5.DL_
.cab
I386/INTERNAT.EX_
.cab
I386/INTL.CP_
.cab
I386/INTL.INF
I386/IOLOGMSG.DL_
.cab
I386/IPFLTDRV.SY_
.cab
I386/IPHLPAPI.DL_
.cab
I386/IPINFO.INF
.vbs
I386/IPNAT.SY_
.cab
I386/IPNATHLP.DL_
.cab
I386/IPROP.DL_
.cab
I386/IPRTPRIO.DL_
.cab
I386/IPRTRMGR.DL_
.cab
I386/IPSEC.SY_
.cab
I386/IPSECMON.EX_
.cab
I386/IPSECSNP.DL_
.cab
I386/IRCLASS.DL_
.cab
I386/IRFTP.EX_
.cab
I386/IRMON.DL_
.cab
I386/IRPROPS.CP_
.cab
I386/IS11.DL_
.cab
I386/IS11M2.DL_
.cab
I386/IS50.DE_
.cab
I386/IS60.DE_
.cab
I386/ISAPNP.SY_
.cab
I386/JSCRIPT.DL_
.cab
I386/KBDCLASS.SY_
.cab
I386/KBDHID.SY_
.cab
I386/KBDNEC.DL_
.cab
I386/KBDUS.DLL
.dll windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/KERNEL32.DL_
.cab
I386/KEYBOARD.IN_
.cab
I386/KS.IN_
.cab
I386/KSECDD.SY_
.cab
I386/KSFILTER.IN_
.cab
I386/KSOLAY.AX_
.cab
I386/KSQMF.AX_
.cab
I386/LABEL.EX_
.cab
I386/LADMIN2X.DL_
.cab
I386/LADMINPX.DL_
.cab
I386/LADMINX.DL_
.cab
I386/LAYOUT.INF
I386/LEGACY.IN_
.cab
I386/LEGCYDRV.IN_
.cab
I386/LGMNTR.EX_
.cab
I386/LGSTITCH.DL_
.cab
I386/LIGHTS.EX_
.cab
I386/LINKINFO.DL_
.cab
I386/LOADPERF.DL_
.cab
I386/LOCALE.NL_
.cab
I386/LOCALMON.DL_
.cab
I386/LOCALSEC.DL_
.cab
I386/LOCWIN32.DL_
.cab
I386/LODCTR.EX_
.cab
I386/LOGHOURS.DL_
.cab
I386/LPK.DL_
.cab
I386/LSASRV.DL_
.cab
I386/LSASS.EX_
.cab
I386/LUCON.TT_
.cab
I386/LVCOMP.IN_
.cab
I386/LVSOUND.IN_
.cab
I386/LZ32.DL_
.cab
I386/L_10646.TT_
.cab
I386/L_EXCEPT.NL_
.cab
I386/L_INTL.NL_
.cab
I386/MACHINE.IN_
.cab
I386/MAIN.CP_
.cab
I386/MAKECAB.EX_
.cab
I386/MARLETT.TT_
.cab
I386/MCAST.DL_
.cab
I386/MCIAVI32.DL_
.cab
I386/MCICDA.DL_
.cab
I386/MCIOLE32.DL_
.cab
I386/MCIWAVE.DL_
.cab
I386/MDHCP.DL_
.cab
I386/MDMINST.DL_
.cab
I386/MDMSETUP.IN_
.cab
I386/MF.IN_
.cab
I386/MF3216.DL_
.cab
I386/MFC40.DL_
.cab
I386/MFC40U.DL_
.cab
I386/MFC42.DL_
.cab
I386/MFC42U.DL_
.cab
I386/MFS12CZ.DE_
.cab
I386/MFS12CZ.DL_
.cab
I386/MGMTAPI.DL_
.cab
I386/MGSYNC.IN_
.cab
I386/MGWAN5.IN_
.cab
I386/MICROSS.TT_
.cab
I386/MIDIMAP.CF_
.cab
I386/MIDIMAP.DL_
.cab
I386/MINIOC.IN_
.cab
I386/MLANG.DA_
.cab
I386/MLANG.DL_
.cab
I386/MMC.EX_
.cab
I386/MMCNDMGR.DL_
.cab
I386/MMCSHEXT.DL_
.cab
I386/MMDET.DL_
.cab
I386/MMDRIVER.IN_
.cab
I386/MMDRV.DL_
.cab
I386/MMFUTIL.DL_
.cab
I386/MMSYS.CP_
.cab
I386/MNB22G15.IC_
.cab
I386/MNB22G18.IC_
.cab
I386/MNB22G21.IC_
.cab
I386/MNEBUG15.IC_
.cab
I386/MNEBUG18.IC_
.cab
I386/MNEBUG21.IC_
.cab
I386/MNP22G15.IC_
.cab
I386/MNP22G18.IC_
.cab
I386/MNP22G21.IC_
.cab
I386/MODEM.SY_
.cab
I386/MODEMCSA.IN_
.cab
I386/MODEMUI.DL_
.cab
I386/MODERN.FO_
.cab
I386/MODEX.DL_
.cab
I386/MONITOR.IN_
.cab
I386/MONITOR2.IN_
.cab
I386/MONITOR3.IN_
.cab
I386/MONITOR4.IN_
.cab
I386/MONITOR5.IN_
.cab
I386/MONITOR6.IN_
.cab
I386/MONITOR7.IN_
.cab
I386/MONITOR8.IN_
.cab
I386/MONITOR9.IN_
.cab
I386/MORICONS.DL_
.cab
I386/MOUNTMGR.SY_
.cab
I386/MPCODECS.IN_
.cab
I386/MPNOTIFY.EX_
.cab
I386/MPR.DL_
.cab
I386/MPRAPI.DL_
.cab
I386/MPRMSG.DL_
.cab
I386/MPRUI.DL_
.cab
I386/MQEXCHNG.CA_
.cab
I386/MRINFO.EX_
.cab
I386/MRXSMB.SY_
.cab
I386/MSACM32.DL_
.cab
I386/MSACM32.DR_
.cab
I386/MSADLIB.ID_
.cab
I386/MSADO15.DL_
.cab
I386/MSAFD.DL_
.cab
I386/MSAPSSPC.DL_
.cab
I386/MSASN1.DL_
.cab
I386/MSCLUS.DL_
.cab
I386/MSCMS.DL_
.cab
I386/MSDART32.DL_
.cab
I386/MSF12CZ.DE_
.cab
I386/MSF12CZ.DL_
.cab
I386/MSFAXMON.DL_
.cab
I386/MSFS.SY_
.cab
I386/MSGINA.DL_
.cab
I386/MSGPC.SY_
.cab
I386/MSHDC.IN_
.cab
I386/MSHTA.EX_
.cab
I386/MSI.DL_
.cab
I386/MSIDENT.DL_
.cab
I386/MSIDLE.DL_
.cab
I386/MSIDLPM.DL_
.cab
I386/MSIDNTLD.DL_
.cab
I386/MSIDPE.DL_
.cab
I386/MSIEXEC.EX_
.cab
I386/MSIHND.DL_
.cab
I386/MSIMG32.DL_
.cab
I386/MSIMSG.DL_
.cab
I386/MSJDBC.CA_
.cab
I386/MSLS31.DL_
.cab
I386/MSMOUSE.IN_
.cab
I386/MSPATCHA.DL_
.cab
I386/MSPORTS.DL_
.cab
I386/MSPRIVS.DL_
.cab
I386/MSRLE32.DL_
.cab
I386/MSSIGN32.DL_
.cab
I386/MSSIP32.DL_
.cab
I386/MSTTS.IN_
.cab
I386/MSTTSSYN.DL_
.cab
I386/MSV1_0.DL_
.cab
I386/MSVCIRT.DL_
.cab
I386/MSVCP50.DLL
.dll windows:4 windows x86 arch:x86

a187c729f52583f8ca9573c6f109607e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

__CxxFrameHandler
_Gettnames
_Getdays
_Getmonths
__p___mb_cur_max
sprintf
strcspn
strtoul
_errno
strtol
isdigit
_Strftime
ldexp
_CIpow
fclose
fwrite
fputc
fgetc
ungetc
fgetpos
fseek
fsetpos
setvbuf
fflush
fputwc
ungetwc
fgetwc
free
localeconv
setlocale
malloc
realloc
__crtCompareStringA
wcstol
_unlock
__crtGetLocaleInfoW
_lock
__setlc_active
__unguarded_readlc_active
__lc_handle
__lc_codepage
__crtLCMapStringA
towlower
towupper
_isctype
__p__pctype
strtod
_ftol
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
??2@YAPAXI@Z
memmove
memchr
wcslen
??4exception@@QAEAAV0@ABV0@@Z
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
fopen
__p__iob

kernel32

DisableThreadLibraryCalls
MultiByteToWideChar
LeaveCriticalSection
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
Sleep
EnterCriticalSection
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement

Exports

Exports

??0?$_Complex_base@M@std@@QAE@ABM0@Z
??0?$_Complex_base@N@std@@QAE@ABN0@Z
??0?$_Complex_base@O@std@@QAE@ABO0@Z
??0?$_Mpunct@D@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$_Mpunct@D@std@@QAE@I_N@Z
??0?$_Mpunct@G@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$_Mpunct@G@std@@QAE@I_N@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG0ABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$codecvt@DDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@DDH@std@@QAE@I@Z
??0?$codecvt@GDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@GDH@std@@QAE@I@Z
??0?$collate@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$collate@D@std@@QAE@I@Z
??0?$collate@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$collate@G@std@@QAE@I@Z
??0?$complex@M@std@@QAE@ABM0@Z
??0?$complex@M@std@@QAE@ABV?$complex@N@1@@Z
??0?$complex@M@std@@QAE@ABV?$complex@O@1@@Z
??0?$complex@N@std@@QAE@ABN0@Z
??0?$complex@N@std@@QAE@ABV?$complex@M@1@@Z
??0?$complex@N@std@@QAE@ABV?$complex@O@1@@Z
??0?$complex@O@std@@QAE@ABO0@Z
??0?$complex@O@std@@QAE@ABV?$complex@M@1@@Z
??0?$complex@O@std@@QAE@ABV?$complex@N@1@@Z
??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$ctype@D@std@@QAE@PBF_NI@Z
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$ctype@G@std@@QAE@I@Z
??0?$messages@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$messages@D@std@@QAE@I@Z
??0?$messages@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$messages@G@std@@QAE@I@Z
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$moneypunct@D$00@std@@QAE@ABV_Locinfo@1@I@Z
??0?$moneypunct@D$00@std@@QAE@I@Z
??0?$moneypunct@D$0A@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$moneypunct@D$0A@@std@@QAE@I@Z
??0?$moneypunct@G$00@std@@QAE@ABV_Locinfo@1@I@Z
??0?$moneypunct@G$00@std@@QAE@I@Z
??0?$moneypunct@G$0A@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$moneypunct@G$0A@@std@@QAE@I@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$numpunct@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$numpunct@D@std@@QAE@I@Z
??0?$numpunct@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$numpunct@G@std@@QAE@I@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0Init@ios_base@std@@QAE@XZ
??0_Locinfo@std@@QAE@ABV01@@Z
??0_Locinfo@std@@QAE@HPBD@Z
??0_Locinfo@std@@QAE@PBD@Z
??0_Lockit@std@@QAE@XZ
??0_Timevec@std@@QAE@ABV01@@Z
??0_Timevec@std@@QAE@PAX@Z
??0_Winit@std@@QAE@XZ
??0bad_alloc@std@@QAE@ABV01@@Z
??0bad_alloc@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_exception@std@@QAE@ABV01@@Z
??0bad_exception@std@@QAE@PBD@Z
??0codecvt_base@std@@QAE@I@Z
??0ctype_base@std@@QAE@I@Z
??0domain_error@std@@QAE@ABV01@@Z
??0domain_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0facet@locale@std@@IAE@I@Z
??0ios_base@std@@IAE@XZ
??0ios_base@std@@QAE@ABV01@@Z
??0length_error@std@@QAE@ABV01@@Z
??0length_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0locale@std@@AAE@PAV_Locimp@01@@Z
??0locale@std@@QAE@ABV01@0H@Z
??0locale@std@@QAE@ABV01@@Z
??0locale@std@@QAE@ABV01@PBDH@Z
??0locale@std@@QAE@PBDH@Z
??0locale@std@@QAE@W4_Uninitialized@1@@Z
??0locale@std@@QAE@XZ
??0logic_error@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0messages_base@std@@QAE@I@Z
??0money_base@std@@QAE@I@Z
??0ostrstream@std@@QAE@PADHH@Z
??0out_of_range@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0overflow_error@std@@QAE@ABV01@@Z
??0overflow_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0range_error@std@@QAE@ABV01@@Z
??0range_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0runtime_error@std@@QAE@ABV01@@Z
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0strstream@std@@QAE@PADHH@Z
??0time_base@std@@QAE@I@Z
??0underflow_error@std@@QAE@ABV01@@Z
??0underflow_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??1?$_Mpunct@D@std@@UAE@XZ
??1?$_Mpunct@G@std@@UAE@XZ
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_filebuf@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_fstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_fstream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ifstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ifstream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$basic_ofstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ofstream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$codecvt@DDH@std@@UAE@XZ
??1?$codecvt@GDH@std@@UAE@XZ
??1?$collate@D@std@@UAE@XZ
??1?$collate@G@std@@UAE@XZ
??1?$ctype@D@std@@UAE@XZ
??1?$ctype@G@std@@UAE@XZ
??1?$messages@D@std@@UAE@XZ
??1?$messages@G@std@@UAE@XZ
??1?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??1?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??1?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??1?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??1?$moneypunct@D$00@std@@UAE@XZ
??1?$moneypunct@D$0A@@std@@UAE@XZ
??1?$moneypunct@G$00@std@@UAE@XZ
??1?$moneypunct@G$0A@@std@@UAE@XZ
??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??1?$numpunct@D@std@@UAE@XZ
??1?$numpunct@G@std@@UAE@XZ
??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??1Init@ios_base@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1_Timevec@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1bad_alloc@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_exception@std@@UAE@XZ
??1codecvt_base@std@@UAE@XZ
??1ctype_base@std@@UAE@XZ
??1domain_error@std@@UAE@XZ
??1facet@locale@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
??1istrstream@std@@UAE@XZ
??1length_error@std@@UAE@XZ
??1locale@std@@QAE@XZ
??1logic_error@std@@UAE@XZ
??1messages_base@std@@UAE@XZ
??1money_base@std@@UAE@XZ
??1ostrstream@std@@UAE@XZ
??1out_of_range@std@@UAE@XZ
??1overflow_error@std@@UAE@XZ
??1range_error@std@@UAE@XZ
??1runtime_error@std@@UAE@XZ
??1strstream@std@@UAE@XZ
??1strstreambuf@std@@UAE@XZ
??1time_base@std@@UAE@XZ
??1underflow_error@std@@UAE@XZ
??4?$_Complex_base@M@std@@QAEAAV01@ABV01@@Z
??4?$_Complex_base@N@std@@QAEAAV01@ABV01@@Z
??4?$_Complex_base@O@std@@QAEAAV01@ABV01@@Z
??4?$_Ctr@M@std@@QAEAAV01@ABV01@@Z
??4?$_Ctr@N@std@@QAEAAV01@ABV01@@Z
??4?$_Ctr@O@std@@QAEAAV01@ABV01@@Z
??4?$allocator@X@std@@QAEAAV01@ABV01@@Z
??4?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_ios@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_iostream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??4?$char_traits@D@std@@QAEAAU01@ABU01@@Z
??4?$char_traits@G@std@@QAEAAU01@ABU01@@Z
??4?$complex@M@std@@QAEAAV01@ABM@Z
??4?$complex@M@std@@QAEAAV01@ABV01@@Z
??4?$complex@N@std@@QAEAAV01@ABN@Z
??4?$complex@N@std@@QAEAAV01@ABV01@@Z
??4?$complex@O@std@@QAEAAV01@ABO@Z
??4?$complex@O@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@C@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@D@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@E@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@F@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@G@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@H@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@I@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@J@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@K@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@M@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@N@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@O@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@_N@std@@QAEAAV01@ABV01@@Z
??4Init@ios_base@std@@QAEAAV012@ABV012@@Z
??4_Locinfo@std@@QAEAAV01@ABV01@@Z
??4_Lockit@std@@QAEAAV01@ABV01@@Z
??4_Num_base@std@@QAEAAU01@ABU01@@Z
??4_Num_float_base@std@@QAEAAU01@ABU01@@Z
??4_Num_int_base@std@@QAEAAU01@ABU01@@Z
??4_Timevec@std@@QAEAAV01@ABV01@@Z
??4_Winit@std@@QAEAAV01@ABV01@@Z
??4bad_alloc@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_exception@std@@QAEAAV01@ABV01@@Z
??4domain_error@std@@QAEAAV01@ABV01@@Z
??4id@locale@std@@QAEAAV012@ABV012@@Z
??4ios_base@std@@QAEAAV01@ABV01@@Z
??4length_error@std@@QAEAAV01@ABV01@@Z
??4locale@std@@QAEAAV01@ABV01@@Z
??4logic_error@std@@QAEAAV01@ABV01@@Z
??4out_of_range@std@@QAEAAV01@ABV01@@Z
??4overflow_error@std@@QAEAAV01@ABV01@@Z
??4range_error@std@@QAEAAV01@ABV01@@Z
??4runtime_error@std@@QAEAAV01@ABV01@@Z
??4underflow_error@std@@QAEAAV01@ABV01@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAO@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAJ@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAM@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAN@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAO@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAPAX@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAC@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAD@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAE@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@M@0@@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@N@0@@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@O@0@@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAC@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAD@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAE@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAG@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@M@0@@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@N@0@@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@O@0@@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAF@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@O@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@M@0@@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@N@0@@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@O@0@@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@C@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@E@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBC@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBE@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@M@0@@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@N@0@@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@O@0@@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@G@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBF@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z
??7ios_base@std@@QBE_NXZ
??8locale@std@@QBE_NABV01@@Z
??8std@@YA_NABMABV?$complex@M@0@@Z
??8std@@YA_NABNABV?$complex@N@0@@Z
??8std@@YA_NABOABV?$complex@O@0@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??8std@@YA_NABV?$complex@M@0@0@Z
??8std@@YA_NABV?$complex@M@0@ABM@Z
??8std@@YA_NABV?$complex@N@0@0@Z
??8std@@YA_NABV?$complex@N@0@ABN@Z
??8std@@YA_NABV?$complex@O@0@0@Z
??8std@@YA_NABV?$complex@O@0@ABO@Z
??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??9locale@std@@QBE_NABV01@@Z
??9std@@YA_NABMABV?$complex@M@0@@Z
??9std@@YA_NABNABV?$complex@N@0@@Z
??9std@@YA_NABOABV?$complex@O@0@@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??9std@@YA_NABV?$complex@M@0@0@Z
??9std@@YA_NABV?$complex@M@0@ABM@Z
??9std@@YA_NABV?$complex@N@0@0@Z
??9std@@YA_NABV?$complex@N@0@ABN@Z
??9std@@YA_NABV?$complex@O@0@0@Z
??9std@@YA_NABV?$complex@O@0@ABO@Z
??9std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??9std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
??Bid@locale@std@@QAEIXZ
??Bios_base@std@@QBEPAXXZ
??Dstd@@YA?AV?$complex@M@0@ABMABV10@@Z
??Dstd@@YA?AV?$complex@M@0@ABV10@0@Z
??Dstd@@YA?AV?$complex@M@0@ABV10@ABM@Z
??Dstd@@YA?AV?$complex@N@0@ABNABV10@@Z
??Dstd@@YA?AV?$complex@N@0@ABV10@0@Z
??Dstd@@YA?AV?$complex@N@0@ABV10@ABN@Z
??Dstd@@YA?AV?$complex@O@0@ABOABV10@@Z
??Dstd@@YA?AV?$complex@O@0@ABV10@0@Z
??Dstd@@YA?AV?$complex@O@0@ABV10@ABO@Z
??Gstd@@YA?AV?$complex@M@0@ABMABV10@@Z
??Gstd@@YA?AV?$complex@M@0@ABV10@0@Z
??Gstd@@YA?AV?$complex@M@0@ABV10@@Z
??Gstd@@YA?AV?$complex@M@0@ABV10@ABM@Z
??Gstd@@YA?AV?$complex@N@0@ABNABV10@@Z
??Gstd@@YA?AV?$complex@N@0@ABV10@0@Z
??Gstd@@YA?AV?$complex@N@0@ABV10@@Z
??Gstd@@YA?AV?$complex@N@0@ABV10@ABN@Z
??Gstd@@YA?AV?$complex@O@0@ABOABV10@@Z
??Gstd@@YA?AV?$complex@O@0@ABV10@0@Z
??Gstd@@YA?AV?$complex@O@0@ABV10@@Z
??Gstd@@YA?AV?$complex@O@0@ABV10@ABO@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@GABV10@@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??Hstd@@YA?AV?$complex@M@0@ABMABV10@@Z

Sections

.text
Size: 335KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/MSVCRT.DLL
.dll windows:4 windows x86 arch:x86

179b04fb57bf5f17850c94a941db63fa

Code Sign

13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12-05-1997 07:00

Not After

31-12-1999 07:00

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12-05-1997 07:00

Not After

31-12-1999 07:00

Subject

OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet

72:b5:13:47:ab:f8:11:d2:a4:1e:00:c0:4f:79:fe:8e
Certificate

Issuer

CN=Microsoft Beta PCA Authority,OU=Copyright (c) 1999 Microsoft Corp.+OU=Microsoft Corporation

Not Before

13-01-1999 07:00

Not After

01-02-2000 07:00

Subject

CN=Microsoft Windows 2000 Beta,OU=Copyright (c) 1999 Microsoft Corp.+OU=Microsoft Corporation

Extended Key Usages

ExtKeyUsageCodeSigning

4f:ff:a6:23:54:b1:ee:2d:5b:e1:ff:3f:b0:86:01:72
Certificate

Issuer

CN=Microsoft Beta Root Authority,OU=Copyright (c) 1999 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11-01-1999 07:00

Not After

31-12-2005 07:00

Subject

CN=Microsoft Beta PCA Authority,OU=Copyright (c) 1999 Microsoft Corp.+OU=Microsoft Corporation

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnumSystemLocalesA
RtlUnwind
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
SetUnhandledExceptionFilter
GetModuleFileNameA
GetModuleFileNameW
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetCommandLineA
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
ResumeThread
CreateThread
TlsSetValue
ExitThread
CloseHandle
GetCurrentThreadId
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
HeapFree
HeapAlloc
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
GetCommandLineW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
UnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetConsoleCtrlHandler
SetEnvironmentVariableW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
RaiseException
GetUserDefaultLCID
GetLocaleInfoW
GetTimeZoneInformation
FlushFileBuffers
SetFilePointer
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
Sleep
Beep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
GetCurrentProcessId
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
CreateProcessA
CreateProcessW
HeapValidate
HeapCompact
HeapWalk
HeapSize
ReadConsoleA
SetConsoleMode
GetConsoleMode
SetEndOfFile
WriteConsoleA
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
LockFile
UnlockFile
CreateFileA
CreatePipe
ReadFile
CreateFileW
GetSystemTimeAsFileTime
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
SetLocalTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@@QAE@ABV0@@Z
??0__non_rtti_object@@QAE@PBD@Z
??0bad_cast@@QAE@ABQBD@Z
??0bad_cast@@QAE@ABV0@@Z
??0bad_typeid@@QAE@ABV0@@Z
??0bad_typeid@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1__non_rtti_object@@UAE@XZ
??1bad_cast@@UAE@XZ
??1bad_typeid@@UAE@XZ
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
??4bad_typeid@@QAEAAV0@ABV0@@Z
??4exception@@QAEAAV0@ABV0@@Z
??8type_info@@QBEHABV0@@Z
??9type_info@@QBEHABV0@@Z
??_7__non_rtti_object@@6B@
??_7bad_cast@@6B@
??_7bad_typeid@@6B@
??_7exception@@6B@
??_E__non_rtti_object@@UAEPAXI@Z
??_Ebad_cast@@UAEPAXI@Z
??_Ebad_typeid@@UAEPAXI@Z
??_Eexception@@UAEPAXI@Z
??_G__non_rtti_object@@UAEPAXI@Z
??_Gbad_cast@@UAEPAXI@Z
??_Gbad_typeid@@UAEPAXI@Z
??_Gexception@@UAEPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDXZ
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?terminate@@YAXXZ
?unexpected@@YAXXZ
?what@exception@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CxxThrowException
_EH_prolog
_Getdays
_Getmonths
_Gettnames
_HUGE
_Strftime
_XcptFilter
__CxxFrameHandler
__CxxLongjmpUnwind
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__argc
__argv
__badioinfo
__crtCompareStringA
__crtGetLocaleInfoW
__crtLCMapStringA
__dllonexit
__doserrno
__fpecode
__getmainargs
__initenv
__isascii
__iscsym
__iscsymf
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv_init
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fileinfo
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pioinfo
__pxcptinfoptrs
__set_app_type
__setlc_active
__setusermatherr
__threadhandle
__threadid
__toascii
__unDName
__unDNameEx
__unguarded_readlc_active
__wargv
__wgetmainargs
__winitenv
_abnormal_termination
_access
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_amsg_exit
_assert
_atodbl
_atoi64
_atoldbl
_beep
_beginthread
_beginthreadex
_c_exit
_cabs
_callnewh
_cexit
_cgets
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_clearfp
_close
_commit
_commode
_control87
_controlfp
_copysign
_cprintf
_cputs
_creat
_cscanf
_ctime64
_ctype
_cwait
_daylight
_dstbias
_dup
_dup2
_ecvt
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fcloseall
_fcvt
_fdopen
_fgetchar
_fgetwchar
_filbuf
_fileinfo
_filelength
_filelengthi64
_fileno
_findclose
_findfirst
_findfirst64
_findfirsti64
_findnext
_findnext64
_findnexti64
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fputchar
_fputwchar
_fsopen
_fstat
_fstat64
_fstati64
_ftime
_ftime64
_ftol
_fullpath
_futime
_futime64
_gcvt
_get_osfhandle
_get_sbh_threshold
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getws
_global_unwind2
_gmtime64
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_i64toa
_i64tow
_initterm
_inp
_inpd
_inpw
_iob
_isatty
_isctype
_ismbbalnum
_ismbbalpha
_ismbbgraph
_ismbbkalnum
_ismbbkana
_ismbbkprint
_ismbbkpunct
_ismbblead
_ismbbprint
_ismbbpunct
_ismbbtrail
_ismbcalnum
_ismbcalpha
_ismbcdigit
_ismbcgraph
_ismbchira
_ismbckata
_ismbcl0
_ismbcl1
_ismbcl2
_ismbclegal
_ismbclower
_ismbcprint
_ismbcpunct
_ismbcspace
_ismbcsymbol
_ismbcupper
_ismbslead
_ismbstrail
_isnan
_itoa
_itow
_j0
_j1
_jn
_kbhit
_lfind
_loaddll
_local_unwind2
_localtime64
_lock
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lseek
_lseeki64
_ltoa
_ltow
_makepath
_mbbtombc
_mbbtype
_mbcasemap
_mbccpy
_mbcjistojms
_mbcjmstojis
_mbclen
_mbctohira
_mbctokata
_mbctolower
_mbctombb
_mbctoupper
_mbctype
_mbsbtype
_mbscat
_mbschr
_mbscmp
_mbscoll
_mbscpy
_mbscspn
_mbsdec
_mbsdup
_mbsicmp
_mbsicoll
_mbsinc
_mbslen
_mbslwr
_mbsnbcat
_mbsnbcmp
_mbsnbcnt
_mbsnbcoll
_mbsnbcpy
_mbsnbicmp
_mbsnbicoll
_mbsnbset
_mbsncat
_mbsnccnt
_mbsncmp
_mbsncoll
_mbsncpy
_mbsnextc
_mbsnicmp
_mbsnicoll
_mbsninc
_mbsnset
_mbspbrk
_mbsrchr
_mbsrev
_mbsset
_mbsspn
_mbsspnp
_mbsstr
_mbstok
_mbstrlen
_mbsupr
_memccpy
_memicmp
_mkdir
_mktemp
_mktime64
_msize
_nextafter
_onexit
_open
_open_osfhandle
_osplatform
_osver
_outp
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_purecall
_putch
_putenv
_putw
_putws
_pwctype
_read
_rmdir
_rmtmp
_rotl
_rotr
_safe_fdiv
_safe_fdivr
_safe_fprem
_safe_fprem1
_scalb
_searchenv
_seh_longjmp_unwind
_set_error_mode
_set_sbh_threshold
_seterrormode
_setjmp
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_snprintf
_snwprintf
_sopen
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_splitpath
_stat
_stat64
_stati64
_statusfp
_strcmpi
_strdate
_strdup
_strerror
_stricmp
_stricoll
_strlwr
_strncoll
_strnicmp
_strnicoll
_strnset
_strrev
_strset
_strtime
_strupr
_swab
_sys_errlist
_sys_nerr
_tell
_telli64
_tempnam
_time64
_timezone
_tolower
_toupper
_tzname
_tzset
_ui64toa
_ui64tow
_ultoa
_ultow
_umask
_ungetch
_unlink
_unloaddll
_unlock
_utime
_utime64
_vsnprintf
_vsnwprintf
_waccess
_wasctime

Sections

.text
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/MSVCRT20.DL_
.cab
I386/MSVCRT40.DL_
.cab
I386/MSVFW32.DL_
.cab
I386/MSVIDC32.DL_
.cab
I386/MSWSOCK.DL_
.cab
I386/MSXML.DL_
.cab
I386/MTSTOCOM.EX_
.cab
I386/MULTIMED.IN_
.cab
I386/MUP.SY_
.cab
I386/MUSTEK.BM_
.cab
I386/MYCOMPUT.DL_
.cab
I386/MYDOCS.DL_
.cab
I386/N3BRIDGE.IN_
.cab
I386/NBF.SY_
.cab
I386/NCPA.CP_
.cab
I386/NDDEAPI.DL_
.cab
I386/NDIS.SY_
.cab
I386/NET1.EX_
.cab
I386/NETAPI.OS_
.cab
I386/NETAPI32.DL_
.cab
I386/NETATLK.IN_
.cab
I386/NETBIOS.SY_
.cab
I386/NETBT.SY_
.cab
I386/NETCFGX.DL_
.cab
I386/NETCIS.IN_
.cab
I386/NETDET.DL_
.cab
I386/NETDLC.IN_
.cab
I386/NETDTECT.DL_
.cab
I386/NETDTECT.SY_
.cab
I386/NETEVENT.DL_
.cab
I386/NETGPC.IN_
.cab
I386/NETH.DL_
.cab
I386/NETID.DL_
.cab
I386/NETLOOP.IN_
.cab
I386/NETMAN.DL_
.cab
I386/NETMSCLI.IN_
.cab
I386/NETMSG.DL_
.cab
I386/NETNB.IN_
.cab
I386/NETNBF.IN_
.cab
I386/NETNOVEL.IN_
.cab
I386/NETOC.DL_
.cab
I386/NETOC.IN_
.cab
I386/NETOEMDH.IN_
.cab
I386/NETRAP.DL_
.cab
I386/NETRASA.IN_
.cab
I386/NETRASS.IN_
.cab
I386/NETRAST.IN_
.cab
I386/NETRWAN.IN_
.cab
I386/NETSERV.IN_
.cab
I386/NETSHELL.DL_
.cab
I386/NETSTRM.IN_
.cab
I386/NETTCPIP.IN_
.cab
I386/NETUI0.DL_
.cab
I386/NETUI1.DL_
.cab
I386/NETUI2.DL_
.cab
I386/NETUPGRD.IN_
.cab
I386/NETWORKS._
.cab
I386/NEWDEV.DL_
.cab
I386/NG18D50.IC_
.cab
I386/NG18D65.IC_
.cab
I386/NG18D93.IC_
.cab
I386/NG22D50.IC_
.cab
I386/NG22D65.IC_
.cab
I386/NG22D93.IC_
.cab
I386/NHELPER.EX_
.cab
I386/NLITE.IN_
.cab
I386/NOTEPAD.EX_
.cab
I386/NPFS.SY_
.cab
I386/NT.FN_
.cab
I386/NT2.FN_
.cab
I386/NT5.CA_
.cab
I386/NT5INF.CA_
.cab
I386/NT5PRTX.CA_
.cab
I386/NTAPM.IN_
.cab
I386/NTDETECT.COM
I386/NTDLL.DLL
.dll windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

CsrAllocateCaptureBuffer
CsrAllocateMessagePointer
CsrCaptureMessageBuffer
CsrCaptureMessageString
CsrCaptureTimeout
CsrClientCallServer
CsrClientConnectToServer
CsrFreeCaptureBuffer
CsrIdentifyAlertableThread
CsrNewThread
CsrProbeForRead
CsrProbeForWrite
CsrSetPriorityClass
DbgBreakPoint
DbgPrint
DbgPrintReturnControlC
DbgPrompt
DbgSsHandleKmApiMsg
DbgSsInitialize
DbgUiConnectToDbg
DbgUiContinue
DbgUiWaitStateChange
DbgUserBreakPoint
KiRaiseUserExceptionDispatcher
KiUserApcDispatcher
KiUserCallbackDispatcher
KiUserExceptionDispatcher
LdrAccessResource
LdrAlternateResourcesEnabled
LdrDisableThreadCalloutsForDll
LdrEnumResources
LdrFindEntryForAddress
LdrFindResourceDirectory_U
LdrFindResource_U
LdrFlushAlternateResourceModules
LdrGetDllHandle
LdrGetProcedureAddress
LdrInitializeThunk
LdrLoadAlternateResourceModule
LdrLoadDll
LdrProcessRelocationBlock
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrShutdownProcess
LdrShutdownThread
LdrUnloadAlternateResourceModule
LdrUnloadDll
LdrVerifyImageMatchesChecksum
NPXEMULATORTABLE
NlsAnsiCodePage
NlsMbCodePageTag
NlsMbOemCodePageTag
NtAcceptConnectPort
NtAccessCheck
NtAccessCheckAndAuditAlarm
NtAccessCheckByType
NtAccessCheckByTypeAndAuditAlarm
NtAccessCheckByTypeResultList
NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtAddAtom
NtAdjustGroupsToken
NtAdjustPrivilegesToken
NtAlertResumeThread
NtAlertThread
NtAllocateLocallyUniqueId
NtAllocateUserPhysicalPages
NtAllocateUuids
NtAllocateVirtualMemory
NtAreMappedFilesTheSame
NtAssignProcessToJobObject
NtCallbackReturn
NtCancelDeviceWakeupRequest
NtCancelIoFile
NtCancelTimer
NtClearEvent
NtClose
NtCloseObjectAuditAlarm
NtCompleteConnectPort
NtConnectPort
NtContinue
NtCreateChannel
NtCreateDirectoryObject
NtCreateEvent
NtCreateEventPair
NtCreateFile
NtCreateIoCompletion
NtCreateJobObject
NtCreateKey
NtCreateMailslotFile
NtCreateMutant
NtCreateNamedPipeFile
NtCreatePagingFile
NtCreatePort
NtCreateProcess
NtCreateProfile
NtCreateSection
NtCreateSemaphore
NtCreateSymbolicLinkObject
NtCreateThread
NtCreateTimer
NtCreateToken
NtCreateWaitablePort
NtCurrentTeb
NtDelayExecution
NtDeleteAtom
NtDeleteFile
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeleteValueKey
NtDeviceIoControlFile
NtDisplayString
NtDuplicateObject
NtDuplicateToken
NtEnumerateKey
NtEnumerateValueKey
NtExtendSection
NtFilterToken
NtFindAtom
NtFlushBuffersFile
NtFlushInstructionCache
NtFlushKey
NtFlushVirtualMemory
NtFlushWriteBuffer
NtFreeUserPhysicalPages
NtFreeVirtualMemory
NtFsControlFile
NtGetContextThread
NtGetDevicePowerState
NtGetPlugPlayEvent
NtGetTickCount
NtGetWriteWatch
NtImpersonateAnonymousToken
NtImpersonateClientOfPort
NtImpersonateThread
NtInitializeRegistry
NtInitiatePowerAction
NtIsSystemResumeAutomatic
NtListenChannel
NtListenPort
NtLoadDriver
NtLoadKey
NtLoadKey2
NtLockFile
NtLockVirtualMemory
NtMakeTemporaryObject
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtMapViewOfSection
NtNotifyChangeDirectoryFile
NtNotifyChangeKey
NtNotifyChangeMultipleKeys
NtOpenChannel
NtOpenDirectoryObject
NtOpenEvent
NtOpenEventPair
NtOpenFile
NtOpenIoCompletion
NtOpenJobObject
NtOpenKey
NtOpenMutant
NtOpenObjectAuditAlarm
NtOpenProcess
NtOpenProcessToken
NtOpenSection
NtOpenSemaphore
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadToken
NtOpenTimer
NtPlugPlayControl
NtPowerInformation
NtPrivilegeCheck
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtProtectVirtualMemory
NtPulseEvent
NtQueryAttributesFile
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryDirectoryFile
NtQueryDirectoryObject
NtQueryEaFile
NtQueryEvent
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationPort
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationToken
NtQueryInstallUILanguage
NtQueryIntervalProfile
NtQueryIoCompletion
NtQueryKey
NtQueryMultipleValueKey
NtQueryMutant
NtQueryObject
NtQueryOpenSubKeys
NtQueryPerformanceCounter
NtQueryQuotaInformationFile
NtQuerySection
NtQuerySecurityObject
NtQuerySemaphore
NtQuerySymbolicLinkObject
NtQuerySystemEnvironmentValue
NtQuerySystemInformation
NtQuerySystemTime
NtQueryTimer
NtQueryTimerResolution
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtQueueApcThread
NtRaiseException
NtRaiseHardError
NtReadFile
NtReadFileScatter
NtReadRequestData
NtReadVirtualMemory
NtRegisterThreadTerminatePort
NtReleaseMutant
NtReleaseSemaphore
NtRemoveIoCompletion
NtReplaceKey
NtReplyPort
NtReplyWaitReceivePort
NtReplyWaitReceivePortEx
NtReplyWaitReplyPort
NtReplyWaitSendChannel
NtRequestDeviceWakeup
NtRequestPort
NtRequestWaitReplyPort
NtRequestWakeupLatency
NtResetEvent
NtResetWriteWatch
NtRestoreKey
NtResumeThread
NtSaveKey
NtSaveMergedKeys
NtSecureConnectPort
NtSendWaitReplyChannel
NtSetContextChannel
NtSetContextThread
NtSetDefaultHardErrorPort
NtSetDefaultLocale
NtSetDefaultUILanguage
NtSetEaFile
NtSetEvent
NtSetHighEventPair
NtSetHighWaitLowEventPair
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationObject
NtSetInformationProcess
NtSetInformationThread
NtSetInformationToken
NtSetIntervalProfile
NtSetIoCompletion
NtSetLdtEntries
NtSetLowEventPair
NtSetLowWaitHighEventPair
NtSetQuotaInformationFile
NtSetSecurityObject
NtSetSystemEnvironmentValue
NtSetSystemInformation
NtSetSystemPowerState
NtSetSystemTime
NtSetThreadExecutionState
NtSetTimer
NtSetTimerResolution
NtSetUuidSeed
NtSetValueKey
NtSetVolumeInformationFile
NtShutdownSystem
NtSignalAndWaitForSingleObject
NtStartProfile
NtStopProfile
NtSuspendThread
NtSystemDebugControl
NtTerminateJobObject
NtTerminateProcess
NtTerminateThread
NtTestAlert
NtUnloadDriver
NtUnloadKey
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtVdmControl
NtWaitForMultipleObjects
NtWaitForSingleObject
NtWaitHighEventPair
NtWaitLowEventPair
NtWriteFile
NtWriteFileGather
NtWriteRequestData
NtWriteVirtualMemory
NtYieldExecution
PfxFindPrefix
PfxInitialize
PfxInsertPrefix
PfxRemovePrefix
PropertyLengthAsVariant
RestoreEm87Context
RtlAbortRXact
RtlAbsoluteToSelfRelativeSD
RtlAcquirePebLock
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedAce
RtlAddAccessDeniedAceEx
RtlAddAccessDeniedObjectAce
RtlAddAce
RtlAddActionToRXact
RtlAddAtomToAtomTable
RtlAddAttributeActionToRXact
RtlAddAuditAccessAce
RtlAddAuditAccessAceEx
RtlAddAuditAccessObjectAce
RtlAddCompoundAce
RtlAddRange
RtlAdjustPrivilege
RtlAllocateAndInitializeSid
RtlAllocateHandle
RtlAllocateHeap
RtlAnsiCharToUnicodeChar
RtlAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlAppendAsciizToString
RtlAppendStringToString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlApplyRXact
RtlApplyRXactNoFlush
RtlAreAllAccessesGranted
RtlAreAnyAccessesGranted
RtlAreBitsClear
RtlAreBitsSet
RtlAssert
RtlCallbackLpcClient
RtlCancelTimer
RtlCaptureStackBackTrace
RtlCharToInteger
RtlCheckForOrphanedCriticalSections
RtlCheckRegistryKey
RtlClearAllBits
RtlClearBits
RtlCompactHeap
RtlCompareMemory
RtlCompareMemoryUlong
RtlCompareString
RtlCompareUnicodeString
RtlCompressBuffer
RtlConsoleMultiByteToUnicodeN
RtlConvertExclusiveToShared
RtlConvertLongToLargeInteger
RtlConvertPropertyToVariant
RtlConvertSharedToExclusive
RtlConvertSidToUnicodeString
RtlConvertToAutoInheritSecurityObject
RtlConvertUiListToApiList
RtlConvertUlongToLargeInteger
RtlConvertVariantToProperty
RtlCopyLuid
RtlCopyLuidAndAttributesArray
RtlCopyRangeList
RtlCopySecurityDescriptor
RtlCopySid
RtlCopySidAndAttributesArray
RtlCopyString
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateAndSetSD
RtlCreateAtomTable
RtlCreateEnvironment
RtlCreateHeap
RtlCreateLpcServer
RtlCreateProcessParameters
RtlCreateQueryDebugBuffer
RtlCreateRegistryKey
RtlCreateSecurityDescriptor
RtlCreateTagHeap
RtlCreateTimer
RtlCreateTimerQueue
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlCreateUserProcess
RtlCreateUserSecurityObject
RtlCreateUserThread
RtlCustomCPToUnicodeN
RtlCutoverTimeToSystemTime
RtlDeNormalizeProcessParams
RtlDebugPrintTimes
RtlDecompressBuffer
RtlDecompressFragment
RtlDefaultNpAcl
RtlDelete
RtlDeleteAce
RtlDeleteAtomFromAtomTable
RtlDeleteCriticalSection
RtlDeleteElementGenericTable
RtlDeleteNoSplay
RtlDeleteOwnersRanges
RtlDeleteRange
RtlDeleteRegistryValue
RtlDeleteResource
RtlDeleteSecurityObject
RtlDeleteTimer
RtlDeleteTimerQueue
RtlDeleteTimerQueueEx
RtlDeregisterWait
RtlDeregisterWaitEx
RtlDestroyAtomTable
RtlDestroyEnvironment
RtlDestroyHandleTable
RtlDestroyHeap
RtlDestroyProcessParameters
RtlDestroyQueryDebugBuffer
RtlDetermineDosPathNameType_U
RtlDnsHostNameToComputerName
RtlDoesFileExists_U
RtlDosPathNameToNtPathName_U
RtlDosSearchPath_U
RtlDowncaseUnicodeString
RtlDumpResource
RtlEmptyAtomTable
RtlEnableEarlyCriticalSectionEventCreation
RtlEnlargedIntegerMultiply
RtlEnlargedUnsignedDivide
RtlEnlargedUnsignedMultiply
RtlEnterCriticalSection
RtlEnumProcessHeaps
RtlEnumerateGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlEqualComputerName
RtlEqualDomainName
RtlEqualLuid
RtlEqualPrefixSid
RtlEqualSid
RtlEqualString
RtlEqualUnicodeString
RtlEraseUnicodeString
RtlExpandEnvironmentStrings_U
RtlExtendHeap
RtlExtendedIntegerMultiply
RtlExtendedLargeIntegerDivide
RtlExtendedMagicDivide
RtlFillMemory
RtlFillMemoryUlong
RtlFindClearBits
RtlFindClearBitsAndSet
RtlFindLastBackwardRunClear
RtlFindLeastSignificantBit
RtlFindLongestRunClear
RtlFindMessage
RtlFindMostSignificantBit
RtlFindNextForwardRunClear
RtlFindRange
RtlFindSetBits
RtlFindSetBitsAndClear
RtlFirstFreeAce
RtlFormatCurrentUserKeyPath
RtlFormatMessage
RtlFreeAnsiString
RtlFreeHandle
RtlFreeHeap
RtlFreeOemString
RtlFreeRangeList
RtlFreeSid
RtlFreeUnicodeString
RtlFreeUserThreadStack
RtlGUIDFromString
RtlGenerate8dot3Name
RtlGetAce
RtlGetCallersAddress
RtlGetCompressionWorkSpaceSize
RtlGetControlSecurityDescriptor
RtlGetCurrentDirectory_U
RtlGetDaclSecurityDescriptor
RtlGetElementGenericTable
RtlGetFirstRange
RtlGetFullPathName_U
RtlGetGroupSecurityDescriptor
RtlGetLongestNtPathLength
RtlGetNextRange
RtlGetNtGlobalFlags
RtlGetNtProductType
RtlGetOwnerSecurityDescriptor
RtlGetProcessHeaps
RtlGetSaclSecurityDescriptor
RtlGetSecurityDescriptorRMControl
RtlGetUserInfoHeap
RtlGetVersion
RtlIdentifierAuthoritySid

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ECODE
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/NTDSA.DL_
.cab
I386/NTDSAPI.DL_
.cab
I386/NTDSATQ.DL_
.cab
I386/NTDSBSRV.DL_
.cab
I386/NTDSETUP.DL_
.cab
I386/NTDSKCC.DL_
.cab
I386/NTDSUTIL.EX_
.cab
I386/NTDSXDS.DL_
.cab
I386/NTFS.SY_
.cab
I386/NTFS40.SYS
.sys windows:4 windows x86 arch:x86

0a49a73ea9e48276b0fef41908334d21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntoskrnl.exe

RtlInitializeBitMap
RtlInitUnicodeString
ExIsResourceAcquiredExclusiveLite
FsRtlOplockIsFastIoPossible
CcUnpinData
CcSetDirtyPinnedData
memmove
ExAllocatePoolWithTag
KeBugCheckEx
MmSetAddressRangeModified
CcCopyWrite
RtlCompareMemory
MmCanFileBeTruncated
ExRaiseStatus
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
IoGetTopLevelIrp
ExFreeToPagedLookasideList
ExAllocateFromPagedLookasideList
KeQuerySystemTime
FsRtlAreNamesEqual
RtlUpcaseUnicodeString
RtlGenerate8dot3Name
FsRtlInitializeLargeMcb
FsRtlAddLargeMcbEntry
RtlFindLongestRunClear
RtlNumberOfClearBits
FsRtlUninitializeLargeMcb
FsRtlTruncateLargeMcb
CcFlushCache
RtlAreBitsClear
RtlSetBits
RtlAreBitsSet
RtlClearBits
RtlFindClearBits
FsRtlGetNextLargeMcbEntry
FsRtlLookupLargeMcbEntry
FsRtlRemoveLargeMcbEntry
IoGetStackLimits
ObfDereferenceObject
CcUninitializeCacheMap
CcSetLogHandleForFile
CcInitializeCacheMap
IoCreateStreamFileObject
CcMapData
CcPinMappedData
CcPinRead
CcPreparePinWrite
CcMdlWriteComplete
CcMdlReadComplete
CcZeroData
KeLeaveCriticalRegion
IoSetTopLevelIrp
IoIsOperationSynchronous
KeEnterCriticalRegion
IofCompleteRequest
IoRemoveShareAccess
FsRtlIsNtstatusExpected
FsRtlNotifyFullReportChange
FsRtlDeleteKeyFromTunnelCache
FsRtlNotifyCleanup
FsRtlAddToTunnelCache
FsRtlFastUnlockAll
IoGetRequestorProcess
FsRtlCheckOplock
FsRtlNotifyFullChangeDirectory
ExConvertExclusiveToSharedLite
ExQueueWorkItem
FsRtlIsNameInExpression
FsRtlDoesNameContainWildCards
FsRtlDissectName
FsRtlFindInTunnelCache
SeSinglePrivilegeCheck
CcPurgeCacheSection
MmFlushImageSection
IoCheckShareAccess
IoCheckEaBufferValidity
FsRtlOplockFsctrl
IoSetShareAccess
IoUpdateShareAccess
FsRtlCurrentBatchOplock
IoSetInformation
IofCallDriver
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
MmMapLockedPages
IoFreeIrp
IoBuildPartialMdl
IoMakeAssociatedIrp
RtlDescribeChunk
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
RtlDecompressFragment
MmUnlockPages
KeInitializeEvent
MmBuildMdlForNonPagedPool
ExGetExclusiveWaiterCount
KeDelayExecutionThread
IoBuildAsynchronousFsdRequest
KeClearEvent
KeWaitForSingleObject
ExInterlockedPushEntrySList
ExReleaseResourceForThreadLite
KeSetEvent
FsRtlIsTotalDeviceFailure
RtlLookupElementGenericTable
SeCaptureSubjectContext
RtlUpperString
RtlCompareString
RtlInitString
FsRtlLegalAnsiCharacterArray
NlsOemLeadByteInfo
NlsMbOemCodePageTag
ExAllocatePool
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
FsRtlNormalizeNtstatus
FsRtlBalanceReads
ObQueryNameString
CcCopyRead
CcSetAdditionalCacheAttributes
IoCreateDevice
IoBuildDeviceIoControlRequest
CcCanIWrite
KeNumberProcessors
ProbeForWrite
ExRaiseAccessViolation
MmUserProbeAddress
ObReferenceObjectByHandle
IoFileObjectType
ExfInterlockedAddUlong
CcFastCopyRead
IoGetRelatedDeviceObject
CcFastCopyWrite
CcMdlRead
CcFastMdlReadWait
CcPrepareMdlWrite
FsRtlPrivateLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAllByKey
FsRtlProcessFileLock
KeSetTimer
KeSetPriorityThread
CcGetDirtyPages
ExInitializeResourceLite
KeInitializeSpinLock
ExDeleteResourceLite
FsRtlLookupLastLargeMcbEntry
FsRtlNumberOfRunsInLargeMcb
FsRtlSplitLargeMcb
RtlFreeOemString
RtlUnicodeStringToCountedOemString
FsRtlIsFatDbcsLegal
FsRtlFastCheckLockForWrite
FsRtlFastCheckLockForRead
IoRaiseInformationalHardError
IoIsSystemThread
KeInitializeDpc
KeInitializeTimer
IoRegisterFileSystem
KeBugCheck
MmQuerySystemSize
FsRtlMdlWriteCompleteDev
FsRtlMdlReadCompleteDev
MmIsThisAnNtAsSystem
SeReleaseSubjectContext
RtlLengthSecurityDescriptor
SeAssignSecurity
IoGetFileObjectGenericMapping
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
ExInitializePagedLookasideList
ExInitializeNPagedLookasideList
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlDelete
RtlSplay
FsRtlPostStackOverflow
FsRtlPostPagingFileStackOverflow
ExInterlockedPopEntrySList
CcSetReadAheadGranularity
FsRtlCheckLockForReadAccess
ExIsResourceAcquiredSharedLite
ExAcquireSharedWaitForExclusive
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeDeassignSecurity
SeSetSecurityDescriptorInfo
SeQuerySecurityDescriptorInfo
SeUnlockSubjectContext
SeOpenObjectAuditAlarm
SeOpenObjectForDeleteAuditAlarm
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
SeAuditingFileEvents
SeFreePrivileges
SeAppendPrivileges
SeAccessCheck
SeLockSubjectContext
SeValidSecurityDescriptor
IoBuildSynchronousFsdRequest
FsRtlInitializeTunnelCache
FsRtlNotifyInitializeSync
RtlInitializeGenericTable
IoDeleteDevice
FsRtlDeleteTunnelCache
FsRtlNotifyUninitializeSync
RtlInsertElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
FsRtlUninitializeOplock
FsRtlInitializeOplock
FsRtlUninitializeFileLock
FsRtlInitializeFileLock
ExReinitializeResourceLite
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
FsRtlCheckLockForWriteAccess
ExAcquireSharedStarveExclusive
CcDeferWrite
RtlUnwind
ExFreePool
CcSetFileSizes
ExAcquireResourceSharedLite
ObQueryObjectAuditingByHandle
SeDeleteObjectAuditAlarm
RtlDeleteElementGenericTable
CcUnpinDataForThread
RtlFillMemoryUlong

hal

ExTryToAcquireFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 255KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 928B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/NTIMAGE.GI_
.cab
I386/NTKRNLMP.EX_
.cab
I386/NTLANMAN.DL_
.cab
I386/NTLANUI.DL_
.cab
I386/NTLANUI2.DL_
.cab
I386/NTLDR
I386/NTLSAPI.DL_
.cab
I386/NTMARTA.DL_
.cab
I386/NTMSAPI.DL_
.cab
I386/NTOC.DL_
.cab
I386/NTOSKRNL.EX_
.cab
I386/NTSCIC22.IC_
.cab
I386/NTSHRUI.DL_
.cab
I386/NULL.SY_
.cab
I386/NWSETUP.DL_
.cab
I386/OAKLEY.DL_
.cab
I386/OBJSEL.DL_
.cab
I386/OCFILESS.IN_
.cab
I386/OCFILESW.IN_
.cab
I386/OCGEN.DL_
.cab
I386/OCMANAGE.DL_
.cab
I386/ODBC32.DL_
.cab
I386/ODBCINT.DL_
.cab
I386/OLE32.DL_
.cab
I386/OLEACC.DL_
.cab
I386/OLEACCRC.DL_
.cab
I386/OLEAUT32.DL_
.cab
I386/OLECLI32.DL_
.cab
I386/OLECNV32.DL_
.cab
I386/OLEDLG.DL_
.cab
I386/OLEPRO32.DL_
.cab
I386/OLESVR32.DL_
.cab
I386/OLETHK32.DL_
.cab
I386/OPENHCI.SY_
.cab
I386/OSCCAB.CA_
.cab
I386/OTHER.IN_
.cab
I386/PACKAGER.EX_
.cab
I386/PANMAP.DL_
.cab
I386/PARTMGR.SY_
.cab
I386/PAUTOENR.DL_
.cab
I386/PCI.SY_
.cab
I386/PCIIDE.SY_
.cab
I386/PCIIDEX.SY_
.cab
I386/PDH.DL_
.cab
I386/PENTNT.EX_
.cab
I386/PERFNET.DL_
.cab
I386/PERFTS.DL_
.cab
I386/PHIME.CA_
.cab
I386/PIDGEN.DLL
.dll windows:5 windows x86 arch:x86

6f94919bc61cf460f96b1057bfb92f03

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

kernel32

FreeResource
LockResource
LoadResource
FindResourceA
SetLastError
MultiByteToWideChar
GetTickCount
WideCharToMultiByte
GetVolumeInformationA
CloseHandle
DeviceIoControl
CreateFileA
lstrcmpA
QueryDosDeviceA
HeapAlloc
GetProcessHeap
HeapFree
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetLastError
SizeofResource
GetLocalTime
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
lstrlenA
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
GetProcAddress
LoadLibraryA
FlushFileBuffers
SetStdHandle
SetFilePointer
SystemTimeToFileTime
lstrcpyA
QueryPerformanceCounter
GlobalMemoryStatus
SetHandleCount
GetStdHandle
VirtualFree
GetLocaleInfoA
GetLocaleInfoW
RtlUnwind

user32

wsprintfA
CharNextA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

PIDGenA
PIDGenSimpA
PIDGenSimpW
PIDGenW
SetupPIDGenA
SetupPIDGenW

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/PIFMGR.DL_
.cab
I386/PLUSTAB.DL_
.cab
I386/POLSTORE.DL_
.cab
I386/POWERCFG.CP_
.cab
I386/POWRPROF.DL_
.cab
I386/PRFLBMSG.DL_
.cab
I386/PRODSPEC.INI
I386/PROFMAP.DL_
.cab
I386/PROTOCOL._
.cab
I386/PSAPI.DL_
.cab
I386/PSBASE.DL_
.cab
I386/PSCHDCNT.H_
.cab
I386/PSTOREC.DL_
.cab
I386/PTILINK.SY_
.cab
I386/PUBPRN.VB_
.cab
I386/PYIME.CA_
.cab
I386/QCUT.DL_
.cab
I386/QUARTZ.DL_
.cab
I386/QUERY.DL_
.cab
I386/QUOTES._
.cab
I386/RADD5018.IC_
.cab
I386/RAPILIB.DL_
.cab
I386/RASADMIN.EX_
.cab
I386/RASAPI32.DL_
.cab
I386/RASAUTH.DL_
.cab
I386/RASDLG.DL_
.cab
I386/RASGPRXY.DL_
.cab
I386/RASGTWY.DL_
.cab
I386/RASIRDA.SY_
.cab
I386/RASMAN.DL_
.cab
I386/RASSAPI.DL_
.cab
I386/RASSAUTH.DL_
.cab
I386/RASSCRPT.DL_
.cab
I386/RAWWAN.SY_
.cab
I386/RCA.IN_
.cab
I386/RCAMSP.DL_
.cab
I386/RDBSS.SY_
.cab
I386/RECOVER.EX_
.cab
I386/REGAPI.DL_
.cab
I386/REGEDIT.EXE
.exe windows:5 windows x86 arch:x86

a279d88ead565236da4474c02d09343b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

OutputDebugStringW
GetProcAddress
GlobalUnlock
lstrcpynW
MulDiv
LoadLibraryW
FreeLibrary
WriteFile
MultiByteToWideChar
WideCharToMultiByte
SearchPathW
CreateFileW
GetFileSize
ReadFile
SetFilePointer
GetLastError
LoadLibraryA
CloseHandle
lstrcmpW
GetComputerNameW
LocalAlloc
FormatMessageW
GetCommandLineW
GetThreadLocale
GetModuleHandleW
ExitProcess
lstrcatW
GetProcessHeap
lstrcmpiW
lstrlenW
lstrcpyW
LocalFree
GlobalAlloc
GlobalLock

gdi32

GetDeviceCaps
ExtTextOutW
CreateFontIndirectW
SelectObject
SetTextColor
SelectClipRgn
ExcludeClipRect
PatBlt
SetBkColor
GetTextMetricsW
CreatePatternBrush
AbortDoc
EndDoc
EndPage
SetViewportOrgEx
StartPage
StartDocW
SetAbortProc
CreateBitmap
DeleteObject
DeleteDC

user32

EnableMenuItem
GetSubMenu
LoadMenuW
IsClipboardFormatAvailable
GetDlgCtrlID
CheckRadioButton
SendMessageW
GetWindowTextW
GetParent
GetClipboardData
IsDlgButtonChecked
GetDlgItemInt
SetClipboardData
RegisterClassExW
LoadImageW
LoadIconW
ShowWindow
SetWindowPlacement
CreateWindowExW
UpdateWindow
DeleteMenu
GetMenu
PostQuitMessage
GetWindowPlacement
SetWindowTextW
EnableWindow
DialogBoxParamW
DrawMenuBar
InsertMenuItemW
SetMenuItemInfoW
GetDesktopWindow
PostMessageW
SetMenuDefaultItem
InsertMenuW
GetMenuItemID
CheckMenuItem
GetMenuItemInfoW
ScreenToClient
SetCursorPos
DispatchMessageW
GetMessageW
IsIconic
ShowCursor
SetCursor
ClientToScreen
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DestroyIcon
GetSysColor
DestroyWindow
CreateDialogParamW
CharNextW
CheckDlgButton
DrawAnimatedRects
DestroyMenu
TrackPopupMenuEx
ModifyMenuW
GetMessagePos
TranslateMessage
TranslateAcceleratorW
LoadAcceleratorsW
SetForegroundWindow
GetLastActivePopup
BringWindowToTop
FindWindowW
LoadStringW
GetWindow
IsDialogMessageW
PeekMessageW
MessageBoxW
CharUpperBuffW
CharUpperW
IsCharAlphaNumericW
CloseClipboard
HideCaret
SetCaretPos
MessageBeep
CharLowerW
InvalidateRect
GetKeyState
KillTimer
ReleaseCapture
SetFocus
SetCapture
SetTimer
DestroyCaret
CreateCaret
ShowCaret
wsprintfW
BeginPaint
EndPaint
ScrollWindowEx
SetScrollInfo
GetDC
ReleaseDC
DefWindowProcW
RegisterClipboardFormatW
LoadCursorW
RegisterClassW
SetWindowLongW
SetDlgItemTextW
SendDlgItemMessageW
GetDlgItem
GetWindowRect
GetSystemMetrics
MoveWindow
MapWindowPoints
SetWindowPos
GetWindowLongW
EndDialog
WinHelpW
OpenClipboard
EmptyClipboard
IntersectRect
GetClientRect
GetDlgItemTextW
CallWindowProcW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegEnumKeyW
RegSetValueExW
RegCreateKeyW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegConnectRegistryW
RegFlushKey
RegSetValueW
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

comctl32

ord2
ord4
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
ImageList_SetBkColor
CreateStatusWindowW
ord358
ord359
ord363
ord337
ord338
ord334
ord236
ord329
ord365
ord340

comdlg32

PrintDlgExW
GetOpenFileNameW
GetSaveFileNameW

shell32

ord195
SHBrowseForFolderW
DragQueryFileW
DragFinish
ShellAboutW

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
I386/REGEDT32.EX_
.cab
I386/REGISTRY.IN_
.cab
I386/REGSVR32.EX_
.cab
I386/REGWIZ.EX_
.cab
I386/REGWIZC.DL_
.cab
I386/RESUTILS.DL_
.cab
I386/RICHED20.DL_
.cab
I386/RICHED32.DL_
.cab
I386/RMVV1.IN_
.cab
I386/RMVV2.IN_
.cab
I386/RNR20.DL_
.cab
I386/ROMAN.FO_
.cab
I386/ROOTMDM.SY_
.cab
I386/ROUTEMON.EX_
.cab
I386/ROUTETAB.DL_
.cab
I386/RPCNS4.DL_
.cab
I386/RPCPROXY.DL_
.cab
I386/RPCRT4.DL_
.cab
I386/RPCSS.DL_
.cab
I386/RS322.CF_
.cab
I386/RSABASE.DLL
.dll regsvr32 windows:5 windows x86 arch:x86

6e4296f62807ed82c0ad3d9d0c87f9d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntdll

_chkstk
_strlwr
wcslen
wcscmp
wcscpy
wcscat
RtlMoveMemory
RtlUnwind

kernel32

MultiByteToWideChar
Sleep
SetLastError
GetModuleHandleW
DeviceIoControl
GetCurrentProcess
GetSystemDirectoryW
LoadLibraryW
CreateFileW
FindFirstFileExW
WriteFile
GetFileSize
GetCurrentThread
MoveFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
WideCharToMultiByte
FindNextFileW
LoadLibraryExA
LocalReAlloc
SizeofResource
LoadResource
FindResourceA
ReadFile
_lclose
SetFilePointer
OpenFile
GetCurrentProcessId
GetProcessHeap
HeapAlloc
GetCurrentThreadId
GetTickCount
GetLocalTime
QueryPerformanceCounter
GlobalMemoryStatus
GetDiskFreeSpaceA
HeapFree
CloseHandle
lstrcpyW
DisableThreadLibraryCalls
DeleteCriticalSection
GetVersionExA
IsBadWritePtr
InitializeCriticalSection
lstrcmpA
LoadLibraryA
GetProcAddress
lstrlenA
lstrcpyA
FreeLibrary
lstrlenW
RaiseException
FindClose
EnterCriticalSection
LeaveCriticalSection
GetComputerNameA
GetLastError
LocalAlloc
LocalFree
SetFileAttributesW
CreateDirectoryW
DeleteFileW

ole32

CoTaskMemFree

advapi32

GetSecurityDescriptorControl
GetSecurityDescriptorLength
SetFileSecurityW
GetFileSecurityW
MakeSelfRelativeSD
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetAclInformation
GetAce
ImpersonateSelf
AdjustTokenPrivileges
RegEnumKeyA
RegDeleteKeyW
RegOpenKeyExW
LookupPrivilegeValueA
PrivilegeCheck
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenThreadToken
RevertToSelf
OpenProcessToken
SetThreadToken
GetTokenInformation
EqualSid
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA
RegCloseKey
RegGetKeySecurity
RegEnumKeyExA
RegQueryInfoKeyA
GetUserNameA
RegSetValueExA
RegCreateKeyExA
AddAccessAllowedAce
FreeSid
InitializeSecurityDescriptor
GetLengthSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeAcl

user32

wsprintfW
wsprintfA
LoadStringW

userenv

GetProfileType

crypt32

CertCompareCertificateName
CertFreeCertificateContext
CertGetCertificateChain
CertVerifySubjectCertificateContext
CertFindCertificateInStore
CryptProtectData
CertCloseStore
CertOpenSystemStoreA
CryptUnprotectData
CertFindExtension
CryptDecodeObject
CertFreeCertificateChain
CertCreateCertificateContext

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/RSFSAPS.DL_
.cab
I386/RSHX32.DL_
.cab
I386/RSM.IN_
.cab
I386/RSTORAGE.IN_
.cab
I386/RSVPSP.DL_
.cab
I386/RTM.DL_
.cab
I386/RTUMEXT.DL_
.cab
I386/RTUTILS.DL_
.cab
I386/RUNDLL32.EX_
.cab
I386/RUNONCE.EX_
.cab
I386/SAM.CF_
.cab
I386/SAM.VC_
.cab
I386/SAMLIB.DL_
.cab
I386/SAMSRV.DL_
.cab
I386/SCARDDLG.DL_
.cab
I386/SCECLI.DL_
.cab
I386/SCEREGVL.IN_
.cab
I386/SCESRV.DL_
.cab
I386/SCHANNEL.DLL
.dll windows:5 windows x86 arch:x86

540b8a6ce6561ead6fb9f39c3a0803d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

secur32

ApplyControlToken

msvcrt

_ltoa
wcsstr
printf
memmove
wcscpy
_ltow
wcslen
_except_handler3
wcschr

ntdll

RtlGetNtProductType
RtlEnterCriticalSection
NtAllocateVirtualMemory
NtFreeVirtualMemory
RtlInitAnsiString
RtlInitializeCriticalSection
NtClose
RtlEqualUnicodeString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlLeaveCriticalSection

msasn1

ASN1CEREncNewBlkElement
ASN1BEREncSX
ASN1BEREncBitString
ASN1BERDecSXVal
ASN1intx_free
ASN1BEREncS32
ASN1BERDecBitString2
ASN1BEREncEndOfContents
ASN1BERDecS32Val
ASN1BEREncExplicitTag
ASN1BERDecEndOfContents
ASN1BEREncOctetString
ASN1BERDecPeekTag
ASN1BERDecExplicitTag
ASN1BEREncOpenType
ASN1CEREncEndBlk
ASN1CEREncFlushBlkElement
ASN1CEREncBeginBlk
ASN1BEREncObjectIdentifier2
ASN1BERDecOctetString
ASN1BERDecOpenType
ASN1DecRealloc
ASN1BERDecNotEndOfContents
ASN1BERDecObjectIdentifier2
ASN1octetstring_free
ASN1Free
ASN1open_free
ASN1_Encode
ASN1_FreeEncoded
ASN1_Decode
ASN1_SetEncoderOption
ASN1_CloseModule
ASN1_CreateModule
ASN1_FreeDecoded

crypt32

CryptInstallOIDFunctionAddress
CertCompareCertificateName
CertGetCertificateChain
CertAddEncodedCertificateToStore
CertCreateCertificateContext
CryptSignAndEncodeCertificate
CertFindChainInStore
CryptEncodeObject
I_CryptGetAsn1Decoder
I_CryptGetAsn1Encoder
I_CryptUninstallAsn1Module
I_CryptInstallAsn1Module
CertControlStore
CertGetEnhancedKeyUsage
CertAddStoreToCollection
CertEnumCTLsInStore
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CryptDecodeObjectEx
CryptDecodeObject
CertDuplicateCertificateContext
CertDuplicateStore
CertOpenSystemStoreA
CertOpenStore
CertSaveStore
CertGetCertificateContextProperty
CertSerializeCertificateStoreElement
CertSetCertificateContextProperty
CertGetNameStringW
CertAddSerializedElementToStore
CertFreeCertificateContext
CertCloseStore
CertNameToStrW
CertNameToStrA

userenv

RegisterGPNotification
UnregisterGPNotification

wsock32

ntohl
htons
ntohs
htonl

advapi32

ReportEventW
CryptVerifySignatureA
CryptHashSessionKey
CryptDuplicateHash
CryptDeriveKey
CryptContextAddRef
CryptDecrypt
CryptEncrypt
CryptExportKey
CryptGenKey
CryptSetKeyParam
CryptGetUserKey
CryptGetKeyParam
CryptSignHashA
CryptGenRandom
CryptImportKey
RevertToSelf
RegCreateKeyExA
DeregisterEventSource
RegQueryValueExW
RegCreateKeyExW
RegFlushKey
RegisterEventSourceW
CryptSetProvParam
CryptGetProvParam
CryptHashData
CryptSignHashW
CryptDestroyKey
CryptCreateHash
CryptSetHashParam
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptAcquireContextW
CryptReleaseContext
AllocateLocallyUniqueId
RegConnectRegistryA
RegOpenKeyExW
RegCloseKey
RegSetValueExW

kernel32

LocalFree
lstrcmpiA
LocalAlloc
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetComputerNameExW
GetComputerNameW
GetCurrentThread
GetLocaleInfoA
GetSystemDefaultLCID
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryW
GetLastError
SetLastError
lstrcpyW
GetTickCount
InterlockedIncrement
InterlockedDecrement
lstrlenW
CloseHandle
VirtualAlloc
OpenProcess
CreateEventA
GetCurrentProcess
lstrlenA
lstrcmpW
WaitForSingleObjectEx
VirtualFree
FreeLibrary
InterlockedExchange
FormatMessageA
LocalReAlloc
GetSystemInfo

user32

CharUpperW

dnsapi

DnsNameCompare_W

Exports

Exports

AcceptSecurityContext
AcquireCredentialsHandleA
AcquireCredentialsHandleW
ApplyControlToken
CompleteAuthToken
DeleteSecurityContext
EnableCertMapping
EnumerateSecurityPackagesA
EnumerateSecurityPackagesW
FreeContextBuffer
FreeCredentialsHandle
ImpersonateSecurityContext
InitSecurityInterfaceA
InitSecurityInterfaceW
InitializeSecurityContextA
InitializeSecurityContextW
MakeSignature
QueryContextAttributesA
QueryContextAttributesW
QuerySecurityPackageInfoA
QuerySecurityPackageInfoW
RevertSecurityContext
SealMessage
SpLsaModeInitialize
SpUserModeInitialize
SslCrackCertificate
SslFreeCertificate
SslGenerateKeyPair
SslGenerateRandomBits
SslGetMaximumKeySize
SslLoadCertificate
UnsealMessage
VerifySignature

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/SCRCONS.EX_
.cab
I386/SCRDBCAT.CA_
.cab
I386/SCRNSAVE.SC_
.cab
I386/SCROBJ.DL_
.cab
I386/SCRRUN.DL_
.cab
I386/SCSI.IN_
.cab
I386/SCSIDEV.IN_
.cab
I386/SCSIPORT.SY_
.cab
I386/SECEDIT.EX_
.cab
I386/SECUR32.DL_
.cab
I386/SECUREDC.IN_
.cab
I386/SECUREWS.IN_
.cab
I386/SECURITY.DL_
.cab
I386/SEFILSHR.DL_
.cab
I386/SENDCMSG.DL_
.cab
I386/SENS.DL_
.cab
I386/SENSAPI.DL_
.cab
I386/SERIFE.FO_
.cab
I386/SERIFF.FO_
.cab
I386/SERVICES.EX_
.cab
I386/SERVICES.MS_
.cab
I386/SERVICES._
.cab
I386/SERWVDRV.DL_
.cab
I386/SETPATHS.CM_
.cab
I386/SETREG.EX_
.cab
I386/SETUP.EX_
.cab
I386/SETUPAPI.DL_
.cab
I386/SETUPDD.SY_
.cab
I386/SETUPDLL.DL_
.cab
I386/SETUPLDR.BIN
I386/SETUPP.INI
I386/SETUPREG.HIV
I386/SETUP_W.BM_
.cab
I386/SFC.DL_
.cab
I386/SFC.EX_
.cab
I386/SFCFILES.DL_
.cab
I386/SFMAPI.DL_
.cab
I386/SFMATALK.SY_
.cab
I386/SFMATMSG.DL_
.cab
I386/SFMMON.DL_
.cab
I386/SFMPSPRT.DL_
.cab
I386/SFMWSHAT.DL_
.cab
I386/SGIBVID.DL_
.cab
I386/SHCMN.DL_
.cab
I386/SHDOCLC.DL_
.cab
I386/SHDOCVW.DL_
.cab
I386/SHELL.IN_
.cab
I386/SHELL32.DL_
.cab
I386/SHFOLDER.DL_
.cab
I386/SHIM.DL_
.cab
I386/SHLWAPI.DL_
.cab
I386/SHMGRATE.EX_
.cab
I386/SHSCRAP.DL_
.cab
I386/SIGTAB.DL_
.cab
I386/SIGVERIF.EX_
.cab
I386/SMALLE.FO_
.cab
I386/SMALLF.FO_
.cab
I386/SMSS.EX_
.cab
I386/SNDBLST.DL_
.cab
I386/SNDBLST.SY_
.cab
I386/SNDVOL32.EX_
.cab
I386/SNMPAPI.DL_
.cab
I386/SOFTPUB.DL_
.cab
I386/SORTKEY.NL_
.cab
I386/SORTTBLS.NL_
.cab
I386/SPCMDCON.SYS
.sys windows:5 windows x86 arch:x86

35c36820433cc6178a5cb00eb14daebc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntoskrnl.exe

ZwQueryKey
_wcsnicmp
_alldiv
ZwCreateFile
RtlMultiByteToUnicodeN
ZwFsControlFile
ZwEnumerateKey
wcsstr
_strnicmp
ZwQuerySymbolicLinkObject
NtClose
RtlSecondsSince1970ToTime
ExSystemTimeToLocalTime
RtlTimeToTimeFields
ZwOpenKey
ZwQueryValueKey
ZwReadFile
wcsncat
RtlUnicodeStringToInteger
KeAttachProcess
KeDetachProcess
ZwSetValueKey
_allrem
ZwQueryDirectoryFile
wcsncpy
_allmul
swprintf
ZwOpenSymbolicLinkObject
wcscat
ZwQueryVolumeInformationFile
ZwWriteFile
RtlUnicodeToOemN
NlsMbOemCodePageTag
NlsOemLeadByteInfo
ZwQueryInformationFile
DbgPrint
wcscmp
_wcsicmp
wcschr
ZwSetInformationFile
wcslen
wcscpy
ZwOpenFile
wcsrchr
_except_handler3
ZwDeviceIoControlFile
ZwClose
RtlInitUnicodeString
memmove
RtlCompareMemory
ExFreePool
ExAllocatePool
RtlCopyUnicodeString
RtlUnicodeStringToAnsiString
RtlInitAnsiString

hal

HalGetEnvironmentVariable

setupdd.sys

SpMemFree
SpUnmapFile
SpMemAlloc
SpkbdIsKeyWaiting
SpStringToUpper
SpRtlFormatMessage
SpArcNameFromRegion
CommandConsoleInterface
SpdInitialize
SpdTerminate
SpLoadUnloadKey
SpPromptForDisk
SpFileExists
SpRegionFromNtName
SpPtDoDelete
SpPtDoCreate
SpPtPrepareDisks
SpPtSectorCountToMB
SpRegionFromDosName
SpPtGetOrdinal
SpFormatMessage
SpPtDetermineRegionSpace
SpSetAutochkCallback
SpExecuteImage
SpExpandFile
SpGetFullPathName
SpCopyFileUsingNames
SpvidDisplayString
SpvidDisplayOemString
SpkbdGetKeypress
SpvidScrollUp
SpvidClearScreenRegion
SpRenameFile
SpConcatenatePaths
SpRetreiveMessageText
SpNtNameFromRegion
SpDupStringW
NtfsMirrorBootSector
SpPtGetSectorLayoutInformation
FmtFillFormatBuffer
pSpBootCodeIoC
SpDetermineOsTypeFromBootSectorC
WriteNtfsBootSector
SpEnumerateDiskRegions
SpOpenAndMapFile

spddlang.sys

SplangGetCursorChar

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/SPDDLANG.SY_
.cab
I386/SPOOLSS.DL_
.cab
I386/SPOOLSV.EX_
.cab
I386/SPRESTRT.EX_
.cab
I386/SQLSTR.DL_
.cab
I386/SRV.SY_
.cab
I386/SRVSVC.DL_
.cab
I386/SSERIFE.FO_
.cab
I386/SSERIFF.FO_
.cab
I386/STDOLE2.TL_
.cab
I386/STDOLE32.TL_
.cab
I386/STICPL.CP_
.cab
I386/STISVC.EX_
.cab
I386/STOBJECT.DL_
.cab
I386/STREAMCI.DL_
.cab
I386/STREAMS.SY_
.cab
I386/SUBROUTN.IN_
.cab
I386/SVCHOST.EX_
.cab
I386/SVCPACK.DL_
.cab
I386/SVCPACK.IN_
.cab
I386/SYMBOLE.FO_
.cab
I386/SYMBOLF.FO_
.cab
I386/SYNTH.DL_
.cab
I386/SYNTH.PA_
.cab
I386/SYNTH.SY_
.cab
I386/SYSCOMP.IN_
.cab
I386/SYSDM.CP_
.cab
I386/SYSINV.DL_
.cab
I386/SYSOC.IN_
.cab
I386/SYSOCMGR.EX_
.cab
I386/SYSSBCK.DL_
.cab
I386/SYSSBCK.IN_
.cab
I386/SYSSETUP.DL_
.cab
I386/SYSSETUP.IN_
.cab
I386/SYSTEM.AD_
.cab
I386/SYSTEM.IN_
.cab
I386/SYSTEM.MD_
.cab
I386/SYSTEM32/NTDLL.DLL
.dll windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

CsrAllocateCaptureBuffer
CsrAllocateMessagePointer
CsrCaptureMessageBuffer
CsrCaptureMessageString
CsrCaptureTimeout
CsrClientCallServer
CsrClientConnectToServer
CsrFreeCaptureBuffer
CsrIdentifyAlertableThread
CsrNewThread
CsrProbeForRead
CsrProbeForWrite
CsrSetPriorityClass
DbgBreakPoint
DbgPrint
DbgPrintReturnControlC
DbgPrompt
DbgSsHandleKmApiMsg
DbgSsInitialize
DbgUiConnectToDbg
DbgUiContinue
DbgUiWaitStateChange
DbgUserBreakPoint
KiRaiseUserExceptionDispatcher
KiUserApcDispatcher
KiUserCallbackDispatcher
KiUserExceptionDispatcher
LdrAccessResource
LdrAlternateResourcesEnabled
LdrDisableThreadCalloutsForDll
LdrEnumResources
LdrFindEntryForAddress
LdrFindResourceDirectory_U
LdrFindResource_U
LdrFlushAlternateResourceModules
LdrGetDllHandle
LdrGetProcedureAddress
LdrInitializeThunk
LdrLoadAlternateResourceModule
LdrLoadDll
LdrProcessRelocationBlock
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrShutdownProcess
LdrShutdownThread
LdrUnloadAlternateResourceModule
LdrUnloadDll
LdrVerifyImageMatchesChecksum
NPXEMULATORTABLE
NlsAnsiCodePage
NlsMbCodePageTag
NlsMbOemCodePageTag
NtAcceptConnectPort
NtAccessCheck
NtAccessCheckAndAuditAlarm
NtAccessCheckByType
NtAccessCheckByTypeAndAuditAlarm
NtAccessCheckByTypeResultList
NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtAddAtom
NtAdjustGroupsToken
NtAdjustPrivilegesToken
NtAlertResumeThread
NtAlertThread
NtAllocateLocallyUniqueId
NtAllocateUserPhysicalPages
NtAllocateUuids
NtAllocateVirtualMemory
NtAreMappedFilesTheSame
NtAssignProcessToJobObject
NtCallbackReturn
NtCancelDeviceWakeupRequest
NtCancelIoFile
NtCancelTimer
NtClearEvent
NtClose
NtCloseObjectAuditAlarm
NtCompleteConnectPort
NtConnectPort
NtContinue
NtCreateChannel
NtCreateDirectoryObject
NtCreateEvent
NtCreateEventPair
NtCreateFile
NtCreateIoCompletion
NtCreateJobObject
NtCreateKey
NtCreateMailslotFile
NtCreateMutant
NtCreateNamedPipeFile
NtCreatePagingFile
NtCreatePort
NtCreateProcess
NtCreateProfile
NtCreateSection
NtCreateSemaphore
NtCreateSymbolicLinkObject
NtCreateThread
NtCreateTimer
NtCreateToken
NtCreateWaitablePort
NtCurrentTeb
NtDelayExecution
NtDeleteAtom
NtDeleteFile
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeleteValueKey
NtDeviceIoControlFile
NtDisplayString
NtDuplicateObject
NtDuplicateToken
NtEnumerateKey
NtEnumerateValueKey
NtExtendSection
NtFilterToken
NtFindAtom
NtFlushBuffersFile
NtFlushInstructionCache
NtFlushKey
NtFlushVirtualMemory
NtFlushWriteBuffer
NtFreeUserPhysicalPages
NtFreeVirtualMemory
NtFsControlFile
NtGetContextThread
NtGetDevicePowerState
NtGetPlugPlayEvent
NtGetTickCount
NtGetWriteWatch
NtImpersonateAnonymousToken
NtImpersonateClientOfPort
NtImpersonateThread
NtInitializeRegistry
NtInitiatePowerAction
NtIsSystemResumeAutomatic
NtListenChannel
NtListenPort
NtLoadDriver
NtLoadKey
NtLoadKey2
NtLockFile
NtLockVirtualMemory
NtMakeTemporaryObject
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtMapViewOfSection
NtNotifyChangeDirectoryFile
NtNotifyChangeKey
NtNotifyChangeMultipleKeys
NtOpenChannel
NtOpenDirectoryObject
NtOpenEvent
NtOpenEventPair
NtOpenFile
NtOpenIoCompletion
NtOpenJobObject
NtOpenKey
NtOpenMutant
NtOpenObjectAuditAlarm
NtOpenProcess
NtOpenProcessToken
NtOpenSection
NtOpenSemaphore
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadToken
NtOpenTimer
NtPlugPlayControl
NtPowerInformation
NtPrivilegeCheck
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtProtectVirtualMemory
NtPulseEvent
NtQueryAttributesFile
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryDirectoryFile
NtQueryDirectoryObject
NtQueryEaFile
NtQueryEvent
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationPort
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationToken
NtQueryInstallUILanguage
NtQueryIntervalProfile
NtQueryIoCompletion
NtQueryKey
NtQueryMultipleValueKey
NtQueryMutant
NtQueryObject
NtQueryOpenSubKeys
NtQueryPerformanceCounter
NtQueryQuotaInformationFile
NtQuerySection
NtQuerySecurityObject
NtQuerySemaphore
NtQuerySymbolicLinkObject
NtQuerySystemEnvironmentValue
NtQuerySystemInformation
NtQuerySystemTime
NtQueryTimer
NtQueryTimerResolution
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtQueueApcThread
NtRaiseException
NtRaiseHardError
NtReadFile
NtReadFileScatter
NtReadRequestData
NtReadVirtualMemory
NtRegisterThreadTerminatePort
NtReleaseMutant
NtReleaseSemaphore
NtRemoveIoCompletion
NtReplaceKey
NtReplyPort
NtReplyWaitReceivePort
NtReplyWaitReceivePortEx
NtReplyWaitReplyPort
NtReplyWaitSendChannel
NtRequestDeviceWakeup
NtRequestPort
NtRequestWaitReplyPort
NtRequestWakeupLatency
NtResetEvent
NtResetWriteWatch
NtRestoreKey
NtResumeThread
NtSaveKey
NtSaveMergedKeys
NtSecureConnectPort
NtSendWaitReplyChannel
NtSetContextChannel
NtSetContextThread
NtSetDefaultHardErrorPort
NtSetDefaultLocale
NtSetDefaultUILanguage
NtSetEaFile
NtSetEvent
NtSetHighEventPair
NtSetHighWaitLowEventPair
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationObject
NtSetInformationProcess
NtSetInformationThread
NtSetInformationToken
NtSetIntervalProfile
NtSetIoCompletion
NtSetLdtEntries
NtSetLowEventPair
NtSetLowWaitHighEventPair
NtSetQuotaInformationFile
NtSetSecurityObject
NtSetSystemEnvironmentValue
NtSetSystemInformation
NtSetSystemPowerState
NtSetSystemTime
NtSetThreadExecutionState
NtSetTimer
NtSetTimerResolution
NtSetUuidSeed
NtSetValueKey
NtSetVolumeInformationFile
NtShutdownSystem
NtSignalAndWaitForSingleObject
NtStartProfile
NtStopProfile
NtSuspendThread
NtSystemDebugControl
NtTerminateJobObject
NtTerminateProcess
NtTerminateThread
NtTestAlert
NtUnloadDriver
NtUnloadKey
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtVdmControl
NtWaitForMultipleObjects
NtWaitForSingleObject
NtWaitHighEventPair
NtWaitLowEventPair
NtWriteFile
NtWriteFileGather
NtWriteRequestData
NtWriteVirtualMemory
NtYieldExecution
PfxFindPrefix
PfxInitialize
PfxInsertPrefix
PfxRemovePrefix
PropertyLengthAsVariant
RestoreEm87Context
RtlAbortRXact
RtlAbsoluteToSelfRelativeSD
RtlAcquirePebLock
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedAce
RtlAddAccessDeniedAceEx
RtlAddAccessDeniedObjectAce
RtlAddAce
RtlAddActionToRXact
RtlAddAtomToAtomTable
RtlAddAttributeActionToRXact
RtlAddAuditAccessAce
RtlAddAuditAccessAceEx
RtlAddAuditAccessObjectAce
RtlAddCompoundAce
RtlAddRange
RtlAdjustPrivilege
RtlAllocateAndInitializeSid
RtlAllocateHandle
RtlAllocateHeap
RtlAnsiCharToUnicodeChar
RtlAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlAppendAsciizToString
RtlAppendStringToString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlApplyRXact
RtlApplyRXactNoFlush
RtlAreAllAccessesGranted
RtlAreAnyAccessesGranted
RtlAreBitsClear
RtlAreBitsSet
RtlAssert
RtlCallbackLpcClient
RtlCancelTimer
RtlCaptureStackBackTrace
RtlCharToInteger
RtlCheckForOrphanedCriticalSections
RtlCheckRegistryKey
RtlClearAllBits
RtlClearBits
RtlCompactHeap
RtlCompareMemory
RtlCompareMemoryUlong
RtlCompareString
RtlCompareUnicodeString
RtlCompressBuffer
RtlConsoleMultiByteToUnicodeN
RtlConvertExclusiveToShared
RtlConvertLongToLargeInteger
RtlConvertPropertyToVariant
RtlConvertSharedToExclusive
RtlConvertSidToUnicodeString
RtlConvertToAutoInheritSecurityObject
RtlConvertUiListToApiList
RtlConvertUlongToLargeInteger
RtlConvertVariantToProperty
RtlCopyLuid
RtlCopyLuidAndAttributesArray
RtlCopyRangeList
RtlCopySecurityDescriptor
RtlCopySid
RtlCopySidAndAttributesArray
RtlCopyString
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateAndSetSD
RtlCreateAtomTable
RtlCreateEnvironment
RtlCreateHeap
RtlCreateLpcServer
RtlCreateProcessParameters
RtlCreateQueryDebugBuffer
RtlCreateRegistryKey
RtlCreateSecurityDescriptor
RtlCreateTagHeap
RtlCreateTimer
RtlCreateTimerQueue
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlCreateUserProcess
RtlCreateUserSecurityObject
RtlCreateUserThread
RtlCustomCPToUnicodeN
RtlCutoverTimeToSystemTime
RtlDeNormalizeProcessParams
RtlDebugPrintTimes
RtlDecompressBuffer
RtlDecompressFragment
RtlDefaultNpAcl
RtlDelete
RtlDeleteAce
RtlDeleteAtomFromAtomTable
RtlDeleteCriticalSection
RtlDeleteElementGenericTable
RtlDeleteNoSplay
RtlDeleteOwnersRanges
RtlDeleteRange
RtlDeleteRegistryValue
RtlDeleteResource
RtlDeleteSecurityObject
RtlDeleteTimer
RtlDeleteTimerQueue
RtlDeleteTimerQueueEx
RtlDeregisterWait
RtlDeregisterWaitEx
RtlDestroyAtomTable
RtlDestroyEnvironment
RtlDestroyHandleTable
RtlDestroyHeap
RtlDestroyProcessParameters
RtlDestroyQueryDebugBuffer
RtlDetermineDosPathNameType_U
RtlDnsHostNameToComputerName
RtlDoesFileExists_U
RtlDosPathNameToNtPathName_U
RtlDosSearchPath_U
RtlDowncaseUnicodeString
RtlDumpResource
RtlEmptyAtomTable
RtlEnableEarlyCriticalSectionEventCreation
RtlEnlargedIntegerMultiply
RtlEnlargedUnsignedDivide
RtlEnlargedUnsignedMultiply
RtlEnterCriticalSection
RtlEnumProcessHeaps
RtlEnumerateGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlEqualComputerName
RtlEqualDomainName
RtlEqualLuid
RtlEqualPrefixSid
RtlEqualSid
RtlEqualString
RtlEqualUnicodeString
RtlEraseUnicodeString
RtlExpandEnvironmentStrings_U
RtlExtendHeap
RtlExtendedIntegerMultiply
RtlExtendedLargeIntegerDivide
RtlExtendedMagicDivide
RtlFillMemory
RtlFillMemoryUlong
RtlFindClearBits
RtlFindClearBitsAndSet
RtlFindLastBackwardRunClear
RtlFindLeastSignificantBit
RtlFindLongestRunClear
RtlFindMessage
RtlFindMostSignificantBit
RtlFindNextForwardRunClear
RtlFindRange
RtlFindSetBits
RtlFindSetBitsAndClear
RtlFirstFreeAce
RtlFormatCurrentUserKeyPath
RtlFormatMessage
RtlFreeAnsiString
RtlFreeHandle
RtlFreeHeap
RtlFreeOemString
RtlFreeRangeList
RtlFreeSid
RtlFreeUnicodeString
RtlFreeUserThreadStack
RtlGUIDFromString
RtlGenerate8dot3Name
RtlGetAce
RtlGetCallersAddress
RtlGetCompressionWorkSpaceSize
RtlGetControlSecurityDescriptor
RtlGetCurrentDirectory_U
RtlGetDaclSecurityDescriptor
RtlGetElementGenericTable
RtlGetFirstRange
RtlGetFullPathName_U
RtlGetGroupSecurityDescriptor
RtlGetLongestNtPathLength
RtlGetNextRange
RtlGetNtGlobalFlags
RtlGetNtProductType
RtlGetOwnerSecurityDescriptor
RtlGetProcessHeaps
RtlGetSaclSecurityDescriptor
RtlGetSecurityDescriptorRMControl
RtlGetUserInfoHeap
RtlGetVersion
RtlIdentifierAuthoritySid

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ECODE
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/SYSTEM32/SMSS.EXE
.sys windows:5 windows x86 arch:x86

c2e20b524370d74b18394371d2ce323f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

ntdll

NtOpenKey
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlFreeSid
RtlAllocateAndInitializeSid
NtClose
NtSetSecurityObject
NtOpenFile
RtlInitUnicodeString
LdrUnloadDll
LdrGetProcedureAddress
LdrLoadDll
NtQueryInformationProcess
NtResumeThread
NtWaitForSingleObject
NtTerminateProcess
RtlDestroyProcessParameters
RtlCreateUserProcess
RtlCreateProcessParameters
NtDeleteKey
RtlSetOwnerSecurityDescriptor
NtQueryDirectoryObject
NtFlushVirtualMemory
NtShutdownSystem
NtFsControlFile
NtCreatePagingFile
RtlGetFullPathName_U
wcslen
NtSetEvent
NtDeviceIoControlFile
RtlPcToFileHeader
RtlCreateUserThread
NtCreateFile
NtCreateEvent
NtQuerySystemInformation
NtInitializeRegistry
RtlAdjustPrivilege
DbgBreakPoint
RtlAllocateHeap
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/SYSTRAY.EX_
.cab
I386/T2EMBED.DL_
.cab
I386/TAHOMA.TT_
.cab
I386/TAHOMABD.TT_
.cab
I386/TAPI32.DL_
.cab
I386/TAPISRV.DL_
.cab
I386/TASKMAN.EX_
.cab
I386/TASKMGR.EX_
.cab
I386/TCARC.SY_
.cab
I386/TCLASSES.CA_
.cab
I386/TCPIP.SY_
.cab
I386/TDI.SY_
.cab
I386/TELEPHON.CP_
.cab
I386/TERMCAP._
.cab
I386/TG18D50.IC_
.cab
I386/TG18D65.IC_
.cab
I386/TG18D93.IC_
.cab
I386/TG22D50.IC_
.cab
I386/TG22D65.IC_
.cab
I386/TG22D93.IC_
.cab
I386/THEMES.EX_
.cab
I386/THUMBVW.DL_
.cab
I386/TIMEDATE.CP_
.cab
I386/TIMES.TT_
.cab
I386/TIMESBD.TT_
.cab
I386/TIMESBI.TT_
.cab
I386/TIMESI.TT_
.cab
I386/TRAFFIC.DL_
.cab
I386/TREBUC.TT_
.cab
I386/TREBUCBD.TT_
.cab
I386/TREBUCBI.TT_
.cab
I386/TREBUCIT.TT_
.cab
I386/TSLABELS.H_
.cab
I386/TSLABELS.IN_
.cab
I386/TXFAUX.DL_
.cab
I386/TXTSETUP.SIF
I386/UDFS.SY_
.cab
I386/UFAT.DL_
.cab
I386/UGENUSD.DL_
.cab
I386/UHCD.SY_
.cab
I386/ULIB.DL_
.cab
I386/UMDMXFRM.DL_
.cab
I386/UMPNPMGR.DL_
.cab
I386/UNICODE.NL_
.cab
I386/UNIMDM.TS_
.cab
I386/UNIMDMAT.DL_
.cab
I386/UNIPLAT.DL_
.cab
I386/UNIPROC/KERNEL32.DL_
.cab
I386/UNIPROC/MP2UP.CAT
I386/UNIPROC/MP2UP.INF
I386/UNIPROC/NTDLL.DLL
.dll windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

CsrAllocateCaptureBuffer
CsrAllocateMessagePointer
CsrCaptureMessageBuffer
CsrCaptureMessageString
CsrCaptureTimeout
CsrClientCallServer
CsrClientConnectToServer
CsrFreeCaptureBuffer
CsrIdentifyAlertableThread
CsrNewThread
CsrProbeForRead
CsrProbeForWrite
CsrSetPriorityClass
DbgBreakPoint
DbgPrint
DbgPrintReturnControlC
DbgPrompt
DbgSsHandleKmApiMsg
DbgSsInitialize
DbgUiConnectToDbg
DbgUiContinue
DbgUiWaitStateChange
DbgUserBreakPoint
KiRaiseUserExceptionDispatcher
KiUserApcDispatcher
KiUserCallbackDispatcher
KiUserExceptionDispatcher
LdrAccessResource
LdrAlternateResourcesEnabled
LdrDisableThreadCalloutsForDll
LdrEnumResources
LdrFindEntryForAddress
LdrFindResourceDirectory_U
LdrFindResource_U
LdrFlushAlternateResourceModules
LdrGetDllHandle
LdrGetProcedureAddress
LdrInitializeThunk
LdrLoadAlternateResourceModule
LdrLoadDll
LdrProcessRelocationBlock
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrShutdownProcess
LdrShutdownThread
LdrUnloadAlternateResourceModule
LdrUnloadDll
LdrVerifyImageMatchesChecksum
NPXEMULATORTABLE
NlsAnsiCodePage
NlsMbCodePageTag
NlsMbOemCodePageTag
NtAcceptConnectPort
NtAccessCheck
NtAccessCheckAndAuditAlarm
NtAccessCheckByType
NtAccessCheckByTypeAndAuditAlarm
NtAccessCheckByTypeResultList
NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtAddAtom
NtAdjustGroupsToken
NtAdjustPrivilegesToken
NtAlertResumeThread
NtAlertThread
NtAllocateLocallyUniqueId
NtAllocateUserPhysicalPages
NtAllocateUuids
NtAllocateVirtualMemory
NtAreMappedFilesTheSame
NtAssignProcessToJobObject
NtCallbackReturn
NtCancelDeviceWakeupRequest
NtCancelIoFile
NtCancelTimer
NtClearEvent
NtClose
NtCloseObjectAuditAlarm
NtCompleteConnectPort
NtConnectPort
NtContinue
NtCreateChannel
NtCreateDirectoryObject
NtCreateEvent
NtCreateEventPair
NtCreateFile
NtCreateIoCompletion
NtCreateJobObject
NtCreateKey
NtCreateMailslotFile
NtCreateMutant
NtCreateNamedPipeFile
NtCreatePagingFile
NtCreatePort
NtCreateProcess
NtCreateProfile
NtCreateSection
NtCreateSemaphore
NtCreateSymbolicLinkObject
NtCreateThread
NtCreateTimer
NtCreateToken
NtCreateWaitablePort
NtCurrentTeb
NtDelayExecution
NtDeleteAtom
NtDeleteFile
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeleteValueKey
NtDeviceIoControlFile
NtDisplayString
NtDuplicateObject
NtDuplicateToken
NtEnumerateKey
NtEnumerateValueKey
NtExtendSection
NtFilterToken
NtFindAtom
NtFlushBuffersFile
NtFlushInstructionCache
NtFlushKey
NtFlushVirtualMemory
NtFlushWriteBuffer
NtFreeUserPhysicalPages
NtFreeVirtualMemory
NtFsControlFile
NtGetContextThread
NtGetDevicePowerState
NtGetPlugPlayEvent
NtGetTickCount
NtGetWriteWatch
NtImpersonateAnonymousToken
NtImpersonateClientOfPort
NtImpersonateThread
NtInitializeRegistry
NtInitiatePowerAction
NtIsSystemResumeAutomatic
NtListenChannel
NtListenPort
NtLoadDriver
NtLoadKey
NtLoadKey2
NtLockFile
NtLockVirtualMemory
NtMakeTemporaryObject
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtMapViewOfSection
NtNotifyChangeDirectoryFile
NtNotifyChangeKey
NtNotifyChangeMultipleKeys
NtOpenChannel
NtOpenDirectoryObject
NtOpenEvent
NtOpenEventPair
NtOpenFile
NtOpenIoCompletion
NtOpenJobObject
NtOpenKey
NtOpenMutant
NtOpenObjectAuditAlarm
NtOpenProcess
NtOpenProcessToken
NtOpenSection
NtOpenSemaphore
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadToken
NtOpenTimer
NtPlugPlayControl
NtPowerInformation
NtPrivilegeCheck
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtProtectVirtualMemory
NtPulseEvent
NtQueryAttributesFile
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryDirectoryFile
NtQueryDirectoryObject
NtQueryEaFile
NtQueryEvent
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationPort
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationToken
NtQueryInstallUILanguage
NtQueryIntervalProfile
NtQueryIoCompletion
NtQueryKey
NtQueryMultipleValueKey
NtQueryMutant
NtQueryObject
NtQueryOpenSubKeys
NtQueryPerformanceCounter
NtQueryQuotaInformationFile
NtQuerySection
NtQuerySecurityObject
NtQuerySemaphore
NtQuerySymbolicLinkObject
NtQuerySystemEnvironmentValue
NtQuerySystemInformation
NtQuerySystemTime
NtQueryTimer
NtQueryTimerResolution
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtQueueApcThread
NtRaiseException
NtRaiseHardError
NtReadFile
NtReadFileScatter
NtReadRequestData
NtReadVirtualMemory
NtRegisterThreadTerminatePort
NtReleaseMutant
NtReleaseSemaphore
NtRemoveIoCompletion
NtReplaceKey
NtReplyPort
NtReplyWaitReceivePort
NtReplyWaitReceivePortEx
NtReplyWaitReplyPort
NtReplyWaitSendChannel
NtRequestDeviceWakeup
NtRequestPort
NtRequestWaitReplyPort
NtRequestWakeupLatency
NtResetEvent
NtResetWriteWatch
NtRestoreKey
NtResumeThread
NtSaveKey
NtSaveMergedKeys
NtSecureConnectPort
NtSendWaitReplyChannel
NtSetContextChannel
NtSetContextThread
NtSetDefaultHardErrorPort
NtSetDefaultLocale
NtSetDefaultUILanguage
NtSetEaFile
NtSetEvent
NtSetHighEventPair
NtSetHighWaitLowEventPair
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationObject
NtSetInformationProcess
NtSetInformationThread
NtSetInformationToken
NtSetIntervalProfile
NtSetIoCompletion
NtSetLdtEntries
NtSetLowEventPair
NtSetLowWaitHighEventPair
NtSetQuotaInformationFile
NtSetSecurityObject
NtSetSystemEnvironmentValue
NtSetSystemInformation
NtSetSystemPowerState
NtSetSystemTime
NtSetThreadExecutionState
NtSetTimer
NtSetTimerResolution
NtSetUuidSeed
NtSetValueKey
NtSetVolumeInformationFile
NtShutdownSystem
NtSignalAndWaitForSingleObject
NtStartProfile
NtStopProfile
NtSuspendThread
NtSystemDebugControl
NtTerminateJobObject
NtTerminateProcess
NtTerminateThread
NtTestAlert
NtUnloadDriver
NtUnloadKey
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtVdmControl
NtWaitForMultipleObjects
NtWaitForSingleObject
NtWaitHighEventPair
NtWaitLowEventPair
NtWriteFile
NtWriteFileGather
NtWriteRequestData
NtWriteVirtualMemory
NtYieldExecution
PfxFindPrefix
PfxInitialize
PfxInsertPrefix
PfxRemovePrefix
PropertyLengthAsVariant
RestoreEm87Context
RtlAbortRXact
RtlAbsoluteToSelfRelativeSD
RtlAcquirePebLock
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedAce
RtlAddAccessDeniedAceEx
RtlAddAccessDeniedObjectAce
RtlAddAce
RtlAddActionToRXact
RtlAddAtomToAtomTable
RtlAddAttributeActionToRXact
RtlAddAuditAccessAce
RtlAddAuditAccessAceEx
RtlAddAuditAccessObjectAce
RtlAddCompoundAce
RtlAddRange
RtlAdjustPrivilege
RtlAllocateAndInitializeSid
RtlAllocateHandle
RtlAllocateHeap
RtlAnsiCharToUnicodeChar
RtlAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlAppendAsciizToString
RtlAppendStringToString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlApplyRXact
RtlApplyRXactNoFlush
RtlAreAllAccessesGranted
RtlAreAnyAccessesGranted
RtlAreBitsClear
RtlAreBitsSet
RtlAssert
RtlCallbackLpcClient
RtlCancelTimer
RtlCaptureStackBackTrace
RtlCharToInteger
RtlCheckForOrphanedCriticalSections
RtlCheckRegistryKey
RtlClearAllBits
RtlClearBits
RtlCompactHeap
RtlCompareMemory
RtlCompareMemoryUlong
RtlCompareString
RtlCompareUnicodeString
RtlCompressBuffer
RtlConsoleMultiByteToUnicodeN
RtlConvertExclusiveToShared
RtlConvertLongToLargeInteger
RtlConvertPropertyToVariant
RtlConvertSharedToExclusive
RtlConvertSidToUnicodeString
RtlConvertToAutoInheritSecurityObject
RtlConvertUiListToApiList
RtlConvertUlongToLargeInteger
RtlConvertVariantToProperty
RtlCopyLuid
RtlCopyLuidAndAttributesArray
RtlCopyRangeList
RtlCopySecurityDescriptor
RtlCopySid
RtlCopySidAndAttributesArray
RtlCopyString
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateAndSetSD
RtlCreateAtomTable
RtlCreateEnvironment
RtlCreateHeap
RtlCreateLpcServer
RtlCreateProcessParameters
RtlCreateQueryDebugBuffer
RtlCreateRegistryKey
RtlCreateSecurityDescriptor
RtlCreateTagHeap
RtlCreateTimer
RtlCreateTimerQueue
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlCreateUserProcess
RtlCreateUserSecurityObject
RtlCreateUserThread
RtlCustomCPToUnicodeN
RtlCutoverTimeToSystemTime
RtlDeNormalizeProcessParams
RtlDebugPrintTimes
RtlDecompressBuffer
RtlDecompressFragment
RtlDefaultNpAcl
RtlDelete
RtlDeleteAce
RtlDeleteAtomFromAtomTable
RtlDeleteCriticalSection
RtlDeleteElementGenericTable
RtlDeleteNoSplay
RtlDeleteOwnersRanges
RtlDeleteRange
RtlDeleteRegistryValue
RtlDeleteResource
RtlDeleteSecurityObject
RtlDeleteTimer
RtlDeleteTimerQueue
RtlDeleteTimerQueueEx
RtlDeregisterWait
RtlDeregisterWaitEx
RtlDestroyAtomTable
RtlDestroyEnvironment
RtlDestroyHandleTable
RtlDestroyHeap
RtlDestroyProcessParameters
RtlDestroyQueryDebugBuffer
RtlDetermineDosPathNameType_U
RtlDnsHostNameToComputerName
RtlDoesFileExists_U
RtlDosPathNameToNtPathName_U
RtlDosSearchPath_U
RtlDowncaseUnicodeString
RtlDumpResource
RtlEmptyAtomTable
RtlEnableEarlyCriticalSectionEventCreation
RtlEnlargedIntegerMultiply
RtlEnlargedUnsignedDivide
RtlEnlargedUnsignedMultiply
RtlEnterCriticalSection
RtlEnumProcessHeaps
RtlEnumerateGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlEqualComputerName
RtlEqualDomainName
RtlEqualLuid
RtlEqualPrefixSid
RtlEqualSid
RtlEqualString
RtlEqualUnicodeString
RtlEraseUnicodeString
RtlExpandEnvironmentStrings_U
RtlExtendHeap
RtlExtendedIntegerMultiply
RtlExtendedLargeIntegerDivide
RtlExtendedMagicDivide
RtlFillMemory
RtlFillMemoryUlong
RtlFindClearBits
RtlFindClearBitsAndSet
RtlFindLastBackwardRunClear
RtlFindLeastSignificantBit
RtlFindLongestRunClear
RtlFindMessage
RtlFindMostSignificantBit
RtlFindNextForwardRunClear
RtlFindRange
RtlFindSetBits
RtlFindSetBitsAndClear
RtlFirstFreeAce
RtlFormatCurrentUserKeyPath
RtlFormatMessage
RtlFreeAnsiString
RtlFreeHandle
RtlFreeHeap
RtlFreeOemString
RtlFreeRangeList
RtlFreeSid
RtlFreeUnicodeString
RtlFreeUserThreadStack
RtlGUIDFromString
RtlGenerate8dot3Name
RtlGetAce
RtlGetCallersAddress
RtlGetCompressionWorkSpaceSize
RtlGetControlSecurityDescriptor
RtlGetCurrentDirectory_U
RtlGetDaclSecurityDescriptor
RtlGetElementGenericTable
RtlGetFirstRange
RtlGetFullPathName_U
RtlGetGroupSecurityDescriptor
RtlGetLongestNtPathLength
RtlGetNextRange
RtlGetNtGlobalFlags
RtlGetNtProductType
RtlGetOwnerSecurityDescriptor
RtlGetProcessHeaps
RtlGetSaclSecurityDescriptor
RtlGetSecurityDescriptorRMControl
RtlGetUserInfoHeap
RtlGetVersion
RtlIdentifierAuthoritySid

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ECODE
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
I386/UNIPROC/WIN32K.SY_
.cab
I386/UNIPROC/WINSRV.DL_
.cab
I386/UNKNOWN.IN_
.cab
I386/UNLODCTR.EX_
.cab
I386/UNSECAPP.EX_
.cab
I386/UNTFS.DL_
.cab
I386/UPDATE.SY_
.cab
I386/UPWIZUN.EX_
.cab
I386/URL.DL_
.cab
I386/URLMON.DL_
.cab
I386/USB.IN_
.cab
I386/USBD.SY_
.cab
I386/USBHUB.SY_
.cab
I386/USBSTOR.IN_
.cab
I386/USBSTOR.SY_
.cab
I386/USER.EX_
.cab
I386/USER32.DL_
.cab
I386/USERENV.DL_
.cab
I386/USERINIT.EX_
.cab
I386/USP10.DL_
.cab
I386/UTILDLL.DL_
.cab
I386/VDMDBG.DL_
.cab
I386/VERDANA.TT_
.cab
I386/VERDANAB.TT_
.cab
I386/VERDANAI.TT_
.cab
I386/VERDANAZ.TT_
.cab
I386/VERIFIER.EX_
.cab
I386/VERSION.DL_
.cab
I386/VGA.DL_
.cab
I386/VGA.SY_
.cab
I386/VGA256.DL_
.cab
I386/VGA64K.DL_
.cab
I386/VGA850.FO_
.cab
I386/VGA860.FO_
.cab
I386/VGA861.FO_
.cab
I386/VGA863.FO_
.cab
I386/VGA865.FO_
.cab
I386/VGAFIX.FO_
.cab
I386/VGAOEM.FO_
.cab
I386/VGASYS.FO_
.cab
I386/VGX.DL_
.cab
I386/VIDEOPRT.SY_
.cab
I386/VMMREG32.DL_
.cab
I386/VOLUME.IN_
.cab
I386/W32TIME.DL_
.cab
I386/W32TM.EX_
.cab
I386/W32TOPL.DL_
.cab
I386/WANMGFR.IN_
.cab
I386/WANMGS.IN_
.cab
I386/WAVE.IN_
.cab
I386/WBEMADS.TL_
.cab
I386/WBEMDISP.TL_
.cab
I386/WBEMSNMP.EX_
.cab
I386/WBEMTEST.EX_
.cab
I386/WDL.TR_
.cab
I386/WDMAUDIO.IN_
.cab
I386/WEXTRACT.EX_
.cab
I386/WFC.CA_
.cab
I386/WIN.IN_
.cab
I386/WINGDING.TT_
.cab
I386/WININET.DL_
.cab
I386/WINLOGON.EX_
.cab
I386/WINMGMT.EX_
.cab
I386/WINMGMTR.DL_
.cab
I386/WINMM.DL_
.cab
I386/WINNT.SIF
I386/WINREP.EX_
.cab
I386/WINRNR.DL_
.cab
I386/WINSCARD.DL_
.cab
I386/WINSPOOL.DR_
.cab
I386/WINSTA.DL_
.cab
I386/WINSTRM.DL_
.cab
I386/WINTRUST.DL_
.cab
I386/WINVER.EX_
.cab
I386/WKSSVC.DL_
.cab
I386/WLDAP32.DL_
.cab
I386/WMI.DL_
.cab
I386/WMICORE.DL_
.cab
I386/WMILIB.SY_
.cab
I386/WMIMGMT.MS_
.cab
I386/WMP.AD_
.cab
I386/WS2HELP.DL_
.cab
I386/WS2IFSL.SY_
.cab
I386/WS2_32.DL_
.cab
I386/WSCRIPT.EX_
.cab
I386/WSH.INF
I386/WSHATM.DL_
.cab
I386/WSHEXT.DL_
.cab
I386/WSHIRDA.DL_
.cab
I386/WSHNETBS.DL_
.cab
I386/WSHTCPIP.DL_
.cab
I386/WSNMP32.DL_
.cab
I386/WSOCK32.DL_
.cab
I386/WTSAPI32.DL_
.cab
I386/WTTSS22.DL_
.cab
I386/WUICON1.GI_
.cab
I386/WUICON2.GI_
.cab
I386/WUICON3.GI_
.cab
I386/WULOGO.GI_
.cab
I386/WUM.HT_
.cab
I386/WUPDINFO.DL_
.cab
I386/XACTSRV.DL_
.cab
I386/XMLDSOC.CA_
.cab
I386/XRDT1354.PP_
.cab
I386/XR_DC230.PP_
.cab
[BOOT]/Boot-NoEmul.img

Sharing

General

Malware Config

Signatures

Files

cbeb585dc924cd0684fa3daaf8e0dd29

Headers

File Characteristics

Imports

ntdll

Sections

.text Size: 307KB - Virtual size: 306KB

.data Size: 58KB - Virtual size: 69KB

.rsrc Size: 171KB - Virtual size: 170KB

.reloc Size: 8KB - Virtual size: 7KB

d187783b1b368c4a8d7a7c7c3605ca5a

Headers

File Characteristics

Imports

ntdll

Sections

.text Size: 299KB - Virtual size: 299KB

.data Size: 58KB - Virtual size: 69KB

.rsrc Size: 171KB - Virtual size: 170KB

.reloc Size: 8KB - Virtual size: 7KB

ea4cbf3c305bfb43c7e36a485e58acb4

Headers

File Characteristics

Imports

kernel32

ole32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.data Size: 1024B - Virtual size: 10KB

.rsrc Size: 1024B - Virtual size: 968B

.reloc Size: 1024B - Virtual size: 1016B

29ba6cfb5bc74e73404bb0c1dc60e0db

Headers

File Characteristics

Imports

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 149KB - Virtual size: 148KB

.data Size: 1KB - Virtual size: 8KB

.rsrc Size: 1024B - Virtual size: 968B

.reloc Size: 6KB - Virtual size: 5KB

98e35e16b753386463b746ee6beee217

Headers

File Characteristics

Imports

kernel32

user32

ole32

advapi32

crypt32

userenv

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 127KB

.data Size: 6KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

cc7deb629b8ef60be772cd3f2c2c4b20

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

cabinet

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 2KB

.text
Size: 307KB - Virtual size: 306KB

.data
Size: 58KB - Virtual size: 69KB

.rsrc
Size: 171KB - Virtual size: 170KB

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 299KB - Virtual size: 299KB

.data
Size: 58KB - Virtual size: 69KB

.rsrc
Size: 171KB - Virtual size: 170KB

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 50KB - Virtual size: 49KB

.data
Size: 1024B - Virtual size: 10KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 1024B - Virtual size: 1016B

.text
Size: 149KB - Virtual size: 148KB

.data
Size: 1KB - Virtual size: 8KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 6KB - Virtual size: 5KB

.text
Size: 128KB - Virtual size: 127KB

.data
Size: 6KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 4KB

.text
Size: 63KB - Virtual size: 63KB

_INIT16
Size: 96B - Virtual size: 69B

.data
Size: 35KB - Virtual size: 35KB

PAGELK
Size: 3KB - Virtual size: 3KB

PAGE
Size: 15KB - Virtual size: 15KB

.edata
Size: 3KB - Virtual size: 3KB

INIT
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 960B - Virtual size: 944B

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 34KB - Virtual size: 34KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 112KB - Virtual size: 111KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 512B - Virtual size: 192B

.text
Size: 335KB - Virtual size: 334KB

.rdata
Size: 186KB - Virtual size: 185KB

.data
Size: 4KB - Virtual size: 5KB