d:\NsStudio\Tools\Baymax\PatchUi\res\x64\PYG64.pdb
Static task
static1
General
-
Target
eazytech_filma_9.4.5.10 filmora.zip
-
Size
289.0MB
-
MD5
0dd5e080b2f79b8b54a2066c9c2dd2b3
-
SHA1
07c73d9a80cbfdae23b6218a9b95386a59cae178
-
SHA256
469169dd056d9ee6e88ef5bca4345a7eccc0ad8844c9c32910c5c6c920d26cef
-
SHA512
32c5a9e8823a4457c610c48c43bb7b2298de9a7fee5bc0a8878238733cc23488bceea6bd9a2d74c9b111bed3af270d972f9dcd53eb7909a45d98f2620530bea3
-
SSDEEP
6291456:d4Eh2Ln19fNDG91Virtuxam529obPtPE3tv0uXZMa6Q874PYb:/IGHGuN2W5PEtPZAQ8Xb
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/eazytech_filma_9.4.5.10/Wondershare Filmora_9.4.5.10/Crack/PYG64.dll unpack001/eazytech_filma_9.4.5.10/Wondershare Filmora_9.4.5.10/Crack/winmm.dll
Files
-
eazytech_filma_9.4.5.10 filmora.zip.zip
-
eazytech_filma_9.4.5.10/Wondershare Filmora_9.4.5.10/Crack/PYG64.dll.dll windows:5 windows x64 arch:x64
bbceac87f8d480082f9cf1b4cca7cd9d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EndPaint
advapi32
RegCloseKey
shell32
ShellExecuteW
ole32
CoTaskMemAlloc
oleaut32
VarUI4FromStr
shlwapi
StrCmpIW
version
GetFileVersionInfoW
gdi32
SaveDC
Exports
Exports
ChinaPYG
Yh��ͦ�ak�����g'�;�����-HHZS�s<�#���Mj\e��c���j�w����-�anA����%�{CX��e�'!��YI\�b��������Ģ]"6Xc��4�#����:H,��G��IN�㕱k&̘���3qm�<b}w�Q���7�wcl�Z��[r�a�b�9k+�%�M���H�C����;�9Rf���\��4�hbv��bܷ��Y����X� E��w|����:/���S�a�)�~aœLS��a0�ꗲ� �����>>�9�{ڴjT�����P� <��� S����Ă^�X���b�������g�=�EYN��u�l����ΙRg;��(�%����E@�A��=��p�$ ���r�A�8���<[�J�?Ђ���}4����9iL�z&E#h[:SD��h���y���*�; ����Y �Y�`@�ml|X!������d������L-N��a���zY�g_)\�u�K��K�yYp|�(Y+�}=��d(�<4D�/ɀ6�lYIOex������C!�d���bJ�GMDa�Ҝ�T�)h���S�腼[�Ei����?��Y����-��?,��+���6-����B�î �6ڧ�d�_mV����F����V�����n9,S�a�=�{�{�Q&c�,�`{��pėb�;�� P��L�V4����IoLo���k\����,d�RI�?�en.���q����8��*��63ր�^2x���.EّdXD�$ gc��k����iE������`IR牋� 8�����W;��,����2������_���ж� �l�_ߣ�8 ml�(��������P=g������3���6a����ԯ��I0�y0��L���.@��������vj�6�s��r����СQd���^1c���a�`�?գ����)��@�Rv^�@g'�<�/7��g;8�Ĭ��~-�jz��Y�q��ϸ��� ��)G'������_�L#��JP����ӖYwM]jX�}W&�^ �!J�eaݳY{��)ϳ�g�xe!���!���l� k3,!v-vU�D.���wO�zL���M�W�M�$OM;M�'PEm��H`ˣ�F{˦qz�ИH#諨e�!���l�!�N����.����q�a5�iC6r��3��s�u�����q�.�K`M��6� �'5)���m�$�ݨ~S���<~���º1���p ��WP��Ѳ��Kam��V�f�V{��>��y}��?��d6�y%x[½Ә�o������S\)�*E�D1z|a{z���� �M�tfc�#2�:9���", Q�mh�6�]�˭�����˕��j�ˁ� �;�U�'Dx�y�&s���s�+�����^��.���� [C�K�%��n��]�l��r⑃�D����wx�?�q�%�gJ.���'*Y�����F���+TV���-�{�@�0� ���O�c�&^s���w�,&({W�@��H�� ���j�Ŕ�c��-H(P�����݅1�B(�Z��^ �&uX/ڱ��^E\.1=�U���'�-%s�Ñ&C��x� qtf���t%�����ű��Uյ���Hf�Q,���~e���1�ӄS�4[�.k�~�z���>qk\J��5�Y�Mv^V�ɭt�Dg�3��V��%k�(�a�w�Ďz#M ����!$�b���h�����֗��9e��\3!?�9z�V[�ETU���A�3�>��{r2���_��.uWqi�����2~��������^���ʿ"/,C`$fGs���[5�9i���b�?�/��t�|���|��2���4��̹�DB�V�(�\�lM���{5D���7�pYf<{�����Z�C���v��[�_�!l+/uv�P��oH*#�<�����'�E�7���OcT���Vm��O�/�r��� 1����-q���-� �yZÊt�%�o B�\�B�j���<9ڐ�ռ;�.�ī�˒Џ�w���k��&�(7����>����~��_��C���)�f�;%s ��~� ��5�db�7 ����0U�m�"����a�d��J��p���D�@R�W�������-O�F�G�+���\A�Bl~��b���bJ�d����� � o�i=��.6P�GW"[���ɓ��1��n�V7�4�'��~�47����N3�'��,9�8 �tC��ź�� ���v�y��Dܯ���Q� �+ڋO[����p>�Ý�Q���3�S�|\r֠Z.*Ұ.aT3zch��<<@��Bdlz����А�9`���=b$CI?[��;�U�� AAga��au��h+J��g�l���s�$�t`̒���k� ���Ƀ+�%��%�*P5�%TՄg�Y&\�l��F~M �m� 8s� {"H-�mF=�I<;�d�nk��8]�� }�����}e��?�%�|�Q��6)��Ϧ1��6��M�ٙ��e�3�<w0�V�m�������Ux�0�� ݲb������8�B�&͋.%T�Zf�q�ul��L9ņ?�����Y����]D��t�����u�V���.s�A�pmA_���J���P)��z 0s�����rϲ��+������`��S5�z�_W�Ǘ 7����̲�Ze���ī���^���m&��p�c��(���p#���i5oC�Gp\�U�Ӭ��eq����ɋ����MU�H5@����`�l���h7v;���҅�"�3<N� !���4>�0�'xIM�d���zV�BWo�o���o��S#�7 �k�r�5ly_����J�g���`dejd�@��)��!�0�t�7uj���U;g���D�x_�BA5� �F�Y�������Z��1�Ƹ������N5�m�Ns�7$Ђ'{��/�p��o�C��{����#�v�����I�,�4p� SŨ�n���4�;�ѭ���g00&]����*��i�����?��M���Sc �ӬPb��2��*<R $ľ���U�D���j������ g�TV��0��n�v�B�XL��o��?�=uu������dU^/x�`��%���lo�V���Y3+~��A�_[=l
Sections
.text Size: - Virtual size: 449KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Baymax0 Size: - Virtual size: 685KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 948KB - Virtual size: 948KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
eazytech_filma_9.4.5.10/Wondershare Filmora_9.4.5.10/Crack/winmm.dll.dll windows:5 windows x64 arch:x64
8b990a02d9eff7bd4479034e75c91c23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
d:\NsStudio\Tools\Baymax x64\InjectDllx64\bin\winmm.pdb
Imports
kernel32
DisableThreadLibraryCalls
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
GetCommandLineW
GetTickCount
Sleep
ExitProcess
CreateThread
GetModuleFileNameW
LoadLibraryW
OutputDebugStringW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapSize
GetModuleHandleW
RtlUnwindEx
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
shlwapi
SHGetValueW
PathRemoveFileSpecW
user32
FindWindowW
RegisterWindowMessageW
SendMessageW
shell32
CommandLineToArgvW
Exports
Exports
CloseDriver
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
OpenDriver
PlaySound
PlaySoundA
PlaySoundW
SendDriverMessage
WOWAppExit
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
joyConfigChanged
joyGetDevCapsA
joyGetDevCapsW
joyGetNumDevs
joyGetPos
joyGetPosEx
joyGetThreshold
joyReleaseCapture
joySetCapture
joySetThreshold
mciDriverNotify
mciDriverYield
mciExecute
mciFreeCommandResource
mciGetCreatorTask
mciGetDeviceIDA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDFromElementIDW
mciGetDeviceIDW
mciGetDriverData
mciGetErrorStringA
mciGetErrorStringW
mciGetYieldProc
mciLoadCommandResource
mciSendCommandA
mciSendCommandW
mciSendStringA
mciSendStringW
mciSetDriverData
mciSetYieldProc
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
mmsystemGetVersion
sndPlaySoundA
sndPlaySoundW
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetSystemTime
timeGetTime
timeKillEvent
timeSetEvent
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 668B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
eazytech_filma_9.4.5.10/Wondershare Filmora_9.4.5.10/Wondershare Filmora_9.4.5.10.exe.exe windows:5 windows x86 arch:x86
483f0c4259a9148c34961abbda6146c1
Code Sign
0a:9f:96:aa:bf:b5:da:c0:f2:9f:56:5d:33:ff:1a:f6Certificate
IssuerCN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before27/02/2020, 00:00Not After11/04/2022, 12:00SubjectCN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before11/02/2011, 12:00Not After10/02/2026, 12:00SubjectCN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate
IssuerCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/10/2019, 00:00Not After17/10/2030, 00:00SubjectCN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before07/01/2016, 12:00Not After07/01/2031, 12:00SubjectCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22/10/2013, 12:00Not After22/10/2028, 12:00SubjectCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:bc:d7:f9:30:84:77:c3:84:6b:c9:54:78:fa:65:68Certificate
IssuerCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before27/02/2020, 00:00Not After11/04/2022, 12:00SubjectCN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate
IssuerCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/10/2019, 00:00Not After17/10/2030, 00:00SubjectCN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before07/01/2016, 12:00Not After07/01/2031, 12:00SubjectCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ad:a7:6b:40:10:11:c3:1f:f2:cd:9b:82:d1:24:86:af:52:c4:47:2f:a8:77:4b:25:d4:85:d1:6a:6d:73:08:78Signer
Actual PE Digestad:a7:6b:40:10:11:c3:1f:f2:cd:9b:82:d1:24:86:af:52:c4:47:2f:a8:77:4b:25:d4:85:d1:6a:6d:73:08:78Digest Algorithmsha256PE Digest Matchestrue3e:78:e4:52:a8:5b:c2:57:ba:b9:be:3b:0f:23:c9:b2:72:e1:34:25Signer
Actual PE Digest3e:78:e4:52:a8:5b:c2:57:ba:b9:be:3b:0f:23:c9:b2:72:e1:34:25Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSection
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CloseHandle
Sleep
comctl32
InitCommonControls
Sections
.text Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 21KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 357KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ