NewLoader[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

NewLoader.zip
Size

105.3MB
MD5

cb3d9f5ad95dbcb0507af2b08730ad9f
SHA1

9512bbb12fc919f1338069df5677829d09b646e0
SHA256

9f60a00eedeee1b382a1ee47209c8c056a4ebbfbf45726aaa1f0909371b3ca9e
SHA512

3e547ab95a505013c63af5bf713493cced0dd63e6e66ec346df00e4181457137f9b3fb420db5bec246907e1ed07bf0e54d22615c8e4d4cebc938b90c9b820d75
SSDEEP

3145728:2LgO9FPp8U4Um3oV79RkBMxRUqv6Z/gGotPJhIy:Kg+lp8Um4Ve+ViVePF

Score

3^/10

Malware Config

Signatures

Unsigned PE 16 IoCs

Checks for missing Authenticode signature.

resource
unpack001/LoaderDownloader.exe
unpack003/$PLUGINSDIR/LangDLL.dll
unpack003/$PLUGINSDIR/StartMenu.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsDialogs.dll
unpack003/$R0
unpack003/Codec/rtvcvfw32.dll
unpack003/RTFC.dll
unpack003/RTMUI.dll
unpack003/RTUI.dll
unpack001/chrome_elf.dll
unpack001/libEGL.dll
unpack001/libGLESv2.dll
unpack001/libcef.dll
unpack001/libcurl.dll
unpack001/zlib1.dll

Files

NewLoader.zip
.zip
LoaderDownloader.exe
.exe windows:6 windows x64 arch:x64

1d631316b01a605a68b2592c84fa2c70

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Venom\Sources\Loader\loader-downloader\x64\Release\LoaderDownloader.pdb

Imports

kernel32

GlobalFree
VerSetConditionMask
GetLastError
FormatMessageW
GetModuleHandleA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
LocalFree
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitOnceComplete
InitOnceBeginInitialize
TerminateProcess
VerifyVersionInfoW
FormatMessageA
GetCurrentProcess
GetModuleFileNameA
SetUnhandledExceptionFilter
CloseHandle

shell32

ShellExecuteExA

msvcp140

?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Random_device@std@@YAIXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?uncaught_exceptions@std@@YAHXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?classic@locale@std@@SAAEBV12@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_broadcast
?_Xinvalid_argument@std@@YAXPEBD@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_Throw_C_error@std@@YAXH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z
?_Xbad_function_call@std@@YAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Winerror_map@std@@YAHH@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?uncaught_exception@std@@YA_NXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCompare@@YA_NPEBX0@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CryptUnprotectMemory
CertVerifyCertificateChainPolicy

bcrypt

BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptDestroyHash
BCryptGetProperty

winhttp

WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSetStatusCallback
WinHttpQueryOption
WinHttpSendRequest
WinHttpOpenRequest
WinHttpGetDefaultProxyConfiguration
WinHttpOpen
WinHttpQueryAuthSchemes
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpReceiveResponse
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryDataAvailable

libcurl

curl_easy_perform
curl_easy_cleanup
curl_easy_init
curl_easy_getinfo
curl_easy_setopt

vcruntime140

__std_exception_copy
__current_exception
__current_exception_context
memcmp
__std_terminate
_purecall
memset
__std_exception_destroy
__C_specific_handler
memmove
memcpy
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_set_app_type
abort
_invalid_parameter_noinfo_noreturn
_errno
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_cexit
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
system
_seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

fopen_s
fgetpos
fclose
fwrite
_get_stream_buffer_pointers
fflush
__stdio_common_vsprintf_s
fgetc
fread
__p__commode
_set_fmode
__stdio_common_vsprintf
ungetc
setvbuf
_fseeki64
fsetpos
fputc

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
free
malloc

api-ms-win-crt-filesystem-l1-1-0

remove
_lock_file
_unlock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

isdigit
isalpha

api-ms-win-crt-convert-l1-1-0

wcstol

concrt140

??0_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ
??1_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ

Sections

.text
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RivaTuner.zip
.zip
RTSSSetup733.exe
.exe windows:4 windows x86 arch:x86

6e7f9a29f2c85394521a08b9f31f6275

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:25:50:7d:1e:f0:2b:01:1b:4f:d1:07:9b:0a:0b:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08-03-2020 00:00

Not After

08-03-2022 23:59

Subject

CN=Alexey Nicolaychuk,O=Alexey Nicolaychuk,POSTALCODE=347900,STREET=Chekhov street 56A\, flat 3,L=Taganrog,ST=Rostov Oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:66:14:5a:43:6f:73:06:b6:58:7c:d8:f0:d1:9a:47:9d:50:8f:00
Signer

Actual PE Digest

61:66:14:5a:43:6f:73:06:b6:58:7c:d8:f0:d1:9a:47:9d:50:8f:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
SetWindowPos
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersion
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
ExitProcess
CopyFileW
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

3e8d18bb71c7ebbda2ddc2a4bb03547b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
GlobalFree
lstrcpynW
lstrcmpW
GlobalAlloc
MulDiv
GetModuleHandleW
lstrcpyW

user32

DialogBoxParamW
SetDlgItemTextW
SendDlgItemMessageW
EndDialog
SetWindowTextW
LoadIconW
ShowWindow
SendMessageW
GetDC

gdi32

GetDeviceCaps
CreateFontIndirectW
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

80469f6834e579db68a646d49780b9d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatW
FindClose
FindNextFileW
lstrcmpW
GetModuleHandleW
lstrcmpiW
MulDiv
lstrcpynW
GlobalAlloc
lstrcpyW
FindFirstFileW
GlobalFree

user32

GetMessageW
TranslateMessage
PostMessageW
DispatchMessageW
GetDlgItem
GetWindowLongW
CheckDlgButton
ShowWindow
LoadIconW
GetClientRect
MoveWindow
DestroyWindow
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextW
SendMessageW
IsDlgButtonChecked
GetWindowTextW
CreateDialogParamW
SetWindowLongW
wsprintfW
ScreenToClient
IsDialogMessageW
CallWindowProcW

gdi32

GetTextMetricsW
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

6b5c4f7d679059f68f1269aad3a5cecd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc

user32

DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW

gdi32

SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0
.dll windows:5 windows x86 arch:x86

b680f9b10ce901a068c1d08f94242b90

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

DefDriverProc

kernel32

lstrcmpiA
SetStdHandle
WriteConsoleW
ReadFile
GetEnvironmentStringsW
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetLastError
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
CreateFileA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
MultiByteToWideChar
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CloseHandle
WriteConsoleA
GetConsoleOutputCP

user32

GetDesktopWindow

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Exports

Exports

Configure
DriverProc

Sections

.text
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Codec/rtvcvfw32.dll
.dll windows:5 windows x86 arch:x86

b680f9b10ce901a068c1d08f94242b90

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

DefDriverProc

kernel32

lstrcmpiA
SetStdHandle
WriteConsoleW
ReadFile
GetEnvironmentStringsW
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetLastError
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
CreateFileA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
MultiByteToWideChar
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CloseHandle
WriteConsoleA
GetConsoleOutputCP

user32

GetDesktopWindow

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Exports

Exports

Configure
DriverProc

Sections

.text
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EncoderServer.cfg
EncoderServer.exe
.exe windows:5 windows x86 arch:x86

a15f293c7bf86619273cc75e9fe57307

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:25:50:7d:1e:f0:2b:01:1b:4f:d1:07:9b:0a:0b:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08-03-2020 00:00

Not After

08-03-2022 23:59

Subject

CN=Alexey Nicolaychuk,O=Alexey Nicolaychuk,POSTALCODE=347900,STREET=Chekhov street 56A\, flat 3,L=Taganrog,ST=Rostov Oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2a:6a:0b:a2:03:fe:16:3f:47:14:36:76:50:31:8c:dc:5b:a8:15:a9
Signer

Actual PE Digest

2a:6a:0b:a2:03:fe:16:3f:47:14:36:76:50:31:8c:dc:5b:a8:15:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\RTSS733\EncoderServer\EncoderServer\Release\EncoderServer.pdb

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

mfc90

ord265
ord316
ord2539
ord1611
ord3213
ord305
ord266
ord9252
ord4890
ord3110
ord6001
ord5646
ord5663
ord4981
ord4333
ord5659
ord5657
ord3209
ord2087
ord4199
ord5813
ord6721
ord5533
ord1046
ord4165
ord6018
ord2206
ord2251
ord820
ord6781
ord4159
ord6783
ord4409
ord4434
ord9945
ord7746
ord12597
ord12145
ord13116
ord10284
ord10437
ord9952
ord13174
ord12384
ord5924
ord341
ord617
ord3579
ord3939
ord593
ord795
ord2448
ord3980
ord6002
ord4982
ord5660
ord447
ord699
ord4463
ord904
ord310
ord2447
ord1222
ord601
ord5552
ord4197
ord7312
ord7118
ord4029
ord4952
ord3346
ord6391
ord1755
ord1752
ord4331
ord1497
ord4650
ord5585
ord5497
ord6780
ord4589
ord5647
ord3732
ord5139
ord4688
ord1729
ord6446
ord5668
ord5666
ord958
ord963
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4667
ord3663
ord1884
ord798
ord4760
ord2069
ord2074
ord4030
ord796
ord595
ord1276
ord1137
ord800
ord4733

msvcr90

_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
__CxxFrameHandler3
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
strcpy_s
_setmbcp
memset
_splitpath_s
_stricmp
sprintf_s
_ismbblead
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
strcat_s

kernel32

GetModuleFileNameA
GetPrivateProfileIntA
CloseHandle
CreateFileMappingA
ResumeThread
OpenEventA
MapViewOfFile
UnmapViewOfFile
QueryPerformanceFrequency
GetLastError
WaitForMultipleObjects
QueryPerformanceCounter
CreateEventA
ResetEvent
SetEvent
WaitForSingleObject
CreateMutexA
OpenFile
ReleaseMutex
GetSystemTimeAsFileTime
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
FreeLibrary
GetProcAddress
LoadLibraryA
_lclose
WriteFile
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
SetFilePointer
SetThreadPriority

user32

LoadCursorA
PostMessageA
FindWindowA
EnableWindow
PeekMessageA
KillTimer
SetTimer

comctl32

InitCommonControlsEx

shlwapi

PathRenameExtensionA
PathRemoveFileSpecA

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EncoderServer64.exe
.exe windows:5 windows x64 arch:x64

f0f8078b83e695b13dca006457894b45

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:25:50:7d:1e:f0:2b:01:1b:4f:d1:07:9b:0a:0b:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08-03-2020 00:00

Not After

08-03-2022 23:59

Subject

CN=Alexey Nicolaychuk,O=Alexey Nicolaychuk,POSTALCODE=347900,STREET=Chekhov street 56A\, flat 3,L=Taganrog,ST=Rostov Oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

73:26:ed:3f:8b:4e:a6:5c:50:27:c7:d8:2c:b1:56:cb:d5:0d:78:56
Signer

Actual PE Digest

73:26:ed:3f:8b:4e:a6:5c:50:27:c7:d8:2c:b1:56:cb:d5:0d:78:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Projects\RTSS733\EncoderServer\EncoderServer\Release\EncoderServer.pdb

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

mfc90

ord798
ord265
ord316
ord2380
ord1523
ord3006
ord305
ord266
ord8878
ord4586
ord2907
ord5684
ord5333
ord5350
ord4677
ord4041
ord5346
ord5344
ord3002
ord1966
ord3923
ord5499
ord6348
ord5220
ord1023
ord3897
ord5701
ord2065
ord310
ord4429
ord6407
ord3892
ord6409
ord4112
ord4136
ord9571
ord7372
ord12223
ord11771
ord12742
ord9910
ord10063
ord9578
ord12800
ord12010
ord5609
ord340
ord604
ord3338
ord3685
ord581
ord773
ord2304
ord3726
ord5685
ord4678
ord5347
ord435
ord677
ord4165
ord882
ord2303
ord1188
ord589
ord5239
ord3921
ord6938
ord6744
ord3774
ord4648
ord3133
ord6041
ord1662
ord1659
ord4039
ord1434
ord4346
ord5272
ord5191
ord6406
ord4285
ord5334
ord3488
ord4833
ord4384
ord1636
ord6086
ord5355
ord5353
ord936
ord941
ord945
ord943
ord947
ord2455
ord2475
ord2459
ord2465
ord2463
ord2461
ord2478
ord2473
ord2457
ord2480
ord2468
ord2450
ord2452
ord2470
ord2233
ord2226
ord1556
ord6410
ord3893
ord6408
ord3430
ord5083
ord6012
ord3011
ord1393
ord5295
ord2010
ord1699
ord1698
ord1635
ord5320
ord2602
ord2797
ord2904
ord4410
ord2780
ord2932
ord2605
ord2711
ord2598
ord3809
ord3810
ord3800
ord2709
ord4042
ord4591
ord4363
ord3422
ord1786
ord776
ord4456
ord1949
ord1954
ord3775
ord774
ord1237
ord1103
ord583
ord778
ord2110

msvcr90

_exit
_XcptFilter
__getmainargs
memcpy
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
strcpy_s
_setmbcp
memset
__CxxFrameHandler3
_splitpath_s
_stricmp
sprintf_s
_ismbblead
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_cexit
strcat_s

kernel32

GetModuleFileNameA
GetPrivateProfileIntA
CloseHandle
CreateFileMappingA
ResumeThread
OpenEventA
MapViewOfFile
UnmapViewOfFile
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
ResetEvent
SetEvent
CreateMutexA
OpenFile
ReleaseMutex
SetFilePointer
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
_lclose
WriteFile
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
SetThreadPriority

user32

LoadCursorA
PostMessageA
FindWindowA
EnableWindow
PeekMessageA
KillTimer
SetTimer

comctl32

InitCommonControlsEx

shlwapi

PathRenameExtensionA
PathRemoveFileSpecA

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 766B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTFC.dll
.dll windows:5 windows x86 arch:x86

2ce31a4516736210dec5c4a1446a5bc1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

shlwapi

SHDeleteKeyA

kernel32

GetFileSize
OpenFile
CloseHandle
UnmapViewOfFile
GetLastError
SetLastError
MapViewOfFile
CreateFileMappingA
CreateFileA
ReleaseMutex
_lclose
WriteFile
ReadFile
GetLocalTime
SetFilePointer
WaitForSingleObject
CreateMutexA
GetVersionExA
MultiByteToWideChar
GetProcAddress
GetModuleHandleA
IsDebuggerPresent
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
GetCurrentProcessId
InterlockedExchange
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep

user32

MessageBoxA

advapi32

RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegDeleteValueA

ole32

CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

msvcr90

_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler3
memcpy
memset
sscanf_s
strrchr
_stricmp
_splitpath_s
_crt_debugger_hook
strcpy_s
strlen
pow
strcat_s
sprintf_s
strstr
_strnicmp
_vsnprintf_s
_strupr_s
_strlwr_s
strncpy_s
strchr
wcscmp
fclose
feof
fgets
fseek
isdigit
_fdopen
_sopen_s
strpbrk
_CxxThrowException
?terminate@@YAXXZ
_except_handler4_common
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_purecall

Exports

Exports

??0CCRC32@@QAE@ABV0@@Z
??0CCRC32@@QAE@XZ
??0CFileVersion@@QAE@ABV0@@Z
??0CFileVersion@@QAE@XZ
??0CFormulaLexicalAnalyzer@@QAE@ABV0@@Z
??0CFormulaLexicalAnalyzer@@QAE@XZ
??0CFormulaTranslator@@QAE@ABV0@@Z
??0CFormulaTranslator@@QAE@XZ
??0CFormulaTranslatorVariableProvider@@QAE@ABV0@@Z
??0CFormulaTranslatorVariableProvider@@QAE@XZ
??0CLexicalAnalyzer@@QAE@ABV0@@Z
??0CLexicalAnalyzer@@QAE@XZ
??0CLog@@QAE@ABV0@@Z
??0CLog@@QAE@XZ
??0CMultiString@@QAE@ABV0@@Z
??0CMultiString@@QAE@PBD@Z
??0CMultiString@@QAE@XZ
??0COSVersion@@QAE@ABV0@@Z
??0COSVersion@@QAE@XZ
??0CPtrListLite@@QAE@ABV0@@Z
??0CPtrListLite@@QAE@XZ
??0CPtrStack@@QAE@ABV0@@Z
??0CPtrStack@@QAE@XZ
??0CRegValue@@QAE@ABV0@@Z
??0CRegValue@@QAE@XZ
??0CStringLite@@QAE@ABV0@@Z
??0CStringLite@@QAE@PBD@Z
??0CStringLite@@QAE@PBDH@Z
??0CStringLite@@QAE@XZ
??0CTaskSchedulerInterface@@QAE@ABV0@@Z
??0CTaskSchedulerInterface@@QAE@XZ
??0CTextFile@@QAE@ABV0@@Z
??0CTextFile@@QAE@XZ
??0CTokenString@@QAE@ABV0@@Z
??0CTokenString@@QAE@XZ
??0CWOW64@@QAE@ABV0@@Z
??0CWOW64@@QAE@XZ
??1CCRC32@@UAE@XZ
??1CFileVersion@@UAE@XZ
??1CFormulaLexicalAnalyzer@@UAE@XZ
??1CFormulaTranslator@@UAE@XZ
??1CFormulaTranslatorVariableProvider@@UAE@XZ
??1CLexicalAnalyzer@@UAE@XZ
??1CLog@@UAE@XZ
??1CMultiString@@UAE@XZ
??1COSVersion@@UAE@XZ
??1CPtrListLite@@UAE@XZ
??1CPtrStack@@UAE@XZ
??1CRegValue@@UAE@XZ
??1CStringLite@@UAE@XZ
??1CTaskSchedulerInterface@@UAE@XZ
??1CTextFile@@UAE@XZ
??1CTokenString@@UAE@XZ
??1CWOW64@@UAE@XZ
??4CCRC32@@QAEAAV0@ABV0@@Z
??4CFileVersion@@QAEAAV0@ABV0@@Z
??4CFormulaLexicalAnalyzer@@QAEAAV0@ABV0@@Z
??4CFormulaTranslator@@QAEAAV0@ABV0@@Z
??4CFormulaTranslatorVariableProvider@@QAEAAV0@ABV0@@Z
??4CLexicalAnalyzer@@QAEAAV0@ABV0@@Z
??4CLog@@QAEAAV0@ABV0@@Z
??4CMultiString@@QAEABV0@ABV0@@Z
??4COSVersion@@QAEAAV0@ABV0@@Z
??4CPtrListLite@@QAEAAV0@ABV0@@Z
??4CPtrStack@@QAEAAV0@ABV0@@Z
??4CRegValue@@QAEAAV0@ABV0@@Z
??4CStringLite@@QAEABV0@ABV0@@Z
??4CStringLite@@QAEABV0@D@Z
??4CStringLite@@QAEABV0@PBD@Z
??4CTaskSchedulerInterface@@QAEAAV0@ABV0@@Z
??4CTextFile@@QAEAAV0@ABV0@@Z
??4CTokenString@@QAEAAV0@ABV0@@Z
??4CWOW64@@QAEAAV0@ABV0@@Z
??BCStringLite@@QBEPBDXZ
??H@YA?AVCStringLite@@ABV0@0@Z
??H@YA?AVCStringLite@@ABV0@PBD@Z
??H@YA?AVCStringLite@@PBDABV0@@Z
??YCStringLite@@QAEABV0@ABV0@@Z
??YCStringLite@@QAEABV0@D@Z
??YCStringLite@@QAEABV0@PBD@Z
??_7CCRC32@@6B@
??_7CFileVersion@@6B@
??_7CFormulaLexicalAnalyzer@@6B@
??_7CFormulaTranslator@@6B@
??_7CFormulaTranslatorVariableProvider@@6B@
??_7CLexicalAnalyzer@@6B@
??_7CLog@@6B@
??_7CMultiString@@6B@
??_7COSVersion@@6B@
??_7CPtrListLite@@6B@
??_7CPtrStack@@6B@
??_7CRegValue@@6B@
??_7CStringLite@@6B@
??_7CTaskSchedulerInterface@@6B@
??_7CTextFile@@6B@
??_7CTokenString@@6B@
??_7CWOW64@@6B@
?AddHead@CPtrListLite@@QAEPAUPTR_LIST_NODE@@PAX@Z
?AddIndent@CLog@@QAEKK@Z
?AddTail@CPtrListLite@@QAEPAUPTR_LIST_NODE@@PAX@Z
?AddTask@CTaskSchedulerInterface@@QAEHPBD000@Z
?AddUnhandledLexeme@CLexicalAnalyzer@@QAEXXZ
?AllocLexemeDescData@CLexicalAnalyzer@@QAEXKPAE@Z
?AllocateCopy@CStringLite@@QAEPADXZ
?AllocateCopy@CStringLite@@SAPADPBD@Z
?Analyze@CLexicalAnalyzer@@QAEJPBD@Z
?Append@CLog@@QAEXPBDH@Z
?Append@CMultiString@@QAEXPBD@Z
?AppendCharset@CLexicalAnalyzer@@QAEJD@Z
?AppendCharset@CLexicalAnalyzer@@QAEJDD@Z
?AppendCharset@CLexicalAnalyzer@@QAEJPBD@Z
?AppendHelper@CMultiString@@AAEXPBDK@Z
?AppendJumpTable@CLexicalAnalyzer@@QAEJGGK@Z
?AppendJumpTable@CLexicalAnalyzer@@QAEJGGKD@Z
?AppendJumpTable@CLexicalAnalyzer@@QAEJGGKDD@Z
?AppendJumpTable@CLexicalAnalyzer@@QAEJGGKPBD@Z
?AppendLexemeStr@CLexicalAnalyzer@@QAEXD@Z
?AppendLexemesList@CFormulaLexicalAnalyzer@@AAEJXZ
?AppendMulti@CMultiString@@QAEXPBD@Z
?Calc@CCRC32@@QAEKKPAEK@Z
?Calc@CCRC32@@QAEKKPBD@Z
?Calc@CFormulaTranslator@@QAEJXZ
?CalcAdd@CFormulaTranslator@@AAEHPAUFORMULATRANSLATOR_VALUE_DESC@@0@Z
?CalcDiv@CFormulaTranslator@@AAEHPAUFORMULATRANSLATOR_VALUE_DESC@@0@Z
?CalcMul@CFormulaTranslator@@AAEHPAUFORMULATRANSLATOR_VALUE_DESC@@0@Z
?CalcPow@CFormulaTranslator@@AAEHPAUFORMULATRANSLATOR_VALUE_DESC@@0@Z
?CalcSub@CFormulaTranslator@@AAEHPAUFORMULATRANSLATOR_VALUE_DESC@@0@Z
?CalcUnaryMinus@CFormulaTranslator@@AAEHPAUFORMULATRANSLATOR_VALUE_DESC@@@Z
?Close@CTextFile@@QAEXXZ
?CompareWithWildcard@CStringLite@@QAEHPBDD@Z
?CompareWithWildcard@CStringLite@@SAHPBD0D@Z
?CreateLexemeDesc@CLexicalAnalyzer@@QAEJK@Z
?DeleteBuf@CTokenString@@AAEXXZ
?DeleteKey@CRegValue@@QAEHXZ
?DeleteTask@CTaskSchedulerInterface@@QAEHPBD@Z
?DeleteValue@CRegValue@@QAEHPBD@Z
?DestroyCache@CTextFile@@QAEXXZ
?DestroyLexemeDesc@CLexicalAnalyzer@@QAEXPAULEXEME_DESC@@@Z
?DestroyLexemes@CLexicalAnalyzer@@QAEXXZ
?DestroyOperandsStack@CFormulaTranslator@@QAEXXZ
?DestroySectionsCache@CTextFile@@QAEXXZ
?DestroyThisLexeme@CLexicalAnalyzer@@QAEPAULEXEME_DESC@@XZ
?EnumSections@CTextFile@@QAE?AVCMultiString@@XZ
?Filter@CMultiString@@QAE?AV1@PAV1@0@Z
?Find@CPtrListLite@@QAEPAUPTR_LIST_NODE@@K@Z
?Find@CPtrListLite@@QAEPAUPTR_LIST_NODE@@PAX@Z
?Find@CStringLite@@QBEHPBD@Z
?Find@CStringLite@@QBEHPBDH@Z
?FindNoCase@CStringLite@@QBEHPBD@Z
?FindNoCase@CStringLite@@QBEHPBDH@Z
?Format@CFormulaTranslator@@QAE?AVCStringLite@@XZ
?Format@CStringLite@@QAAXPBDZZ
?Get@CFileVersion@@SAKPBD@Z
?GetAt@CPtrListLite@@QAEPAXPAUPTR_LIST_NODE@@@Z
?GetCharsetSize@CLexicalAnalyzer@@QAEGXZ
?GetCount@CPtrListLite@@QAEKXZ
?GetErrName@CLexicalAnalyzer@@SA?AVCStringLite@@J@Z
?GetFilename@CLog@@QAEPBDXZ
?GetFirst@CMultiString@@QAEPBDXZ
?GetFltValue@CFormulaTranslator@@AAEMPAUFORMULATRANSLATOR_VALUE_DESC@@@Z
?GetFltValue@CFormulaTranslator@@QAEMXZ
?GetHead@CPtrListLite@@QAEPAUPTR_LIST_NODE@@XZ
?GetHeadLexeme@CLexicalAnalyzer@@QAEPAULEXEME_DESC@@XZ
?GetHeaderFlags@CLog@@QAEKXZ
?GetIndent@CLog@@QAEKXZ
?GetIntValue@CFormulaTranslator@@AAEJPAUFORMULATRANSLATOR_VALUE_DESC@@@Z
?GetIntValue@CFormulaTranslator@@QAEJXZ
?GetLength@CStringLite@@QBEHXZ
?GetLexemeStr@CLexicalAnalyzer@@QAEPBDXZ
?GetMajorVersion@COSVersion@@QAEKXZ
?GetMinorVersion@COSVersion@@QAEKXZ
?GetNext@CMultiString@@QAEPBDXZ
?GetNext@CPtrListLite@@QAEPAXAAPAUPTR_LIST_NODE@@@Z
?GetNextLexeme@CLexicalAnalyzer@@QAEPAULEXEME_DESC@@XZ
?GetParam@CTextFile@@SAHHPBDAAVCStringLite@@0H@Z
?GetParams@CTextFile@@SAHHHPBDAAVCStringLite@@0H@Z
?GetParams@CTextFile@@SAHPBDAAVCStringLite@@10H@Z
?GetParams@CTextFile@@SAHPBDAAVCStringLite@@110H@Z
?GetPlatformID@COSVersion@@QAEKXZ
?GetPrev@CPtrListLite@@QAEPAXAAPAUPTR_LIST_NODE@@@Z
?GetPrevLexeme@CLexicalAnalyzer@@QAEPAULEXEME_DESC@@XZ
?GetRange@CTextFile@@SAHPBDAAK1@Z
?GetSamDesired@CRegValue@@QAEKXZ
?GetSeparator@CTokenString@@QAEDXZ
?GetSize@CMultiString@@SAKPBD@Z
?GetStr@CFileVersion@@SA?AVCStringLite@@PBD@Z
?GetStrUni@CFileVersion@@CA?AVCStringLite@@PBD@Z
?GetStrVxd@CFileVersion@@CA?AVCStringLite@@PBD@Z
?GetSystemWow64DirectoryA@CWOW64@@SAIPADI@Z
?GetTail@CPtrListLite@@QAEPAUPTR_LIST_NODE@@XZ
?GetTailLexeme@CLexicalAnalyzer@@QAEPAULEXEME_DESC@@XZ
?GetThisLexeme@CLexicalAnalyzer@@QAEPAULEXEME_DESC@@XZ
?GetTimeStamp@CLog@@QAE_JXZ
?GetUnhandledLexeme@CLexicalAnalyzer@@QAEPAULEXEME_DESC@@XZ
?GetValue@CRegValue@@QAE?AVCMultiString@@PBDAAV2@@Z
?GetValue@CRegValue@@QAE?AVCStringLite@@PBD0@Z
?GetValue@CRegValue@@QAEKPBDKK@Z
?GetValue@CTextFile@@SAHPBDAAKK@Z
?GetVxdVersion@CFileVersion@@CAHPADPAKPAX@Z
?GetVxdVersionInfo@CFileVersion@@CAHPADKPAX@Z
?GetVxdVersionInfoSize@CFileVersion@@CAKPAD@Z
?Home@CTextFile@@QAEXXZ
?Init@CFormulaLexicalAnalyzer@@QAEXXZ
?Init@CMultiString@@QAEXPBD@Z
?Init@CTaskSchedulerInterface@@QAEHXZ
?InitJumpTable@CLexicalAnalyzer@@QAEJG@Z
?InitLexemePriority@CFormulaTranslator@@AAEKPAULEXEME_DESC@@@Z
?InitMulti@CMultiString@@QAEXPBD@Z
?InitTable@CCRC32@@QAEXXZ
?IsConstFltLexeme@CFormulaLexicalAnalyzer@@QAEHPAULEXEME_DESC@@@Z
?IsConstIntLexeme@CFormulaLexicalAnalyzer@@QAEHPAULEXEME_DESC@@@Z
?IsConstLexeme@CFormulaLexicalAnalyzer@@QAEHPAULEXEME_DESC@@@Z
?IsEmpty@CMultiString@@QAEHXZ
?IsEmpty@CPtrListLite@@QAEHXZ
?IsEmpty@CStringLite@@QBEHXZ
?IsFltValue@CFormulaTranslator@@AAEHPAUFORMULATRANSLATOR_VALUE_DESC@@@Z
?IsFltValue@CFormulaTranslator@@QAEHXZ
?IsInRange@CTextFile@@SAHKPBD@Z
?IsIntValue@CFormulaTranslator@@AAEHPAUFORMULATRANSLATOR_VALUE_DESC@@@Z
?IsIntValue@CFormulaTranslator@@QAEHXZ
?IsOperationBracketLexeme@CFormulaLexicalAnalyzer@@QAEHPAULEXEME_DESC@@@Z
?IsOperationCloseBracketLexeme@CFormulaLexicalAnalyzer@@QAEHPAULEXEME_DESC@@@Z
?IsOperationLexeme@CFormulaLexicalAnalyzer@@QAEHPAULEXEME_DESC@@@Z
?IsOperationOpenBracketLexeme@CFormulaLexicalAnalyzer@@QAEHPAULEXEME_DESC@@@Z
?IsTaskExist@CTaskSchedulerInterface@@QAEHPBD@Z
?IsVarLexeme@CFormulaLexicalAnalyzer@@QAEHPAULEXEME_DESC@@@Z
?IsWindows2000@COSVersion@@QAEHXZ
?IsWindows2000OrLater@COSVersion@@QAEHXZ
?IsWindows7@COSVersion@@QAEHXZ
?IsWindows7OrLater@COSVersion@@QAEHXZ
?IsWindows95@COSVersion@@QAEHXZ
?IsWindows98@COSVersion@@QAEHXZ
?IsWindows98OrLater@COSVersion@@QAEHXZ
?IsWindows9x@COSVersion@@QAEHXZ
?IsWindowsME@COSVersion@@QAEHXZ
?IsWindowsNT4@COSVersion@@QAEHXZ
?IsWindowsNT4OrLater@COSVersion@@QAEHXZ
?IsWindowsNT@COSVersion@@QAEHXZ
?IsWindowsVista@COSVersion@@QAEHXZ
?IsWindowsVistaOrLater@COSVersion@@QAEHXZ
?IsWindowsXP64OrLater@COSVersion@@QAEHXZ
?IsWindowsXP@COSVersion@@QAEHXZ
?IsWindowsXPOrLater@COSVersion@@QAEHXZ
?IsWow64Process@CWOW64@@SAHPAXPAH@Z
?KillTable@CCRC32@@QAEXXZ
?Left@CStringLite@@QBE?AV1@H@Z
?MakeLower@CStringLite@@QAEXXZ
?MakeUpper@CStringLite@@QAEXXZ
?MarkReachabilityHelper@CLexicalAnalyzer@@AAEXPAEG@Z
?Mid@CStringLite@@QBE?AV1@HH@Z
?OnStateChange@CFormulaLexicalAnalyzer@@EAEJGGD@Z
?Open@CTextFile@@QAEHPBD@Z
?Peek@CPtrStack@@QAEPAXXZ
?Pop@CPtrStack@@QAEPAXXZ
?PostAnalyze@CFormulaLexicalAnalyzer@@EAEJH@Z
?PreAnalyze@CFormulaLexicalAnalyzer@@EAEJXZ
?Precache@CTextFile@@QAEXPBD@Z
?Precache@CTextFile@@QAEXXZ
?PrecacheSections@CTextFile@@QAEXXZ
?Push@CPtrStack@@QAEXPAX@Z
?PushVal@CFormulaTranslator@@AAEXKJ@Z
?PushVar@CFormulaTranslator@@AAEHPBD@Z
?QueryValue@CRegValue@@QAEHPBDAAKK@Z
?QueryValueEx@CRegValue@@QAEHPBDPAEAAK2@Z
?ReadSection@CTextFile@@UAEHPBDAAVCStringLite@@@Z
?ReadSectionParam@CTextFile@@UAE?AVCStringLite@@PBD00@Z
?ReadSectionParam@CTextFile@@UAEHPBD0AAVCStringLite@@@Z
?ReadString@CTextFile@@QAEHAAVCStringLite@@@Z
?RemoveAll@CPtrListLite@@QAEXXZ
?RemoveAt@CPtrListLite@@QAEXPAUPTR_LIST_NODE@@@Z
?Replace@CStringLite@@QAEHPBD0@Z
?ResetLexemeStr@CLexicalAnalyzer@@QAEXXZ
?Right@CStringLite@@QBE?AV1@H@Z
?SetFilename@CLog@@QAEXPBD@Z
?SetHeaderFlags@CLog@@QAEXK@Z
?SetIndent@CLog@@QAEXK@Z
?SetLexemeStr@CLexicalAnalyzer@@QAEXD@Z
?SetRegistryKey@CRegValue@@QAEXPAUHKEY__@@PBD@Z
?SetSamDesired@CRegValue@@QAEXK@Z
?SetValue@CRegValue@@QAEHPBD0@Z
?SetValue@CRegValue@@QAEHPBDKK@Z
?SetValueEx@CRegValue@@QAEHPBDPAEKK@Z
?SetVariableProvider@CFormulaTranslator@@QAEXPAVCFormulaTranslatorVariableProvider@@@Z
?Sort@CPtrListLite@@QAEXHP6AHPAUPTR_LIST_NODE@@0@Z@Z
?SortLexemesHelper@CFormulaTranslator@@CAHPAUPTR_LIST_NODE@@0@Z
?StrToDWORD@CFileVersion@@SAKPBD@Z
?StripComments@CTextFile@@QAEHAAVCStringLite@@@Z
?SubIndent@CLog@@QAEKK@Z
?SwapWithNext@CPtrListLite@@QAEXPAUPTR_LIST_NODE@@@Z
?SwapWithPrev@CPtrListLite@@QAEXPAUPTR_LIST_NODE@@@Z
?Translate@CFormulaTranslator@@QAEJPBD@Z
?TrimLeft@CStringLite@@QAEXD@Z
?TrimLeft@CStringLite@@QAEXPBD@Z
?TrimLeft@CStringLite@@QAEXXZ
?TrimRight@CStringLite@@QAEXD@Z
?TrimRight@CStringLite@@QAEXPBD@Z
?TrimRight@CStringLite@@QAEXXZ
?Uninit@CMultiString@@QAEXXZ
?Uninit@CTaskSchedulerInterface@@QAEXXZ
?UninitCharset@CLexicalAnalyzer@@QAEXXZ
?UninitJumpTable@CLexicalAnalyzer@@QAEXXZ
?ValidateJumpTable@CLexicalAnalyzer@@QAEJXZ
?Wow64DisableWow64FsRedirection@CWOW64@@SAHPAPAX@Z
?Wow64RevertWow64FsRedirection@CWOW64@@SAHPAX@Z
?g_hRTFCDLL@@3PAUHINSTANCE__@@A
?helper_AppendBuf@CStringLite@@IAEXD@Z
?helper_AppendBuf@CStringLite@@IAEXPBD@Z
?helper_FreeBuf@CStringLite@@IAEXXZ
?helper_InitBuf@CStringLite@@IAEXD@Z
?helper_InitBuf@CStringLite@@IAEXPBD@Z
?helper_InitBuf@CStringLite@@IAEXPBDH@Z
?strtok@CTokenString@@QAEPADPBD0@Z
?strtokex@CTokenString@@QAEPADPBD0@Z

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTMUI.dll
.dll windows:5 windows x86 arch:x86

960c8cfa99b3b65d86195c390ec402f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathRemoveFileSpecA

rtfc

?GetParam@CTextFile@@SAHHPBDAAVCStringLite@@0H@Z
??1CStringLite@@UAE@XZ
?Calc@CCRC32@@QAEKKPBD@Z
??1CCRC32@@UAE@XZ
??0CCRC32@@QAE@XZ
??0CStringLite@@QAE@XZ

mfc90

ord5666
ord5668
ord6446
ord1729
ord4688
ord5139
ord3732
ord4589
ord6780
ord5497
ord5585
ord4650
ord1496
ord4331
ord1752
ord1755
ord6388
ord3344
ord1678
ord1809
ord1810
ord2208
ord5309
ord5152
ord4617
ord5615
ord374
ord4993
ord5636
ord2074
ord2069
ord6048
ord1536
ord2899
ord3987
ord3568
ord2282
ord4498
ord2130
ord1361
ord1108
ord3895
ord753
ord5137
ord5153
ord4618
ord4594
ord5262
ord5286
ord5032
ord5216
ord5493
ord5496
ord5494
ord5495
ord5644
ord6474
ord6058
ord1791
ord6365
ord3436
ord6473
ord6475
ord542
ord539
ord541
ord4013
ord3896
ord756
ord4678
ord1643
ord4686
ord5645
ord1497
ord6391
ord3346
ord1711
ord2224
ord1409
ord2592
ord547
ord549
ord4996
ord3365
ord4014
ord698
ord580
ord446
ord3560
ord958
ord6154
ord903
ord5862
ord3313
ord4462
ord941
ord6682
ord6676
ord781
ord5776
ord1144
ord2896
ord4037
ord1045
ord2123
ord1241
ord391
ord1152
ord2591
ord4431
ord3223
ord4513
ord6557
ord6559
ord4116
ord3175
ord4337
ord586
ord3653
ord4667
ord5647
ord1726
ord1789
ord789
ord4025
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4668
ord376
ord639
ord3783
ord6802
ord5761
ord945
ord5924
ord820
ord6791
ord266
ord1709
ord3579
ord579
ord5528
ord2539
ord4311
ord6815
ord817
ord1568
ord2531
ord780
ord310
ord1137
ord5750
ord1247
ord2566
ord1252
ord1603
ord6613
ord3213
ord305
ord3178
ord1611
ord798
ord300
ord910
ord963
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord6494
ord1792
ord316
ord601
ord800
ord5482

msvcr90

memset
sscanf_s
_findfirst64i32
_stricmp
_access
strstr
_findnext64i32
__CxxFrameHandler3
_findclose
strcpy_s
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ

kernel32

GetPrivateProfileStringA
LoadLibraryA
FreeResource
GetLocalTime
LoadResource
FindResourceA
GetModuleFileNameA
GetProcAddress
LockResource
FreeLibrary
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentThreadId

user32

GetWindowLongA
GetParent
ModifyMenuA
GetSubMenu
GetMenuState
GetMenuItemID
GetSystemMetrics
MonitorFromPoint
GetDC
ReleaseDC
GetCursorPos
IsWindow
MapDialogRect
GetClassNameA
GetDlgCtrlID
IsWindowVisible
ScreenToClient
ClientToScreen
PtInRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetWindow
GetWindowRect
SendMessageA
LoadMenuA
EnableWindow
InvalidateRect
GetClientRect
LoadImageA
DestroyIcon
WindowFromPoint

gdi32

GetDeviceCaps

Exports

Exports

??0?$CList@PAULANGUAGE_DESC@@PAU1@@@QAE@H@Z
??0?$CList@PAULOCALIZED_STRING@@PAU1@@@QAE@H@Z
??0?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAE@H@Z
??0CLocalizationManager@@QAE@XZ
??0CLocalizedDialog@@IAE@XZ
??0CLocalizedDialog@@QAE@IPAVCWnd@@@Z
??0CLocalizedMenu@@QAE@XZ
??0CLocalizedPropertyPage@@QAE@II@Z
??0CLocalizedPropertyPage@@QAE@PBDI@Z
??0CLocalizedPropertyPage@@QAE@XZ
??0CLocalizedPropertySheet@@QAE@IPAVCWnd@@I@Z
??0CLocalizedPropertySheet@@QAE@PBDPAVCWnd@@I@Z
??0CLocalizedStringDifferenceList@@QAE@XZ
??0CLocalizedStringList@@QAE@XZ
??0CLocalizedTooltip@@QAE@XZ
??0CToolTipCtrlEx@@QAE@XZ
??1?$CList@PAULANGUAGE_DESC@@PAU1@@@UAE@XZ
??1?$CList@PAULOCALIZED_STRING@@PAU1@@@UAE@XZ
??1?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@UAE@XZ
??1CLocalizationManager@@UAE@XZ
??1CLocalizedDialog@@MAE@XZ
??1CLocalizedMenu@@UAE@XZ
??1CLocalizedPropertyPage@@UAE@XZ
??1CLocalizedPropertySheet@@UAE@XZ
??1CLocalizedStringDifferenceList@@UAE@XZ
??1CLocalizedStringList@@UAE@XZ
??1CLocalizedTooltip@@UAE@XZ
??1CToolTipCtrlEx@@UAE@XZ
??_7?$CList@PAULANGUAGE_DESC@@PAU1@@@6B@
??_7?$CList@PAULOCALIZED_STRING@@PAU1@@@6B@
??_7?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@6B@
??_7CLocalizationManager@@6B@
??_7CLocalizedDialog@@6B@
??_7CLocalizedMenu@@6B@
??_7CLocalizedPropertyPage@@6B@
??_7CLocalizedPropertySheet@@6B@
??_7CLocalizedStringDifferenceList@@6B@
??_7CLocalizedStringList@@6B@
??_7CLocalizedTooltip@@6B@
??_7CToolTipCtrlEx@@6B@
??_F?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEXXZ
??_F?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEXXZ
??_F?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEXXZ
?Add@CLocalizedStringDifferenceList@@QAEXPBDPAULOCALIZED_STRING@@@Z
?Add@CLocalizedStringList@@QAEHPBDJJ0IKJJ@Z
?AddHead@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEPAU__POSITION@@PAULANGUAGE_DESC@@@Z
?AddHead@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEXPAV1@@Z
?AddHead@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEPAU__POSITION@@PAULOCALIZED_STRING@@@Z
?AddHead@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEXPAV1@@Z
?AddHead@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEPAU__POSITION@@PAULOCALIZED_STRING_DIFFERENCE@@@Z
?AddHead@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEXPAV1@@Z
?AddLanguageDesc@CLocalizationManager@@QAEXPBD@Z
?AddTail@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEPAU__POSITION@@PAULANGUAGE_DESC@@@Z
?AddTail@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEXPAV1@@Z
?AddTail@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEPAU__POSITION@@PAULOCALIZED_STRING@@@Z
?AddTail@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEXPAV1@@Z
?AddTail@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEPAU__POSITION@@PAULOCALIZED_STRING_DIFFERENCE@@@Z
?AddTail@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEXPAV1@@Z
?AllocateLocalizedTooltip@CLocalizationManager@@QAEPAVCLocalizedTooltip@@XZ
?AppendLog@CLocalizationManager@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H0HK@Z
?AreTooltipsEnabled@CLocalizationManager@@QAEHXZ
?Compare@CLocalizationManager@@QAEXPBD@Z
?CompareFileSystem@CLocalizationManager@@QAEXPBD0K@Z
?CompareFileSystemHelper@CLocalizationManager@@QAEXPBD00KPAK@Z
?CreateObject@CLocalizedDialog@@SGPAVCObject@@XZ
?CreateObject@CLocalizedPropertyPage@@SGPAVCObject@@XZ
?DefWindowProcA@CLocalizedDialog@@MAEJIIJ@Z
?DefWindowProcA@CLocalizedPropertyPage@@MAEJIIJ@Z
?DefWindowProcA@CLocalizedPropertySheet@@MAEJIIJ@Z
?Destroy@CLocalizedStringDifferenceList@@QAEXXZ
?Destroy@CLocalizedStringList@@QAEXXZ
?DoDataExchange@CLocalizedDialog@@MAEXPAVCDataExchange@@@Z
?DoDataExchange@CLocalizedPropertyPage@@MAEXPAVCDataExchange@@@Z
?Enable@CLocalizedTooltip@@QAEXH@Z
?EnableScroll@CLocalizedPropertyPage@@QAEXH@Z
?EnableScroll@CLocalizedPropertySheet@@QAEXH@Z
?EnableTooltips@CLocalizationManager@@QAEXH@Z
?Find@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEPAU__POSITION@@PAULANGUAGE_DESC@@PAU2@@Z
?Find@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEPAU__POSITION@@PAULOCALIZED_STRING@@PAU2@@Z
?Find@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEPAU__POSITION@@PAULOCALIZED_STRING_DIFFERENCE@@PAU2@@Z
?Find@CLocalizationManager@@QAEPAULANGUAGE_DESC@@PBD@Z
?FindIndex@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEPAU__POSITION@@H@Z
?FindIndex@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEPAU__POSITION@@H@Z
?FindIndex@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEPAU__POSITION@@H@Z
?FreeNode@?$CList@PAULANGUAGE_DESC@@PAU1@@@IAEXPAUCNode@1@@Z
?FreeNode@?$CList@PAULOCALIZED_STRING@@PAU1@@@IAEXPAUCNode@1@@Z
?FreeNode@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@IAEXPAUCNode@1@@Z
?Get@CLocalizationManager@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDAAJ10I@Z
?Get@CLocalizedStringList@@QAEHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAJ1PBDI11@Z
?GetAllocateLocalizedTooltip@CLocalizationManager@@QAEP6APAVCLocalizedTooltip@@XZXZ
?GetAt@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEAAPAULANGUAGE_DESC@@PAU__POSITION@@@Z
?GetAt@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEABQAULANGUAGE_DESC@@PAU__POSITION@@@Z
?GetAt@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEAAPAULOCALIZED_STRING@@PAU__POSITION@@@Z
?GetAt@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEABQAULOCALIZED_STRING@@PAU__POSITION@@@Z
?GetAt@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEAAPAULOCALIZED_STRING_DIFFERENCE@@PAU__POSITION@@@Z
?GetAt@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEABQAULOCALIZED_STRING_DIFFERENCE@@PAU__POSITION@@@Z
?GetCount@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEHXZ
?GetCount@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEHXZ
?GetCount@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEHXZ
?GetCreator@CLocalizationManager@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetCreatorEmail@CLocalizationManager@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetCreatorICQ@CLocalizationManager@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetDebugFlags@CLocalizationManager@@QAEKXZ
?GetDpi@@YAIPAUHWND__@@@Z
?GetDpiForMonitor@@YAIPAUHMONITOR__@@@Z
?GetDpiForWindow@@YAIPAUHWND__@@@Z
?GetFolder@CLocalizationManager@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetHead@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEAAPAULANGUAGE_DESC@@XZ
?GetHead@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEABQAULANGUAGE_DESC@@XZ
?GetHead@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEAAPAULOCALIZED_STRING@@XZ
?GetHead@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEABQAULOCALIZED_STRING@@XZ
?GetHead@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEAAPAULOCALIZED_STRING_DIFFERENCE@@XZ
?GetHead@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEABQAULOCALIZED_STRING_DIFFERENCE@@XZ
?GetHeadPosition@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEPAU__POSITION@@XZ
?GetHeadPosition@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEPAU__POSITION@@XZ
?GetHeadPosition@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEPAU__POSITION@@XZ
?GetHelpFilePath@CLocalizedTooltip@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?GetID@CLocalizationManager@@QAEPBDXZ
?GetLabel@CLocalizedPropertyPage@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetLanguage@CLocalizationManager@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetMessageMap@CLocalizedDialog@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CLocalizedPropertyPage@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CLocalizedPropertySheet@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CToolTipCtrlEx@@MBEPBUAFX_MSGMAP@@XZ
?GetNext@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEAAPAULANGUAGE_DESC@@AAPAU__POSITION@@@Z
?GetNext@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEABQAULANGUAGE_DESC@@AAPAU__POSITION@@@Z
?GetNext@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEAAPAULOCALIZED_STRING@@AAPAU__POSITION@@@Z
?GetNext@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEABQAULOCALIZED_STRING@@AAPAU__POSITION@@@Z
?GetNext@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEAAPAULOCALIZED_STRING_DIFFERENCE@@AAPAU__POSITION@@@Z
?GetNext@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEABQAULOCALIZED_STRING_DIFFERENCE@@AAPAU__POSITION@@@Z
?GetPrev@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEAAPAULANGUAGE_DESC@@AAPAU__POSITION@@@Z
?GetPrev@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEABQAULANGUAGE_DESC@@AAPAU__POSITION@@@Z
?GetPrev@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEAAPAULOCALIZED_STRING@@AAPAU__POSITION@@@Z
?GetPrev@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEABQAULOCALIZED_STRING@@AAPAU__POSITION@@@Z
?GetPrev@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEAAPAULOCALIZED_STRING_DIFFERENCE@@AAPAU__POSITION@@@Z
?GetPrev@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEABQAULOCALIZED_STRING_DIFFERENCE@@AAPAU__POSITION@@@Z
?GetResourceFilePath@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD0@Z
?GetRuntimeClass@CLocalizedDialog@@UBEPAUCRuntimeClass@@XZ
?GetRuntimeClass@CLocalizedPropertyPage@@UBEPAUCRuntimeClass@@XZ
?GetRuntimeClass@CLocalizedPropertySheet@@UBEPAUCRuntimeClass@@XZ
?GetSize@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEHXZ
?GetSize@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEHXZ
?GetSize@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEHXZ
?GetSystemMetricsForDpi@@YAHHI@Z
?GetTail@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEAAPAULANGUAGE_DESC@@XZ
?GetTail@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEABQAULANGUAGE_DESC@@XZ
?GetTail@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEAAPAULOCALIZED_STRING@@XZ
?GetTail@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEABQAULOCALIZED_STRING@@XZ
?GetTail@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEAAPAULOCALIZED_STRING_DIFFERENCE@@XZ
?GetTail@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEABQAULOCALIZED_STRING_DIFFERENCE@@XZ
?GetTailPosition@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEPAU__POSITION@@XZ
?GetTailPosition@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEPAU__POSITION@@XZ
?GetTailPosition@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEPAU__POSITION@@XZ
?GetTemplateName@CLocalizedDialog@@QAEPBDXZ
?GetThisClass@CLocalizedDialog@@SGPAUCRuntimeClass@@XZ
?GetThisClass@CLocalizedPropertyPage@@SGPAUCRuntimeClass@@XZ
?GetThisClass@CLocalizedPropertySheet@@SGPAUCRuntimeClass@@XZ
?GetThisMessageMap@CLocalizedDialog@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CLocalizedPropertyPage@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CLocalizedPropertySheet@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CToolTipCtrlEx@@KGPBUAFX_MSGMAP@@XZ
?GetTooltipID@CLocalizedTooltip@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HH@Z
?Init@CLocalizationManager@@QAEXPBD0K@Z
?Init@CLocalizedTooltip@@QAEXPAVCWnd@@@Z
?InitToolTipText@CLocalizedTooltip@@QAEXHH@Z
?InsertAfter@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEPAU__POSITION@@PAU2@PAULANGUAGE_DESC@@@Z
?InsertAfter@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEPAU__POSITION@@PAU2@PAULOCALIZED_STRING@@@Z
?InsertAfter@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEPAU__POSITION@@PAU2@PAULOCALIZED_STRING_DIFFERENCE@@@Z
?InsertBefore@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEPAU__POSITION@@PAU2@PAULANGUAGE_DESC@@@Z
?InsertBefore@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEPAU__POSITION@@PAU2@PAULOCALIZED_STRING@@@Z
?InsertBefore@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEPAU__POSITION@@PAU2@PAULOCALIZED_STRING_DIFFERENCE@@@Z
?IsEmpty@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEHXZ
?IsEmpty@?$CList@PAULOCALIZED_STRING@@PAU1@@@QBEHXZ
?IsEmpty@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QBEHXZ
?IsInitialized@CLocalizationManager@@QAEHXZ
?LoadMenuA@CLocalizedMenu@@QAEHI@Z
?LoadStringA@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@I@Z
?LoadStringA@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?LoadStringA@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAJ1PBDI@Z
?LoadTooltip@CLocalizedTooltip@@UAEXPBD@Z
?Localize@@YAXPAVCMenu@@@Z
?Localize@@YAXPAVCWnd@@@Z
?LockSetModified@CLocalizedPropertyPage@@QAEXH@Z
?NewNode@?$CList@PAULANGUAGE_DESC@@PAU1@@@IAEPAUCNode@1@PAU21@0@Z
?NewNode@?$CList@PAULOCALIZED_STRING@@PAU1@@@IAEPAUCNode@1@PAU21@0@Z
?NewNode@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@IAEPAUCNode@1@PAU21@0@Z
?OnAdjustHeight@CLocalizedPropertySheet@@UAEXXZ
?OnCreate@CLocalizedPropertyPage@@IAEHPAUtagCREATESTRUCTA@@@Z
?OnDpiChange@CLocalizedPropertyPage@@UAEXXZ
?OnGetMinMaxInfo@CLocalizedPropertySheet@@IAEXPAUtagMINMAXINFO@@@Z
?OnInitDialog@CLocalizedDialog@@MAEHXZ
?OnInitDialog@CLocalizedPropertyPage@@MAEHXZ
?OnInitDialog@CLocalizedPropertySheet@@MAEHXZ
?OnMouseMove@CLocalizedDialog@@IAEXIVCPoint@@@Z
?OnMouseMove@CLocalizedPropertyPage@@IAEXIVCPoint@@@Z
?OnMouseMove@CLocalizedTooltip@@QAEXIVCPoint@@@Z
?OnPreTranslateMessage@CLocalizedTooltip@@QAEXPAUtagMSG@@@Z
?OnSize@CLocalizedPropertyPage@@IAEXIHH@Z
?OnSize@CLocalizedPropertySheet@@IAEXIHH@Z
?OnToolTipText@CLocalizedDialog@@IAEHIPAUtagNMHDR@@PAJ@Z
?OnToolTipText@CLocalizedPropertyPage@@IAEHIPAUtagNMHDR@@PAJ@Z
?OnToolTipText@CLocalizedTooltip@@QAEHIPAUtagNMHDR@@PAJ@Z
?OnVScroll@CLocalizedPropertyPage@@IAEXIIPAVCScrollBar@@@Z
?OnWindowFromPoint@CToolTipCtrlEx@@IAEJIJ@Z
?PostLoadTooltip@CLocalizedTooltip@@UAEXPBD@Z
?PreTranslateMessage@CLocalizedDialog@@MAEHPAUtagMSG@@@Z
?PreTranslateMessage@CLocalizedPropertyPage@@MAEHPAUtagMSG@@@Z
?PrepareTooltips@CLocalizedTooltip@@QAEXXZ
?RedrawChild@CLocalizedDialog@@QAEXI@Z
?RemoveAll@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEXXZ
?RemoveAll@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEXXZ
?RemoveAll@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEXXZ
?RemoveAt@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEXPAU__POSITION@@@Z
?RemoveAt@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEXPAU__POSITION@@@Z
?RemoveAt@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEXPAU__POSITION@@@Z
?RemoveHead@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEPAULANGUAGE_DESC@@XZ
?RemoveHead@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEPAULOCALIZED_STRING@@XZ
?RemoveHead@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEPAULOCALIZED_STRING_DIFFERENCE@@XZ
?RemoveTail@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEPAULANGUAGE_DESC@@XZ
?RemoveTail@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEPAULOCALIZED_STRING@@XZ
?RemoveTail@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEPAULOCALIZED_STRING_DIFFERENCE@@XZ
?RepositionChildren@CLocalizedPropertySheet@@QAEXHH@Z
?ResetScrollbars@CLocalizedPropertyPage@@QAEXXZ
?Save@CLocalizedStringDifferenceList@@QAEXPAVCStringArray@@@Z
?Serialize@?$CList@PAULANGUAGE_DESC@@PAU1@@@UAEXAAVCArchive@@@Z
?Serialize@?$CList@PAULOCALIZED_STRING@@PAU1@@@UAEXAAVCArchive@@@Z
?Serialize@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@UAEXAAVCArchive@@@Z
?SetAllocateLocalizedTooltip@CLocalizationManager@@QAEXP6APAVCLocalizedTooltip@@XZ@Z
?SetAt@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEXPAU__POSITION@@PAULANGUAGE_DESC@@@Z
?SetAt@?$CList@PAULOCALIZED_STRING@@PAU1@@@QAEXPAU__POSITION@@PAULOCALIZED_STRING@@@Z
?SetAt@?$CList@PAULOCALIZED_STRING_DIFFERENCE@@PAU1@@@QAEXPAU__POSITION@@PAULOCALIZED_STRING_DIFFERENCE@@@Z
?SetDpiAware@@YAHK@Z
?SetModifiedLockable@CLocalizedPropertyPage@@QAEXH@Z
?SetTargetWnd@CToolTipCtrlEx@@QAEXPAVCWnd@@@Z
?SetupScrollbars@CLocalizedPropertyPage@@QAEXXZ
?Uninit@CLocalizationManager@@QAEXXZ
?_GetBaseClass@CLocalizedDialog@@KGPAUCRuntimeClass@@XZ
?_GetBaseClass@CLocalizedPropertyPage@@KGPAUCRuntimeClass@@XZ
?_GetBaseClass@CLocalizedPropertySheet@@KGPAUCRuntimeClass@@XZ
?classCLocalizedDialog@CLocalizedDialog@@2UCRuntimeClass@@B
?classCLocalizedPropertyPage@CLocalizedPropertyPage@@2UCRuntimeClass@@B
?classCLocalizedPropertySheet@CLocalizedPropertySheet@@2UCRuntimeClass@@B
?g_dwDpiAware@@3KA
?g_localizationManager@@3VCLocalizationManager@@A

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTSS.dat
RTSS.exe
.exe windows:5 windows x86 arch:x86

1de1425c2d90ea352675f268933cd570

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:25:50:7d:1e:f0:2b:01:1b:4f:d1:07:9b:0a:0b:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08-03-2020 00:00

Not After

08-03-2022 23:59

Subject

CN=Alexey Nicolaychuk,O=Alexey Nicolaychuk,POSTALCODE=347900,STREET=Chekhov street 56A\, flat 3,L=Taganrog,ST=Rostov Oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c4:3d:c4:3b:c3:8b:6d:89:fb:d2:b5:90:49:1f:b7:af:f4:29:bd:c1
Signer

Actual PE Digest

c4:3d:c4:3b:c3:8b:6d:89:fb:d2:b5:90:49:1f:b7:af:f4:29:bd:c1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dinput8

DirectInput8Create

shlwapi

PathRemoveFileSpecA
PathStripPathA
PathIsRelativeA

rtfc

??1CTaskSchedulerInterface@@UAE@XZ
?IsTaskExist@CTaskSchedulerInterface@@QAEHPBD@Z
?DeleteTask@CTaskSchedulerInterface@@QAEHPBD@Z
?AddTask@CTaskSchedulerInterface@@QAEHPBD000@Z
?Uninit@CTaskSchedulerInterface@@QAEXXZ
??0CTaskSchedulerInterface@@QAE@XZ
??YCStringLite@@QAEABV0@PBD@Z
??H@YA?AVCStringLite@@PBDABV0@@Z
??YCStringLite@@QAEABV0@ABV0@@Z
??0CFileVersion@@QAE@XZ
?GetStr@CFileVersion@@SA?AVCStringLite@@PBD@Z
??1CFileVersion@@UAE@XZ
?GetValue@CRegValue@@QAE?AVCStringLite@@PBD0@Z
?DeleteValue@CRegValue@@QAEHPBD@Z
??0CTokenString@@QAE@XZ
?strtok@CTokenString@@QAEPADPBD0@Z
??1CTokenString@@UAE@XZ
?GetValue@CTextFile@@SAHPBDAAKK@Z
?IsWow64Process@CWOW64@@SAHPAXPAH@Z
??0CStringLite@@QAE@PBDH@Z
?Init@CTaskSchedulerInterface@@QAEHXZ
?ReadSectionParam@CTextFile@@UAE?AVCStringLite@@PBD00@Z
?ReadSection@CTextFile@@UAEHPBDAAVCStringLite@@@Z
??0CTextFile@@QAE@XZ
??1CTextFile@@UAE@XZ
?GetParam@CTextFile@@SAHHPBDAAVCStringLite@@0H@Z
??4CStringLite@@QAEABV0@PBD@Z
??0CStringLite@@QAE@XZ
?ReadSectionParam@CTextFile@@UAEHPBD0AAVCStringLite@@@Z
?IsEmpty@CStringLite@@QBEHXZ
??H@YA?AVCStringLite@@ABV0@PBD@Z
??0CStringLite@@QAE@PBD@Z
?IsWindowsVistaOrLater@COSVersion@@QAEHXZ
?SetRegistryKey@CRegValue@@QAEXPAUHKEY__@@PBD@Z
?SetValue@CRegValue@@QAEHPBD0@Z
??1CRegValue@@UAE@XZ
??0COSVersion@@QAE@XZ
?IsWindows9x@COSVersion@@QAEHXZ
??1COSVersion@@UAE@XZ
??1CStringLite@@UAE@XZ
?Precache@CTextFile@@QAEXPBD@Z
??0CRegValue@@QAE@XZ

rtui

?NotifyParent@CSkinnedControl@@UAEXKK@Z
?HitTest@CSkinnedButton@@UAEHVCPoint@@K@Z
?GetClassNameA@CSkinnedButton@@UAE?AVCStringLite@@XZ
?OnLButtonDown@CSkinnedButton@@UAEXVCPoint@@@Z
?OnLButtonUp@CSkinnedButton@@UAEXVCPoint@@@Z
?OnMouseMove@CSkinnedButton@@UAEXVCPoint@@@Z
?OnKeyDown@CSkinnedButton@@UAEXIII@Z
?OnKeyUp@CSkinnedControl@@UAEXIII@Z
?Draw@CSkinnedButton@@UAEXPAVCDIB@@0@Z
?Redraw@CSkinnedControl@@QAEXXZ
?OverrideDIBPressedHottrack@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIBHottrack@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIBPressed@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIB@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OnCreate@CSkinnedButton@@UAEHPAVCSkin@@PBDK1K@Z
??0CSkinnedSlider@@QAE@XZ
?OnKillFocus@CSkinnedSlider@@UAEXXZ
?GetIndicatorValue@CSkinnedSlider@@UAEMK@Z
?OnLButtonDown@CSkinnedSlider@@UAEXVCPoint@@@Z
?OnLButtonUp@CSkinnedSlider@@UAEXVCPoint@@@Z
?OnCreate@CSkinnedSlider@@UAEHPAVCSkin@@PBDK1K@Z
?SetTimerPeriod@CSkinnedControl@@QAEXK@Z
?PauseTimer@CSkinnedControl@@QAEXH@Z
?GetPos@CSkinnedSlider@@QAEJXZ
?SetPos@CSkinnedSlider@@QAEXJ@Z
?SetRange@CSkinnedSlider@@QAEHJJ@Z
?SetPage@CSkinnedSlider@@QAEXK@Z
??1CSkinnedSlider@@UAE@XZ
?Draw@CSkinnedSlider@@UAEXPAVCDIB@@0@Z
?OnKeyUp@CSkinnedSlider@@UAEXIII@Z
?OnKeyDown@CSkinnedSlider@@UAEXIII@Z
?GetIndicatorValue@CSkinnedControl@@UAEMK@Z
?OnTimer@CSkinnedButton@@UAEXXZ
?SetVisible@CSkinnedControl@@UAEHH@Z
?OnKillFocus@CSkinnedButton@@UAEXXZ
?OnKillKeyboardFocus@CSkinnedControl@@UAEXXZ
?IsKeyboardFocusCaptured@CSkinnedControl@@UAEHXZ
?DefWindowProcA@CSkinnedWnd@@MAEJIIJ@Z
?GetLayeredWindowAlpha@CSkinnedWnd@@QAEKXZ
?GetScaleFactor@CSkinnedWnd@@QAEKXZ
?AddControl@CSkinnedWnd@@QAEHPAVCSkinnedControl@@H@Z
?Create@CSkinnedControl@@QAEHPAVCSkin@@PBDK1KH@Z
?SetID@CSkinnedControl@@QAEXK@Z
?SetCheckbox@CSkinnedButton@@QAEXH@Z
?RemoveControl@CSkinnedWnd@@QAEHPAVCSkinnedControl@@@Z
?SetSpin@CSkinnedButton@@QAEXH@Z
?IsHorizontal@CSkinnedSlider@@QAEHXZ
?SetEditMask@CSkinnedText@@QAEXPBD@Z
?SetEditCursor@CSkinnedText@@QAEDD@Z
?SetEditTextLen@CSkinnedText@@QAEHH@Z
?SetEditAnimationFrames@CSkinnedText@@QAEKK@Z
?SetEditMode@CSkinnedText@@QAEHH@Z
?CreateAdditionalControls@CSkinnedWnd@@QAEHPAVCSkin@@PBDKHH@Z
?SortControls@CSkinnedWnd@@QAEXXZ
?GetParam@CSkinnedPlaceholder@@QAEHHAAVCStringLite@@@Z
?IsVisible@CSkinnedControl@@QAEHXZ
?CreateTimer@CSkinnedWnd@@QAEKK@Z
?GetThisMessageMap@CSkinnedWnd@@KGPBUAFX_MSGMAP@@XZ
?IsKeyboardFocusCaptured@CSkinnedWnd@@QAEHXZ
?IsEnabled@CSkinnedControl@@QAEHXZ
?OnKeyDown@CSkinnedWnd@@IAEXIII@Z
?OnDestroy@CSkinnedWnd@@IAEXXZ
?SaveDIB@CDIB@@QAEHPAD@Z
?GetID@CSkinnedControl@@QAEKXZ
?OnLButtonDown@CSkinnedWnd@@IAEXIVCPoint@@@Z
?Swap@CSkinnedWnd@@QAEHHPBD@Z
?RedrawControls@CSkinnedWnd@@QAEXXZ
?OnTimer@CSkinnedWnd@@IAEXI@Z
?GetControlByName@CSkinnedWnd@@QAEPAVCSkinnedControl@@PBD@Z
?SetNextState@CSkinnedButton@@QAEKXZ
?HitTest@CSkinnedSlider@@UAEHVCPoint@@K@Z
?GetDC@CLayeredWindowDC@@QAEPAUHDC__@@XZ
?DeleteDC@CLayeredWindowDC@@QAEXXZ
?SkinToClient@CSkinnedWnd@@QAEHH@Z
?GetControlRect@CSkinnedControl@@QAE?AVCRect@@XZ
?SkinToClient@CSkinnedWnd@@QAE?AVCRect@@V2@@Z
?OnLButtonUp@CSkinnedWnd@@IAEXIVCPoint@@@Z
?GetText@CSkinnedText@@QAE?AVCStringLite@@XZ
?LockUpdateDIB@CSkinnedWnd@@QAEXH@Z
?SetText@CSkinnedText@@QAEXPBD@Z
?SetState@CSkinnedButton@@QAEXK@Z
?Enable@CSkinnedControl@@QAEHH@Z
?Create@CSkinnedWnd@@UAEHPAVCSkin@@PBDK@Z
?OnMoveWindow@CSkinnedWnd@@UAEXVCPoint@@@Z
?SetLayout@CSkinnedWnd@@UAEHK@Z
?OnReadControlDesc@CSkinnedWnd@@UAEHPAVCSkin@@PBD1K1AAVCStringLite@@@Z
?OnReadDefaultControlDesc@CSkinnedWnd@@UAEHPAVCSkin@@PBD1K1AAVCStringLite@@@Z
?UpdateDIB@CSkinnedWnd@@UAEHXZ
?UpdateDIB@CSkinnedWnd@@UAEHPAVCDC@@VCRect@@@Z
??0CSkinnedWnd@@QAE@XZ
??0CSkinnedButton@@QAE@XZ
??0CSkinnedText@@QAE@XZ
?OnMouseMove@CSkinnedSlider@@UAEXVCPoint@@@Z
??0CDIBWnd@@QAE@XZ
?UpdateDIB@CDIBWnd@@UAEHPAVCDC@@VCRect@@@Z
?UpdateDIB@CDIBWnd@@UAEHXZ
??1CDIBWnd@@UAE@XZ
?GetThisMessageMap@CDIBWnd@@KGPBUAFX_MSGMAP@@XZ
??1CDIB@@UAE@XZ
?Bar@CDIB@@QAEHJJJJJ@Z
?ConvertHSLToRGB@CDIB@@QAEXPAK00000@Z
?GetHeight@CDIB@@QAEJXZ
?GetWidthB@CDIB@@QAEJXZ
?GetWidth@CDIB@@QAEJXZ
?GetImage@CDIB@@QAEPAEXZ
?ConvertRGBToHSL@CDIB@@QAEXPAK00000@Z
??0CDIB@@QAE@XZ
?AttachDIB@CDIBWnd@@QAEHPAVCDIB@@@Z
?Create@CDIBWnd@@QAEHKABUtagRECT@@PAVCWnd@@I@Z
?Create@CDIB@@QAEHJJGK@Z
?ClipInt@CValueClipper@@SAHHHH@Z
?CreateBitmap@CDIB@@QAEPAUHBITMAP__@@PAVCDC@@@Z
?GetRect@CDIB@@QAEXPAVCRect@@@Z
?GetPixel@CDIB@@QAEHHHAAK@Z
?LoadImageA@CDIB@@QAEHPAD@Z
??1CSkin@@UAE@XZ
?Destroy@CSkinnedWnd@@QAEXH@Z
?SetLayeredWindowAlpha@CSkinnedWnd@@QAEXK@Z
?SetLayeredWindowMode@CSkinnedWnd@@QAEXK@Z
?IsSupportedFormat@CSkin@@QAEHXZ
?SetAsyncScaling@CDIBWnd@@QAEXK@Z
?SetScalingMode@CDIBWnd@@QAEXK@Z
?SetScaleFactor@CSkinnedWnd@@QAEXK@Z
?Decompile@CSkin@@QAEHPBDK@Z
?ReadHeaderSectionParam@CSkin@@QAEHPBD0AAVCStringLite@@@Z
?Load@CSkin@@QAEHPAVCMemFile@@@Z
?SetPath@CSkin@@QAEHPBD@Z
?Compile@CSkin@@QAEHPBDK@Z
??0CSkin@@QAE@XZ
?GetSizeB@CDIB@@QAEKXZ
?AlphaBlt@CDIB@@QAEHPAV1@0JJJJJJK@Z
?Create@CMMTimer@@QAEHIIKPAUHWND__@@IIJ@Z
?IsActive@CMMTimer@@QAEHXZ
??1CMMTimer@@UAE@XZ
??0CMMTimer@@QAE@XZ
?Blt@CDIB@@QAEHPAV1@JJJJJJ@Z
?Kill@CMMTimer@@QAEXH@Z
?EatMessages@CMMTimer@@QAEHXZ
?ConvertToTrueColor@CDIB@@QAEHXZ
?DestroyDIB@CDIB@@QAEHXZ
?GetName@CSkinnedControl@@QAEPBDXZ
?HitTest@CSkinnedWnd@@QAEPAVCSkinnedControl@@VCPoint@@K@Z
?UpdateLayeredWindowAttributes@CSkinnedWnd@@QAEXXZ
?UpdateLayeredWindow@CSkinnedWnd@@QAEXXZ
?GetLayeredWindowMode@CSkinnedWnd@@QAEKXZ
?IsNative@CSkin@@QAEHXZ
?LoadPAK@CDIB@@QAEHPAVCSZArray@@PBD@Z
?MapBitmapName@CSkin@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?GetPAK@CSkin@@QAEPAVCSZArray@@XZ
?ClientToSkin@CSkinnedWnd@@QAE?AVCPoint@@V2@@Z
?GetClassNameA@CSkinnedSlider@@UAE?AVCStringLite@@XZ
?IsCaptured@CSkinnedWnd@@QAEHXZ
?OnMouseMove@CSkinnedWnd@@IAEXIVCPoint@@@Z
?EnableRedraw@CSkinnedWnd@@QAEXH@Z
?IsRedrawEnabled@CSkinnedWnd@@QAEHXZ
?Press@CSkinnedButton@@QAEXH@Z
?IsPressed@CSkinnedButton@@QAEHXZ
?Uninit@CSkin@@QAEXXZ
??1CSkinnedPlaceholder@@UAE@XZ
??1CSkinnedText@@UAE@XZ
??1CSkinnedButton@@UAE@XZ
??1CSkinnedWnd@@UAE@XZ
??0CSkinnedPlaceholder@@QAE@XZ

rtmui

?GetThisClass@CLocalizedPropertySheet@@SGPAUCRuntimeClass@@XZ
??1CLocalizedPropertySheet@@UAE@XZ
?DefWindowProcA@CLocalizedPropertySheet@@MAEJIIJ@Z
?OnAdjustHeight@CLocalizedPropertySheet@@UAEXXZ
?GetThisMessageMap@CLocalizedPropertySheet@@KGPBUAFX_MSGMAP@@XZ
??0CLocalizedPropertySheet@@QAE@PBDPAVCWnd@@I@Z
?EnableScroll@CLocalizedPropertySheet@@QAEXH@Z
?OnInitDialog@CLocalizedPropertySheet@@MAEHXZ
??0CLocalizedTooltip@@QAE@XZ
?GetHelpFilePath@CLocalizedTooltip@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
??1CLocalizedTooltip@@UAE@XZ
?LoadTooltip@CLocalizedTooltip@@UAEXPBD@Z
?GetTooltipID@CLocalizedTooltip@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HH@Z
?GetNext@?$CList@PAULANGUAGE_DESC@@PAU1@@@QAEAAPAULANGUAGE_DESC@@AAPAU__POSITION@@@Z
?GetHeadPosition@?$CList@PAULANGUAGE_DESC@@PAU1@@@QBEPAU__POSITION@@XZ
?OnMouseMove@CLocalizedTooltip@@QAEXIVCPoint@@@Z
?OnPreTranslateMessage@CLocalizedTooltip@@QAEXPAUtagMSG@@@Z
?OnToolTipText@CLocalizedTooltip@@QAEHIPAUtagNMHDR@@PAJ@Z
?EnableTooltips@CLocalizationManager@@QAEXH@Z
?Init@CLocalizedTooltip@@QAEXPAVCWnd@@@Z
?PrepareTooltips@CLocalizedTooltip@@QAEXXZ
?GetThisClass@CLocalizedDialog@@SGPAUCRuntimeClass@@XZ
??1CLocalizedDialog@@MAE@XZ
??0CLocalizedDialog@@QAE@IPAVCWnd@@@Z
?PreTranslateMessage@CLocalizedDialog@@MAEHPAUtagMSG@@@Z
?DefWindowProcA@CLocalizedDialog@@MAEJIIJ@Z
?DoDataExchange@CLocalizedDialog@@MAEXPAVCDataExchange@@@Z
?GetThisMessageMap@CLocalizedDialog@@KGPBUAFX_MSGMAP@@XZ
?LoadStringA@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@I@Z
?OnInitDialog@CLocalizedDialog@@MAEHXZ
?Init@CLocalizationManager@@QAEXPBD0K@Z
?g_localizationManager@@3VCLocalizationManager@@A
??0CLocalizedMenu@@QAE@XZ
?LoadMenuA@CLocalizedMenu@@QAEHI@Z
?Compare@CLocalizationManager@@QAEXPBD@Z
?Find@CLocalizationManager@@QAEPAULANGUAGE_DESC@@PBD@Z
?SetAllocateLocalizedTooltip@CLocalizationManager@@QAEXP6APAVCLocalizedTooltip@@XZ@Z
?SetDpiAware@@YAHK@Z
?Localize@@YAXPAVCWnd@@@Z
?Localize@@YAXPAVCMenu@@@Z
?LoadStringA@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?GetThisClass@CLocalizedPropertyPage@@SGPAUCRuntimeClass@@XZ
??1CLocalizedPropertyPage@@UAE@XZ
??1CLocalizedMenu@@UAE@XZ
?g_dwDpiAware@@3KA
?GetDpi@@YAIPAUHWND__@@@Z
?GetThisMessageMap@CLocalizedPropertyPage@@KGPBUAFX_MSGMAP@@XZ
?OnInitDialog@CLocalizedPropertyPage@@MAEHXZ
??0CLocalizedPropertyPage@@QAE@II@Z
?DoDataExchange@CLocalizedPropertyPage@@MAEXPAVCDataExchange@@@Z
?OnDpiChange@CLocalizedPropertyPage@@UAEXXZ
?DefWindowProcA@CLocalizedPropertyPage@@MAEJIIJ@Z
?PreTranslateMessage@CLocalizedPropertyPage@@MAEHPAUtagMSG@@@Z

msimg32

GradientFill

mfc90

ord5520
ord404
ord1258
ord2591
ord615
ord5137
ord5153
ord663
ord5286
ord5032
ord5216
ord5493
ord5496
ord5494
ord5495
ord2045
ord2047
ord1934
ord2057
ord1937
ord2360
ord4618
ord3487
ord4640
ord1670
ord2277
ord4496
ord1604
ord2103
ord3436
ord4594
ord5924
ord1211
ord1265
ord4529
ord1387
ord2372
ord5960
ord320
ord2566
ord1709
ord3528
ord2469
ord1042
ord6646
ord4678
ord1643
ord4686
ord5645
ord1711
ord2224
ord1409
ord1016
ord6140
ord2354
ord616
ord3488
ord1671
ord1770
ord2590
ord6365
ord4251
ord3138
ord1222
ord5307
ord1144
ord639
ord3489
ord3228
ord5636
ord4993
ord5151
ord4616
ord5852
ord1536
ord3738
ord2210
ord411
ord664
ord3016
ord2209
ord3351
ord405
ord3009
ord2130
ord3179
ord5753
ord1555
ord6793
ord341
ord617
ord1098
ord5552
ord1603
ord6613
ord3213
ord305
ord1611
ord2447
ord793
ord4434
ord4409
ord6783
ord4159
ord6781
ord4733
ord2251
ord2206
ord6018
ord4165
ord1046
ord5533
ord6721
ord5813
ord4199
ord5659
ord4981
ord6001
ord3659
ord589
ord4952
ord4029
ord942
ord2896
ord4481
ord2481
ord6166
ord5997
ord2141
ord820
ord692
ord1492
ord6771
ord2105
ord1698
ord4643
ord3553
ord4727
ord1884
ord2100
ord686
ord3545
ord6333
ord6802
ord5761
ord5482
ord4760
ord333
ord4527
ord4396
ord6071
ord3731
ord6791
ord5750
ord1247
ord3579
ord436
ord3157
ord1691
ord6079
ord525
ord6078
ord6527
ord6170
ord4153
ord3148
ord6074
ord3627
ord1358
ord3477
ord3479
ord3612
ord2588
ord1183
ord3534
ord1137
ord1061
ord1087
ord3726
ord6153
ord1254
ord310
ord941
ord4392
ord300
ord3178
ord817
ord781
ord580
ord3997
ord2280
ord4644
ord3554
ord693
ord524
ord744
ord2470
ord6507
ord2097
ord2587
ord1357
ord367
ord636
ord798
ord3980
ord2448
ord795
ord2087
ord3209
ord5657
ord5660
ord4333
ord4982
ord5663
ord5646
ord6002
ord3110
ord4890
ord593
ord3939
ord265
ord266
ord4030
ord796
ord3663
ord6740
ord4977
ord6048
ord6584
ord6456
ord1782
ord1717
ord3277
ord3638
ord595
ord2364
ord2899
ord4116
ord2539
ord6291
ord2048
ord772
ord2069
ord2592
ord3346
ord6391
ord1497
ord2074
ord5647
ord4667
ord3940
ord3056
ord4248
ord6559
ord3140
ord2497
ord5870
ord316
ord945
ord4311
ord1041
ord910
ord6335
ord601
ord4252
ord6327
ord1252
ord1938
ord5615
ord4617
ord5152
ord5309
ord2208
ord1810
ord1809
ord1678
ord3344
ord6388
ord1755
ord1752
ord4331
ord1496
ord4650
ord5585
ord5497
ord6780
ord4589
ord3732
ord5139
ord4688
ord1729
ord6446
ord5668
ord5666
ord958
ord963
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4668
ord581
ord782
ord800
ord5262
ord2106
ord1276

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_except_handler4_common
malloc
__iob_func
fprintf
fread
pow
_invoke_watson
_setjmp3
longjmp
floor
memcmp
vsprintf_s
sprintf_s
labs
__RTDynamicCast
_findfirst32
_findnext32
_findclose
_time32
_mkdir
strcmp
strstr
_time64
_localtime64_s
strftime
_mktime64
_fullpath
_strnicmp
strcpy_s
strcat_s
_access
memset
memcpy_s
_stricmp
strlen
memcpy
sscanf_s
_splitpath_s
__CxxFrameHandler3
_setmbcp
free
_controlfp_s

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
ExitProcess
GetFileSize
ReadFile
OpenFile
WriteFile
_lclose
GetLocalTime
WritePrivateProfileStringA
DeleteFileA
GetVersionExA
LocalFree
OpenProcess
BeginUpdateResourceA
EnumResourceTypesA
EndUpdateResourceA
EnumResourceNamesA
FindResourceA
LoadResource
LockResource
SizeofResource
UpdateResourceA
FreeResource
GetModuleFileNameA
GetCurrentProcess
Sleep
CreateFileMappingA
GetPrivateProfileStringA
GetTickCount
CreateMutexA
ReleaseMutex
CloseHandle
WaitForMultipleObjects
ResetEvent
GetSystemDirectoryA
OutputDebugStringA
ResumeThread
lstrlenA
lstrcpyA
lstrcatA
GetLastError
SetLastError
GetModuleHandleA
SetEvent
SetThreadPriority
QueryPerformanceFrequency
WaitForSingleObject
QueryPerformanceCounter
SwitchToThread
CreateEventA
LoadLibraryA
GetProcAddress
FreeLibrary
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile

user32

PostMessageA
IsWindowVisible
GetActiveWindow
GetForegroundWindow
IsRectEmpty
OffsetRect
GetDC
ReleaseDC
GetSysColor
CopyRect
PtInRect
FillRect
ScreenToClient
InvalidateRgn
RedrawWindow
SetTimer
KillTimer
GetCapture
WindowFromPoint
GetCursorPos
SetCursor
GetAsyncKeyState
DestroyIcon
LoadImageA
SetForegroundWindow
GetWindowRect
FindWindowA
RegisterWindowMessageA
GetDesktopWindow
MessageBoxA
GetMonitorInfoA
SystemParametersInfoA
MonitorFromPoint
GetSystemMetrics
GetSubMenu
GetUpdateRect
SetMenuInfo
GetMenuInfo
LoadCursorA
GetWindowThreadProcessId
IsIconic
SetWindowRgn
GetWindow
SendMessageTimeoutA
IsWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
AdjustWindowRectEx
ReleaseCapture
GetParent
SetCapture
GetWindowLongA
SetWindowLongA
SendMessageA
EnableWindow
BroadcastSystemMessageA
GetClientRect
DrawTextA

gdi32

GetDeviceCaps
CreateBitmap
SetTextColor
SetBkColor
GetTextCharacterExtra
GetTextMetricsA
GetCharWidth32A
GetCharABCWidthsA
TextOutA
GetDIBits
DeleteDC
GetObjectA
GetBitmapBits
SetBitmapBits
SetStretchBltMode
StretchDIBits
CreateFontA
CreatePen
CreateSolidBrush
GetCurrentObject
GetTextExtentPoint32A
BitBlt
CombineRgn
CreateRectRgn
CreateCompatibleBitmap
DeleteObject
StretchBlt
SelectObject
CreateCompatibleDC

advapi32

SetNamedSecurityInfoA
RegCloseKey
RegDeleteValueA
GetNamedSecurityInfoA
ConvertStringSidToSidA
SetEntriesInAclA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA

shell32

Shell_NotifyIconA
SHGetSpecialFolderPathA
ShellExecuteA

comctl32

ord17
ImageList_DrawEx

wininet

InternetErrorDlg
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetReadFile

Exports

Exports

GetColorPreview
GetHostAppID
GetHostAppProperty
GetHostAppVersion
LocalizeMenu
LocalizeStr
LocalizeWnd
PickColor
PickColorEx

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RTSSHooks.dll.copy
.dll windows:5 windows x86 arch:x86

96d14285f505879379b759922b757138

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:ee:75:21:7e:5a:98:ef:4f:f2:76:4d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

17-09-2019 08:15

Not After

16-09-2022 08:28

Subject

SERIALNUMBER=22178368,CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,STREET=NO.69\, LI-DE ST.\, ZHONGHE DIST.,L=New Taipei,ST=New Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bc:9f:a8:45:a0:74:71:93:6d:87:65:dd:16:7c:55:d4:e3:1d:49:02
Signer

Actual PE Digest

bc:9f:a8:45:a0:74:71:93:6d:87:65:dd:16:7c:55:d4:e3:1d:49:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdA

shlwapi

PathAddBackslashA
PathRemoveExtensionA
PathMatchSpecA
PathRemoveFileSpecA
PathStripPathA
PathRenameExtensionA

winmm

timeKillEvent
timeSetEvent

kernel32

VirtualAlloc
VirtualFree
VirtualProtect
SwitchToThread
GetTickCount
CloseHandle
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
ReleaseMutex
CreateMutexA
ReadFile
GetFileSize
OpenFile
GetSystemDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryA
FreeLibrary
GetVersionExA
CreateEventA
GetCurrentProcessId
MapViewOfFile
OpenFileMappingA
OpenEventA
UnmapViewOfFile
ResetEvent
SetEvent
GetCurrentThreadId
GetLocalTime
_lclose
WriteFile
SetFilePointer
OutputDebugStringA
GetLastError
CreateFileMappingA
GetWindowsDirectoryA
DuplicateHandle
Sleep
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
GetEnvironmentVariableA
SetWaitableTimer
CreateWaitableTimerA
GetCurrentProcess
GetExitCodeProcess
InterlockedCompareExchange
ResumeThread
FlushInstructionCache
SetThreadContext
GetThreadContext
SetLastError
LoadLibraryExW
VirtualQuery
GetPrivateProfileStringA
WritePrivateProfileStringA
DeleteFileA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LocalAlloc
GetSystemDirectoryW
GetFileAttributesW
LocalFree
FileTimeToSystemTime
GetModuleFileNameW
VerifyVersionInfoW
VerSetConditionMask
lstrcmpW
ExpandEnvironmentStringsW
GetFullPathNameW
InterlockedExchange
RaiseException
GetLocaleInfoA
UnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
GetTimeZoneInformation
WideCharToMultiByte
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetModuleHandleA
GetProcAddress
GetModuleFileNameA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetUnhandledExceptionFilter
HeapAlloc
TerminateProcess
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
GetModuleHandleW
SetEnvironmentVariableA
GetFileAttributesA
RtlUnwind
MultiByteToWideChar
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
CreateDirectoryA
FindClose
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
GetCommandLineA
HeapFree
TlsFree

user32

DrawIcon
ReleaseDC
RegisterWindowMessageA
SetWindowsHookExA
CallNextHookEx
SendMessageA
PostMessageA
MessageBeep
GetForegroundWindow
SendMessageTimeoutA
UnhookWindowsHookEx
DestroyWindow
GetIconInfo
RegisterClassA
CreateWindowExA
GetActiveWindow
IntersectRect
SubtractRect
WindowFromDC
GetClientRect
FindWindowA
MonitorFromWindow
GetMonitorInfoA
FindWindowExA
GetClassNameA
GetCursorPos
GetDC
EnumDisplaySettingsA
GetAsyncKeyState
FillRect
LoadCursorA
GetWindowThreadProcessId

gdi32

SetTextColor
SetBkColor
CreateFontA
GetTextCharacterExtra
GetTextMetricsA
GetCharWidth32A
GetCharABCWidthsA
GetTextExtentPoint32A
TextOutA
CreateCompatibleDC
GetDeviceCaps
CreateBitmap
SelectObject
BitBlt
DeleteObject
GetDIBits
CreateDCA
GetDeviceGammaRamp
DeleteDC
GetStockObject
CreateSolidBrush

Exports

Exports

BeginRecord
CleanupPreview
CopyFontTexture
DeleteProfile
DesktopVideoCapture
EndRecord
EnumProfiles
GetFnOffsetCacheErr
GetFontTextureWidth
GetPreviewStats
GetProfileProperty
InitFnOffsetCache
InitPreview
InjectProcess
InstallRTSSHook
IsCaptureInProgress
IsValidFnOffsetCache
LatencyMarker
LoadProfile
PTTEvent
RenderPreviewBeginD3D9
RenderPreviewEnd
ResetProfile
SaveProfile
ScreenCapture
SetFlags
SetProfileProperty
UninstallRTSSHook
UpdateProfiles
ValidateRuntimes
VideoCapture
VideoCaptureEx
_RTSSCBTProc@12
_RTSSRemoteProc@4

Sections

.text
Size: 524KB - Virtual size: 523KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 44.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTSSHooks64.dll.copy
.dll windows:5 windows x64 arch:x64

4e020a45ad5027e96fc41e1f1270b912

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:ee:75:21:7e:5a:98:ef:4f:f2:76:4d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

17-09-2019 08:15

Not After

16-09-2022 08:28

Subject

SERIALNUMBER=22178368,CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,STREET=NO.69\, LI-DE ST.\, ZHONGHE DIST.,L=New Taipei,ST=New Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

72:a1:a7:b9:88:76:7e:63:cc:d7:e7:65:3f:01:c3:df:16:23:ad:78
Signer

Actual PE Digest

72:a1:a7:b9:88:76:7e:63:cc:d7:e7:65:3f:01:c3:df:16:23:ad:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdA

shlwapi

PathAddBackslashA
PathRemoveExtensionA
PathMatchSpecA
PathRemoveFileSpecA
PathStripPathA
PathRenameExtensionA

winmm

timeKillEvent
timeSetEvent

kernel32

VirtualQuery
VirtualFree
VirtualProtect
SwitchToThread
GetTickCount
CloseHandle
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
ReleaseMutex
CreateMutexA
ReadFile
GetFileSize
OpenFile
GetSystemDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryA
FreeLibrary
GetVersionExA
CreateEventA
GetCurrentProcessId
MapViewOfFile
OpenFileMappingA
OpenEventA
UnmapViewOfFile
ResetEvent
SetEvent
GetCurrentThreadId
GetLocalTime
_lclose
WriteFile
SetFilePointer
OutputDebugStringA
GetLastError
GetWindowsDirectoryA
DuplicateHandle
Sleep
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
GetEnvironmentVariableA
SetWaitableTimer
CreateWaitableTimerA
GetCurrentProcess
GetExitCodeProcess
ResumeThread
FlushInstructionCache
SetThreadContext
GetThreadContext
SetLastError
VirtualAlloc
GetModuleHandleW
GetPrivateProfileStringA
WritePrivateProfileStringA
DeleteFileA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalAlloc
GetSystemDirectoryW
GetFileAttributesW
LocalFree
FileTimeToSystemTime
GetModuleFileNameW
VerifyVersionInfoW
VerSetConditionMask
GetFullPathNameW
RaiseException
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
HeapReAlloc
FlushFileBuffers
GetConsoleMode
GetConsoleCP
RtlVirtualUnwind
HeapDestroy
HeapCreate
HeapSetInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
GetTimeZoneInformation
WideCharToMultiByte
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetProcAddress
GetModuleFileNameA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
RtlPcToFileHeader
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
LoadLibraryExW
SetEnvironmentVariableA
RtlUnwindEx
GetFileAttributesA
RtlLookupFunctionEntry
MultiByteToWideChar
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
CreateDirectoryA
FindClose
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
FlsSetValue
GetCommandLineA
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
HeapAlloc
TerminateProcess
IsDebuggerPresent
HeapSize

user32

DrawIcon
ReleaseDC
RegisterWindowMessageA
SetWindowsHookExA
CallNextHookEx
PostMessageA
SendMessageA
MessageBeep
GetForegroundWindow
SendMessageTimeoutA
UnhookWindowsHookEx
DestroyWindow
GetIconInfo
RegisterClassA
CreateWindowExA
IntersectRect
SubtractRect
WindowFromDC
GetClientRect
FindWindowA
MonitorFromWindow
GetMonitorInfoA
GetWindowThreadProcessId
FindWindowExA
GetClassNameA
GetCursorPos
GetDC
EnumDisplaySettingsA
GetAsyncKeyState
FillRect
LoadCursorA
GetActiveWindow

gdi32

SetTextColor
SetBkColor
CreateFontA
GetTextCharacterExtra
GetTextMetricsA
GetCharWidth32A
GetCharABCWidthsA
GetTextExtentPoint32A
TextOutA
CreateCompatibleDC
GetDeviceCaps
CreateBitmap
SelectObject
BitBlt
DeleteObject
GetDIBits
CreateDCA
GetDeviceGammaRamp
DeleteDC
GetStockObject
CreateSolidBrush

Exports

Exports

BeginRecord
CleanupPreview
CopyFontTexture
DeleteProfile
DesktopVideoCapture
EndRecord
EnumProfiles
GetFnOffsetCacheErr
GetFontTextureWidth
GetPreviewStats
GetProfileProperty
InitFnOffsetCache
InitPreview
InjectProcess
InstallRTSSHook
IsCaptureInProgress
IsValidFnOffsetCache
LatencyMarker
LoadProfile
PTTEvent
RTSSCBTProc
RTSSRemoteProc
RenderPreviewBeginD3D9
RenderPreviewEnd
ResetProfile
SaveProfile
ScreenCapture
SetFlags
SetProfileProperty
UninstallRTSSHook
UpdateProfiles
ValidateRuntimes
VideoCapture
VideoCaptureEx

Sections

.text
Size: 625KB - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 45.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTSSHooksLoader.exe
.exe windows:5 windows x86 arch:x86

03f49005641bb128cf958dd3cba79eab

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:25:50:7d:1e:f0:2b:01:1b:4f:d1:07:9b:0a:0b:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08-03-2020 00:00

Not After

08-03-2022 23:59

Subject

CN=Alexey Nicolaychuk,O=Alexey Nicolaychuk,POSTALCODE=347900,STREET=Chekhov street 56A\, flat 3,L=Taganrog,ST=Rostov Oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

51:20:d4:f5:ad:6f:a8:31:02:a2:0c:0d:25:74:b2:20:fe:9d:94:f8
Signer

Actual PE Digest

51:20:d4:f5:ad:6f:a8:31:02:a2:0c:0d:25:74:b2:20:fe:9d:94:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\RTSS733\RTSSHooksLoader\RTSSHooksLoader\Release\RTSSHooksLoader.pdb

Imports

psapi

EnumProcesses

mfc90

ord1752
ord1755
ord6391
ord3346
ord4952
ord4029
ord7118
ord7312
ord300
ord1611
ord3213
ord305
ord4197
ord5552
ord1222
ord2447
ord9252
ord4890
ord3110
ord6001
ord5646
ord5663
ord4981
ord4333
ord5659
ord5657
ord3209
ord2087
ord4199
ord5668
ord6721
ord5533
ord1046
ord4165
ord6018
ord2206
ord2251
ord4733
ord6781
ord4159
ord6783
ord4409
ord4434
ord9945
ord7746
ord12597
ord12145
ord13116
ord10284
ord10437
ord9952
ord13174
ord12384
ord341
ord617
ord820
ord3579
ord265
ord266
ord5666
ord4331
ord4688
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4667
ord3663
ord4116
ord316
ord2592
ord601
ord310
ord4760
ord2069
ord1497
ord4650
ord5585
ord5497
ord6780
ord4589
ord5647
ord3732
ord958
ord5139
ord2074
ord4030
ord1729
ord963
ord6446
ord796
ord595
ord800
ord1276
ord1137
ord5813

msvcr90

strpbrk
_setmbcp
strcpy_s
__CxxFrameHandler3
memset
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
strcat_s
_stricmp

kernel32

GetModuleHandleA
CloseHandle
OpenProcess
GetProcAddress
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
LoadLibraryA
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetPrivateProfileStringA
GetLastError
CreateFileMappingA
GetModuleFileNameA

user32

PostMessageA
FindWindowA
EnableWindow
SendMessageTimeoutA
GetWindow
GetDesktopWindow
GetWindowThreadProcessId
RegisterWindowMessageA
LoadCursorA

comctl32

InitCommonControlsEx

shlwapi

PathStripPathA
PathRemoveFileSpecA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTSSHooksLoader64.exe
.exe windows:5 windows x64 arch:x64

48c96fbc2f1db4292b73fffd675edef2

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:25:50:7d:1e:f0:2b:01:1b:4f:d1:07:9b:0a:0b:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08-03-2020 00:00

Not After

08-03-2022 23:59

Subject

CN=Alexey Nicolaychuk,O=Alexey Nicolaychuk,POSTALCODE=347900,STREET=Chekhov street 56A\, flat 3,L=Taganrog,ST=Rostov Oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:f0:4f:9f:34:8f:44:f3:19:7a:3a:29:7d:89:d8:10:67:0e:07:53
Signer

Actual PE Digest

30:f0:4f:9f:34:8f:44:f3:19:7a:3a:29:7d:89:d8:10:67:0e:07:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Projects\RTSS733\RTSSHooksLoader\RTSSHooksLoader\Release\RTSSHooksLoader.pdb

Imports

psapi

EnumProcesses

mfc90

ord1434
ord4039
ord1659
ord1662
ord6041
ord3133
ord4648
ord3774
ord6744
ord6938
ord300
ord1523
ord3006
ord305
ord3921
ord5239
ord1188
ord2303
ord8878
ord4586
ord2907
ord5684
ord5333
ord5350
ord4677
ord4041
ord5346
ord5344
ord3002
ord1966
ord936
ord5499
ord6348
ord5220
ord1023
ord3897
ord5701
ord2065
ord2110
ord4429
ord6407
ord3892
ord6409
ord4112
ord4136
ord9571
ord7372
ord12223
ord11771
ord12742
ord9910
ord10063
ord9578
ord12800
ord12010
ord340
ord604
ord798
ord3338
ord265
ord266
ord4346
ord6086
ord945
ord943
ord947
ord2455
ord2475
ord2459
ord2465
ord2463
ord2461
ord2478
ord2473
ord2457
ord2480
ord2468
ord2450
ord2452
ord2470
ord2233
ord2226
ord1556
ord6410
ord3893
ord6408
ord3430
ord5083
ord6012
ord3011
ord1393
ord5295
ord2010
ord1699
ord1698
ord1635
ord5320
ord2602
ord2797
ord2904
ord4410
ord2780
ord2932
ord2605
ord2711
ord2598
ord3809
ord3810
ord3800
ord2709
ord4042
ord4591
ord4363
ord3422
ord3852
ord316
ord2437
ord589
ord310
ord4456
ord1949
ord5272
ord5191
ord6406
ord4285
ord5334
ord3488
ord4833
ord4384
ord1636
ord1954
ord3775
ord5355
ord941
ord5353
ord774
ord583
ord778
ord1237
ord1103
ord3923

msvcr90

strpbrk
_setmbcp
strcpy_s
__CxxFrameHandler3
memset
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
strcat_s
_stricmp

kernel32

GetModuleHandleA
CloseHandle
OpenProcess
GetProcAddress
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
LoadLibraryA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
Sleep
GetPrivateProfileStringA
GetLastError
CreateFileMappingA
GetModuleFileNameA

user32

PostMessageA
FindWindowA
EnableWindow
SendMessageTimeoutA
GetWindow
GetDesktopWindow
GetWindowThreadProcessId
RegisterWindowMessageA
LoadCursorA

comctl32

InitCommonControlsEx

shlwapi

PathStripPathA
PathRemoveFileSpecA

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 690B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTUI.dll
.dll windows:5 windows x86 arch:x86

cd6e848007d71adb8f82a622da11ffe2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathStripPathA
PathIsRelativeA
PathFileExistsA
PathRemoveFileSpecA

winmm

timeKillEvent
timeSetEvent

rtfc

?RemoveAt@CPtrListLite@@QAEXPAUPTR_LIST_NODE@@@Z
?GetTail@CPtrListLite@@QAEPAUPTR_LIST_NODE@@XZ
?Sort@CPtrListLite@@QAEXHP6AHPAUPTR_LIST_NODE@@0@Z@Z
??YCStringLite@@QAEABV0@PBD@Z
?Left@CStringLite@@QBE?AV1@H@Z
??YCStringLite@@QAEABV0@D@Z
?GetParams@CTextFile@@SAHHHPBDAAVCStringLite@@0H@Z
?IsEmpty@CStringLite@@QBEHXZ
?Home@CTextFile@@QAEXXZ
??0CStringLite@@QAE@PBDH@Z
?Precache@CTextFile@@QAEXPBD@Z
?PrecacheSections@CTextFile@@QAEXXZ
?Open@CTextFile@@QAEHPBD@Z
?ReadString@CTextFile@@QAEHAAVCStringLite@@@Z
?GetLength@CStringLite@@QBEHXZ
?ReadSection@CTextFile@@UAEHPBDAAVCStringLite@@@Z
?GetParams@CTextFile@@SAHPBDAAVCStringLite@@10H@Z
??H@YA?AVCStringLite@@ABV0@0@Z
?Format@CStringLite@@QAAXPBDZZ
?GetParam@CTextFile@@SAHHPBDAAVCStringLite@@0H@Z
??0CStringLite@@QAE@PBD@Z
??YCStringLite@@QAEABV0@ABV0@@Z
?GetCount@CPtrListLite@@QAEKXZ
?DestroyCache@CTextFile@@QAEXXZ
??0CTextFile@@QAE@XZ
??0CTokenString@@QAE@XZ
?strtok@CTokenString@@QAEPADPBD0@Z
?GetValue@CTextFile@@SAHPBDAAKK@Z
??1CTokenString@@UAE@XZ
??0CStringLite@@QAE@XZ
??4CStringLite@@QAEABV0@PBD@Z
??1CPtrListLite@@UAE@XZ
??4CStringLite@@QAEABV0@ABV0@@Z
??4CTextFile@@QAEAAV0@ABV0@@Z
??0CStringLite@@QAE@ABV0@@Z
??0CTextFile@@QAE@ABV0@@Z
??1CStringLite@@UAE@XZ
??1CTextFile@@UAE@XZ
?RemoveAll@CPtrListLite@@QAEXXZ
?AddTail@CPtrListLite@@QAEPAUPTR_LIST_NODE@@PAX@Z
?GetHead@CPtrListLite@@QAEPAUPTR_LIST_NODE@@XZ
??0CPtrListLite@@QAE@XZ
??_7CPtrListLite@@6B@
??0CCRC32@@QAE@XZ
?Calc@CCRC32@@QAEKKPAEK@Z
??1CCRC32@@UAE@XZ
??H@YA?AVCStringLite@@ABV0@PBD@Z

mfc90

ord2448
ord795
ord2087
ord3209
ord5657
ord5660
ord4333
ord4982
ord5663
ord5646
ord6002
ord3110
ord4890
ord593
ord3939
ord4030
ord1884
ord4760
ord524
ord744
ord2069
ord2587
ord1222
ord3346
ord6391
ord1755
ord1752
ord4331
ord1497
ord4650
ord5585
ord2074
ord5497
ord6780
ord4589
ord5647
ord3732
ord5139
ord4688
ord1729
ord6446
ord5668
ord5666
ord958
ord963
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord3980
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4667
ord3663
ord595
ord796
ord320
ord5852
ord817
ord300
ord1265
ord798
ord4516
ord1490
ord6557
ord6291
ord2592
ord4502
ord2469
ord1358
ord3528
ord2106
ord1183
ord3534
ord579
ord5528
ord6815
ord780
ord945
ord453
ord702
ord3213
ord305
ord6613
ord3178
ord1611
ord310
ord1137
ord820
ord316
ord601
ord2539
ord910
ord6793
ord3179
ord404
ord5520
ord663
ord5753
ord1555
ord6062
ord3579
ord2588
ord265
ord266
ord800
ord391
ord2607
ord1241
ord1152

msvcr90

_encoded_null
_encode_pointer
?terminate@@YAXXZ
strlen
pow
floor
memcmp
__iob_func
fprintf
strchr
sscanf_s
__RTDynamicCast
_mkdir
strcat_s
wcstombs_s
_CIpow
_purecall
fflush
fclose
fwrite
_ftelli64
_fseeki64
fread
__CxxFrameHandler3
fopen_s
_mktime64
realloc
malloc
free
strcpy_s
qsort
_setjmp3
longjmp
memset
_splitpath_s
_stricmp
memcpy
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer

kernel32

CreateProcessA
GetModuleFileNameA
ExitProcess
InterlockedExchange
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetFullPathNameA
CloseHandle
WaitForSingleObject
SetEvent
WaitForMultipleObjects
ResetEvent
CreateEventA
ResumeThread
SetThreadPriority
Sleep
GetPrivateProfileIntA
GetPrivateProfileStringA
FindResourceA
LoadResource
LockResource
InterlockedCompareExchange
GetTickCount
FreeResource

user32

UnionRect
GetDC
ReleaseCapture
IsWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
GetFocus
SetCapture
LockWindowUpdate
SendMessageA
ClientToScreen
GetWindowRect
SetWindowRgn
EqualRect
ReleaseDC
IntersectRect
PtInRect
GetCursorPos
ScreenToClient
PeekMessageA
PostMessageA
EnableWindow
RedrawWindow
GetUpdateRect
GetClientRect
CopyRect
LoadCursorA

gdi32

SetDIBits
StretchBlt
StretchDIBits
CreateDIBitmap
CreateCompatibleDC
GetDeviceCaps
CreateFontA
CreateBitmap
SelectObject
BitBlt
GetDIBits
DeleteDC
GetCurrentObject
CreateRectRgn
CombineRgn
DeleteObject
CreatePalette
SetStretchBltMode

Exports

Exports

??0CDIB@@QAE@XZ
??0CDIBCache@@QAE@ABV0@@Z
??0CDIBCache@@QAE@XZ
??0CDIBDC@@QAE@XZ
??0CDIBWnd@@QAE@XZ
??0CDIBWndThread@@IAE@XZ
??0CDIBWndThread@@QAE@PAVCDIBWnd@@@Z
??0CLauncherThread@@IAE@XZ
??0CLauncherThread@@QAE@PAVCWnd@@PAVCLauncherThreadOwner@@PBDK@Z
??0CLauncherThreadOwner@@QAE@ABV0@@Z
??0CLauncherThreadOwner@@QAE@XZ
??0CLayeredWindowDC@@QAE@ABV0@@Z
??0CLayeredWindowDC@@QAE@XZ
??0CMMTimer@@QAE@ABV0@@Z
??0CMMTimer@@QAE@XZ
??0CSkin@@QAE@ABV0@@Z
??0CSkin@@QAE@XZ
??0CSkinnedButton@@QAE@ABV0@@Z
??0CSkinnedButton@@QAE@XZ
??0CSkinnedControl@@QAE@ABV0@@Z
??0CSkinnedControl@@QAE@XZ
??0CSkinnedIndicator@@QAE@XZ
??0CSkinnedIndicatorSource@@QAE@ABV0@@Z
??0CSkinnedIndicatorSource@@QAE@XZ
??0CSkinnedPlaceholder@@QAE@ABV0@@Z
??0CSkinnedPlaceholder@@QAE@XZ
??0CSkinnedSite@@QAE@ABV0@@Z
??0CSkinnedSite@@QAE@XZ
??0CSkinnedSlider@@QAE@ABV0@@Z
??0CSkinnedSlider@@QAE@XZ
??0CSkinnedText@@QAE@XZ
??0CSkinnedWnd@@QAE@XZ
??0CValueClipper@@QAE@ABV0@@Z
??0CValueClipper@@QAE@XZ
??1CDIB@@UAE@XZ
??1CDIBCache@@UAE@XZ
??1CDIBDC@@UAE@XZ
??1CDIBWnd@@UAE@XZ
??1CDIBWndThread@@MAE@XZ
??1CLauncherThread@@UAE@XZ
??1CLauncherThreadOwner@@UAE@XZ
??1CLayeredWindowDC@@UAE@XZ
??1CMMTimer@@UAE@XZ
??1CSkin@@UAE@XZ
??1CSkinnedButton@@UAE@XZ
??1CSkinnedControl@@UAE@XZ
??1CSkinnedIndicator@@UAE@XZ
??1CSkinnedIndicatorSource@@UAE@XZ
??1CSkinnedPlaceholder@@UAE@XZ
??1CSkinnedSite@@UAE@XZ
??1CSkinnedSlider@@UAE@XZ
??1CSkinnedText@@UAE@XZ
??1CSkinnedWnd@@UAE@XZ
??1CValueClipper@@UAE@XZ
??4CDIBCache@@QAEAAV0@ABV0@@Z
??4CLauncherThreadOwner@@QAEAAV0@ABV0@@Z
??4CLayeredWindowDC@@QAEAAV0@ABV0@@Z
??4CMMTimer@@QAEAAV0@ABV0@@Z
??4CSkin@@QAEAAV0@ABV0@@Z
??4CSkinnedButton@@QAEAAV0@ABV0@@Z
??4CSkinnedControl@@QAEAAV0@ABV0@@Z
??4CSkinnedIndicatorSource@@QAEAAV0@ABV0@@Z
??4CSkinnedPlaceholder@@QAEAAV0@ABV0@@Z
??4CSkinnedSite@@QAEAAV0@ABV0@@Z
??4CSkinnedSlider@@QAEAAV0@ABV0@@Z
??4CValueClipper@@QAEAAV0@ABV0@@Z
??_7CDIB@@6B@
??_7CDIBCache@@6B@
??_7CDIBDC@@6B@
??_7CDIBWnd@@6B@
??_7CDIBWndThread@@6B@
??_7CLauncherThread@@6B@
??_7CLauncherThreadOwner@@6B@
??_7CLayeredWindowDC@@6B@
??_7CMMTimer@@6B@
??_7CSkin@@6B@
??_7CSkinnedButton@@6B@
??_7CSkinnedControl@@6B@
??_7CSkinnedIndicator@@6B@
??_7CSkinnedIndicatorSource@@6B@
??_7CSkinnedPlaceholder@@6B@
??_7CSkinnedSite@@6B@
??_7CSkinnedSlider@@6B@
??_7CSkinnedText@@6B@
??_7CSkinnedWnd@@6B@
??_7CValueClipper@@6B@
?AddControl@CSkinnedWnd@@QAEHPAVCSkinnedControl@@H@Z
?AddDIB@CDIBCache@@QAEPAVCDIB@@PBDPAVCSkin@@0@Z
?AddDIB@CDIBCache@@QAEXPBDPAVCDIB@@K@Z
?AddDirtyRect@CSkinnedWnd@@QAEXPAVCRect@@@Z
?AlphaBlt@CDIB@@QAEHPAV1@0JJJJJJK@Z
?Animate@CSkinnedButton@@QAEHXZ
?Animate@CSkinnedIndicator@@QAEHXZ
?Animate@CSkinnedText@@QAEXXZ
?AppendPAK@CDIB@@QAEHPAVCSZArray@@PBDH@Z
?ApplyBitmapEffect@CSkin@@QAEHPBDPAVCDIB@@@Z
?AsyncPrepare@CDIBWnd@@QAEXXZ
?AsyncUpdate@CDIBWndThread@@QAEXXZ
?AsyncUpdateBackbuffer@CDIBWnd@@QAEXKK@Z
?Attach@CDIB@@QAEHPAV1@H@Z
?AttachDIB@CDIBWnd@@QAEHPAVCDIB@@@Z
?Bar@CDIB@@QAEHJJJJJ@Z
?BeginRedrawDirtyControls@CSkinnedWnd@@QAEXXZ
?Blt@CDIB@@QAEHPAV1@JJJJJJ@Z
?Blur9Tap@CDIB@@QAEHXZ
?CalcIndicatorValue@CSkinnedIndicatorSource@@UAEMM@Z
?CalcTimerPeriod@CSkinnedWnd@@QAEKXZ
?Capture@CDIB@@QAEHPAVCDC@@KK@Z
?CaptureDesktop@CDIB@@QAEHVCRect@@@Z
?ChangeRgn@CSkinnedWnd@@QAEXXZ
?ClientToSkin@CSkinnedWnd@@QAE?AVCPoint@@V2@@Z
?ClientToSkin@CSkinnedWnd@@QAE?AVCRect@@V2@@Z
?ClientToSkin@CSkinnedWnd@@QAEHH@Z
?ClipDWORD@CValueClipper@@SAKKKK@Z
?ClipFloat@CValueClipper@@SAMMMM@Z
?ClipInt@CValueClipper@@SAHHHH@Z
?ClipLong@CValueClipper@@SAJJJJ@Z
?ColorKeyBlt@CDIB@@QAEHPAV1@JJJJJJK@Z
?Compile@CSkin@@QAEHPBDK@Z
?CompressToPNG@CDIB@@QAEXXZ
?ConvertHSLToRGB@CDIB@@QAEXPAK00000@Z
?ConvertRGBToHSL@CDIB@@QAEXPAK00000@Z
?ConvertTo256Color@CDIB@@QAEHXZ
?ConvertTo256ColorHelper@CDIB@@KAHPBX0@Z
?ConvertToAlpha@CDIB@@QAEHXZ
?ConvertToGreyscale@CDIB@@QAEHXZ
?ConvertToHiColor@CDIB@@QAEHH@Z
?ConvertToTrueColor@CDIB@@QAEHXZ
?CopyCompressed@CDIB@@QAEXKPAEK@Z
?CopyDIB@CDIB@@QAEHPAV1@@Z
?Create@CDIB@@QAEHJJGK@Z
?Create@CDIBWnd@@QAEHKABUtagRECT@@PAVCWnd@@I@Z
?Create@CMMTimer@@QAEHIIKP6AXK@Z@Z
?Create@CMMTimer@@QAEHIIKPAUHWND__@@IIJ@Z
?Create@CSkinnedControl@@QAEHPAVCSkin@@PBDK1KH@Z
?Create@CSkinnedWnd@@UAEHPAVCSkin@@PBDK@Z
?CreateAdditionalButtons@CSkinnedWnd@@QAEHPAVCSkin@@PBDKHH@Z
?CreateAdditionalControls@CSkinnedWnd@@QAEHPAVCSkin@@PBDKHH@Z
?CreateAdditionalIndicator@CSkinnedWnd@@QAEHPAVCSkin@@PBDK11HH@Z
?CreateAdditionalIndicators@CSkinnedWnd@@QAEHPAVCSkin@@PBDKHH@Z
?CreateBitmap@CDIB@@QAEPAUHBITMAP__@@PAUHDC__@@@Z
?CreateBitmap@CDIB@@QAEPAUHBITMAP__@@PAVCDC@@@Z
?CreateDCA@CDIBDC@@QAEXXZ
?CreateDCA@CLayeredWindowDC@@QAEXPAVCDIB@@0KKK@Z
?CreateDCA@CSkinnedIndicator@@QAEXK@Z
?CreateFontA@CSkinnedText@@QAEHPAVCSkin@@PBD@Z
?CreateObject@CDIBWndThread@@SGPAVCObject@@XZ
?CreateObject@CLauncherThread@@SGPAVCObject@@XZ
?CreatePAK@CDIB@@SAJPBD0@Z
?CreatePalette@CDIB@@QAEPAUHPALETTE__@@XZ
?CreateRgn@CDIB@@QAEPAUHRGN__@@KK@Z
?CreateThread@CDIBWnd@@QAEXXZ
?CreateTimer@CSkinnedWnd@@QAEKK@Z
?Decompile@CSkin@@QAEHPBDK@Z
?DefWindowProcA@CSkinnedWnd@@MAEJIIJ@Z
?DeleteDC@CDIBDC@@QAEXXZ
?DeleteDC@CLayeredWindowDC@@QAEXXZ
?Destroy@CDIBWndThread@@QAEXXZ
?Destroy@CSkinnedWnd@@QAEXH@Z
?DestroyAdditionalControls@CSkinnedWnd@@QAEXXZ
?DestroyCompressed@CDIB@@QAEXXZ
?DestroyDIB@CDIB@@QAEHXZ
?DestroyDirtyRects@CSkinnedWnd@@QAEXXZ
?DestroyImage@CDIB@@QAEHXZ
?DestroyPalette@CDIB@@QAEHXZ
?DestroyThread@CDIBWnd@@QAEXXZ
?DetachDIB@CDIBWnd@@QAEXXZ
?DisplayMessage@CSkinnedWnd@@UAEHPBDK@Z
?DoEdit@CSkinnedText@@QAEXXZ
?Draw@CSkinnedButton@@UAEXPAVCDIB@@0@Z
?Draw@CSkinnedIndicator@@UAEXPAVCDIB@@0@Z
?Draw@CSkinnedIndicatorSource@@UAEXPAVCDIB@@0@Z
?Draw@CSkinnedPlaceholder@@UAEXPAVCDIB@@0@Z
?Draw@CSkinnedSite@@UAEXPAVCDIB@@0@Z
?Draw@CSkinnedSlider@@UAEXPAVCDIB@@0@Z
?Draw@CSkinnedText@@UAEXPAVCDIB@@0@Z
?Dump@CDIBCache@@QAEXPBD@Z
?DumpCache@CSkinnedWnd@@QAEXPBD@Z
?EatMessages@CMMTimer@@QAEHXZ
?Emboss@CDIB@@QAEHEEEE@Z
?Enable@CSkinnedControl@@QAEHH@Z
?EnableAnimtation@CSkinnedIndicator@@QAEXH@Z
?EnableClickPos@CSkinnedSlider@@QAEXH@Z
?EnableRedraw@CSkinnedWnd@@QAEXH@Z
?EnableRedrawControls@CSkinnedWnd@@QAEXH@Z
?EncryptDecryptHeader@CSkin@@QAEXPAEK0K@Z
?EncryptDecryptHeader@CSkin@@QAEXPAVCSZArray@@@Z
?EndEdit@CSkinnedText@@QAEXH@Z
?EndRedrawDirtyControls@CSkinnedWnd@@QAEXXZ
?ExitInstance@CDIBWndThread@@UAEHXZ
?ExitInstance@CLauncherThread@@UAEHXZ
?ExtractAlpha@CDIB@@QAEHXZ
?FastCopyDIB@CDIB@@QAEHPAV1@@Z
?FastResizeA8R8G8B8@CDIB@@SAXPAEKKK0KKK@Z
?FastResizeR8G8B8@CDIB@@SAXPAEKKK0KKK@Z
?FastResizeR8G8B8@CDIB@@SAXPAEKKK0KKKK@Z
?FillBitmapInfoHeader@CDIB@@QAEXPAUtagBITMAPINFOHEADER@@@Z
?FindDIB@CDIBCache@@QAEPAVCDIB@@PBD@Z
?FixSize@CSkinnedControl@@QAEXPAVCDIB@@0@Z
?FixSizes@CSkinnedSite@@QAEXXZ
?FlushDC@CDIBDC@@QAEXXZ
?FlushDIB@CDIBDC@@QAEXXZ
?GetAdditionalError@CSkin@@QAEPBDXZ
?GetAlpha@CSkinnedControl@@QAEKXZ
?GetAlphaPath@CSkinnedSlider@@QAE?AVCPoint@@V2@@Z
?GetAnimationFrame@CSkinnedButton@@QAEKXZ
?GetAnimationFrames@CSkinnedButton@@QAEKXZ
?GetAsyncScaling@CDIBWnd@@QAEKXZ
?GetBackbuffer@CDIBWnd@@QAEHXZ
?GetBaseColorKey@CSkinnedWnd@@QAEHAAK@Z
?GetBgndRect@CSkinnedSlider@@AAE?AVCRect@@XZ
?GetBitmap@CLayeredWindowDC@@QAEPAUHBITMAP__@@XZ
?GetBitmapFilenameWithEffects@CSkin@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAH@Z
?GetBltHitCount@CDIB@@QAEJPAV1@JJJJJJJJ@Z
?GetCapturedControl@CSkinnedWnd@@QAEPAVCSkinnedControl@@XZ
?GetClassNameA@CSkinnedButton@@UAE?AVCStringLite@@XZ
?GetClassNameA@CSkinnedIndicator@@UAE?AVCStringLite@@XZ
?GetClassNameA@CSkinnedIndicatorSource@@UAE?AVCStringLite@@XZ
?GetClassNameA@CSkinnedPlaceholder@@UAE?AVCStringLite@@XZ
?GetClassNameA@CSkinnedSite@@UAE?AVCStringLite@@XZ
?GetClassNameA@CSkinnedSlider@@UAE?AVCStringLite@@XZ
?GetClassNameA@CSkinnedText@@UAE?AVCStringLite@@XZ
?GetCommonParamsNum@CSkinnedControl@@SAKK@Z
?GetCompatibilityFlags@CSkinnedWnd@@QAEKXZ
?GetControlByID@CSkinnedWnd@@QAEPAVCSkinnedControl@@K@Z
?GetControlByName@CSkinnedWnd@@QAEPAVCSkinnedControl@@PBD@Z
?GetControlRect@CSkinnedControl@@QAE?AVCRect@@XZ
?GetControlRectInvalidated@CSkinnedControl@@QAE?AVCRect@@XZ
?GetControlRectRelative@CSkinnedControl@@QAE?AVCRect@@XZ
?GetDC@CDIBDC@@QAEPAUHDC__@@XZ
?GetDC@CLayeredWindowDC@@QAEPAUHDC__@@XZ
?GetDC@CSkinnedIndicator@@QAEPAVCDIBDC@@H@Z
?GetDIB@CSkinnedButton@@AAEPAVCDIB@@XZ
?GetDIB@CSkinnedIndicator@@QAEPAVCDIB@@XZ
?GetDIB@CSkinnedSlider@@AAEPAVCDIB@@XZ
?GetDIBAlpha@CSkinnedButton@@AAEPAVCDIB@@XZ
?GetDIBAlpha@CSkinnedIndicator@@QAEPAVCDIB@@XZ
?GetDIBAlpha@CSkinnedSlider@@AAEPAVCDIB@@XZ
?GetDIBAlphaBeforeClick@CSkinnedButton@@AAEPAVCDIB@@XZ
?GetDIBCache@CSkinnedControl@@QAEPAVCDIBCache@@XZ
?GetDepth@CDIB@@QAEGXZ
?GetDragRect@CSkinnedSlider@@AAE?AVCRect@@XZ
?GetEditAnimationFrames@CSkinnedText@@QAEKXZ
?GetEditCursor@CSkinnedText@@QAEDXZ
?GetEditMask@CSkinnedText@@QAEPBDXZ
?GetEditTextLen@CSkinnedText@@QAEHXZ
?GetFileType@CDIB@@QAEKPBD@Z
?GetFormat@CSkin@@QAEKXZ
?GetHeaderBitmapsSectionName@CSkin@@QAEPBDXZ
?GetHeaderGlobalSectionName@CSkin@@QAEPBDXZ
?GetHeight@CDIB@@QAEJXZ
?GetHost@CSkin@@QAEPBDXZ
?GetHottrackControl@CSkinnedWnd@@QAEPAVCSkinnedControl@@XZ
?GetID@CSkinnedControl@@QAEKXZ
?GetImage@CDIB@@QAEPAEXZ
?GetIndicatorValue@CSkinnedControl@@UAEMK@Z
?GetIndicatorValue@CSkinnedIndicatorSource@@UAEMK@Z
?GetIndicatorValue@CSkinnedSlider@@UAEMK@Z
?GetKeyboardFocus@CSkinnedWnd@@QAEPAVCSkinnedControl@@XZ
?GetLastError@CDIB@@QAEHXZ
?GetLauncherThread@CLauncherThreadOwner@@QAEPAVCLauncherThread@@XZ
?GetLayeredWindowAlpha@CSkinnedWnd@@QAEKXZ
?GetLayeredWindowMode@CSkinnedWnd@@QAEKXZ
?GetLayout@CSkinnedWnd@@QAEKXZ
?GetMMTimerMode@CMMTimer@@QAEKXZ
?GetMessageMap@CDIBWnd@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CDIBWndThread@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CLauncherThread@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CSkinnedWnd@@MBEPBUAFX_MSGMAP@@XZ
?GetName@CSkinnedControl@@QAEPBDXZ
?GetName@CSkinnedWnd@@QAEPBDXZ
?GetNearestColor@CDIB@@QAEHPAUtagPALETTEENTRY@@@Z
?GetNearestColor@CDIB@@SAHPAUtagPALETTEENTRY@@H0@Z
?GetOwner@CDIB@@QAEPAVCDIBWnd@@XZ
?GetPAK@CSkin@@QAEPAVCSZArray@@XZ
?GetPage@CSkinnedSlider@@QAEKXZ
?GetPalette@CDIB@@QAEPAUtagPALETTEENTRY@@XZ
?GetPaletteSize@CDIB@@QAEHXZ
?GetParam@CSkinnedIndicator@@QAEHHAAVCStringLite@@@Z
?GetParam@CSkinnedPlaceholder@@QAEHHAAVCStringLite@@@Z
?GetParams@CSkinnedIndicator@@QAEPBDXZ
?GetParams@CSkinnedPlaceholder@@QAEPBDXZ
?GetPeriod@CMMTimer@@QAEIXZ
?GetPixel@CDIB@@QAEHHHAAK@Z
?GetPoint@CSkinnedSlider@@QAE?AVCPoint@@XZ
?GetPos@CSkinnedSlider@@QAEJXZ
?GetRGBDifference@CDIB@@SAHPAUtagPALETTEENTRY@@0@Z
?GetRect@CDIB@@QAEXPAVCRect@@@Z
?GetReplace@CSkinnedText@@QAEEE@Z
?GetRuntimeClass@CDIBWndThread@@UBEPAUCRuntimeClass@@XZ
?GetRuntimeClass@CLauncherThread@@UBEPAUCRuntimeClass@@XZ
?GetSSAAHeight@CDIBDC@@QAEKXZ
?GetSSAAWidth@CDIBDC@@QAEKXZ
?GetScaleFactor@CSkinnedWnd@@QAEKXZ
?GetScalingMode@CDIBWnd@@QAEKXZ
?GetSite@CSkinnedControl@@QAEPAVCSkinnedSite@@XZ
?GetSize@CDIB@@QAEKXZ
?GetSizeB@CDIB@@QAEKXZ
?GetSourceControl@CSkinnedIndicator@@QAEPAVCSkinnedControl@@XZ
?GetState@CSkinnedButton@@QAEKXZ
?GetStates@CSkinnedButton@@QAEKXZ
?GetStrFilter@CDIB@@SAPADXZ
?GetText@CSkinnedText@@QAE?AVCStringLite@@XZ
?GetThisClass@CDIBWndThread@@SGPAUCRuntimeClass@@XZ
?GetThisClass@CLauncherThread@@SGPAUCRuntimeClass@@XZ
?GetThisMessageMap@CDIBWnd@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CDIBWndThread@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CLauncherThread@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CSkinnedWnd@@KGPBUAFX_MSGMAP@@XZ
?GetThread@CDIBWnd@@QAEPAVCDIBWndThread@@XZ
?GetTimerPeriod@CSkinnedControl@@QAEKXZ
?GetTimerRes@CSkinnedWnd@@QAEHXZ
?GetWidth@CDIB@@QAEJXZ
?GetWidthB@CDIB@@QAEJXZ
?GetWnd@CSkin@@QAEPAVCSkinnedWnd@@XZ
?GetWnd@CSkinnedControl@@QAEPAVCSkinnedWnd@@XZ
?GetZOrder@CSkinnedControl@@QAEKXZ
?HitTest@CSkinnedButton@@UAEHVCPoint@@K@Z
?HitTest@CSkinnedControl@@UAEHVCPoint@@K@Z
?HitTest@CSkinnedPlaceholder@@UAEHVCPoint@@K@Z
?HitTest@CSkinnedSite@@UAEHVCPoint@@K@Z
?HitTest@CSkinnedSlider@@UAEHVCPoint@@K@Z
?HitTest@CSkinnedText@@UAEHVCPoint@@K@Z
?HitTest@CSkinnedWnd@@QAEPAVCSkinnedControl@@VCPoint@@K@Z
?HitTestBase@CSkinnedWnd@@QAEHVCPoint@@K@Z
?InitDivLookup@CDIB@@QAEXXZ
?InitHeaderType@CSkin@@QAEHK@Z
?InitInstance@CDIBWndThread@@UAEHXZ
?InitInstance@CLauncherThread@@UAEHXZ
?InitResize@CDIB@@SAXPAK00000KKKKKKK@Z
?Invalidate@CSkinnedControl@@QAEXH@Z
?IsActive@CMMTimer@@QAEHXZ
?IsAlphaPath@CSkinnedSlider@@QAEHXZ
?IsAnimationEnabled@CSkinnedIndicator@@QAEHXZ
?IsBlind@CSkinnedIndicator@@QAEHXZ
?IsCaptured@CSkinnedControl@@QAEHXZ
?IsCaptured@CSkinnedWnd@@QAEHXZ
?IsCheckbox@CSkinnedButton@@QAEHXZ
?IsCmdLine@CSkinnedButton@@QAEHXZ
?IsCompressed@CDIB@@QAEHXZ
?IsEditMode@CSkinnedText@@QAEHXZ
?IsEditing@CSkinnedText@@QAEHXZ
?IsEnabled@CSkinnedControl@@QAEHXZ
?IsGDI@CSkinnedText@@QAEHXZ
?IsHorizontal@CSkinnedIndicator@@QAEHXZ
?IsHorizontal@CSkinnedSlider@@QAEHXZ
?IsHottrack@CSkinnedControl@@QAEHXZ
?IsIdle@CDIBWndThread@@QAEHXZ
?IsIntersected@CSkinnedControl@@QAEHPAVCRect@@@Z
?IsInverted@CSkinnedIndicator@@QAEHXZ
?IsKeyboardFocusCaptured@CSkinnedControl@@UAEHXZ
?IsKeyboardFocusCaptured@CSkinnedText@@UAEHXZ
?IsKeyboardFocusCaptured@CSkinnedWnd@@QAEHXZ
?IsNative@CSkin@@QAEHXZ
?IsPressed@CSkinnedButton@@QAEHXZ
?IsRedrawControlsEnabled@CSkinnedWnd@@QAEHXZ
?IsRedrawEnabled@CSkinnedWnd@@QAEHXZ
?IsSmooth@CSkinnedIndicator@@QAEHXZ
?IsSpin@CSkinnedButton@@QAEHXZ
?IsSupportedFormat@CSkin@@IAEHK@Z
?IsSupportedFormat@CSkin@@QAEHXZ
?IsTimerPaused@CSkinnedControl@@QAEHXZ
?IsUSFHeader@CSkin@@QAEHXZ
?IsUXFHeader@CSkin@@QAEHXZ
?IsValidChar@CSkinnedText@@QAEHE@Z
?IsVisible@CSkinnedControl@@QAEHXZ
?Kill@CDIBWndThread@@QAEXXZ
?Kill@CLauncherThread@@QAEXXZ
?Kill@CMMTimer@@QAEXH@Z
?KillDivLookup@CDIB@@QAEXXZ
?LaunchApplication@CLauncherThread@@QAEHPBDK@Z
?Line@CDIB@@QAEHJJJJJ@Z
?Load@CSkin@@QAEHPAVCMemFile@@@Z
?LoadDIB@CDIB@@QAEHHPAUHINSTANCE__@@@Z
?LoadDIB@CDIB@@QAEHPAD@Z
?LoadDIB@CDIB@@QAEHPBDPAUHINSTANCE__@@@Z
?LoadGIF@CDIB@@QAEHPAD@Z
?LoadImageA@CDIB@@QAEHPAD@Z
?LoadJPEG@CDIB@@QAEHPAD@Z
?LoadPAK@CDIB@@QAEHPAVCSZArray@@PBD@Z
?LoadPAK@CDIB@@QAEHPBD0@Z
?LoadPCX@CDIB@@QAEHPAD@Z
?LoadPNG@CDIB@@QAEHPAD@Z
?LoadPNG@CDIB@@QAEHPAEK@Z
?LockUpdateDIB@CSkinnedWnd@@QAEXH@Z
?LockUpdateLayeredWindow@CSkinnedWnd@@QAEXH@Z
?MapBitmapName@CSkin@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?NotifyParent@CSkinnedControl@@UAEXKK@Z
?OnAsyncUpdate@CDIBWnd@@QAEXXZ
?OnCreate@CDIBWnd@@QAEHPAUtagCREATESTRUCTA@@@Z
?OnCreate@CSkinnedButton@@UAEHPAVCSkin@@PBDK1K@Z
?OnCreate@CSkinnedIndicator@@UAEHPAVCSkin@@PBDK1K@Z
?OnCreate@CSkinnedIndicatorSource@@UAEHPAVCSkin@@PBDK1K@Z
?OnCreate@CSkinnedPlaceholder@@UAEHPAVCSkin@@PBDK1K@Z
?OnCreate@CSkinnedSite@@UAEHPAVCSkin@@PBDK1K@Z
?OnCreate@CSkinnedSlider@@UAEHPAVCSkin@@PBDK1K@Z
?OnCreate@CSkinnedText@@UAEHPAVCSkin@@PBDK1K@Z
?OnCreateCommon@CSkinnedControl@@IAEHKPBDAAK11K@Z
?OnDestroy@CDIBWnd@@IAEXXZ
?OnDestroy@CSkinnedWnd@@IAEXXZ
?OnKeyDown@CSkinnedButton@@UAEXIII@Z
?OnKeyDown@CSkinnedControl@@UAEXIII@Z
?OnKeyDown@CSkinnedPlaceholder@@UAEXIII@Z
?OnKeyDown@CSkinnedSlider@@UAEXIII@Z
?OnKeyDown@CSkinnedText@@UAEXIII@Z
?OnKeyDown@CSkinnedWnd@@IAEXIII@Z
?OnKeyUp@CSkinnedControl@@UAEXIII@Z
?OnKeyUp@CSkinnedSlider@@UAEXIII@Z
?OnKeyUp@CSkinnedWnd@@IAEXIII@Z
?OnKillFocus@CSkinnedButton@@UAEXXZ
?OnKillFocus@CSkinnedControl@@UAEXXZ
?OnKillFocus@CSkinnedSlider@@UAEXXZ
?OnKillFocus@CSkinnedText@@UAEXXZ
?OnKillFocus@CSkinnedWnd@@IAEXPAVCWnd@@@Z
?OnKillKeyboardFocus@CSkinnedControl@@UAEXXZ
?OnKillKeyboardFocus@CSkinnedText@@UAEXXZ
?OnLButtonDown@CSkinnedButton@@UAEXVCPoint@@@Z
?OnLButtonDown@CSkinnedControl@@UAEXVCPoint@@@Z
?OnLButtonDown@CSkinnedPlaceholder@@UAEXVCPoint@@@Z
?OnLButtonDown@CSkinnedSlider@@UAEXVCPoint@@@Z
?OnLButtonDown@CSkinnedText@@UAEXVCPoint@@@Z
?OnLButtonDown@CSkinnedWnd@@IAEXIVCPoint@@@Z
?OnLButtonUp@CSkinnedButton@@UAEXVCPoint@@@Z
?OnLButtonUp@CSkinnedControl@@UAEXVCPoint@@@Z
?OnLButtonUp@CSkinnedPlaceholder@@UAEXVCPoint@@@Z
?OnLButtonUp@CSkinnedSlider@@UAEXVCPoint@@@Z
?OnLButtonUp@CSkinnedText@@UAEXVCPoint@@@Z
?OnLButtonUp@CSkinnedWnd@@IAEXIVCPoint@@@Z
?OnMouseMove@CSkinnedButton@@UAEXVCPoint@@@Z
?OnMouseMove@CSkinnedControl@@UAEXVCPoint@@@Z
?OnMouseMove@CSkinnedPlaceholder@@UAEXVCPoint@@@Z
?OnMouseMove@CSkinnedSlider@@UAEXVCPoint@@@Z
?OnMouseMove@CSkinnedText@@UAEXVCPoint@@@Z
?OnMouseMove@CSkinnedWnd@@IAEXIVCPoint@@@Z
?OnMoveWindow@CSkinnedWnd@@UAEXVCPoint@@@Z
?OnPaint@CDIBWnd@@IAEXXZ
?OnReadControlDesc@CSkinnedWnd@@UAEHPAVCSkin@@PBD1K1AAVCStringLite@@@Z
?OnReadDefaultControlDesc@CSkinnedWnd@@UAEHPAVCSkin@@PBD1K1AAVCStringLite@@@Z
?OnSetScaleFactor@CSkinnedWnd@@UAEXK@Z
?OnTimer@CSkinnedButton@@UAEXXZ
?OnTimer@CSkinnedControl@@UAEXXZ
?OnTimer@CSkinnedIndicator@@UAEXXZ
?OnTimer@CSkinnedText@@UAEXXZ
?OnTimer@CSkinnedWnd@@IAEXI@Z
?OnUpdateLayeredWindow@CSkinnedWnd@@UAEXPAUHDC__@@@Z
?OutCode@CDIB@@IAEHJJJJJJ@Z
?OverrideDIB@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIB@CSkinnedIndicator@@QAEXPAVCDIB@@@Z
?OverrideDIBAlpha@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIBAlpha@CSkinnedIndicator@@QAEXPAVCDIB@@@Z
?OverrideDIBHottrack@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIBHottrackAlpha@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIBPressed@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIBPressedAlpha@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIBPressedHottrack@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideDIBPressedHottrackAlpha@CSkinnedButton@@QAEXPAVCDIB@@@Z
?OverrideHeader@CSkin@@AAEXPAVCTextFile@@@Z
?PauseTimer@CSkinnedControl@@QAEXH@Z
?PointToPos@CSkinnedSlider@@AAEJVCPoint@@@Z
?PosToPoint@CSkinnedSlider@@AAE?AVCPoint@@J@Z
?PostMessageToTarget@CMMTimer@@IAEXXZ
?Press@CSkinnedButton@@QAEXH@Z
?ProcessCommandLine@CLauncherThread@@QAEXPBDAAPAD1H@Z
?ProcessLButtonDown@CSkinnedWnd@@QAEHVCPoint@@@Z
?ProcessLButtonUp@CSkinnedWnd@@QAEHVCPoint@@@Z
?ProcessMouseMove@CSkinnedWnd@@QAEHVCPoint@@@Z
?RGBTo555@CDIB@@SAGEEE@Z
?ReadControlDesc@CSkin@@QAEHPBD0K0AAVCStringLite@@@Z
?ReadHeaderSection@CSkin@@QAEHPBDAAVCStringLite@@@Z
?ReadHeaderSectionParam@CSkin@@QAEHPBD0AAVCStringLite@@@Z
?ReadHeaderSectionParamForLayout@CSkin@@QAEHPBDK0AAVCStringLite@@H@Z
?RecalcControlRect@CSkinnedText@@QAEXXZ
?Recompress@CDIB@@QAEXXZ
?Recreate@CSkinnedControl@@QAEHPAVCSkin@@H@Z
?Redraw@CSkinnedControl@@QAEXXZ
?RedrawControl@CSkinnedWnd@@QAEXPAVCSkinnedControl@@@Z
?RedrawControls@CSkinnedWnd@@QAEXPAVCRect@@@Z
?RedrawControls@CSkinnedWnd@@QAEXXZ
?RedrawIndicators@CSkinnedControl@@QAEXXZ
?ReleaseKeyboardFocus@CSkinnedControl@@QAEXXZ
?RemoveControl@CSkinnedWnd@@QAEHPAVCSkinnedControl@@@Z
?RemoveUnusedEntries@CDIB@@QAEHXZ
?RepositionControl@CSkinnedControl@@QAEXXZ
?ResetLayouts@CSkinnedWnd@@QAEXXZ
?ResizeA8R8G8B8@CDIB@@SAXPAEKKK0KKK@Z
?ResizeDIB@CDIB@@QAEHHHH@Z
?ResizePalette@CDIB@@QAEHH@Z
?ResizePaletteHelper@CDIB@@KAHPBX0@Z
?ResizeR8G8B8@CDIB@@SAXPAEKKK0KKK@Z
?ResizeR8G8B8@CDIB@@SAXPAEKKK0KKKK@Z
?SaveDIB@CDIB@@QAEHPAD@Z
?SetAdditionalError@CSkin@@QAEXPBD@Z
?SetAlphaHitTest@CSkinnedButton@@QAEXH@Z
?SetAlphaPathThreshold@CSkinnedSlider@@QAEXK@Z
?SetAnimationFrame@CSkinnedButton@@QAEHK@Z
?SetAnimationFrames@CSkinnedIndicator@@QAEXK@Z
?SetAsyncScaling@CDIBWnd@@QAEXK@Z
?SetBackbuffer@CDIBWnd@@QAEXH@Z
?SetBgndColor@CSkinnedText@@QAEXK@Z
?SetCapture@CSkinnedControl@@QAEHH@Z

Sections

.text
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SaveMedia.cfg
SaveMedia.dll
.dll windows:5 windows x86 arch:x86

43b0d6741ccb904ea1c66050f700cbbc

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:ee:75:21:7e:5a:98:ef:4f:f2:76:4d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

17-09-2019 08:15

Not After

16-09-2022 08:28

Subject

SERIALNUMBER=22178368,CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,STREET=NO.69\, LI-DE ST.\, ZHONGHE DIST.,L=New Taipei,ST=New Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ff:7e:f7:a6:cb:37:0d:8f:b4:50:17:a9:bf:a1:21:53:d4:78:14:eb
Signer

Actual PE Digest

ff:7e:f7:a6:cb:37:0d:8f:b4:50:17:a9:bf:a1:21:53:d4:78:14:eb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

msvfw32

ICCompressorChoose
ICSendMessage
ICClose
ICGetInfo
ICOpen

shlwapi

PathStripPathA
PathRemoveFileSpecA
PathRenameExtensionA

dsound

ord6
ord7

mfc90

ord5924
ord817
ord1884
ord3939
ord701
ord4890
ord3110
ord6002
ord5646
ord5663
ord4982
ord4333
ord5660
ord5657
ord3209
ord2087
ord795
ord2448
ord3980
ord945
ord906
ord5865
ord4465
ord449
ord699
ord904
ord4463
ord447
ord4993
ord3987
ord5615
ord4617
ord5309
ord2208
ord1810
ord1809
ord1678
ord3344
ord6388
ord1496
ord4650
ord5636
ord4668
ord374
ord639
ord2899
ord2360
ord5152
ord310
ord4502
ord1938
ord2372
ord1183
ord1387
ord615
ord2103
ord1604
ord4496
ord2277
ord1670
ord3346
ord6391
ord1755
ord1752
ord4331
ord1497
ord4640
ord5585
ord2074
ord5497
ord6780
ord4589
ord5647
ord3732
ord5139
ord4688
ord1729
ord6446
ord5668
ord5666
ord958
ord963
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord3277
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4667
ord3487
ord595
ord1137
ord3213
ord305
ord6613
ord3178
ord910
ord1611
ord3783
ord4311
ord798
ord2566
ord6802
ord5761
ord1709
ord1252
ord6791
ord265
ord266
ord316
ord2539
ord820
ord601
ord5750
ord1247
ord3579
ord800
ord593

msvcr90

strpbrk
strncpy_s
srand
rand
wcstombs_s
_setjmp3
fopen_s
longjmp
fclose
_mkdir
_stricmp
sscanf_s
_findfirst64i32
__CxxFrameHandler3
strcpy_s
_findnext64i32
_findclose
_splitpath_s
strcat_s
_purecall
memcpy
memset
sprintf_s
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_except_handler4_common
getenv
sscanf
sprintf
exit
malloc
fwrite
__iob_func
fprintf
strlen
free
memcmp
fflush
ferror

kernel32

WriteFile
_lclose
GetLocalTime
CloseHandle
GetTickCount
LoadLibraryExA
SetFilePointer
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetCurrentThreadId
GetCurrentThread
OpenFile
GetCurrentProcessId
GetPrivateProfileStringA
ReleaseMutex
WaitForSingleObject
CreateMutexA
SystemTimeToFileTime
SetEndOfFile
CreateFileA
LoadLibraryA
GetPrivateProfileIntA
WritePrivateProfileStringA
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
ExitProcess
DeleteFileA
WideCharToMultiByte
GetVersionExA
SetEvent
WaitForMultipleObjects
ResetEvent
CreateEventA
GetSystemInfo
ResumeThread
SetThreadPriority
TerminateThread
GetModuleHandleA
QueryPerformanceFrequency
QueryPerformanceCounter
ReadFile

user32

EnumDisplaySettingsA
GetDC
LoadCursorA
GetCursorPos
GetIconInfo
DrawIcon
ReleaseDC
SendMessageA
EnableWindow

gdi32

CreateBitmap
BitBlt
CreateCompatibleDC
DeleteObject
GetDeviceCaps
SelectObject
DeleteDC
GetDIBits

ole32

CoUninitialize
CoTaskMemFree
CoInitialize
CoCreateInstance
PropVariantClear

Exports

Exports

Configure
EnumAudioSources
GetStat
Init
SaveMedia
Uninit

Sections

.text
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SaveMedia64.dll
.dll windows:5 windows x64 arch:x64

1db55a5f5782886deb99ac5f3a3b2ce8

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:ee:75:21:7e:5a:98:ef:4f:f2:76:4d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

17-09-2019 08:15

Not After

16-09-2022 08:28

Subject

SERIALNUMBER=22178368,CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,STREET=NO.69\, LI-DE ST.\, ZHONGHE DIST.,L=New Taipei,ST=New Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 10:00

Not After

28-06-2032 10:00

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d3:cc:05:ef:f5:f0:a7:f4:04:78:81:90:2e:60:3d:80:27:64:26:dd
Signer

Actual PE Digest

d3:cc:05:ef:f5:f0:a7:f4:04:78:81:90:2e:60:3d:80:27:64:26:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

msvfw32

ICCompressorChoose
ICSendMessage
ICClose
ICGetInfo
ICOpen

shlwapi

PathStripPathA
PathRemoveFileSpecA
PathRenameExtensionA

dsound

ord6
ord7

mfc90

ord5609
ord795
ord1786
ord3685
ord679
ord4586
ord2907
ord5685
ord5333
ord5350
ord4678
ord4041
ord5347
ord5344
ord3002
ord1966
ord773
ord2304
ord3726
ord923
ord884
ord5551
ord4167
ord437
ord677
ord882
ord4165
ord435
ord4689
ord3732
ord5302
ord4313
ord5003
ord2067
ord1714
ord1713
ord1585
ord3131
ord6038
ord1433
ord4346
ord5323
ord4364
ord362
ord617
ord2722
ord2218
ord4846
ord310
ord4202
ord1840
ord2230
ord1149
ord1339
ord602
ord1977
ord1517
ord4196
ord2136
ord1581
ord3133
ord6041
ord1662
ord1659
ord4039
ord1434
ord4336
ord5272
ord1954
ord5191
ord6406
ord4285
ord5334
ord3488
ord4833
ord4384
ord1636
ord6086
ord5355
ord5353
ord936
ord941
ord945
ord943
ord947
ord2455
ord2475
ord2459
ord2465
ord2463
ord2461
ord2478
ord2473
ord2457
ord2480
ord2468
ord2450
ord2452
ord2470
ord2233
ord2226
ord1556
ord6410
ord3893
ord6408
ord3430
ord5083
ord6012
ord3011
ord1393
ord5295
ord2010
ord1699
ord1698
ord1635
ord5320
ord2602
ord2797
ord2904
ord4410
ord2780
ord2932
ord2605
ord2711
ord2598
ord3069
ord3809
ord3810
ord3800
ord2709
ord4042
ord4591
ord4363
ord3253
ord583
ord1103
ord3006
ord305
ord6247
ord2973
ord888
ord1523
ord3529
ord4027
ord776
ord2411
ord6428
ord5448
ord1616
ord1213
ord6417
ord265
ord266
ord316
ord2380
ord798
ord589
ord5437
ord1209
ord3338
ord778
ord581

msvcr90

strncpy_s
srand
rand
memcmp
__C_specific_handler
wcstombs_s
_setjmp
fopen_s
longjmp
fclose
_mkdir
_stricmp
sscanf_s
__CxxFrameHandler3
_findfirst64i32
strcpy_s
_findnext64i32
_findclose
_splitpath_s
strcat_s
_purecall
memset
memcpy
sprintf_s
strpbrk
__clean_type_info_names_internal
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__CppXcptFilter
_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
getenv
sscanf
sprintf
exit
malloc
fwrite
__iob_func
fprintf
strlen
free
fflush
ferror

kernel32

GetCurrentProcessId
WriteFile
SetFilePointer
GetPrivateProfileStringA
GetTickCount
LoadLibraryExA
CloseHandle
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetCurrentThreadId
GetCurrentThread
OpenFile
GetLocalTime
_lclose
ReleaseMutex
WaitForSingleObject
CreateMutexA
SystemTimeToFileTime
SetEndOfFile
CreateFileA
LoadLibraryA
GetPrivateProfileIntA
WritePrivateProfileStringA
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
ExitProcess
DeleteFileA
WideCharToMultiByte
GetVersionExA
SetEvent
WaitForMultipleObjects
ResetEvent
CreateEventA
GetSystemInfo
ResumeThread
SetThreadPriority
TerminateThread
GetModuleHandleA
QueryPerformanceFrequency
QueryPerformanceCounter
ReadFile

user32

EnumDisplaySettingsA
GetDC
LoadCursorA
GetCursorPos
GetIconInfo
DrawIcon
ReleaseDC
SendMessageA
EnableWindow

gdi32

CreateBitmap
BitBlt
CreateCompatibleDC
DeleteObject
GetDeviceCaps
SelectObject
DeleteDC
GetDIBits

ole32

CoUninitialize
CoTaskMemFree
CoInitialize
CoCreateInstance
PropVariantClear

Exports

Exports

Configure
EnumAudioSources
GetStat
Init
SaveMedia
Uninit

Sections

.text
Size: 358KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 459KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libmfxsw32.dll
.dll windows:5 windows x86 arch:x86

3b6ea42b172600bb5a8950b6766adce0

Code Sign

35:de:f4:cf
Certificate

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Not Before

22-08-1998 16:41

Not After

22-08-2018 16:41

Subject

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:b0:ff
Certificate

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Not Before

16-02-2006 18:01

Not After

19-02-2016 18:01

Subject

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1b:aa:c3:a2:00:01:00:00:79:76
Certificate

Issuer

CN=Intel External Basic Issuing CA 3A,O=Intel Corporation,C=US

Not Before

12-12-2011 18:40

Not After

26-11-2014 18:40

Subject

CN=Intel(R) Software Products

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1e:80:b7:00:00:00:00:00:07
Certificate

Issuer

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Not Before

15-05-2009 19:25

Not After

15-05-2015 19:35

Subject

CN=Intel External Basic Issuing CA 3A,O=Intel Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:7b:38:2d:2b:14:3d:42:3e:33:ac:81:56:4b:de:44:29:9d:dd:ad
Signer

Actual PE Digest

7e:7b:38:2d:2b:14:3d:42:3e:33:ac:81:56:4b:de:44:29:9d:dd:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\users\mkazakov\2013_R2\MediaSDK_2013_R2\build\win_Win32\bin\libmfxsw32.pdb

Imports

kernel32

GetLastError
CreateEventExW
GetOverlappedResult
WriteFile
CloseHandle
CreateEventW
InterlockedIncrement
WaitForSingleObject
SetEvent
ResetEvent
SetThreadAffinityMask
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetModuleFileNameW
GetSystemInfo
QueryPerformanceCounter
GetSystemTimeAsFileTime
Sleep
SwitchToThread
ReleaseSemaphore
CreateSemaphoreW
OutputDebugStringA
DecodePointer
EncodePointer
GetCurrentThreadId
GetCommandLineA
HeapAlloc
HeapReAlloc
HeapFree
ExitThread
CreateThread
GetProcAddress
GetModuleHandleW
ExitProcess
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
GetTickCount
GetCurrentProcessId
LoadLibraryW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
FlushFileBuffers
CreateFileW
ReadFile
GetFileAttributesExW
DeleteFileW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

winmm

timeGetTime

Exports

Exports

MFXCloneSession
MFXClose
MFXDisjoinSession
MFXGetPriority
MFXInit
MFXJoinSession
MFXQueryIMPL
MFXQueryVersion
MFXSetPriority
MFXVideoCORE_GetHandle
MFXVideoCORE_SetBufferAllocator
MFXVideoCORE_SetFrameAllocator
MFXVideoCORE_SetHandle
MFXVideoCORE_SyncOperation
MFXVideoDECODE_Close
MFXVideoDECODE_DecodeFrameAsync
MFXVideoDECODE_DecodeHeader
MFXVideoDECODE_GetDecodeStat
MFXVideoDECODE_GetPayload
MFXVideoDECODE_GetVideoParam
MFXVideoDECODE_Init
MFXVideoDECODE_Query
MFXVideoDECODE_QueryIOSurf
MFXVideoDECODE_Reset
MFXVideoDECODE_SetSkipMode
MFXVideoENCODE_Close
MFXVideoENCODE_EncodeFrameAsync
MFXVideoENCODE_GetEncodeStat
MFXVideoENCODE_GetVideoParam
MFXVideoENCODE_Init
MFXVideoENCODE_Query
MFXVideoENCODE_QueryIOSurf
MFXVideoENCODE_Reset
MFXVideoUSER_ProcessFrameAsync
MFXVideoUSER_Register
MFXVideoUSER_Unregister
MFXVideoVPP_Close
MFXVideoVPP_GetVPPStat
MFXVideoVPP_GetVideoParam
MFXVideoVPP_Init
MFXVideoVPP_Query
MFXVideoVPP_QueryIOSurf
MFXVideoVPP_Reset
MFXVideoVPP_RunFrameVPPAsync

Sections

.text
Size: 14.6MB - Virtual size: 14.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 453KB - Virtual size: 453KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 194KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 213KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libmfxsw64.dll
.dll windows:5 windows x64 arch:x64

ceb419a5aaa755241938db3b7db9fb65

Code Sign

35:de:f4:cf
Certificate

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Not Before

22-08-1998 16:41

Not After

22-08-2018 16:41

Subject

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:b0:ff
Certificate

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Not Before

16-02-2006 18:01

Not After

19-02-2016 18:01

Subject

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1b:aa:c3:a2:00:01:00:00:79:76
Certificate

Issuer

CN=Intel External Basic Issuing CA 3A,O=Intel Corporation,C=US

Not Before

12-12-2011 18:40

Not After

26-11-2014 18:40

Subject

CN=Intel(R) Software Products

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1e:80:b7:00:00:00:00:00:07
Certificate

Issuer

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Not Before

15-05-2009 19:25

Not After

15-05-2015 19:35

Subject

CN=Intel External Basic Issuing CA 3A,O=Intel Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:8a:b8:6f:64:ba:04:f3:b1:8d:3c:05:6d:e2:4e:53:02:44:df:08
Signer

Actual PE Digest

d4:8a:b8:6f:64:ba:04:f3:b1:8d:3c:05:6d:e2:4e:53:02:44:df:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\users\mkazakov\2013_R2\MediaSDK_2013_R2\build\win_x64\bin\libmfxsw64.pdb

Imports

kernel32

GetLastError
CreateEventExW
GetOverlappedResult
WriteFile
CloseHandle
CreateEventW
WaitForSingleObject
SetEvent
ResetEvent
SetThreadAffinityMask
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetModuleFileNameW
GetSystemInfo
QueryPerformanceCounter
GetSystemTimeAsFileTime
Sleep
SwitchToThread
ReleaseSemaphore
CreateSemaphoreW
OutputDebugStringA
DecodePointer
EncodePointer
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapAlloc
HeapReAlloc
HeapFree
ExitThread
CreateThread
GetProcAddress
GetModuleHandleW
ExitProcess
RaiseException
RtlPcToFileHeader
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
GetStdHandle
HeapSize
FlsGetValue
FlsFree
SetLastError
FlsAlloc
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetTickCount
GetCurrentProcessId
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
FlushFileBuffers
CreateFileW
ReadFile
GetFileAttributesExW
DeleteFileW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

winmm

timeGetTime

Exports

Exports

MFXCloneSession
MFXClose
MFXDisjoinSession
MFXGetPriority
MFXInit
MFXJoinSession
MFXQueryIMPL
MFXQueryVersion
MFXSetPriority
MFXVideoCORE_GetHandle
MFXVideoCORE_SetBufferAllocator
MFXVideoCORE_SetFrameAllocator
MFXVideoCORE_SetHandle
MFXVideoCORE_SyncOperation
MFXVideoDECODE_Close
MFXVideoDECODE_DecodeFrameAsync
MFXVideoDECODE_DecodeHeader
MFXVideoDECODE_GetDecodeStat
MFXVideoDECODE_GetPayload
MFXVideoDECODE_GetVideoParam
MFXVideoDECODE_Init
MFXVideoDECODE_Query
MFXVideoDECODE_QueryIOSurf
MFXVideoDECODE_Reset
MFXVideoDECODE_SetSkipMode
MFXVideoENCODE_Close
MFXVideoENCODE_EncodeFrameAsync
MFXVideoENCODE_GetEncodeStat
MFXVideoENCODE_GetVideoParam
MFXVideoENCODE_Init
MFXVideoENCODE_Query
MFXVideoENCODE_QueryIOSurf
MFXVideoENCODE_Reset
MFXVideoUSER_ProcessFrameAsync
MFXVideoUSER_Register
MFXVideoUSER_Unregister
MFXVideoVPP_Close
MFXVideoVPP_GetVPPStat
MFXVideoVPP_GetVideoParam
MFXVideoVPP_Init
MFXVideoVPP_Query
MFXVideoVPP_QueryIOSurf
MFXVideoVPP_Reset
MFXVideoVPP_RunFrameVPPAsync

Sections

.text
Size: 17.9MB - Virtual size: 17.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1016KB - Virtual size: 1015KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 248KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 337KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VenomLoader.pdb
api-ms-win-crt-convert-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:39:f7:9f:d5:a1:46:43:f5:a6:cd:a6:17:8d:2c:bc:99:5b:17:b6:f9:26:2b:86:77:07:e4:0f:72:7d:9f:44
Signer

Actual PE Digest

af:39:f7:9f:d5:a1:46:43:f5:a6:cd:a6:17:8d:2c:bc:99:5b:17:b6:f9:26:2b:86:77:07:e4:0f:72:7d:9f:44

Digest Algorithm

sha256

PE Digest Matches

true

6e:0c:10:bd:e8:f1:57:a4:46:f6:44:ba:7e:c8:8b:38:cd:fe:0e:9e
Signer

Actual PE Digest

6e:0c:10:bd:e8:f1:57:a4:46:f6:44:ba:7e:c8:8b:38:cd:fe:0e:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-convert-l1-1-0.pdb

Exports

Exports

__toascii
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_atoll_l
_ecvt
_ecvt_s
_fcvt
_fcvt_s
_gcvt
_gcvt_s
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_itoa
_itoa_s
_itow
_itow_s
_ltoa
_ltoa_s
_ltow
_ltow_s
_strtod_l
_strtof_l
_strtoi64
_strtoi64_l
_strtoimax_l
_strtol_l
_strtold_l
_strtoll_l
_strtoui64
_strtoui64_l
_strtoul_l
_strtoull_l
_strtoumax_l
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_wcstod_l
_wcstof_l
_wcstoi64
_wcstoi64_l
_wcstoimax_l
_wcstol_l
_wcstold_l
_wcstoll_l
_wcstombs_l
_wcstombs_s_l
_wcstoui64
_wcstoui64_l
_wcstoul_l
_wcstoull_l
_wcstoumax_l
_wctomb_l
_wctomb_s_l
_wtof
_wtof_l
_wtoi
_wtoi64
_wtoi64_l
_wtoi_l
_wtol
_wtol_l
_wtoll
_wtoll_l
atof
atoi
atol
atoll
btowc
c16rtomb
c32rtomb
mbrtoc16
mbrtoc32
mbrtowc
mbsrtowcs
mbsrtowcs_s
mbstowcs
mbstowcs_s
mbtowc
strtod
strtof
strtoimax
strtol
strtold
strtoll
strtoul
strtoull
strtoumax
wcrtomb
wcrtomb_s
wcsrtombs
wcsrtombs_s
wcstod
wcstof
wcstoimax
wcstol
wcstold
wcstoll
wcstombs
wcstombs_s
wcstoul
wcstoull
wcstoumax
wctob
wctomb
wctomb_s
wctrans

Sections

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-environment-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:50:ab:7d:96:b1:03:e5:9c:33:57:e5:a2:a0:b0:20:c6:70:41:b6:fc:13:b7:33:4e:95:4a:ec:63:2c:b4:a8
Signer

Actual PE Digest

12:50:ab:7d:96:b1:03:e5:9c:33:57:e5:a2:a0:b0:20:c6:70:41:b6:fc:13:b7:33:4e:95:4a:ec:63:2c:b4:a8

Digest Algorithm

sha256

PE Digest Matches

true

c5:39:0c:5d:fd:6d:02:3f:78:e0:49:32:92:57:8b:49:82:d4:9a:26
Signer

Actual PE Digest

c5:39:0c:5d:fd:6d:02:3f:78:e0:49:32:92:57:8b:49:82:d4:9a:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-environment-l1-1-0.pdb

Exports

Exports

__p__environ
__p__wenviron
_dupenv_s
_putenv
_putenv_s
_searchenv
_searchenv_s
_wdupenv_s
_wgetcwd
_wgetdcwd
_wgetenv
_wgetenv_s
_wputenv
_wputenv_s
_wsearchenv
_wsearchenv_s
getenv
getenv_s

Sections

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-filesystem-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fc:47:2d:ca:6b:a1:9d:72:3c:5f:36:47:b3:d2:7a:57:1a:d1:90:9b:a8:d2:90:fd:0a:65:1c:c0:c9:09:c1:97
Signer

Actual PE Digest

fc:47:2d:ca:6b:a1:9d:72:3c:5f:36:47:b3:d2:7a:57:1a:d1:90:9b:a8:d2:90:fd:0a:65:1c:c0:c9:09:c1:97

Digest Algorithm

sha256

PE Digest Matches

true

f9:a5:18:70:cc:4c:b9:ed:b4:4d:b8:5d:43:4e:52:ff:7d:59:3a:56
Signer

Actual PE Digest

f9:a5:18:70:cc:4c:b9:ed:b4:4d:b8:5d:43:4e:52:ff:7d:59:3a:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-filesystem-l1-1-0.pdb

Exports

Exports

_access
_access_s
_chdir
_chdrive
_chmod
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_fullpath
_getdiskfree
_getdrive
_getdrives
_lock_file
_makepath
_makepath_s
_mkdir
_rmdir
_splitpath
_splitpath_s
_stat32
_stat32i64
_stat64
_stat64i32
_umask
_umask_s
_unlink
_unlock_file
_waccess
_waccess_s
_wchdir
_wchmod
_wfindfirst32
_wfindfirst32i64
_wfindfirst64
_wfindfirst64i32
_wfindnext32
_wfindnext32i64
_wfindnext64
_wfindnext64i32
_wfullpath
_wmakepath
_wmakepath_s
_wmkdir
_wremove
_wrename
_wrmdir
_wsplitpath
_wsplitpath_s
_wstat32
_wstat32i64
_wstat64
_wstat64i32
_wunlink
remove
rename

Sections

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-heap-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:d6:5e:72:3e:36:d8:eb:18:5a:15:7c:b7:d1:d7:a2:94:3a:0a:f8:1d:12:ef:82:99:65:78:35:67:28:54:40
Signer

Actual PE Digest

6e:d6:5e:72:3e:36:d8:eb:18:5a:15:7c:b7:d1:d7:a2:94:3a:0a:f8:1d:12:ef:82:99:65:78:35:67:28:54:40

Digest Algorithm

sha256

PE Digest Matches

true

14:b3:5f:6d:73:dc:fc:c0:a9:10:3a:cd:c2:7b:b5:5b:25:79:6e:80
Signer

Actual PE Digest

14:b3:5f:6d:73:dc:fc:c0:a9:10:3a:cd:c2:7b:b5:5b:25:79:6e:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-heap-l1-1-0.pdb

Exports

Exports

_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_callnewh
_calloc_base
_expand
_free_base
_get_heap_handle
_heapchk
_heapmin
_heapwalk
_malloc_base
_msize
_query_new_handler
_query_new_mode
_realloc_base
_recalloc
_set_new_mode
calloc
free
malloc
realloc

Sections

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-locale-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:45:92:9b:72:0d:e4:40:22:56:a2:e1:f6:2a:62:af:87:6b:ea:09:d2:31:d1:f8:19:7d:a0:d3:5a:75:b8:04
Signer

Actual PE Digest

5a:45:92:9b:72:0d:e4:40:22:56:a2:e1:f6:2a:62:af:87:6b:ea:09:d2:31:d1:f8:19:7d:a0:d3:5a:75:b8:04

Digest Algorithm

sha256

PE Digest Matches

true

82:4d:d6:e4:c3:34:d8:4e:2e:38:55:84:0c:2d:a8:9f:20:c3:1b:a7
Signer

Actual PE Digest

82:4d:d6:e4:c3:34:d8:4e:2e:38:55:84:0c:2d:a8:9f:20:c3:1b:a7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-locale-l1-1-0.pdb

Exports

Exports

___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
__initialize_lconv_for_unsigned_char
__pctype_func
__pwctype_func
_configthreadlocale
_create_locale
_free_locale
_get_current_locale
_getmbcp
_lock_locales
_setmbcp
_unlock_locales
_wcreate_locale
_wsetlocale
localeconv
setlocale

Sections

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-math-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:0e:44:23:c0:fa:ef:3c:a2:b9:75:e9:78:49:ba:5a:76:a5:a1:f0:55:ca:52:1a:c2:9d:09:8f:b9:66:36:9d
Signer

Actual PE Digest

3a:0e:44:23:c0:fa:ef:3c:a2:b9:75:e9:78:49:ba:5a:76:a5:a1:f0:55:ca:52:1a:c2:9d:09:8f:b9:66:36:9d

Digest Algorithm

sha256

PE Digest Matches

true

33:29:11:ca:36:3c:eb:96:9c:d1:1e:07:b1:15:13:e0:5d:32:92:a8
Signer

Actual PE Digest

33:29:11:ca:36:3c:eb:96:9c:d1:1e:07:b1:15:13:e0:5d:32:92:a8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-math-l1-1-0.pdb

Exports

Exports

_Cbuild
_Cmulcc
_Cmulcr
_FCbuild
_FCmulcc
_FCmulcr
_LCbuild
_LCmulcc
_LCmulcr
__setusermatherr
_cabs
_chgsign
_chgsignf
_copysign
_copysignf
_d_int
_dclass
_dexp
_dlog
_dnorm
_dpcomp
_dpoly
_dscale
_dsign
_dsin
_dtest
_dunscale
_except1
_fd_int
_fdclass
_fdexp
_fdlog
_fdnorm
_fdopen
_fdpcomp
_fdpoly
_fdscale
_fdsign
_fdsin
_fdtest
_fdunscale
_finite
_finitef
_fpclass
_fpclassf
_get_FMA3_enable
_hypot
_hypotf
_isnan
_isnanf
_j0
_j1
_jn
_ld_int
_ldclass
_ldexp
_ldlog
_ldpcomp
_ldpoly
_ldscale
_ldsign
_ldsin
_ldtest
_ldunscale
_logb
_logbf
_nextafter
_nextafterf
_scalb
_scalbf
_set_FMA3_enable
_y0
_y1
_yn
acos
acosf
acosh
acoshf
acoshl
asin
asinf
asinh
asinhf
asinhl
atan
atan2
atan2f
atanf
atanh
atanhf
atanhl
cabs
cabsf
cabsl
cacos
cacosf
cacosh
cacoshf
cacoshl
cacosl
carg
cargf
cargl
casin
casinf
casinh
casinhf
casinhl
casinl
catan
catanf
catanh
catanhf
catanhl
catanl
cbrt
cbrtf
cbrtl
ccos
ccosf
ccosh
ccoshf
ccoshl
ccosl
ceil
ceilf
cexp
cexpf
cexpl
cimag
cimagf
cimagl
clog
clog10
clog10f
clog10l
clogf
clogl
conj
conjf
conjl
copysign
copysignf
copysignl
cos
cosf
cosh
coshf
cpow
cpowf
cpowl
cproj
cprojf
cprojl
creal
crealf
creall
csin
csinf
csinh
csinhf
csinhl
csinl
csqrt
csqrtf
csqrtl
ctan
ctanf
ctanh
ctanhf
ctanhl
ctanl
erf
erfc
erfcf
erfcl
erff
erfl
exp
exp2
exp2f
exp2l
expf
expm1
expm1f
expm1l
fabs
fdim
fdimf
fdiml
floor
floorf
fma
fmaf
fmal
fmax
fmaxf
fmaxl
fmin
fminf
fminl
fmod
fmodf
frexp
hypot
ilogb
ilogbf
ilogbl
ldexp
lgamma
lgammaf
lgammal
llrint
llrintf
llrintl
llround
llroundf
llroundl
log
log10
log10f
log1p
log1pf
log1pl
log2
log2f
log2l
logb
logbf
logbl
logf
lrint
lrintf
lrintl
lround
lroundf
lroundl
modf
modff
nan
nanf
nanl
nearbyint
nearbyintf
nearbyintl
nextafter
nextafterf
nextafterl
nexttoward
nexttowardf
nexttowardl
norm
normf
norml
pow
powf
remainder
remainderf
remainderl
remquo
remquof
remquol
rint
rintf
rintl
round
roundf
roundl
scalbln
scalblnf
scalblnl
scalbn
scalbnf
scalbnl
sin
sinf
sinh
sinhf
sqrt
sqrtf
tan
tanf
tanh
tanhf
tgamma
tgammaf
tgammal
trunc
truncf
truncl

Sections

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-multibyte-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:80:01:b3:58:1c:85:61:5d:26:39:4b:bf:53:f3:3a:df:7e:95:a1:d9:b9:09:26:4e:2d:38:3c:fa:3d:ac:d8
Signer

Actual PE Digest

14:80:01:b3:58:1c:85:61:5d:26:39:4b:bf:53:f3:3a:df:7e:95:a1:d9:b9:09:26:4e:2d:38:3c:fa:3d:ac:d8

Digest Algorithm

sha256

PE Digest Matches

true

07:eb:e8:45:ea:ad:1d:74:5f:21:29:93:a5:86:52:10:29:e7:63:5d
Signer

Actual PE Digest

07:eb:e8:45:ea:ad:1d:74:5f:21:29:93:a5:86:52:10:29:e7:63:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-multibyte-l1-1-0.pdb

Exports

Exports

__p__mbcasemap
__p__mbctype
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbblank
_ismbbblank_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcblank
_ismbcblank_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_mbbtombc
_mbbtombc_l
_mbbtype
_mbbtype_l
_mbcasemap
_mbccpy
_mbccpy_l
_mbccpy_s
_mbccpy_s_l
_mbcjistojms
_mbcjistojms_l
_mbcjmstojis
_mbcjmstojis_l
_mbclen
_mbclen_l
_mbctohira
_mbctohira_l
_mbctokata
_mbctokata_l
_mbctolower
_mbctolower_l
_mbctombb
_mbctombb_l
_mbctoupper
_mbctoupper_l
_mblen_l
_mbsbtype
_mbsbtype_l
_mbscat_s
_mbscat_s_l
_mbschr
_mbschr_l
_mbscmp
_mbscmp_l
_mbscoll
_mbscoll_l
_mbscpy_s
_mbscpy_s_l
_mbscspn
_mbscspn_l
_mbsdec
_mbsdec_l
_mbsdup
_mbsicmp
_mbsicmp_l
_mbsicoll
_mbsicoll_l
_mbsinc
_mbsinc_l
_mbslen
_mbslen_l
_mbslwr
_mbslwr_l
_mbslwr_s
_mbslwr_s_l
_mbsnbcat
_mbsnbcat_l
_mbsnbcat_s
_mbsnbcat_s_l
_mbsnbcmp
_mbsnbcmp_l
_mbsnbcnt
_mbsnbcnt_l
_mbsnbcoll
_mbsnbcoll_l
_mbsnbcpy
_mbsnbcpy_l
_mbsnbcpy_s
_mbsnbcpy_s_l
_mbsnbicmp
_mbsnbicmp_l
_mbsnbicoll
_mbsnbicoll_l
_mbsnbset
_mbsnbset_l
_mbsnbset_s
_mbsnbset_s_l
_mbsncat
_mbsncat_l
_mbsncat_s
_mbsncat_s_l
_mbsnccnt
_mbsnccnt_l
_mbsncmp
_mbsncmp_l
_mbsncoll
_mbsncoll_l
_mbsncpy
_mbsncpy_l
_mbsncpy_s
_mbsncpy_s_l
_mbsnextc
_mbsnextc_l
_mbsnicmp
_mbsnicmp_l
_mbsnicoll
_mbsnicoll_l
_mbsninc
_mbsninc_l
_mbsnlen
_mbsnlen_l
_mbsnset
_mbsnset_l
_mbsnset_s
_mbsnset_s_l
_mbspbrk
_mbspbrk_l
_mbsrchr
_mbsrchr_l
_mbsrev
_mbsrev_l
_mbsset
_mbsset_l
_mbsset_s
_mbsset_s_l
_mbsspn
_mbsspn_l
_mbsspnp
_mbsspnp_l
_mbsstr
_mbsstr_l
_mbstok
_mbstok_l
_mbstok_s
_mbstok_s_l
_mbstowcs_l
_mbstowcs_s_l
_mbstrlen
_mbstrlen_l
_mbstrnlen
_mbstrnlen_l
_mbsupr
_mbsupr_l
_mbsupr_s
_mbsupr_s_l
_mbtowc_l

Sections

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-runtime-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:04:20:34:d8:b8:30:51:ca:cf:76:00:00:00:00:04:20
Certificate

Issuer

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20-02-2019 22:39

Not After

31-07-2020 22:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Development Root Certificate Authority 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-05-2014 17:33

Not After

28-05-2029 17:43

Subject

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:48:69:45:ca:d1:19:82:dc:cf:8b:46:36:62:28:31:ce:0c:51:61:09:97:a2:e8:41:b2:7e:ad:da:e9:39:b2
Signer

Actual PE Digest

b4:48:69:45:ca:d1:19:82:dc:cf:8b:46:36:62:28:31:ce:0c:51:61:09:97:a2:e8:41:b2:7e:ad:da:e9:39:b2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-runtime-l1-1-0.pdb

Exports

Exports

_Exit
__doserrno
__fpe_flt_rounds
__fpecode
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__pgmptr
__p__wcmdln
__p__wpgmptr
__pxcptinfoptrs
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__wcserror
__wcserror_s
_assert
_beginthread
_beginthreadex
_c_exit
_cexit
_clearfp
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_crt_at_quick_exit
_crt_atexit
_endthread
_endthreadex
_errno
_execute_onexit_table
_exit
_fpieee_flt
_fpreset
_get_doserrno
_get_errno
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_pgmptr
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_wide_winmain_command_line
_get_wpgmptr
_getdllprocaddr
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_query_app_type
_register_onexit_function
_register_thread_local_exe_atexit_callback
_resetstkoflw
_seh_filter_dll
_seh_filter_exe
_set_abort_behavior
_set_app_type
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_invalid_parameter_handler
_set_new_handler
_set_thread_local_invalid_parameter_handler
_seterrormode
_sleep
_statusfp
_strerror
_strerror_s
_wassert
_wcserror
_wcserror_s
_wperror
_wsystem
abort
exit
feclearexcept
fegetenv
fegetexceptflag
fegetround
feholdexcept
fesetenv
fesetexceptflag
fesetround
fetestexcept
perror
quick_exit
raise
set_terminate
signal
strerror
strerror_s
system
terminate

Sections

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-stdio-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:34:6d:89:13:fd:ec:58:53:71:21:ab:91:c1:2a:fc:56:4c:a2:fe:f2:1a:67:de:84:30:3b:47:31:38:5b:1c
Signer

Actual PE Digest

da:34:6d:89:13:fd:ec:58:53:71:21:ab:91:c1:2a:fc:56:4c:a2:fe:f2:1a:67:de:84:30:3b:47:31:38:5b:1c

Digest Algorithm

sha256

PE Digest Matches

true

ba:e9:ed:3c:48:cf:9b:9e:72:b3:43:07:6a:35:f1:53:91:af:5f:0c
Signer

Actual PE Digest

ba:e9:ed:3c:48:cf:9b:9e:72:b3:43:07:6a:35:f1:53:91:af:5f:0c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-stdio-l1-1-0.pdb

Exports

Exports

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vswscanf
_chsize
_chsize_s
_close
_commit
_creat
_dup
_dup2
_eof
_fclose_nolock
_fcloseall
_fflush_nolock
_fgetc_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filelength
_filelengthi64
_fileno
_flushall
_fputc_nolock
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_ftell_nolock
_ftelli64
_ftelli64_nolock
_fwrite_nolock
_get_fmode
_get_osfhandle
_get_printf_count_output
_get_stream_buffer_pointers
_getc_nolock
_getcwd
_getdcwd
_getmaxstdio
_getw
_getwc_nolock
_getws
_getws_s
_isatty
_kbhit
_locking
_lseek
_lseeki64
_mktemp
_mktemp_s
_open
_open_osfhandle
_pclose
_pipe
_popen
_putc_nolock
_putw
_putwc_nolock
_putws
_read
_rmtmp
_set_fmode
_set_printf_count_output
_setmaxstdio
_setmode
_sopen
_sopen_dispatch
_sopen_s
_tell
_telli64
_tempnam
_ungetc_nolock
_ungetwc_nolock
_wcreat
_wfdopen
_wfopen
_wfopen_s
_wfreopen
_wfreopen_s
_wfsopen
_wmktemp
_wmktemp_s
_wopen
_wpopen
_write
_wsopen
_wsopen_dispatch
_wsopen_s
_wtempnam
_wtmpnam
_wtmpnam_s
clearerr
clearerr_s
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
fopen
fopen_s
fputc
fputs
fputwc
fputws
fread
fread_s
freopen
freopen_s
fseek
fsetpos
ftell
fwrite
getc
getchar
gets
gets_s
getwc
getwchar
putc
putchar
puts
putwc
putwchar
rewind
setbuf
setvbuf
tmpfile
tmpfile_s
tmpnam
tmpnam_s
ungetc
ungetwc

Sections

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-string-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

72:6a:7f:87:f7:64:2e:22:83:6d:be:56:03:8b:2a:94:76:c0:10:e1:c0:23:02:7c:e8:b4:f4:01:cb:96:50:ef
Signer

Actual PE Digest

72:6a:7f:87:f7:64:2e:22:83:6d:be:56:03:8b:2a:94:76:c0:10:e1:c0:23:02:7c:e8:b4:f4:01:cb:96:50:ef

Digest Algorithm

sha256

PE Digest Matches

true

45:89:0a:e3:19:4f:e2:5b:f6:04:c2:87:7d:09:48:4d:98:22:f9:08
Signer

Actual PE Digest

45:89:0a:e3:19:4f:e2:5b:f6:04:c2:87:7d:09:48:4d:98:22:f9:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-string-l1-1-0.pdb

Exports

Exports

__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__strncnt
__wcsncnt
_isalnum_l
_isalpha_l
_isblank_l
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l
_iswblank_l
_iswcntrl_l
_iswcsym_l
_iswcsymf_l
_iswctype_l
_iswdigit_l
_iswgraph_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_isxdigit_l
_memccpy
_memicmp
_memicmp_l
_strcoll_l
_strdup
_stricmp
_stricmp_l
_stricoll
_stricoll_l
_strlwr
_strlwr_l
_strlwr_s
_strlwr_s_l
_strncoll
_strncoll_l
_strnicmp
_strnicmp_l
_strnicoll
_strnicoll_l
_strnset
_strnset_s
_strrev
_strset
_strset_s
_strupr
_strupr_l
_strupr_s
_strupr_s_l
_strxfrm_l
_tolower
_tolower_l
_toupper
_toupper_l
_towlower_l
_towupper_l
_wcscoll_l
_wcsdup
_wcsicmp
_wcsicmp_l
_wcsicoll
_wcsicoll_l
_wcslwr
_wcslwr_l
_wcslwr_s
_wcslwr_s_l
_wcsncoll
_wcsncoll_l
_wcsnicmp
_wcsnicmp_l
_wcsnicoll
_wcsnicoll_l
_wcsnset
_wcsnset_s
_wcsrev
_wcsset
_wcsset_s
_wcsupr
_wcsupr_l
_wcsupr_s
_wcsupr_s_l
_wcsxfrm_l
_wctype
is_wctype
isalnum
isalpha
isblank
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswblank
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
mblen
mbrlen
memcpy_s
memmove_s
memset
strcat
strcat_s
strcmp
strcoll
strcpy
strcpy_s
strcspn
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strspn
strtok
strtok_s
strxfrm
tolower
toupper
towctrans
towlower
towupper
wcscat
wcscat_s
wcscmp
wcscoll
wcscpy
wcscpy_s
wcscspn
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsspn
wcstok
wcstok_s
wcsxfrm
wctype
wmemcpy_s
wmemmove_s

Sections

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-time-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:f8:99:9c:17:65:b5:50:8a:22:06:90:13:4a:05:86:51:42:ee:a0:a6:e2:31:59:2b:8a:4d:46:67:df:56:da
Signer

Actual PE Digest

08:f8:99:9c:17:65:b5:50:8a:22:06:90:13:4a:05:86:51:42:ee:a0:a6:e2:31:59:2b:8a:4d:46:67:df:56:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-time-l1-1-0.pdb

Exports

Exports

_Getdays
_Getmonths
_Gettnames
_Strftime
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__daylight
__dstbias
__timezone
__tzname
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_difftime32
_difftime64
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_futime32
_futime64
_get_daylight
_get_dstbias
_get_timezone
_get_tzname
_getsystime
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_localtime32
_localtime32_s
_localtime64
_localtime64_s
_mkgmtime32
_mkgmtime64
_mktime32
_mktime64
_setsystime
_strdate
_strdate_s
_strftime_l
_strtime
_strtime_s
_time32
_time64
_timespec32_get
_timespec64_get
_tzset
_utime32
_utime64
_wasctime
_wasctime_s
_wcsftime_l
_wctime32
_wctime32_s
_wctime64
_wctime64_s
_wstrdate
_wstrdate_s
_wstrtime
_wstrtime_s
_wutime32
_wutime64
asctime
asctime_s
clock
strftime
wcsftime

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-crt-utility-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:29:d3:82:0e:f8:56:98:a6:1a:15:8b:8e:c1:4f:70:ae:bf:2d:b9:c5:e0:7d:70:03:f4:df:4b:02:bf:4c:6e
Signer

Actual PE Digest

92:29:d3:82:0e:f8:56:98:a6:1a:15:8b:8e:c1:4f:70:ae:bf:2d:b9:c5:e0:7d:70:03:f4:df:4b:02:bf:4c:6e

Digest Algorithm

sha256

PE Digest Matches

true

2d:07:ef:20:dc:47:e0:9a:2f:3d:c6:32:c8:6a:c3:c6:fc:34:e2:39
Signer

Actual PE Digest

2d:07:ef:20:dc:47:e0:9a:2f:3d:c6:32:c8:6a:c3:c6:fc:34:e2:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-utility-l1-1-0.pdb

Exports

Exports

_abs64
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_lfind
_lfind_s
_lrotl
_lrotr
_lsearch
_lsearch_s
_rotl
_rotl64
_rotr
_rotr64
_swab
abs
bsearch
bsearch_s
div
imaxabs
imaxdiv
labs
ldiv
llabs
lldiv
qsort
qsort_s
rand
rand_s
srand

Sections

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
chrome_100_percent.pak
chrome_200_percent.pak
chrome_elf.dll
.dll windows:5 windows x64 arch:x64

6117a7b217842f47d54cef2492a41678

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

chrome_elf.dll.pdb

Imports

kernel32

AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateDirectoryW
CreateEventW
CreateFileW
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateThread
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsSetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadId
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExW
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
LockFileEx
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSRWLockExclusive
RemoveDirectoryW
ResetEvent
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetNamedPipeHandleState
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualProtectEx
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcmpiA

Exports

Exports

ClearReportsBetween_ExportThunk
CrashForException_ExportThunk
DisableHook
DrainLog
DumpHungProcessWithPtype_ExportThunk
DumpProcessWithoutCrash
GetApplyHookResult
GetBlockedModulesCount
GetCrashReports_ExportThunk
GetCrashpadDatabasePath_ExportThunk
GetHandleVerifier
GetInstallDetailsPayload
GetUniqueBlockedModulesCount
GetUserDataDirectoryThunk
InjectDumpForHungInput_ExportThunk
IsBrowserProcess
IsCrashReportingEnabledImpl
IsThirdPartyInitialized
RegisterLogNotification
RequestSingleCrashUpload_ExportThunk
SetCrashKeyValueImpl
SetMetricsClientId
SetUploadConsent_ExportThunk
SignalChromeElf
SignalInitializeCrashReporting

Sections

.text
Size: 787KB - Virtual size: 787KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.crthunk
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oldntma
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 289B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
d3dcompiler_47.dll
.dll windows:10 windows x64 arch:x64

4004e7f7eff525b82926d9696cb4db19

Code Sign

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-09-2016 17:58

Not After

07-09-2018 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-08-2017 20:11

Not After

11-08-2018 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-09-2017 18:07

Not After

12-09-2018 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:ac:68:cf:5d:17:21:66:80:b3:3a:75:5a:f7:9b:a8:cf:a4:a9:ea:0a:d8:7f:7f:64:68:e2:b3:93:a4:eb:9a
Signer

Actual PE Digest

90:ac:68:cf:5d:17:21:66:80:b3:3a:75:5a:f7:9b:a8:cf:a4:a9:ea:0a:d8:7f:7f:64:68:e2:b3:93:a4:eb:9a

Digest Algorithm

sha256

PE Digest Matches

true

fa:90:fa:70:4f:be:7b:a4:ac:bd:95:97:95:be:bb:d0:a7:a6:8b:11
Signer

Actual PE Digest

fa:90:fa:70:4f:be:7b:a4:ac:bd:95:97:95:be:bb:d0:a7:a6:8b:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D3DCompiler_47.pdb

Imports

msvcrt

_unlock
_lock
??1type_info@@UEAA@XZ
strncpy_s
malloc
_strnicmp
atoi
isdigit
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
_isnan
_purecall
__isascii
_clearfp
_controlfp
_strdup
_mbstrlen
_vsnwprintf
strtoul
isxdigit
isalpha
atof
strchr
setlocale
strnlen
__dllonexit
modf
isspace
wcsncmp
wcsncpy_s
_wcsicmp
memcpy
memset
fclose
bsearch
qsort
strcat_s
strstr
_onexit
memcmp
strcmp
_snwprintf_s
__unDName
fread
fseek
_wfsopen
wcstoul
_fileno
sscanf_s
_filelengthi64
towlower
_wcsnicmp
_wsplitpath_s
wcscpy_s
wcsncat_s
wcsrchr
swprintf_s
_wfullpath
_wmakepath_s
_time64
_chsize_s
_close
_read
_write
_lseeki64
_get_osfhandle
_open_osfhandle
_wcsdup
wcscat_s
ftell
_mbscmp
_memicmp
_wgetenv
toupper
_atoi64
_errno
strtod
__CxxFrameHandler3
_strtoui64
?terminate@@YAXXZ
_CxxThrowException
tan
strrchr
tolower
_finite
_fpclass
memmove
strcpy_s
memcpy_s
isalnum
getenv
free
_stricmp
sprintf_s
_vsnprintf
strncmp
_wsopen
acos
asin
atan
atan2
ceil
cos
cosh
exp
floor
floorf
fmod
log
pow
sin
sinh
sqrt
tanh

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
HeapCreate
lstrcmpiA
CreateFileA
SetLastError
FlushViewOfFile
MapViewOfFileEx
SetFilePointer
InitializeCriticalSectionAndSpinCount
ExpandEnvironmentStringsW
DeviceIoControl
SetFilePointerEx
SetEndOfFile
GetFileType
DeleteFileW
SetFileAttributesW
LCMapStringW
GetFileAttributesW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
LocalFree
LocalAlloc
LoadLibraryExW
DisableThreadLibraryCalls
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
WriteFile
FreeLibrary
VirtualFree
VirtualAlloc
GetSystemInfo
CreateFileW
GetLastError
GetFileSizeEx
ReadFile
CloseHandle
Sleep
TlsAlloc
TlsSetValue
HeapDestroy
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetProcAddress

advapi32

CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
CryptDestroyHash
RegCloseKey

rpcrt4

UuidCreate

Exports

Exports

D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DCreateFunctionLinkingGraph
D3DCreateLinker
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DLoadModule
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReflectLibrary
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 868KB - Virtual size: 867KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
icudtl.dat
libEGL.dll
.dll windows:5 windows x64 arch:x64

585861b958c9f1fe9cc0324e1020a230

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

libEGL.dll.pdb

Imports

kernel32

AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateEventW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WaitForSingleObjectEx
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile

Exports

Exports

eglBindAPI
eglBindTexImage
eglChooseConfig
eglClientWaitSync
eglClientWaitSyncKHR
eglCopyBuffers
eglCreateContext
eglCreateDeviceANGLE
eglCreateImage
eglCreateImageKHR
eglCreateNativeClientBufferANDROID
eglCreatePbufferFromClientBuffer
eglCreatePbufferSurface
eglCreatePixmapSurface
eglCreatePlatformPixmapSurface
eglCreatePlatformPixmapSurfaceEXT
eglCreatePlatformWindowSurface
eglCreatePlatformWindowSurfaceEXT
eglCreateStreamKHR
eglCreateStreamProducerD3DTextureANGLE
eglCreateSync
eglCreateSyncKHR
eglCreateWindowSurface
eglDebugMessageControlKHR
eglDestroyContext
eglDestroyImage
eglDestroyImageKHR
eglDestroyStreamKHR
eglDestroySurface
eglDestroySync
eglDestroySyncKHR
eglDupNativeFenceFDANDROID
eglGetCompositorTimingANDROID
eglGetCompositorTimingSupportedANDROID
eglGetConfigAttrib
eglGetConfigs
eglGetCurrentContext
eglGetCurrentDisplay
eglGetCurrentSurface
eglGetDisplay
eglGetError
eglGetFrameTimestampSupportedANDROID
eglGetFrameTimestampsANDROID
eglGetMscRateANGLE
eglGetNativeClientBufferANDROID
eglGetNextFrameIdANDROID
eglGetPlatformDisplay
eglGetPlatformDisplayEXT
eglGetProcAddress
eglGetSyncAttrib
eglGetSyncAttribKHR
eglGetSyncValuesCHROMIUM
eglHandleGPUSwitchANGLE
eglInitialize
eglLabelObjectKHR
eglMakeCurrent
eglPostSubBufferNV
eglPresentationTimeANDROID
eglProgramCacheGetAttribANGLE
eglProgramCachePopulateANGLE
eglProgramCacheQueryANGLE
eglProgramCacheResizeANGLE
eglQueryAPI
eglQueryContext
eglQueryDebugKHR
eglQueryDeviceAttribEXT
eglQueryDeviceStringEXT
eglQueryDisplayAttribANGLE
eglQueryDisplayAttribEXT
eglQueryStreamKHR
eglQueryStreamu64KHR
eglQueryString
eglQueryStringiANGLE
eglQuerySurface
eglQuerySurfacePointerANGLE
eglReacquireHighPowerGPUANGLE
eglReleaseDeviceANGLE
eglReleaseHighPowerGPUANGLE
eglReleaseTexImage
eglReleaseThread
eglSetBlobCacheFuncsANDROID
eglSignalSyncKHR
eglStreamAttribKHR
eglStreamConsumerAcquireKHR
eglStreamConsumerGLTextureExternalAttribsNV
eglStreamConsumerGLTextureExternalKHR
eglStreamConsumerReleaseKHR
eglStreamPostD3DTextureANGLE
eglSurfaceAttrib
eglSwapBuffers
eglSwapBuffersWithDamageKHR
eglSwapBuffersWithFrameTokenANGLE
eglSwapInterval
eglTerminate
eglWaitClient
eglWaitGL
eglWaitNative
eglWaitSync
eglWaitSyncKHR

Sections

.text
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 289B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libGLESv2.dll
.dll windows:5 windows x64 arch:x64

62b94bd6c48f8e0f6d82aa2752720dbe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

libGLESv2.dll.pdb

Imports

user32

CreateWindowExA
CreateWindowExW
DefWindowProcA
DestroyWindow
GetClassInfoA
GetClientRect
GetDC
GetWindowThreadProcessId
InvalidateRect
IsIconic
IsWindow
LoadCursorA
RegisterClassA
ReleaseDC
UnregisterClassA
WindowFromDC

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
CompareStringW
CreateEventW
CreateFileW
CreateMutexW
CreateThread
DeleteCriticalSection
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsSetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetEnvironmentVariableA
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InitializeSRWLock
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile

dxgi

CreateDXGIFactory
CreateDXGIFactory1

gdi32

ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
SetPixelFormat
SwapBuffers

Exports

Exports

??0PlatformMethods@angle@@QEAA@XZ
??4PlatformMethods@angle@@QEAAAEAU01@$$QEAU01@@Z
??4PlatformMethods@angle@@QEAAAEAU01@AEBU01@@Z
ANGLEGetDisplayPlatform
ANGLEResetDisplayPlatform
EGL_BindAPI
EGL_BindTexImage
EGL_ChooseConfig
EGL_ClientWaitSync
EGL_ClientWaitSyncKHR
EGL_CopyBuffers
EGL_CreateContext
EGL_CreateDeviceANGLE
EGL_CreateImage
EGL_CreateImageKHR
EGL_CreateNativeClientBufferANDROID
EGL_CreatePbufferFromClientBuffer
EGL_CreatePbufferSurface
EGL_CreatePixmapSurface
EGL_CreatePlatformPixmapSurface
EGL_CreatePlatformPixmapSurfaceEXT
EGL_CreatePlatformWindowSurface
EGL_CreatePlatformWindowSurfaceEXT
EGL_CreateStreamKHR
EGL_CreateStreamProducerD3DTextureANGLE
EGL_CreateSync
EGL_CreateSyncKHR
EGL_CreateWindowSurface
EGL_DebugMessageControlKHR
EGL_DestroyContext
EGL_DestroyImage
EGL_DestroyImageKHR
EGL_DestroyStreamKHR
EGL_DestroySurface
EGL_DestroySync
EGL_DestroySyncKHR
EGL_DupNativeFenceFDANDROID
EGL_GetCompositorTimingANDROID
EGL_GetCompositorTimingSupportedANDROID
EGL_GetConfigAttrib
EGL_GetConfigs
EGL_GetCurrentContext
EGL_GetCurrentDisplay
EGL_GetCurrentSurface
EGL_GetDisplay
EGL_GetError
EGL_GetFrameTimestampSupportedANDROID
EGL_GetFrameTimestampsANDROID
EGL_GetMscRateANGLE
EGL_GetNativeClientBufferANDROID
EGL_GetNextFrameIdANDROID
EGL_GetPlatformDisplay
EGL_GetPlatformDisplayEXT
EGL_GetProcAddress
EGL_GetSyncAttrib
EGL_GetSyncAttribKHR
EGL_GetSyncValuesCHROMIUM
EGL_HandleGPUSwitchANGLE
EGL_Initialize
EGL_LabelObjectKHR
EGL_MakeCurrent
EGL_PostSubBufferNV
EGL_PresentationTimeANDROID
EGL_ProgramCacheGetAttribANGLE
EGL_ProgramCachePopulateANGLE
EGL_ProgramCacheQueryANGLE
EGL_ProgramCacheResizeANGLE
EGL_QueryAPI
EGL_QueryContext
EGL_QueryDebugKHR
EGL_QueryDeviceAttribEXT
EGL_QueryDeviceStringEXT
EGL_QueryDisplayAttribANGLE
EGL_QueryDisplayAttribEXT
EGL_QueryStreamKHR
EGL_QueryStreamu64KHR
EGL_QueryString
EGL_QueryStringiANGLE
EGL_QuerySurface
EGL_QuerySurfacePointerANGLE
EGL_ReacquireHighPowerGPUANGLE
EGL_ReleaseDeviceANGLE
EGL_ReleaseHighPowerGPUANGLE
EGL_ReleaseTexImage
EGL_ReleaseThread
EGL_SetBlobCacheFuncsANDROID
EGL_SignalSyncKHR
EGL_StreamAttribKHR
EGL_StreamConsumerAcquireKHR
EGL_StreamConsumerGLTextureExternalAttribsNV
EGL_StreamConsumerGLTextureExternalKHR
EGL_StreamConsumerReleaseKHR
EGL_StreamPostD3DTextureANGLE
EGL_SurfaceAttrib
EGL_SwapBuffers
EGL_SwapBuffersWithDamageKHR
EGL_SwapBuffersWithFrameTokenANGLE
EGL_SwapInterval
EGL_Terminate
EGL_WaitClient
EGL_WaitGL
EGL_WaitNative
EGL_WaitSync
EGL_WaitSyncKHR
GL_ActiveShaderProgram
GL_ActiveShaderProgramContextANGLE
GL_ActiveShaderProgramEXT
GL_ActiveShaderProgramEXTContextANGLE
GL_ActiveTexture
GL_ActiveTextureContextANGLE
GL_AlphaFunc
GL_AlphaFuncContextANGLE
GL_AlphaFuncx
GL_AlphaFuncxContextANGLE
GL_AttachShader
GL_AttachShaderContextANGLE
GL_BeginQuery
GL_BeginQueryContextANGLE
GL_BeginQueryEXT
GL_BeginQueryEXTContextANGLE
GL_BeginTransformFeedback
GL_BeginTransformFeedbackContextANGLE
GL_BindAttribLocation
GL_BindAttribLocationContextANGLE
GL_BindBuffer
GL_BindBufferBase
GL_BindBufferBaseContextANGLE
GL_BindBufferContextANGLE
GL_BindBufferRange
GL_BindBufferRangeContextANGLE
GL_BindFragDataLocationEXT
GL_BindFragDataLocationEXTContextANGLE
GL_BindFragDataLocationIndexedEXT
GL_BindFragDataLocationIndexedEXTContextANGLE
GL_BindFramebuffer
GL_BindFramebufferContextANGLE
GL_BindFramebufferOES
GL_BindFramebufferOESContextANGLE
GL_BindImageTexture
GL_BindImageTextureContextANGLE
GL_BindProgramPipeline
GL_BindProgramPipelineContextANGLE
GL_BindProgramPipelineEXT
GL_BindProgramPipelineEXTContextANGLE
GL_BindRenderbuffer
GL_BindRenderbufferContextANGLE
GL_BindRenderbufferOES
GL_BindRenderbufferOESContextANGLE
GL_BindSampler
GL_BindSamplerContextANGLE
GL_BindTexture
GL_BindTextureContextANGLE
GL_BindTransformFeedback
GL_BindTransformFeedbackContextANGLE
GL_BindUniformLocationCHROMIUM
GL_BindUniformLocationCHROMIUMContextANGLE
GL_BindVertexArray
GL_BindVertexArrayContextANGLE
GL_BindVertexArrayOES
GL_BindVertexArrayOESContextANGLE
GL_BindVertexBuffer
GL_BindVertexBufferContextANGLE
GL_BlendBarrier
GL_BlendBarrierContextANGLE
GL_BlendColor
GL_BlendColorContextANGLE
GL_BlendEquation
GL_BlendEquationContextANGLE
GL_BlendEquationSeparate
GL_BlendEquationSeparateContextANGLE
GL_BlendEquationSeparatei
GL_BlendEquationSeparateiContextANGLE
GL_BlendEquationSeparateiEXT
GL_BlendEquationSeparateiEXTContextANGLE
GL_BlendEquationSeparateiOES
GL_BlendEquationSeparateiOESContextANGLE
GL_BlendEquationi
GL_BlendEquationiContextANGLE
GL_BlendEquationiEXT
GL_BlendEquationiEXTContextANGLE
GL_BlendEquationiOES
GL_BlendEquationiOESContextANGLE
GL_BlendFunc
GL_BlendFuncContextANGLE
GL_BlendFuncSeparate
GL_BlendFuncSeparateContextANGLE
GL_BlendFuncSeparatei
GL_BlendFuncSeparateiContextANGLE
GL_BlendFuncSeparateiEXT
GL_BlendFuncSeparateiEXTContextANGLE
GL_BlendFuncSeparateiOES
GL_BlendFuncSeparateiOESContextANGLE
GL_BlendFunci
GL_BlendFunciContextANGLE
GL_BlendFunciEXT
GL_BlendFunciEXTContextANGLE
GL_BlendFunciOES
GL_BlendFunciOESContextANGLE
GL_BlitFramebuffer
GL_BlitFramebufferANGLE
GL_BlitFramebufferANGLEContextANGLE
GL_BlitFramebufferContextANGLE
GL_BlitFramebufferNV
GL_BlitFramebufferNVContextANGLE
GL_BufferData
GL_BufferDataContextANGLE
GL_BufferStorageEXT
GL_BufferStorageEXTContextANGLE
GL_BufferStorageExternalEXT
GL_BufferStorageExternalEXTContextANGLE
GL_BufferStorageMemEXT
GL_BufferStorageMemEXTContextANGLE
GL_BufferSubData
GL_BufferSubDataContextANGLE
GL_CheckFramebufferStatus
GL_CheckFramebufferStatusContextANGLE
GL_CheckFramebufferStatusOES
GL_CheckFramebufferStatusOESContextANGLE
GL_Clear
GL_ClearBufferfi
GL_ClearBufferfiContextANGLE
GL_ClearBufferfv
GL_ClearBufferfvContextANGLE
GL_ClearBufferiv
GL_ClearBufferivContextANGLE
GL_ClearBufferuiv
GL_ClearBufferuivContextANGLE
GL_ClearColor
GL_ClearColorContextANGLE
GL_ClearColorx
GL_ClearColorxContextANGLE
GL_ClearContextANGLE
GL_ClearDepthf
GL_ClearDepthfContextANGLE
GL_ClearDepthx
GL_ClearDepthxContextANGLE
GL_ClearStencil
GL_ClearStencilContextANGLE
GL_ClientActiveTexture
GL_ClientActiveTextureContextANGLE
GL_ClientWaitSync
GL_ClientWaitSyncContextANGLE
GL_ClipControlEXT
GL_ClipControlEXTContextANGLE
GL_ClipPlanef
GL_ClipPlanefContextANGLE
GL_ClipPlanex
GL_ClipPlanexContextANGLE
GL_Color4f
GL_Color4fContextANGLE
GL_Color4ub
GL_Color4ubContextANGLE
GL_Color4x
GL_Color4xContextANGLE
GL_ColorMask
GL_ColorMaskContextANGLE
GL_ColorMaski
GL_ColorMaskiContextANGLE
GL_ColorMaskiEXT
GL_ColorMaskiEXTContextANGLE
GL_ColorMaskiOES
GL_ColorMaskiOESContextANGLE
GL_ColorPointer
GL_ColorPointerContextANGLE
GL_CompileShader
GL_CompileShaderContextANGLE
GL_CompressedCopyTextureCHROMIUM
GL_CompressedCopyTextureCHROMIUMContextANGLE
GL_CompressedTexImage2D
GL_CompressedTexImage2DContextANGLE
GL_CompressedTexImage2DRobustANGLE
GL_CompressedTexImage2DRobustANGLEContextANGLE
GL_CompressedTexImage3D
GL_CompressedTexImage3DContextANGLE
GL_CompressedTexImage3DOES
GL_CompressedTexImage3DOESContextANGLE
GL_CompressedTexImage3DRobustANGLE
GL_CompressedTexImage3DRobustANGLEContextANGLE
GL_CompressedTexSubImage2D
GL_CompressedTexSubImage2DContextANGLE
GL_CompressedTexSubImage2DRobustANGLE
GL_CompressedTexSubImage2DRobustANGLEContextANGLE
GL_CompressedTexSubImage3D
GL_CompressedTexSubImage3DContextANGLE
GL_CompressedTexSubImage3DOES
GL_CompressedTexSubImage3DOESContextANGLE
GL_CompressedTexSubImage3DRobustANGLE
GL_CompressedTexSubImage3DRobustANGLEContextANGLE
GL_CopyBufferSubData
GL_CopyBufferSubDataContextANGLE
GL_CopyImageSubData
GL_CopyImageSubDataContextANGLE
GL_CopyImageSubDataEXT
GL_CopyImageSubDataEXTContextANGLE
GL_CopyImageSubDataOES
GL_CopyImageSubDataOESContextANGLE
GL_CopySubTexture3DANGLE
GL_CopySubTexture3DANGLEContextANGLE
GL_CopySubTextureCHROMIUM
GL_CopySubTextureCHROMIUMContextANGLE
GL_CopyTexImage2D
GL_CopyTexImage2DContextANGLE
GL_CopyTexSubImage2D
GL_CopyTexSubImage2DContextANGLE
GL_CopyTexSubImage3D
GL_CopyTexSubImage3DContextANGLE
GL_CopyTexSubImage3DOES
GL_CopyTexSubImage3DOESContextANGLE
GL_CopyTexture3DANGLE
GL_CopyTexture3DANGLEContextANGLE
GL_CopyTextureCHROMIUM
GL_CopyTextureCHROMIUMContextANGLE
GL_CoverageModulationCHROMIUM
GL_CoverageModulationCHROMIUMContextANGLE
GL_CreateMemoryObjectsEXT
GL_CreateMemoryObjectsEXTContextANGLE
GL_CreateProgram
GL_CreateProgramContextANGLE
GL_CreateShader
GL_CreateShaderContextANGLE
GL_CreateShaderProgramv
GL_CreateShaderProgramvContextANGLE
GL_CreateShaderProgramvEXT
GL_CreateShaderProgramvEXTContextANGLE
GL_CullFace
GL_CullFaceContextANGLE
GL_CurrentPaletteMatrixOES
GL_CurrentPaletteMatrixOESContextANGLE
GL_DebugMessageCallback
GL_DebugMessageCallbackContextANGLE
GL_DebugMessageCallbackKHR
GL_DebugMessageCallbackKHRContextANGLE
GL_DebugMessageControl
GL_DebugMessageControlContextANGLE
GL_DebugMessageControlKHR
GL_DebugMessageControlKHRContextANGLE
GL_DebugMessageInsert
GL_DebugMessageInsertContextANGLE
GL_DebugMessageInsertKHR
GL_DebugMessageInsertKHRContextANGLE
GL_DeleteBuffers
GL_DeleteBuffersContextANGLE
GL_DeleteFencesNV
GL_DeleteFencesNVContextANGLE
GL_DeleteFramebuffers
GL_DeleteFramebuffersContextANGLE
GL_DeleteFramebuffersOES
GL_DeleteFramebuffersOESContextANGLE
GL_DeleteMemoryObjectsEXT
GL_DeleteMemoryObjectsEXTContextANGLE
GL_DeleteProgram
GL_DeleteProgramContextANGLE
GL_DeleteProgramPipelines
GL_DeleteProgramPipelinesContextANGLE
GL_DeleteProgramPipelinesEXT
GL_DeleteProgramPipelinesEXTContextANGLE
GL_DeleteQueries
GL_DeleteQueriesContextANGLE
GL_DeleteQueriesEXT
GL_DeleteQueriesEXTContextANGLE
GL_DeleteRenderbuffers
GL_DeleteRenderbuffersContextANGLE
GL_DeleteRenderbuffersOES
GL_DeleteRenderbuffersOESContextANGLE
GL_DeleteSamplers
GL_DeleteSamplersContextANGLE
GL_DeleteSemaphoresEXT
GL_DeleteSemaphoresEXTContextANGLE
GL_DeleteShader
GL_DeleteShaderContextANGLE
GL_DeleteSync
GL_DeleteSyncContextANGLE
GL_DeleteTextures
GL_DeleteTexturesContextANGLE
GL_DeleteTransformFeedbacks
GL_DeleteTransformFeedbacksContextANGLE
GL_DeleteVertexArrays
GL_DeleteVertexArraysContextANGLE
GL_DeleteVertexArraysOES
GL_DeleteVertexArraysOESContextANGLE
GL_DepthFunc
GL_DepthFuncContextANGLE
GL_DepthMask
GL_DepthMaskContextANGLE
GL_DepthRangef
GL_DepthRangefContextANGLE
GL_DepthRangex
GL_DepthRangexContextANGLE
GL_DetachShader
GL_DetachShaderContextANGLE
GL_Disable
GL_DisableClientState
GL_DisableClientStateContextANGLE
GL_DisableContextANGLE
GL_DisableExtensionANGLE
GL_DisableExtensionANGLEContextANGLE
GL_DisableVertexAttribArray
GL_DisableVertexAttribArrayContextANGLE
GL_Disablei
GL_DisableiContextANGLE
GL_DisableiEXT
GL_DisableiEXTContextANGLE
GL_DisableiOES
GL_DisableiOESContextANGLE
GL_DiscardFramebufferEXT
GL_DiscardFramebufferEXTContextANGLE
GL_DispatchCompute
GL_DispatchComputeContextANGLE
GL_DispatchComputeIndirect
GL_DispatchComputeIndirectContextANGLE
GL_DrawArrays
GL_DrawArraysContextANGLE
GL_DrawArraysIndirect
GL_DrawArraysIndirectContextANGLE
GL_DrawArraysInstanced
GL_DrawArraysInstancedANGLE
GL_DrawArraysInstancedANGLEContextANGLE
GL_DrawArraysInstancedBaseInstanceANGLE
GL_DrawArraysInstancedBaseInstanceANGLEContextANGLE
GL_DrawArraysInstancedContextANGLE
GL_DrawArraysInstancedEXT
GL_DrawArraysInstancedEXTContextANGLE
GL_DrawBuffers
GL_DrawBuffersContextANGLE
GL_DrawBuffersEXT
GL_DrawBuffersEXTContextANGLE
GL_DrawElements
GL_DrawElementsBaseVertex
GL_DrawElementsBaseVertexContextANGLE
GL_DrawElementsBaseVertexEXT
GL_DrawElementsBaseVertexEXTContextANGLE
GL_DrawElementsBaseVertexOES
GL_DrawElementsBaseVertexOESContextANGLE
GL_DrawElementsContextANGLE
GL_DrawElementsIndirect
GL_DrawElementsIndirectContextANGLE
GL_DrawElementsInstanced
GL_DrawElementsInstancedANGLE
GL_DrawElementsInstancedANGLEContextANGLE
GL_DrawElementsInstancedBaseVertex
GL_DrawElementsInstancedBaseVertexBaseInstanceANGLE
GL_DrawElementsInstancedBaseVertexBaseInstanceANGLEContextANGLE
GL_DrawElementsInstancedBaseVertexContextANGLE
GL_DrawElementsInstancedBaseVertexEXT
GL_DrawElementsInstancedBaseVertexEXTContextANGLE
GL_DrawElementsInstancedBaseVertexOES
GL_DrawElementsInstancedBaseVertexOESContextANGLE
GL_DrawElementsInstancedContextANGLE
GL_DrawElementsInstancedEXT
GL_DrawElementsInstancedEXTContextANGLE
GL_DrawRangeElements
GL_DrawRangeElementsBaseVertex
GL_DrawRangeElementsBaseVertexContextANGLE
GL_DrawRangeElementsBaseVertexEXT
GL_DrawRangeElementsBaseVertexEXTContextANGLE
GL_DrawRangeElementsBaseVertexOES
GL_DrawRangeElementsBaseVertexOESContextANGLE
GL_DrawRangeElementsContextANGLE
GL_DrawTexfOES
GL_DrawTexfOESContextANGLE
GL_DrawTexfvOES
GL_DrawTexfvOESContextANGLE
GL_DrawTexiOES
GL_DrawTexiOESContextANGLE
GL_DrawTexivOES
GL_DrawTexivOESContextANGLE
GL_DrawTexsOES
GL_DrawTexsOESContextANGLE
GL_DrawTexsvOES
GL_DrawTexsvOESContextANGLE
GL_DrawTexxOES
GL_DrawTexxOESContextANGLE
GL_DrawTexxvOES
GL_DrawTexxvOESContextANGLE
GL_EGLImageTargetRenderbufferStorageOES
GL_EGLImageTargetRenderbufferStorageOESContextANGLE
GL_EGLImageTargetTexture2DOES
GL_EGLImageTargetTexture2DOESContextANGLE
GL_Enable
GL_EnableClientState
GL_EnableClientStateContextANGLE
GL_EnableContextANGLE
GL_EnableVertexAttribArray
GL_EnableVertexAttribArrayContextANGLE
GL_Enablei
GL_EnableiContextANGLE
GL_EnableiEXT
GL_EnableiEXTContextANGLE
GL_EnableiOES
GL_EnableiOESContextANGLE
GL_EndQuery
GL_EndQueryContextANGLE
GL_EndQueryEXT
GL_EndQueryEXTContextANGLE
GL_EndTransformFeedback
GL_EndTransformFeedbackContextANGLE
GL_FenceSync
GL_FenceSyncContextANGLE
GL_Finish
GL_FinishContextANGLE

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 253KB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 305B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcef.dll
.dll windows:5 windows x64 arch:x64

2afec320a7d749c2467d487181d4be88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

libcef.dll.pdb

Imports

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AllocConsole
AreFileApisANSI
AssignProcessToJobObject
AttachConsole
CallbackMayRunLong
CancelIo
CancelIoEx
CheckRemoteDebuggerPresent
ClearCommError
CloseHandle
CloseThreadpool
CloseThreadpoolWork
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectW
CreateMemoryResourceNotification
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateThreadpool
CreateThreadpoolWork
CreateToolhelp32Snapshot
DebugBreak
DecodePointer
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesEx
EnumSystemLocalesW
EscapeCommFunction
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeW
FindNextFileA
FindNextFileW
FindNextVolumeW
FindResourceW
FindVolumeClose
FlsAlloc
FlsSetValue
FlushFileBuffers
FlushInstructionCache
FlushViewOfFile
FoldStringW
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommModemStatus
GetCommState
GetCommandLineA
GetCommandLineW
GetComputerNameExA
GetComputerNameExW
GetComputerNameW
GetConsoleDisplayMode
GetConsoleMode
GetConsoleOutputCP
GetCurrencyFormatEx
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetDateFormatEx
GetDateFormatW
GetDiskFreeSpaceA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetDynamicTimeZoneInformation
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetGeoInfoW
GetLastError
GetLocalTime
GetLocaleInfoEx
GetLocaleInfoW
GetLogicalDriveStringsW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetNumberFormatEx
GetOEMCP
GetOverlappedResult
GetPriorityClass
GetPrivateProfileStringW
GetProcAddress
GetProcessAffinityMask
GetProcessHandleCount
GetProcessHeap
GetProcessHeaps
GetProcessId
GetProcessIoCounters
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultLCID
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemPowerStatus
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadId
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadPriority
GetThreadPriorityBoost
GetThreadTimes
GetTickCount
GetTimeFormatEx
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultLocaleName
GetUserDefaultUILanguage
GetUserGeoID
GetVersion
GetVersionExW
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetVolumePathNamesForVolumeNameW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalSize
GlobalUnlock
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapLock
HeapReAlloc
HeapSetInformation
HeapSize
HeapUnlock
HeapValidate
HeapWalk
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
InitializeSRWLock
InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessInJob
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32EmptyWorkingSet
K32EnumProcessModules
K32GetMappedFileNameW
K32GetModuleFileNameExW
K32GetModuleInformation
K32GetPerformanceInfo
K32GetProcessMemoryInfo
K32QueryWorkingSetEx
LCIDToLocaleName
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LocaleNameToLCID
LockFile
LockFileEx
LockResource
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenEventW
OpenFileMappingW
OpenProcess
OpenThread
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
PowerClearRequest
PowerCreateRequest
PowerSetRequest
Process32FirstW
Process32NextW
ProcessIdToSessionId
PurgeComm
QueryDosDeviceW
QueryFullProcessImageNameW
QueryInformationJobObject
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
RaiseFailFastException
ReadConsoleW
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
RemoveVectoredExceptionHandler
ReplaceFileW
ResetEvent
ResolveLocaleName
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlCaptureStackBackTrace
RtlDeleteFunctionTable
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SearchPathW
SetCommState
SetCommTimeouts
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetInformationJobObject
SetLastError
SetNamedPipeHandleState
SetPriorityClass
SetProcessShutdownParameters
SetStdHandle
SetThreadAffinityMask
SetThreadExecutionState
SetThreadPriority
SetThreadPriorityBoost
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
SetUnhandledExceptionFilter
SignalObjectAndWait
SizeofResource
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SleepEx
SubmitThreadpoolWork
SuspendThread
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateJobObject
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
TryEnterCriticalSection
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
UnregisterWait
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitForThreadpoolWorkCallbacks
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
Wow64GetThreadContext
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcmpiA
lstrcmpiW
lstrlenW

dbghelp

StackWalk64
SymCleanup
SymFromAddr
SymFunctionTableAccess64
SymGetLineFromAddr64
SymGetModuleBase64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW

ws2_32

WSACloseEvent
WSACreateEvent
WSAEnumNameSpaceProvidersW
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSALookupServiceBeginW
WSALookupServiceEnd
WSALookupServiceNextW
WSARecvFrom
WSAResetEvent
WSASend
WSASendTo
WSASetEvent
WSASetServiceW
WSASocketW
WSAStartup
WSAWaitForMultipleEvents
WSCEnumProtocols
WSCGetProviderPath
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_ntop
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
send
sendto
setsockopt
shutdown
socket

iphlpapi

CancelIPChangeNotify
FreeMibTable
GetAdaptersAddresses
GetAdaptersInfo
GetIfTable2
GetInterfaceInfo
IpReleaseAddress
IpRenewAddress
NotifyAddrChange

oleaut32

LoadRegTypeLi
LoadTypeLi
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayPutElement
SafeArrayUnaccessData
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VarBstrCmp
VarUI4FromStr
VariantClear
VariantCopy
VariantInit
VariantTimeToSystemTime

dxgi

CreateDXGIFactory1

winmm

midiInAddBuffer
midiInClose
midiInGetDevCapsW
midiInGetNumDevs
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInUnprepareHeader
midiOutClose
midiOutGetDevCapsW
midiOutGetNumDevs
midiOutLongMsg
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutShortMsg
midiOutUnprepareHeader
timeBeginPeriod
timeEndPeriod
timeGetTime
waveInGetNumDevs
waveOutClose
waveOutGetNumDevs
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutUnprepareHeader
waveOutWrite

user32

AdjustWindowRectEx
AllowSetForegroundWindow
BeginPaint
BringWindowToTop
CallNextHookEx
CallWindowProcW
CharLowerW
CharNextW
CharToOemBuffW
CharUpperW
ClientToScreen
ClipCursor
CloseClipboard
CloseDesktop
CloseTouchInputHandle
CloseWindowStation
CountClipboardFormats
CreateCaret
CreateDesktopW
CreateDialogParamW
CreateIconIndirect
CreatePopupMenu
CreateWindowExW
CreateWindowStationW
DdeClientTransaction
DdeConnect
DdeCreateStringHandleW
DdeDisconnect
DdeFreeStringHandle
DdeInitializeW
DdeUninitialize
DefRawInputProc
DefWindowProcW
DestroyCaret
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DisplayConfigGetDeviceInfo
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawTextExW
EmptyClipboard
EnableMenuItem
EnableWindow
EndMenu
EndPaint
EnumChildWindows
EnumClipboardFormats
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsExW
EnumDisplaySettingsW
EnumThreadWindows
EnumWindows
EqualRect
ExitWindowsEx
FillRect
FindWindowExW
FindWindowW
FlashWindowEx
FrameRect
GetActiveWindow
GetAncestor
GetAsyncKeyState
GetCapture
GetCaretBlinkTime
GetClassInfoExW
GetClassLongPtrW
GetClassNameW
GetClientRect
GetClipboardData
GetClipboardFormatNameW
GetClipboardSequenceNumber
GetCursorInfo
GetCursorPos
GetDC
GetDesktopWindow
GetDisplayConfigBufferSizes
GetDlgItem
GetDlgItemTextW
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetGuiResources
GetIconInfo
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameW
GetKeyboardState
GetLastInputInfo
GetLayeredWindowAttributes
GetMenu
GetMenuInfo
GetMenuItemCount
GetMenuItemInfoW
GetMenuState
GetMessageExtraInfo
GetMessagePos
GetMessageTime
GetMessageW
GetMonitorInfoW
GetParent
GetProcessWindowStation
GetPropW
GetQueueStatus
GetRawInputData
GetRawInputDeviceInfoW
GetRawInputDeviceList
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetThreadDesktop
GetTopWindow
GetUserObjectInformationW
GetWindow
GetWindowDC
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowRgn
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
InflateRect
InsertMenuItemW
IntersectRect
InvalidateRect
InvertRect
IsChild
IsClipboardFormatAvailable
IsDialogMessageW
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadCursorW
LoadIconW
LoadImageW
LoadStringW
MapVirtualKeyExW
MapVirtualKeyW
MapWindowPoints
MessageBeep
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MoveWindow
MsgWaitForMultipleObjectsEx
NotifyWinEvent
OemToCharA
OemToCharBuffA
OffsetRect
OpenClipboard
OpenInputDesktop
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PrintWindow
PrivateExtractIconsW
PtInRect
QueryDisplayConfig
RedrawWindow
RegisterClassExW
RegisterClassW
RegisterClipboardFormatW
RegisterDeviceNotificationW
RegisterHotKey
RegisterPowerSettingNotification
RegisterRawInputDevices
RegisterTouchWindow
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendInput
SendMessageTimeoutW
SendMessageW
SetCapture
SetCaretPos
SetClipboardData
SetCursor
SetCursorPos
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetKeyboardState
SetMenuDefaultItem
SetMenuInfo
SetMenuItemInfoW
SetParent
SetProcessDPIAware
SetProcessWindowStation
SetPropW
SetRect
SetRectEmpty
SetThreadDesktop
SetTimer
SetWinEventHook
SetWindowLongPtrW
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowCursor
ShowWindow
SystemParametersInfoW
ToUnicodeEx
TrackMouseEvent
TrackPopupMenu
TranslateMessage
UnhookWinEvent
UnhookWindowsHookEx
UnregisterClassW
UnregisterDeviceNotification
UnregisterHotKey
UnregisterPowerSettingNotification
UpdateLayeredWindow
WindowFromPoint

gdi32

AddFontMemResourceEx
BeginPath
BitBlt
CancelDC
CloseEnhMetaFile
CloseFigure
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateEnhMetaFileW
CreateFontA
CreateFontIndirectA
CreateFontIndirectW
CreateFontW
CreatePen
CreatePolygonRgn
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
EndDoc
EndPage
EndPath
EnumEnhMetaFile
EnumFontFamiliesExA
EnumFontFamiliesExW
EqualRgn
ExtCreatePen
ExtEscape
ExtTextOutW
FillPath
GdiAlphaBlend
GdiComment
GdiFlush
GetBkColor
GetCharABCWidthsW
GetCharWidthW
GetClipBox
GetClipRgn
GetCurrentObject
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetEnhMetaFileHeader
GetFontData
GetFontUnicodeRanges
GetGlyphIndicesW
GetGlyphOutlineW
GetICMProfileW
GetObjectType
GetObjectW
GetOutlineTextMetricsW
GetRegionData
GetRgnBox
GetStockObject
GetTextExtentPointI
GetTextFaceA
GetTextFaceW
GetTextMetricsW
GetWorldTransform
IntersectClipRect
LineTo
ModifyWorldTransform
MoveToEx
PlayEnhMetaFile
PlayEnhMetaFileRecord
PolyBezierTo
PtInRegion
RemoveFontMemResourceEx
RestoreDC
SaveDC
SelectClipPath
SelectClipRgn
SelectObject
SetAbortProc
SetArcDirection
SetBkColor
SetBkMode
SetBrushOrgEx
SetDCBrushColor
SetDCPenColor
SetDIBits
SetDIBitsToDevice
SetEnhMetaFileBits
SetGraphicsMode
SetMiterLimit
SetPolyFillMode
SetROP2
SetRectRgn
SetStretchBltMode
SetTextAlign
SetTextColor
SetWorldTransform
StartDocW
StartPage
StretchBlt
StretchDIBits
StrokeAndFillPath
StrokePath
WidenPath

uiautomationcore

UiaGetReservedMixedAttributeValue
UiaGetReservedNotSupportedValue
UiaHostProviderFromHwnd
UiaRaiseAutomationEvent
UiaRaiseAutomationPropertyChangedEvent
UiaRaiseStructureChangedEvent
UiaReturnRawElementProvider

oleacc

AccessibleChildren
AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject
WindowFromAccessibleObject

secur32

AcquireCredentialsHandleA
AcquireCredentialsHandleW
CompleteAuthToken
DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExW
InitializeSecurityContextA
InitializeSecurityContextW
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
LsaLogonUser
QueryContextAttributesW
QuerySecurityPackageInfoW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
RegisterGPNotification
UnregisterGPNotification

netapi32

NetApiBufferFree
NetGetJoinInformation
NetUserGetInfo

shell32

CommandLineToArgvW
DragQueryFileW
ord680
SHAppBarMessage
SHBrowseForFolderW
SHChangeNotify
ord4
ord2
SHCreateItemFromParsingName
SHGetDesktopFolder
SHGetFileInfoW
SHGetFolderPathW
SHGetKnownFolderPath
SHGetMalloc
SHGetPathFromIDListW
SHGetPropertyStoreForWindow
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetStockIconInfo
SHOpenFolderAndSelectItems
SHOpenWithDialog
SHQueryUserNotificationState
ShellExecuteA
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW

wintrust

CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
WTHelperProvDataFromStateData
WinVerifyTrust

comctl32

InitCommonControlsEx

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

hid

HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetPreparsedData
HidD_GetProductString
HidD_GetSerialNumberString
HidP_GetCaps

crypt32

CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
CertCloseStore
CertCompareCertificateName
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertFindCertificateInStore
CertFindChainInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetIssuerCertificateFromStore
CertGetNameStringW
CertOpenStore
CertOpenSystemStoreW
CertSetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertVerifyTimeValidity
CryptAcquireCertificatePrivateKey
CryptDecodeObjectEx
CryptInstallOIDFunctionAddress
CryptMsgClose
CryptMsgGetParam
CryptProtectData
CryptQueryObject
CryptUnprotectData
CryptVerifyCertificateSignatureEx

chrome_elf

ClearReportsBetween_ExportThunk
CrashForException_ExportThunk
DumpHungProcessWithPtype_ExportThunk
GetCrashReports_ExportThunk
GetInstallDetailsPayload
GetUserDataDirectoryThunk
InjectDumpForHungInput_ExportThunk
IsThirdPartyInitialized
RequestSingleCrashUpload_ExportThunk
SetMetricsClientId
SetUploadConsent_ExportThunk
SignalChromeElf
SignalInitializeCrashReporting

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

propsys

InitPropVariantFromCLSID
PSGetPropertyKeyFromName
VariantCompare

shlwapi

AssocQueryStringW
ord437
PathFindExtensionW
PathFindFileNameW
PathMatchSpecW
PathRemoveExtensionW
ord12

dwrite

DWriteCreateFactory

dwmapi

DwmDefWindowProc
DwmExtendFrameIntoClientArea
DwmGetCompositionTimingInfo
DwmGetWindowAttribute
DwmIsCompositionEnabled
DwmSetWindowAttribute

winspool.drv

ClosePrinter
DeviceCapabilitiesW
DocumentPropertiesW
EnumPrintersW
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
ord203
GetJobW
GetPrinterDriverW
GetPrinterW
OpenPrinterW

uxtheme

CloseThemeData
DrawThemeBackground
ord47
GetThemeBackgroundContentRect
GetThemePartSize
OpenThemeData

usp10

ScriptFreeCache
ScriptItemize
ScriptShape

comdlg32

ChooseColorW
GetOpenFileNameW
GetSaveFileNameW
PrintDlgExW

d3d9

Direct3DCreate9Ex

dxva2

DXVA2CreateDirect3DDeviceManager9
DXVA2CreateVideoService

credui

CredUIPromptForWindowsCredentialsW

imm32

ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext
ImmGetConversionStatus
ImmGetIMEFileNameW
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmSetOpenStatus

urlmon

CoInternetCreateSecurityManager

winhttp

WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpWriteData

cryptui

CryptUIDlgCertMgr
CryptUIDlgViewCertificateW

dhcpcsvc

DhcpCApiInitialize
DhcpRequestParams

wevtapi

EvtClose
EvtCreateRenderContext
EvtNext
EvtQuery
EvtRender

ncrypt

NCryptFreeObject
NCryptGetProperty
NCryptSignHash

wininet

GetUrlCacheEntryInfoExW

esent

JetAttachDatabase2W
JetBeginSessionW
JetCloseTable
JetCreateInstanceW
JetGetTableColumnInfoW
JetInit
JetMove
JetOpenDatabaseW
JetOpenTableW
JetRetrieveColumn
JetSetSystemParameterW
JetTerm

Exports

Exports

CrashForExceptionInNonABICompliantCodeRange
GetHandleVerifier
IsSandboxedProcess
RelaunchChromeBrowserWithNewCommandLineIfNeeded
cef_add_cross_origin_whitelist_entry
cef_api_hash
cef_base64decode
cef_base64encode
cef_begin_tracing
cef_binary_value_create
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_browser_view_create
cef_browser_view_get_for_browser
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_command_line_get_global
cef_cookie_manager_get_global_manager
cef_crash_reporting_enabled
cef_create_context_shared
cef_create_directory
cef_create_new_temp_directory
cef_create_temp_directory_in_directory
cef_create_url
cef_currently_on
cef_delete_file
cef_dictionary_value_create
cef_directory_exists
cef_display_get_alls
cef_display_get_count
cef_display_get_matching_bounds
cef_display_get_nearest_point
cef_display_get_primary
cef_do_message_loop_work
cef_drag_data_create
cef_enable_highdpi_support
cef_end_tracing
cef_execute_java_script_with_user_gesture_for_tests
cef_execute_process
cef_format_url_for_security_display
cef_get_current_platform_thread_handle
cef_get_current_platform_thread_id
cef_get_extensions_for_mime_type
cef_get_mime_type
cef_get_min_log_level
cef_get_path
cef_get_temp_directory
cef_get_vlog_level
cef_image_create
cef_initialize
cef_is_cert_status_error
cef_is_web_plugin_unstable
cef_label_button_create
cef_launch_process
cef_list_value_create
cef_load_crlsets_file
cef_log
cef_media_router_get_global
cef_menu_button_create
cef_menu_model_create
cef_now_from_system_trace_time
cef_panel_create
cef_parse_json
cef_parse_json_buffer
cef_parse_jsonand_return_error
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_print_settings_create
cef_process_message_create
cef_quit_message_loop
cef_refresh_web_plugins
cef_register_extension
cef_register_scheme_handler_factory
cef_register_web_plugin_crash
cef_register_widevine_cdm
cef_remove_cross_origin_whitelist_entry
cef_request_context_create_context
cef_request_context_get_global_context
cef_request_create
cef_resource_bundle_get_global
cef_response_create
cef_run_message_loop
cef_scroll_view_create
cef_server_create
cef_set_crash_key_value
cef_set_osmodal_loop
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_lower
cef_string_utf16_to_upper
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_textfield_create
cef_thread_create
cef_time_delta
cef_time_from_doublet
cef_time_from_timet
cef_time_now
cef_time_to_doublet
cef_time_to_timet
cef_trace_counter
cef_trace_counter_id
cef_trace_event_async_begin
cef_trace_event_async_end
cef_trace_event_async_step_into
cef_trace_event_async_step_past
cef_trace_event_begin
cef_trace_event_end
cef_trace_event_instant
cef_translator_test_create
cef_translator_test_ref_ptr_library_child_child_create
cef_translator_test_ref_ptr_library_child_create
cef_translator_test_ref_ptr_library_create
cef_translator_test_scoped_library_child_child_create
cef_translator_test_scoped_library_child_create
cef_translator_test_scoped_library_create
cef_unregister_internal_web_plugin
cef_uridecode
cef_uriencode
cef_urlrequest_create
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_v8value_create_array
cef_v8value_create_array_buffer
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_uint
cef_v8value_create_undefined
cef_value_create
cef_version_info
cef_visit_web_plugin_info
cef_waitable_event_create
cef_window_create_top_level
cef_write_json
cef_xml_reader_create
cef_zip_directory
cef_zip_reader_create

Sections

.text
Size: 120.5MB - Virtual size: 120.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19.2MB - Virtual size: 19.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 506KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 108B

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 569B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcurl.dll
.dll windows:6 windows x64 arch:x64

a32a41a64a73ad2a4b2f1b61d8981765

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb

Imports

wldap32

ord27
ord26
ord32
ord41
ord50
ord45
ord60
ord211
ord46
ord33
ord35
ord79
ord30
ord22
ord143
ord301
ord200

ws2_32

setsockopt
WSAIoctl
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
WSASetLastError
inet_pton
getaddrinfo
freeaddrinfo
gethostname
listen
accept
closesocket
recv
send
socket
ioctlsocket
ntohl
__WSAFDIsSet
select
htonl
WSAStartup
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
recvfrom
sendto
ntohs

advapi32

CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGenRandom

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertGetNameStringA

zlib1

inflateInit_
inflateEnd
inflate
zlibVersion
inflateInit2_

kernel32

GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
FormatMessageW
SetLastError
GetLastError
MoveFileExA
Sleep
GetEnvironmentVariableA
GetStdHandle
CloseHandle
GetProcAddress
FreeLibrary
MultiByteToWideChar
SleepEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
GetFileType
ReadFile
WaitForMultipleObjects
QueryPerformanceCounter
GetTickCount
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
WaitForSingleObjectEx
PeekNamedPipe

vcruntime140

memset
strchr
strrchr
memmove
memcmp
strstr
memchr
__C_specific_handler
__std_type_info_destroy_list
memcpy

api-ms-win-crt-stdio-l1-1-0

fgets
fseek
__acrt_iob_func
fwrite
__stdio_common_vsscanf
fputs
__stdio_common_vsprintf
fputc
fread
fclose
_close
_open
feof
_read
_write
fflush
fopen
_lseeki64
ftell

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoll
atoi
strtoul
strtol

api-ms-win-crt-runtime-l1-1-0

_cexit
_getpid
__sys_nerr
strerror
_errno
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_beginthreadex
_initterm
_initterm_e

api-ms-win-crt-string-l1-1-0

_strdup
strpbrk
strncpy
strcmp
isupper
strspn
tolower
strcspn
strncmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64
_fstat64
_unlink
_access

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_fdopen

Exports

Exports

curl_dbg_accept
curl_dbg_calloc
curl_dbg_fclose
curl_dbg_fdopen
curl_dbg_fopen
curl_dbg_free
curl_dbg_log
curl_dbg_malloc
curl_dbg_mark_sclose
curl_dbg_memdebug
curl_dbg_memlimit
curl_dbg_realloc
curl_dbg_recv
curl_dbg_sclose
curl_dbg_send
curl_dbg_socket
curl_dbg_strdup
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_perform_ev
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_version
curl_version_info

Sections

.text
Size: 355KB - Virtual size: 355KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
locales/en-US.pak
locales/pt-BR.pak
msvcp140.dll
.dll windows:6 windows x64 arch:x64

01c801a34c4715440ef1f25ad689b315

Code Sign

33:00:00:01:36:1b:d9:a8:16:fd:b8:e9:32:00:00:00:00:01:36
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-10-2019 23:17

Not After

21-01-2021 23:17

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:37

Not After

02-05-2020 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:37

Not After

02-05-2020 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:f2:ce:f0:6b:33:91:c2:a5:5c:2f:44:e4:21:54:88:e8:09:31:05:76:a9:0a:7c:5c:8e:01:93:9a:da:80:3c
Signer

Actual PE Digest

6d:f2:ce:f0:6b:33:91:c2:a5:5c:2f:44:e4:21:54:88:e8:09:31:05:76:a9:0a:7c:5c:8e:01:93:9a:da:80:3c

Digest Algorithm

sha256

PE Digest Matches

true

48:83:9f:3f:80:32:1f:c8:5c:fa:be:ca:d8:b4:84:f6:ea:7e:86:df
Signer

Actual PE Digest

48:83:9f:3f:80:32:1f:c8:5c:fa:be:ca:d8:b4:84:f6:ea:7e:86:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\agent\_work\3\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb

Imports

vcruntime140

__C_specific_handler
__current_exception_context
memcmp
__uncaught_exceptions
__uncaught_exception
memchr
memmove
__std_terminate
_purecall
memset
memcpy
_CxxThrowException
__AdjustPointer
__current_exception
__std_exception_destroy
__std_type_info_destroy_list
__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
calloc
malloc
free

api-ms-win-crt-runtime-l1-1-0

abort
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
terminate
_endthreadex
_seh_filter_dll
_set_new_handler
_execute_onexit_table
_crt_atexit
_cexit
_initterm_e
_configure_narrow_argv
_initterm
_errno
_beginthreadex

api-ms-win-crt-string-l1-1-0

isxdigit
isupper
wcscpy_s
wcsnlen
__strncnt
tolower
strcspn
iswdigit
isdigit
iswxdigit
islower
isspace
isalnum
iswspace
_wcsdup
iswalnum

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
_lock_locales
___lc_locale_name_func
___lc_collate_cp_func
localeconv
___lc_codepage_func
setlocale
__pctype_func
_unlock_locales

api-ms-win-crt-stdio-l1-1-0

ungetwc
fseek
_fsopen
_wfsopen
__acrt_iob_func
_get_stream_buffer_pointers
fclose
__stdio_common_vsprintf_s
fflush
fputs
fgetc
fgetpos
fputc
fgetwc
fread
fputwc
fwrite
fsetpos
ungetc
setvbuf
_fseeki64

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_wrename
_wchdir
_wremove
_wrmdir
_unlock_file

api-ms-win-crt-time-l1-1-0

_W_Getdays
_Getmonths
_W_Gettnames
_Wcsftime
_Strftime
_W_Getmonths
_Gettnames
_Getdays

api-ms-win-crt-environment-l1-1-0

_wgetcwd

api-ms-win-crt-math-l1-1-0

log
pow
powf
ldexp
logf
frexp

api-ms-win-crt-convert-l1-1-0

strtof
btowc
strtod

api-ms-win-crt-utility-l1-1-0

rand_s

kernel32

RtlCaptureStackBackTrace
RaiseException
MultiByteToWideChar
GetCPInfo
WideCharToMultiByte
LoadLibraryExA
CompareStringW
LCMapStringW
GetLocaleInfoW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
FreeLibrary
VirtualQuery
VirtualProtect
GetSystemInfo
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
IsProcessorFeaturePresent
RtlPcToFileHeader
GetStringTypeW
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleExW
QueueUserWorkItem
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThreadId
SwitchToThread
Sleep
WaitForSingleObjectEx
FormatMessageA
LocalFree
DecodePointer
EncodePointer
CreateHardLinkW
CopyFileW
GetLastError
CloseHandle
AreFileApisANSI
GetTempPathW
SetFileTime
SetFilePointerEx
SetFileAttributesW

Exports

Exports

??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
??0?$_Yarn@D@std@@QEAA@AEBV01@@Z
??0?$_Yarn@D@std@@QEAA@PEBD@Z
??0?$_Yarn@D@std@@QEAA@XZ
??0?$_Yarn@G@std@@QEAA@AEBV01@@Z
??0?$_Yarn@G@std@@QEAA@PEBG@Z
??0?$_Yarn@G@std@@QEAA@XZ
??0?$_Yarn@_W@std@@QEAA@AEBV01@@Z
??0?$_Yarn@_W@std@@QEAA@PEB_W@Z
??0?$_Yarn@_W@std@@QEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@W4_Uninitialized@1@@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@W4_Uninitialized@1@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@AEBV01@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@W4_Uninitialized@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@AEBV01@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@W4_Uninitialized@1@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@AEBV01@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@W4_Uninitialized@1@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$codecvt@DDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$codecvt@DDU_Mbstatet@@@std@@QEAA@_K@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@KW4_Codecvt_mode@1@_K@Z
??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@_K@Z
??0?$codecvt@_UDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@KW4_Codecvt_mode@1@_K@Z
??0?$codecvt@_UDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$codecvt@_UDU_Mbstatet@@@std@@QEAA@_K@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??0?$ctype@D@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$ctype@D@std@@QEAA@PEBF_N_K@Z
??0?$ctype@G@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$ctype@G@std@@QEAA@_K@Z
??0?$ctype@_W@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$ctype@_W@std@@QEAA@_K@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z
??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAA@PEBD_K@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAA@PEBD_K@Z
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAA@PEBD_K@Z
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAA@PEBD_K@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAA@PEBD_K@Z
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z
??0Init@ios_base@std@@QEAA@XZ
??0_Facet_base@std@@QEAA@AEBV01@@Z
??0_Facet_base@std@@QEAA@XZ
??0_Init_locks@std@@QEAA@XZ
??0_Locimp@locale@std@@AEAA@AEBV012@@Z
??0_Locimp@locale@std@@AEAA@_N@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0_Lockit@std@@QEAA@XZ
??0_Timevec@std@@QEAA@AEBV01@@Z
??0_Timevec@std@@QEAA@PEAX@Z
??0_UShinit@std@@QEAA@XZ
??0_Winit@std@@QEAA@XZ
??0codecvt_base@std@@QEAA@_K@Z
??0ctype_base@std@@QEAA@_K@Z
??0facet@locale@std@@IEAA@_K@Z
??0id@locale@std@@QEAA@_K@Z
??0ios_base@std@@IEAA@XZ
??0task_continuation_context@Concurrency@@AEAA@XZ
??0time_base@std@@QEAA@_K@Z
??1?$_Yarn@D@std@@QEAA@XZ
??1?$_Yarn@G@std@@QEAA@XZ
??1?$_Yarn@_W@std@@QEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$codecvt@DDU_Mbstatet@@@std@@MEAA@XZ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??1?$codecvt@_SDU_Mbstatet@@@std@@MEAA@XZ
??1?$codecvt@_UDU_Mbstatet@@@std@@MEAA@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??1?$ctype@D@std@@MEAA@XZ
??1?$ctype@G@std@@MEAA@XZ
??1?$ctype@_W@std@@MEAA@XZ
??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ
??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ
??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ
??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ
??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ
??1?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ
??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ
??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ
??1?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ
??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ
??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ
??1?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ
??1Init@ios_base@std@@QEAA@XZ
??1_Facet_base@std@@UEAA@XZ
??1_Init_locks@std@@QEAA@XZ
??1_Locimp@locale@std@@MEAA@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1_Timevec@std@@QEAA@XZ
??1_UShinit@std@@QEAA@XZ
??1_Winit@std@@QEAA@XZ
??1codecvt_base@std@@UEAA@XZ
??1ctype_base@std@@UEAA@XZ
??1facet@locale@std@@MEAA@XZ
??1ios_base@std@@UEAA@XZ
??1time_base@std@@UEAA@XZ
??4?$_Iosb@H@std@@QEAAAEAV01@$$QEAV01@@Z
??4?$_Iosb@H@std@@QEAAAEAV01@AEBV01@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@AEBV01@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??4?$_Yarn@G@std@@QEAAAEAV01@AEBV01@@Z
??4?$_Yarn@G@std@@QEAAAEAV01@PEBG@Z
??4?$_Yarn@_W@std@@QEAAAEAV01@AEBV01@@Z
??4?$_Yarn@_W@std@@QEAAAEAV01@PEB_W@Z
??4?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_istream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z
??4?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAAEAV01@AEBV01@@Z
??4?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAAEAV01@AEBV01@@Z
??4?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@AEBV01@@Z
??4Init@ios_base@std@@QEAAAEAV012@AEBV012@@Z
??4_Crt_new_delete@std@@QEAAAEAU01@$$QEAU01@@Z
??4_Crt_new_delete@std@@QEAAAEAU01@AEBU01@@Z
??4_Facet_base@std@@QEAAAEAV01@AEBV01@@Z
??4_Init_locks@std@@QEAAAEAV01@AEBV01@@Z
??4_Timevec@std@@QEAAAEAV01@AEBV01@@Z
??4_UShinit@std@@QEAAAEAV01@AEBV01@@Z
??4_Winit@std@@QEAAAEAV01@AEBV01@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAF@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAJ@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAO@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAPEAX@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAF@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAJ@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAK@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAM@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAN@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAO@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAPEAX@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_J@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_K@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@GU?$char_traits@G@std@@@1@AEAV21@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAF@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAJ@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAK@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAM@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAN@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAO@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAPEAX@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_J@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AEAV21@@Z@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@O@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@O@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@GU?$char_traits@G@std@@@1@AEAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@O@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
??7ios_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??Bios_base@std@@QEBA_NXZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_istream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$codecvt@DDU_Mbstatet@@@std@@6B@
??_7?$codecvt@GDU_Mbstatet@@@std@@6B@
??_7?$codecvt@_SDU_Mbstatet@@@std@@6B@
??_7?$codecvt@_UDU_Mbstatet@@@std@@6B@
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@
??_7?$ctype@D@std@@6B@
??_7?$ctype@G@std@@6B@
??_7?$ctype@_W@std@@6B@
??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7_Facet_base@std@@6B@
??_7_Locimp@locale@std@@6B@
??_7codecvt_base@std@@6B@
??_7ctype_base@std@@6B@
??_7facet@locale@std@@6B@
??_7ios_base@std@@6B@
??_7time_base@std@@6B@
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@
??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@
??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@
??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@
??_8?$basic_istream@_WU?$char_traits@_W@std@@@std@@7B@
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@
??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@
??_8?$basic_ostream@_WU?$char_traits@_W@std@@@std@@7B@
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??_D?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??_F?$codecvt@DDU_Mbstatet@@@std@@QEAAXXZ
??_F?$codecvt@GDU_Mbstatet@@@std@@QEAAXXZ
??_F?$codecvt@_SDU_Mbstatet@@@std@@QEAAXXZ
??_F?$codecvt@_UDU_Mbstatet@@@std@@QEAAXXZ
??_F?$codecvt@_WDU_Mbstatet@@@std@@QEAAXXZ
??_F?$ctype@D@std@@QEAAXXZ
??_F?$ctype@G@std@@QEAAXXZ
??_F?$ctype@_W@std@@QEAAXXZ
??_F?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ
??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ
??_F?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ
??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ
??_F?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ
??_F?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ
??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ
??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ
??_F?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ
??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ
??_F?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ
??_F?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ
??_F_Locinfo@std@@QEAAXXZ
??_F_Timevec@std@@QEAAXXZ
??_Fcodecvt_base@std@@QEAAXXZ
??_Fctype_base@std@@QEAAXXZ
??_Ffacet@locale@std@@QEAAXXZ
??_Fid@locale@std@@QEAAXXZ
??_Ftime_base@std@@QEAAXXZ
?CaptureCallstack@platform@details@Concurrency@@YA_KPEAPEAX_K1@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Addcats@_Locinfo@std@@QEAAAEAV12@HPEBD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Addstd@ios_base@std@@SAXPEAV12@@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Atexit@@YAXP6AXXZ@Z
?_BADOFF@std@@3_JB
?_C_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_C_str@?$_Yarn@G@std@@QEBAPEBGXZ
?_C_str@?$_Yarn@_W@std@@QEBAPEB_WXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Callfns@ios_base@std@@AEAAXW4event@12@@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Clocptr@_Locimp@locale@std@@0PEAV123@EA
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Donarrow@?$ctype@G@std@@IEBADGD@Z
?_Donarrow@?$ctype@_W@std@@IEBAD_WD@Z
?_Dowiden@?$ctype@G@std@@IEBAGD@Z
?_Dowiden@?$ctype@_W@std@@IEBA_WD@Z
?_Empty@?$_Yarn@D@std@@QEBA_NXZ
?_Empty@?$_Yarn@G@std@@QEBA_NXZ
?_Empty@?$_Yarn@_W@std@@QEBA_NXZ
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Ffmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAPEADPEADDH@Z
?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAPEADPEADDH@Z
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAPEADPEADDH@Z
?_Findarr@ios_base@std@@AEAAAEAU_Iosarray@12@H@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBD_K@Z
?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBD_K@Z
?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBD_K@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$codecvt@_SDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$codecvt@_UDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@facet@locale@std@@SA_KPEAPEBV123@PEBV23@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getdateorder@_Locinfo@std@@QEBAHXZ
?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AEAVios_base@2@PEAH@Z
?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AEAVios_base@2@PEAH@Z
?_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AEAVios_base@2@PEAH@Z
?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AEAVios_base@2@PEAH@Z
?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AEAVios_base@2@PEAH@Z
?_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AEAVios_base@2@PEAH@Z
?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z
?_Getfmt@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z
?_Getfmt@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HAEBVlocale@2@@Z
?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HAEBVlocale@2@@Z
?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HAEBVlocale@2@@Z
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAEAHAEBV?$ctype@D@2@@Z
?_Getint@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0HHAEAHAEBV?$ctype@G@2@@Z
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAEAHAEBV?$ctype@_W@2@@Z
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
?_Getname@_Locinfo@std@@QEBAPEBDXZ
?_Getptr@_Timevec@std@@QEBAPEAXXZ
?_Gettnames@_Locinfo@std@@QEBA?AV_Timevec@2@XZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Gnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBA_JXZ
?_Gnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBA_JXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Gnpreinc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnpreinc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Gnpreinc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Id_cnt@id@locale@std@@0HA
?_Ifmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z
?_Ifmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z
?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Index@ios_base@std@@0HA

Sections

.text
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources.pak
snapshot_blob.bin
v8_context_snapshot.bin
vcruntime140.dll
.dll windows:6 windows x64 arch:x64

44c3854843f7a3fccdf8ddbbea66f302

Code Sign

33:00:00:01:5b:35:5a:26:9f:60:85:60:fc:00:00:00:00:01:5b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-12-2019 01:13

Not After

17-03-2021 01:13

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:32BD-E3D5-3B1D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:39

Not After

03-03-2021 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:39

Not After

03-03-2021 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:0b:84:5c:28:24:72:d8:94:33:25:aa:e8:f7:86:20:56:07:ff:89:37:d6:b5:96:12:0f:bc:dd:50:38:c4:18
Signer

Actual PE Digest

8d:0b:84:5c:28:24:72:d8:94:33:25:aa:e8:f7:86:20:56:07:ff:89:37:d6:b5:96:12:0f:bc:dd:50:38:c4:18

Digest Algorithm

sha256

PE Digest Matches

true

9b:c8:97:1c:ca:d5:7e:0b:7a:d2:4f:03:33:1f:95:05:01:42:12:b3
Signer

Actual PE Digest

9b:c8:97:1c:ca:d5:7e:0b:7a:d2:4f:03:33:1f:95:05:01:42:12:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

terminate
abort

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free

api-ms-win-crt-string-l1-1-0

strcpy_s
strncmp
wcsncmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-convert-l1-1-0

atol

kernel32

SetLastError
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
GetModuleHandleW
RtlUnwind
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
GetModuleFileNameW

Exports

Exports

_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vcruntime140_1.dll
.dll windows:6 windows x64 arch:x64

ae0bde6314fa2027b54ce04898f6ab69

Code Sign

33:00:00:01:44:53:0e:24:fc:63:f8:45:72:00:00:00:00:01:44
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13-11-2019 21:42

Not After

11-02-2021 21:42

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D6BD-E3E7-1685,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:39

Not After

03-03-2021 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:39

Not After

03-03-2021 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:48:cd:dc:79:c7:13:13:2a:a8:e0:5d:0a:d9:93:e2:33:39:83:58:0a:28:b3:40:48:a0:fd:a1:c6:7b:86:7c
Signer

Actual PE Digest

8d:48:cd:dc:79:c7:13:13:2a:a8:e0:5d:0a:d9:93:e2:33:39:83:58:0a:28:b3:40:48:a0:fd:a1:c6:7b:86:7c

Digest Algorithm

sha256

PE Digest Matches

true

87:6c:58:6e:1a:87:da:7a:14:9d:b3:03:dd:8f:af:1b:a4:59:21:1f
Signer

Actual PE Digest

87:6c:58:6e:1a:87:da:7a:14:9d:b3:03:dd:8f:af:1b:a4:59:21:1f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\agent\_work\7\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

terminate
abort

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp

vcruntime140

__processing_throw
__C_specific_handler
memmove
__current_exception

kernel32

IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwindEx
RtlLookupFunctionEntry
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
EncodePointer
RaiseException
RtlPcToFileHeader
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLastError
SetLastError
TlsAlloc

Exports

Exports

__CxxFrameHandler4
__NLG_Dispatch2
__NLG_Return2

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zlib1.dll
.dll windows:6 windows x64 arch:x64

3e00cc5294fc2fcbabd14c323443ba4e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb

Imports

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memchr
memset
memcpy

api-ms-win-crt-stdio-l1-1-0

_wopen
_write
_read
_close
__stdio_common_vsprintf
_open
_lseeki64

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-runtime-l1-1-0

_errno
_cexit
strerror
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm

kernel32

GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
RtlCaptureContext
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent

Exports

Exports

adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d631316b01a605a68b2592c84fa2c70

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

msvcp140

crypt32

bcrypt

winhttp

libcurl

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

concrt140

Sections

.text Size: 396KB - Virtual size: 395KB

.rdata Size: 123KB - Virtual size: 123KB

.data Size: 46KB - Virtual size: 48KB

.pdata Size: 20KB - Virtual size: 20KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 4KB - Virtual size: 4KB

6e7f9a29f2c85394521a08b9f31f6275

Code Sign

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

49:25:50:7d:1e:f0:2b:01:1b:4f:d1:07:9b:0a:0b:5eCertificate

Extended Key Usages

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2Certificate

Extended Key Usages

Key Usages

61:66:14:5a:43:6f:73:06:b6:58:7c:d8:f0:d1:9a:47:9d:50:8f:00Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 176KB

.rsrc Size: 39KB - Virtual size: 39KB

3e8d18bb71c7ebbda2ddc2a4bb03547b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Exports

.text
Size: 396KB - Virtual size: 395KB

.rdata
Size: 123KB - Virtual size: 123KB

.data
Size: 46KB - Virtual size: 48KB

.pdata
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 4KB - Virtual size: 4KB

04:00:00:00:00:01:21:58:53:08:a2
Certificate

49:25:50:7d:1e:f0:2b:01:1b:4f:d1:07:9b:0a:0b:5e
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Certificate

61:66:14:5a:43:6f:73:06:b6:58:7c:d8:f0:d1:9a:47:9d:50:8f:00
Signer

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 176KB

.rsrc
Size: 39KB - Virtual size: 39KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 681B

.data
Size: 512B - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 352B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 1024B - Virtual size: 578B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 648B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 638B