cb47e9ec99e4b9c782c030165896a240N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cb47e9ec99e4b9c782c030165896a240N.exe
Size

2.4MB
MD5

cb47e9ec99e4b9c782c030165896a240
SHA1

f1baeed110223d981631a172f121e03ae17c0991
SHA256

8fe5d86bc0a79c51a3e0443a15ac73832359466ac567329d2dfec6758a7c82c5
SHA512

27a14e0a58244d9e0585690bdc31359a008e9df61114000217908c6b57e1f004d33f3383606e956b00cd3e611afc7c2b4d06729c79d6c81d5288f2a6287d2075
SSDEEP

49152:4dttM5VI27hzODZ9M0CJffLgwhtfapdFQid4gDW3Z6LMwMACnY:4dt50UCJfDgwhZaZDW3MYCyY

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx
static1/unpack001/Winmugen_debug.exe	upx
static1/unpack001/winmugen.exe	upx

Unsigned PE 18 IoCs

Checks for missing Authenticode signature.

resource
cb47e9ec99e4b9c782c030165896a240N.exe
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/MyNsisExtend.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/locate.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/xml.dll
unpack001/$TEMP/$_89_/MyNsisSkin.dll
unpack001/ALLEG40.DLL
unpack001/ISTask.dll
unpack001/UninsFiles/ISTask.dll
unpack001/Winmugen_debug.exe
unpack001/winmugen.exe
unpack001/zlib.dll
unpack001/ʼϷ.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

cb47e9ec99e4b9c782c030165896a240N.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ButtonEvent.dll
.dll windows:4 windows x86 arch:x86

0ece15e7d9bb35972aec701f46192460

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalAlloc
lstrcpyA
lstrcpynA
GlobalFree

user32

PostMessageA
CallWindowProcA
GetDlgItem
FindWindowExA
SetWindowLongA
wsprintfA

Exports

Exports

AddEventHandler
Unload
UnsetEventHandler
WhichButtonId

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/MyNsisExtend.dll
.dll windows:4 windows x86 arch:x86

9cb11d0d4bed69c64ae8d0549b4ce4ce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\v2.2\install\build\MSVC.2005\Tool\GMNsisExtend\release_staticA2\MyNsisExtend.pdb

Imports

shlwapi

PathSkipRootA
PathCombineA

wininet

InternetOpenUrlA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetSetOptionA
InternetSetFilePointer
InternetConnectA
HttpQueryInfoA
InternetReadFile
InternetOpenA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

InitializeCriticalSection
GlobalFree
lstrcpyA
SetEvent
Sleep
ResetEvent
CreateEventA
lstrcpynA
GlobalAlloc
lstrcmpiA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
lstrlenA
GetLogicalDriveStringsA
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessA
DisableThreadLibraryCalls
CloseHandle
GetFileSize
CreateFileA
GetFileAttributesA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetPrivateProfileStringA
lstrcmpA
CreateFileW
ReadFile
WriteFile
SetFilePointer
GetVersionExA
SetFileTime
GetFileTime
SetEndOfFile
ResumeThread
GetCurrentThreadId
GetTickCount
GetVersion
ExpandEnvironmentStringsA
GetSystemInfo
SetFileAttributesA
WritePrivateProfileStringA
SetEnvironmentVariableA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentDirectoryA
DeleteFileA
SearchPathA
CreateDirectoryA
GetFullPathNameA
GetFileSizeEx
InterlockedExchange
DeviceIoControl
GetTempFileNameA
GetSystemDirectoryA
MoveFileExA
GetLongPathNameA
GetFileInformationByHandle
RemoveDirectoryA
GetTempPathA
MoveFileA
GetWindowsDirectoryA
CopyFileA
GetProcAddress
FreeLibrary
GetModuleFileNameA
LoadLibraryA
GetModuleHandleA
LoadLibraryExA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
FindClose
FindFirstFileA
FindNextFileA
GetLocaleInfoW
GetLocaleInfoA
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
TlsFree
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
HeapSize
HeapReAlloc
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
CompareStringA
InterlockedIncrement
SetLastError
SetCurrentDirectoryA
CompareStringW
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
CreateThread
ExitThread
VirtualFree
HeapCreate
HeapDestroy
GetCurrentThread
GetProcessHeap
GetCommandLineA
IsDebuggerPresent
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedDecrement

user32

GetDlgItem
wsprintfA
SetTimer
KillTimer
SetForegroundWindow
GetWindow
GetWindowRect
AttachThreadInput
GetWindowLongA
SystemParametersInfoA
IsWindowVisible
IsIconic
GetForegroundWindow
SetWindowTextA
GetWindowTextA
MapWindowPoints
IsZoomed
GetClientRect
GetWindowTextLengthA
GetWindowThreadProcessId
GetActiveWindow
SendMessageTimeoutA
GetParent
LoadStringW
SetWindowPos
GetSystemMetrics
ShowWindow
EnumThreadWindows
GetClassNameA
SendMessageA

advapi32

RegDeleteValueA
RegQueryInfoKeyA
RegLoadKeyA
RegRestoreKeyA
RegEnumValueA
RegEnumKeyExA
RegSaveKeyA
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
ShellExecuteA
SHGetSpecialFolderPathA

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
SysAllocString

Exports

Exports

ChangeInstDirtoMax
CheckInstallLimit
ConvertSoftInstallTime
CreateShortcut
CreateTimer
DecodeFile
DestroyTimer
Exec
ExecWait
Get7zOriginalSize
GetAdvertFileName
GetAdvertID
GetAdvertIcon
GetAdvertLocalFile
GetAdvertName
GetAdvertUrl
GetBaiduHomePageURL
GetChromeHomePageURL
GetExeFileNameFromUrl
GetForceAdvertFileName
GetForceAdvertID
GetForceAdvertLocalFile
GetForceAdvertName
GetForceAdvertUrl
GetHomePageName
GetHomePageName2
GetIEHomePageURL
GetSingleFileSize
GetSougouHomePageURL
GetSpecialBuild
GetSubChannel
HomePageChecksOut
InitPopUpInfo
LoadEncrypedXML
LoadEncrypedXMLFromUrl
LoadXMLFromUrl
LoadXml
OpenUrl
PinToTaskbar
PopUp
PopupAD
SendResearchResult
SetHomePage
SetUnGameList
UnPinFromTaskBar

Sections

.text
Size: 440KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/locate.dll
.dll windows:4 windows x86 arch:x86

7f8181c74f882a780c7cd485241e8b51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
MultiByteToWideChar
lstrlenW
lstrlenA
GetWindowsDirectoryW
WideCharToMultiByte
CompareFileTime
FindNextFileA
FindNextFileW
FileTimeToSystemTime
RemoveDirectoryA
RemoveDirectoryW
FindFirstFileA
FindFirstFileW
FindClose
SystemTimeToFileTime
FileTimeToLocalFileTime

user32

SetWindowTextA
SetWindowTextW
GetDlgItem
FindWindowExA
MessageBoxW

Exports

Exports

_Close
_Find
_GetSize
_Open
_RMDirEmpty
_Unload

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsRandom.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetRandom

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/xml.dll
.dll windows:4 windows x86 arch:x86

b5ed5b3a951d4443ce56e5453702d536

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
lstrcpynA
lstrcmpA
lstrcmpiA
lstrcpyA
RtlUnwind
GetModuleFileNameA
RaiseException
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
HeapReAlloc
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
GetLastError
LoadLibraryA
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
CloseHandle
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileA
VirtualProtect
GetSystemInfo
VirtualQuery
SetStdHandle
GetLocaleInfoA
InterlockedExchange
SetEndOfFile

Exports

Exports

_CloneNode
_Coordinate
_CreateNode
_CreateText
_CurrentAttribute
_DeclarationEncoding
_DeclarationStandalone
_DeclarationVersion
_ElementPath
_FindCloseElement
_FindNextElement
_FirstAttribute
_FirstChild
_FirstChildElement
_FreeNode
_GetAttribute
_GetNodeValue
_GetText
_GotoHandle
_GotoPath
_InsertAfterNode
_InsertBeforeNode
_InsertEndChild
_IsCDATA
_LastAttribute
_LastChild
_LoadFile
_NextAttribute
_NextSibling
_NextSiblingElement
_NoChildren
_NodeHandle
_NodeType
_Parent
_PreviousAttribute
_PreviousSibling
_RemoveAllChild
_RemoveAttribute
_RemoveNode
_ReplaceNode
_RootElement
_SaveFile
_SetAttribute
_SetAttributeName
_SetAttributeValue
_SetCDATA
_SetCondenseWhiteSpace
_SetEncoding
_SetNodeValue
_SetText
_Unload
_XPathAttribute
_XPathNode
_XPathString

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/$_89_/GMSkin_Image_2012_v1.zip
.zip
skin.xml
skin/Thumbs.db
skin/icon1.png
.png
skin/保存目录.png
.png
skin/关闭.png
.png
skin/协议背景.png
.png
skin/卸载背景.png
.png
skin/图片背景框.png
.png
skin/多选.png
.png
skin/安装.png
.png
skin/安装01.png
.png
skin/安装02.png
.png
skin/安装03.png
.png
skin/安装04.png
.png
skin/安装05.png
.png
skin/安装协议.png
.png
skin/安装完成.png
.png
skin/安装完成按钮.png
.png
skin/完成.png
.png
skin/广告关闭.png
.png
skin/按钮.png
.png
skin/最小化.png
.png
skin/最小化2.png
.png
skin/格子.png
.png
skin/欢迎.png
.png
skin/浏览.png
.png
skin/游戏弹出.png
.png
skin/软件弹出.png
.png
skin/进度条.png
.png
skin/进度条背景.png
.png
skin/选项.png
.png
skin/默认背景.png
.png
$TEMP/$_89_/MyNsisSkin.dll
.dll windows:4 windows x86 arch:x86

8b2c18b411d31cbef33f61e5be07509a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\v2.2\install\build\MSVC.2005\Tool\GMSkin\release_static2\MyNsisSkin.pdb

Imports

msimg32

TransparentBlt
AlphaBlend

kernel32

DosDateTimeToFileTime
CreateDirectoryW
GetCurrentDirectoryW
SetFileTime
WriteFile
SetEndOfFile
GetLastError
GetFileTime
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
SystemTimeToFileTime
InitializeCriticalSection
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
GetCurrentProcess
DuplicateHandle
GetFileType
SetFilePointer
WideCharToMultiByte
lstrcpyW
GetCurrentThreadId
MulDiv
lstrcatW
CreateFileW
GetFileSize
CreateFileA
ReadFile
CloseHandle
MultiByteToWideChar
lstrcmpiW
DisableThreadLibraryCalls
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
HeapCreate
HeapDestroy
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
Sleep
HeapSize
ExitProcess

user32

ScreenToClient
ClientToScreen
UpdateWindow
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
SetWindowTextW
CharNextW
InvalidateRect
EnumChildWindows
SetCapture
ReleaseCapture
ShowWindow
SetWindowRgn
OffsetRect
wsprintfW
GetSystemMetrics
SetWindowPos
GetSystemMenu
GetMenuItemInfoW
PostMessageW
PtInRect
SetTimer
GetClassNameW
GetParent
MapWindowPoints
SetPropW
CallWindowProcW
GetPropW
DefWindowProcW
GetClientRect
GetWindowRect
IsWindow
GetWindowLongW
LoadCursorW
SetCursor
TrackMouseEvent
BeginPaint
EndPaint
IsWindowEnabled
GetWindowTextW
SendMessageW
DrawTextW
SetWindowLongW
GetCursorPos
KillTimer

gdi32

CreatePen
SetStretchBltMode
StretchBlt
CreateFontIndirectW
CreateDIBSection
SetBkColor
CreateSolidBrush
CreateRoundRectRgn
RoundRect
GetStockObject
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
SetBkMode
SetTextColor
BitBlt
DeleteObject

oleaut32

SysFreeString

Exports

Exports

AddShowImage
AddShowImageFromFile
AddShowText
ClearAllShow
DelShowImage
DelShowText
InitSkin
SetBkImage
SetBtnImage
SetCloseBtnImage
SetEditBkColor
SetProgressBKImage
SetProgressImage
SetProgressTextWindow
SetTextClr
SetWindowID
SlideOff
SlideOn

Sections

.text
Size: 260KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/$_89_/config.dat
$TEMP/$_89_/game.jpg
.jpg
ALLEG40.DLL
.dll windows:4 windows x86 arch:x86

5fc8cddcc26b8a380b651fb92ce9d2d5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetCurrentProcess
GetModuleHandleA
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
GetCurrentThread
InitializeCriticalSection
DuplicateHandle
GetVersion
PulseEvent
WaitForMultipleObjects
ExitProcess
ResetEvent
GetLogicalDrives
WaitForSingleObject
SetEvent
GetThreadPriority
SetThreadPriority
Sleep
FormatMessageA
CreateEventA
FreeLibrary
DisableThreadLibraryCalls
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
LocalFree
GetProcAddress
OutputDebugStringA
LoadLibraryA
CloseHandle
GetVersionExA

user32

EnableMenuItem
RedrawWindow
GetSystemMenu
MessageBoxW
ReleaseDC
MoveWindow
keybd_event
MessageBoxA
CallWindowProcA
KillTimer
SendMessageA
GetDC
ShowWindow
SetWindowLongA
PostMessageA
SetWindowPos
GetWindowRect
GetClientRect
AdjustWindowRect
SetWindowTextA
SetCursorPos
GetCursorPos
GetWindowLongA
SetClassLongA
GetClassLongA
SystemParametersInfoA
ClientToScreen
GetForegroundWindow
GetKeyboardState
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
SetForegroundWindow
UpdateWindow
GetMessageA
DispatchMessageA
TranslateMessage
DefWindowProcA
PostQuitMessage
SetTimer
GetActiveWindow
IsIconic
BeginPaint
EndPaint
RegisterWindowMessageA
ShowCursor

gdi32

SelectObject
CreateSolidBrush
GetDeviceCaps
SelectPalette
SetPaletteEntries
RealizePalette
CreatePalette
GetPaletteEntries
DeleteObject
GetObjectA
GetDIBits
CreateDIBitmap
DeleteDC
StretchBlt
StretchDIBits
CreateCompatibleDC
GetSystemPaletteEntries
CreateCompatibleBitmap

ole32

CoUninitialize
CoInitialize
CoCreateInstance

dinput

DirectInputCreateA

ddraw

DirectDrawCreate

winmm

midiOutShortMsg
midiOutSetVolume
timeGetTime
midiOutClose
midiOutOpen
midiOutReset
midiOutGetNumDevs
midiOutGetDevCapsA
joyGetPosEx
waveOutUnprepareHeader
waveOutRestart
waveOutGetPosition
waveOutPause
waveOutOpen
waveOutPrepareHeader
waveOutWrite
waveOutSetVolume
waveOutGetVolume
joyGetDevCapsA
joyGetNumDevs
waveOutClose
waveOutReset

dsound

ord1
ord2

msvcrt

_close
_dup
_lseek
_CIacos
qsort
tmpnam
strpbrk
memmove
_CIpow
_CIfmod
rand
_ftol
realloc
vsprintf
fwrite
fclose
sprintf
getenv
fopen
fprintf
fflush
abort
_iob
fputs
_errno
exit
free
malloc
clock
atof
strtol
strtod
strerror
calloc
_stat
_findfirst
_findnext
_stricmp
_strdup
_write
_read
_getdrive
_getdcwd
_initterm
_unlink
_findclose
_open
_adjust_fdiv
_beginthread

Exports

Exports

_WinMain
__linear_vtable15
__linear_vtable16
__linear_vtable24
__linear_vtable32
__linear_vtable8
_acos_tbl
_add_edge
_add_exit_func
_al_drive_exists
_al_file_isok
_al_file_size
_al_file_time
_al_free
_al_getdcwd
_al_getdrive
_al_linker_midi
_al_linker_mouse
_al_malloc
_al_realloc
_al_sane_realloc
_allegro_count
_blender_add15
_blender_add16
_blender_add24
_blender_alpha
_blender_alpha15
_blender_alpha16
_blender_alpha24
_blender_alpha32
_blender_black
_blender_burn15
_blender_burn16
_blender_burn24
_blender_col_15
_blender_col_16
_blender_col_24
_blender_col_32
_blender_color15
_blender_color16
_blender_color24
_blender_difference15
_blender_difference16
_blender_difference24
_blender_dissolve15
_blender_dissolve16
_blender_dissolve24
_blender_dodge15
_blender_dodge16
_blender_dodge24
_blender_func15
_blender_func15x
_blender_func16
_blender_func16x
_blender_func24
_blender_func24x
_blender_func32
_blender_hue15
_blender_hue16
_blender_hue24
_blender_invert15
_blender_invert16
_blender_invert24
_blender_luminance15
_blender_luminance16
_blender_luminance24
_blender_multiply15
_blender_multiply16
_blender_multiply24
_blender_saturation15
_blender_saturation16
_blender_saturation24
_blender_screen15
_blender_screen16
_blender_screen24
_blender_trans15
_blender_trans16
_blender_trans24
_blender_write_alpha
_blit_between_formats
_clip_polygon_segment
_clip_polygon_segment_f
_color_conv
_color_depth
_color_find_glyph
_color_load_depth
_colorconv_blit_15_to_16
_colorconv_blit_15_to_24
_colorconv_blit_15_to_32
_colorconv_blit_15_to_8
_colorconv_blit_16_to_15
_colorconv_blit_16_to_24
_colorconv_blit_16_to_32
_colorconv_blit_16_to_8
_colorconv_blit_24_to_15
_colorconv_blit_24_to_16
_colorconv_blit_24_to_32
_colorconv_blit_24_to_8
_colorconv_blit_32_to_15
_colorconv_blit_32_to_16
_colorconv_blit_32_to_24
_colorconv_blit_32_to_8
_colorconv_blit_8_to_15
_colorconv_blit_8_to_16
_colorconv_blit_8_to_24
_colorconv_blit_8_to_32
_colorconv_blit_8_to_8
_compile_sprites
_construct_datafile
_cos_tbl
_create_driver_list
_current_palette
_current_palette_changed
_current_refresh_rate
_datafile_type
_default_ds
_default_font
_destroy_driver_list
_digi_driver_list
_digi_volume
_digmid_find_patches
_dispsw_status
_draw_listbox
_draw_scrollable_frame
_draw_textbox
_drawing_mode
_drawing_pattern
_drawing_x_anchor
_drawing_x_mask
_drawing_y_anchor
_drawing_y_mask
_driver_list_append_driver
_driver_list_append_list
_driver_list_prepend_driver
_dummy_adjust_patches
_dummy_key_on
_dummy_load_patches
_dummy_noop1
_dummy_noop2
_dummy_noop3
_fill_3d_edge_structure
_fill_3d_edge_structure_f
_find_utype
_fixup_loaded_bitmap
_font_vtable_color
_font_vtable_mono
_get_colorconv_blitter
_get_colorconv_map
_get_scanline_filler
_get_vtable
_getpixel
_getpixel15
_getpixel16
_getpixel24
_getpixel32
_gfx_bank
_gfx_driver_list
_gfx_mode_set_count
_got_prev_current_palette
_grow_scratch_mem
_gui_button_proc
_gui_ctext_proc
_gui_edit_proc
_gui_list_proc
_gui_shadow_box_proc
_gui_text_list_proc
_handle_key_press
_handle_key_release
_handle_listbox_click
_handle_mouse_input
_handle_pckey
_handle_scrollable_scroll
_handle_scrollable_scroll_click
_handle_timer_tick
_joy_type
_joystick_driver_list
_joystick_installed
_key
_key_accent1
_key_accent1_flag
_key_accent1_lower_table
_key_accent1_upper_table
_key_accent2
_key_accent2_flag
_key_accent2_lower_table
_key_accent2_upper_table
_key_accent3
_key_accent3_flag
_key_accent3_lower_table
_key_accent3_upper_table
_key_accent4
_key_accent4_flag
_key_accent4_lower_table
_key_accent4_upper_table
_key_altgr_lower_table
_key_altgr_upper_table
_key_ascii_table
_key_capslock_table
_key_control_table
_key_shift_table
_key_shifts
_key_standard_kb
_keyboard_driver_list
_keyboard_installed
_last_bank_1
_last_bank_2
_linear_blit16
_linear_blit24
_linear_blit32
_linear_blit8
_linear_blit_backward16
_linear_blit_backward24
_linear_blit_backward32
_linear_blit_backward8
_linear_clear_to_color16
_linear_clear_to_color24
_linear_clear_to_color32
_linear_clear_to_color8
_linear_draw_256_sprite16
_linear_draw_256_sprite24
_linear_draw_256_sprite32
_linear_draw_character16
_linear_draw_character24
_linear_draw_character32
_linear_draw_character8
_linear_draw_glyph16
_linear_draw_glyph24
_linear_draw_glyph32
_linear_draw_glyph8
_linear_draw_lit_rle_sprite15
_linear_draw_lit_rle_sprite16
_linear_draw_lit_rle_sprite24
_linear_draw_lit_rle_sprite32
_linear_draw_lit_rle_sprite8
_linear_draw_lit_sprite15
_linear_draw_lit_sprite16
_linear_draw_lit_sprite24
_linear_draw_lit_sprite32
_linear_draw_lit_sprite8
_linear_draw_rle_sprite15
_linear_draw_rle_sprite16
_linear_draw_rle_sprite24
_linear_draw_rle_sprite32
_linear_draw_rle_sprite8
_linear_draw_sprite16
_linear_draw_sprite24
_linear_draw_sprite32
_linear_draw_sprite8
_linear_draw_sprite_h_flip16
_linear_draw_sprite_h_flip24
_linear_draw_sprite_h_flip32
_linear_draw_sprite_h_flip8
_linear_draw_sprite_v_flip16
_linear_draw_sprite_v_flip24
_linear_draw_sprite_v_flip32
_linear_draw_sprite_v_flip8
_linear_draw_sprite_vh_flip16
_linear_draw_sprite_vh_flip24
_linear_draw_sprite_vh_flip32
_linear_draw_sprite_vh_flip8
_linear_draw_trans_rgba_rle_sprite15
_linear_draw_trans_rgba_rle_sprite16
_linear_draw_trans_rgba_rle_sprite24
_linear_draw_trans_rgba_sprite15
_linear_draw_trans_rgba_sprite16
_linear_draw_trans_rgba_sprite24
_linear_draw_trans_rle_sprite15
_linear_draw_trans_rle_sprite16
_linear_draw_trans_rle_sprite24
_linear_draw_trans_rle_sprite32
_linear_draw_trans_rle_sprite8
_linear_draw_trans_sprite15
_linear_draw_trans_sprite16
_linear_draw_trans_sprite24
_linear_draw_trans_sprite32
_linear_draw_trans_sprite8
_linear_getpixel16
_linear_getpixel24
_linear_getpixel32
_linear_getpixel8
_linear_hline15
_linear_hline16
_linear_hline24
_linear_hline32
_linear_hline8
_linear_masked_blit16
_linear_masked_blit24
_linear_masked_blit32
_linear_masked_blit8
_linear_putpixel15
_linear_putpixel16
_linear_putpixel24
_linear_putpixel32
_linear_putpixel8
_linear_vline15
_linear_vline16
_linear_vline24
_linear_vline32
_linear_vline8
_make_bitmap
_midi_allocate_voice
_midi_driver_list
_midi_none
_midi_tick
_midi_volume
_mix_some_samples
_mixer_exit
_mixer_get_frequency
_mixer_get_pan
_mixer_get_position
_mixer_get_volume
_mixer_init
_mixer_init_voice
_mixer_loop_voice
_mixer_ramp_volume
_mixer_release_voice
_mixer_set_echo
_mixer_set_frequency
_mixer_set_pan
_mixer_set_position
_mixer_set_tremolo
_mixer_set_vibrato
_mixer_set_volume
_mixer_start_voice
_mixer_stop_frequency_sweep
_mixer_stop_pan_sweep
_mixer_stop_voice
_mixer_stop_volume_ramp
_mixer_sweep_frequency
_mixer_sweep_pan
_mono_find_glyph
_mouse_b
_mouse_driver_list
_mouse_installed
_mouse_on
_mouse_pointer
_mouse_screen
_mouse_type
_mouse_x
_mouse_y
_mouse_z
_normal_line
_normal_rectfill
_optim_alternative_drawer
_pack_fdopen
_packfile_datasize
_packfile_filesize
_packfile_type
_palette_color15
_palette_color16
_palette_color24
_palette_color32
_palette_color8
_palette_expansion_table
_parallelogram_map
_parallelogram_map_standard
_pckey_scancode_to_ascii
_pckeys_init
_persp_xoffset
_persp_xoffset_f
_persp_xscale
_persp_xscale_f
_persp_yoffset
_persp_yoffset_f
_persp_yscale
_persp_yscale_f
_phys_voice
_pivot_scaled_sprite_flip
_poly_scanline_atex16
_poly_scanline_atex24
_poly_scanline_atex32
_poly_scanline_atex8
_poly_scanline_atex_lit15
_poly_scanline_atex_lit16
_poly_scanline_atex_lit24
_poly_scanline_atex_lit32
_poly_scanline_atex_lit8
_poly_scanline_atex_mask15
_poly_scanline_atex_mask16
_poly_scanline_atex_mask24
_poly_scanline_atex_mask32
_poly_scanline_atex_mask8
_poly_scanline_atex_mask_lit15
_poly_scanline_atex_mask_lit16
_poly_scanline_atex_mask_lit24
_poly_scanline_atex_mask_lit32
_poly_scanline_atex_mask_lit8
_poly_scanline_atex_mask_trans15
_poly_scanline_atex_mask_trans16
_poly_scanline_atex_mask_trans24
_poly_scanline_atex_mask_trans32
_poly_scanline_atex_mask_trans8
_poly_scanline_atex_trans15
_poly_scanline_atex_trans16
_poly_scanline_atex_trans24
_poly_scanline_atex_trans32
_poly_scanline_atex_trans8
_poly_scanline_dummy
_poly_scanline_gcol8
_poly_scanline_grgb15
_poly_scanline_grgb16
_poly_scanline_grgb24
_poly_scanline_grgb32
_poly_scanline_grgb8
_poly_scanline_ptex16
_poly_scanline_ptex24
_poly_scanline_ptex32
_poly_scanline_ptex8
_poly_scanline_ptex_lit15
_poly_scanline_ptex_lit16
_poly_scanline_ptex_lit24
_poly_scanline_ptex_lit32
_poly_scanline_ptex_lit8
_poly_scanline_ptex_mask15
_poly_scanline_ptex_mask16
_poly_scanline_ptex_mask24
_poly_scanline_ptex_mask32
_poly_scanline_ptex_mask8
_poly_scanline_ptex_mask_lit15
_poly_scanline_ptex_mask_lit16
_poly_scanline_ptex_mask_lit24
_poly_scanline_ptex_mask_lit32
_poly_scanline_ptex_mask_lit8
_poly_scanline_ptex_mask_trans15
_poly_scanline_ptex_mask_trans16
_poly_scanline_ptex_mask_trans24
_poly_scanline_ptex_mask_trans32
_poly_scanline_ptex_mask_trans8
_poly_scanline_ptex_trans15
_poly_scanline_ptex_trans16
_poly_scanline_ptex_trans24
_poly_scanline_ptex_trans32
_poly_scanline_ptex_trans8
_poly_zbuf_atex16
_poly_zbuf_atex24
_poly_zbuf_atex32
_poly_zbuf_atex8
_poly_zbuf_atex_lit15
_poly_zbuf_atex_lit16
_poly_zbuf_atex_lit24
_poly_zbuf_atex_lit32
_poly_zbuf_atex_lit8
_poly_zbuf_atex_mask15
_poly_zbuf_atex_mask16
_poly_zbuf_atex_mask24
_poly_zbuf_atex_mask32
_poly_zbuf_atex_mask8
_poly_zbuf_atex_mask_lit15
_poly_zbuf_atex_mask_lit16
_poly_zbuf_atex_mask_lit24
_poly_zbuf_atex_mask_lit32
_poly_zbuf_atex_mask_lit8
_poly_zbuf_atex_mask_trans15
_poly_zbuf_atex_mask_trans16
_poly_zbuf_atex_mask_trans24
_poly_zbuf_atex_mask_trans32
_poly_zbuf_atex_mask_trans8
_poly_zbuf_atex_trans15
_poly_zbuf_atex_trans16
_poly_zbuf_atex_trans24
_poly_zbuf_atex_trans32
_poly_zbuf_atex_trans8
_poly_zbuf_flat16
_poly_zbuf_flat24
_poly_zbuf_flat32
_poly_zbuf_flat8
_poly_zbuf_gcol8
_poly_zbuf_grgb15
_poly_zbuf_grgb16
_poly_zbuf_grgb24
_poly_zbuf_grgb32
_poly_zbuf_grgb8
_poly_zbuf_ptex16
_poly_zbuf_ptex24
_poly_zbuf_ptex32
_poly_zbuf_ptex8
_poly_zbuf_ptex_lit15
_poly_zbuf_ptex_lit16
_poly_zbuf_ptex_lit24
_poly_zbuf_ptex_lit32
_poly_zbuf_ptex_lit8
_poly_zbuf_ptex_mask15
_poly_zbuf_ptex_mask16
_poly_zbuf_ptex_mask24
_poly_zbuf_ptex_mask32
_poly_zbuf_ptex_mask8
_poly_zbuf_ptex_mask_lit15
_poly_zbuf_ptex_mask_lit16
_poly_zbuf_ptex_mask_lit24
_poly_zbuf_ptex_mask_lit32
_poly_zbuf_ptex_mask_lit8
_poly_zbuf_ptex_mask_trans15
_poly_zbuf_ptex_mask_trans16
_poly_zbuf_ptex_mask_trans24
_poly_zbuf_ptex_mask_trans32
_poly_zbuf_ptex_mask_trans8
_poly_zbuf_ptex_trans15
_poly_zbuf_ptex_trans16
_poly_zbuf_ptex_trans24
_poly_zbuf_ptex_trans32

Sections

.text
Size: 424KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExeConfig.ini
History of WinMUGEN.txt
ISTask.dll
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ExecConsoleAppX
KillTask
RunTask
SerialNumberDisk
SerialNumberHDD

Sections

CODE
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 167B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UninsFiles/ISTask.dll
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ExecConsoleAppX
KillTask
RunTask
SerialNumberDisk
SerialNumberHDD

Sections

CODE
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 167B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Winmugen_debug.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 492KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 287KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
about No limit winmugen.txt
cfg.ini
docs/readme.txt
docs/updates.txt
game.ico
mugen0.pcx
mugen1.pcx
mugenw.log
readme.txt
updates.txt
winmugen.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 492KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 287KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zlib.dll
.dll windows:4 windows x86 arch:x86

e5c5650f0b0c0414d7e983aacdedc6c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crtdll

fwrite
fread
_errno
fclose
free
vsprintf
fflush
fseek
rewind
fputc
malloc
ftell
fprintf
_fdopen
fopen
sprintf
calloc
_initterm

kernel32

GlobalAlloc
GetVersion
GlobalFree

Exports

Exports

adler32
compress
compress2
crc32
deflate
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflateReset
deflateSetDictionary
get_crc_table
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzwrite
inflate
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGetGlobalComment
unzGetGlobalInfo
unzGetLocalExtrafield
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpen
unzOpen2
unzOpenCurrentFile
unzOpenCurrentFile2
unzReadCurrentFile
unzStringFileNameCompare
unzeof
unztell
zError
zipClose
zipCloseFileInZip
zipCloseFileInZipRaw
zipOpen
zipOpenNewFileInZip
zipOpenNewFileInZip2
zipWriteInFileInZip
zlibVersion

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
б.txt
ʼϷ.exe
.exe windows:4 windows x86 arch:x86

db14222dff4ad9d88d8e8a3d01d8328c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Apps\release\GameLoginTool.pdb

Imports

gdiplus

GdipLoadImageFromStream
GdipCreateFont
GdipDeletePen
GdipCreatePen1
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipFree
GdipDeleteGraphics
GdipCloneBrush
GdipCreateFromHDC
GdipAlloc
GdipDeleteBrush
GdiplusShutdown
GdiplusStartup
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreatePath
GdipDeletePath
GdipGetFamily
GdipAddPathString
GdipGetFontSize
GdipGetFontStyle
GdipCloneImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipImageSelectActiveFrame
GdipSetTextRenderingHint
GdipAddPathArcI
GdipClosePathFigure
GdipSetPageUnit
GdipSetPenMode
GdipDrawPath
GdipFillPath
GdipReleaseDC
GdipDrawLineI
GdipDrawString
GdipCreateSolidFill
GdipDrawImageRectRectI
GdipDrawImageI
GdipGetImageWidth
GdipFillRectangleI
GdipGetImageHeight
GdipGetPathWorldBounds
GdipDisposeImage
GdipResetPath
GdipDeleteFont

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetOpenUrlW
InternetSetFilePointer
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetQueryDataAvailable
InternetCrackUrlW
InternetWriteFile
InternetSetStatusCallbackW
InternetGetLastResponseInfoW

kernel32

CopyFileW
GetDriveTypeW
CreateDirectoryW
GetFileAttributesW
GetTickCount
FindFirstFileW
FindNextFileW
FindClose
GetCurrentThreadId
ResumeThread
GetVersion
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetSystemInfo
LocalFree
LocalAlloc
SetEndOfFile
GetFileTime
ReadFile
SetFileTime
WriteFile
SetFilePointer
GetFileInformationByHandle
GetFileSizeEx
DeviceIoControl
GetFullPathNameW
GetLongPathNameW
MoveFileW
MoveFileExW
SetCurrentDirectoryW
GetWindowsDirectoryW
CreateEventW
SetEvent
ResetEvent
TerminateProcess
GetExitCodeProcess
SuspendThread
GetCurrentProcess
SetErrorMode
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVolumeInformationW
GetDiskFreeSpaceW
InterlockedExchange
InterlockedIncrement
RemoveDirectoryW
CreateThread
TerminateThread
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreW
TlsFree
GetProcessHeap
HeapAlloc
CreateEventA
HeapFree
GetOverlappedResult
LoadLibraryA
WriteFileGather
SetFilePointerEx
ReadFileScatter
CreateFileA
GetQueuedCompletionStatus
CreateWaitableTimerW
InterlockedCompareExchange
TlsSetValue
InterlockedExchangeAdd
PostQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetSystemTimeAsFileTime
QueueUserAPC
SleepEx
TlsGetValue
SetWaitableTimer
TlsAlloc
CreateIoCompletionPort
SetLastError
GetModuleHandleA
CancelIo
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GlobalMemoryStatusEx
VirtualUnlock
VirtualLock
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
MulDiv
GetThreadLocale
SystemTimeToFileTime
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
GlobalReAlloc
GlobalHandle
LocalReAlloc
FileTimeToLocalFileTime
GlobalFlags
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
RtlUnwind
RaiseException
ExitProcess
HeapSize
SetStdHandle
GetFileType
VirtualProtect
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetCurrentDirectoryA
GetDriveTypeA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
SetFileAttributesW
GetModuleHandleW
WaitForMultipleObjects
GetCurrentDirectoryW
GetVersionExW
ExitThread
CreateMutexW
FormatMessageW
GetLastError
GetACP
CompareStringW
lstrlenW
lstrlenA
FileTimeToSystemTime
lstrcpyW
GlobalFree
OpenProcess
Sleep
DeleteFileW
WaitForSingleObject
CloseHandle
WritePrivateProfileStringW
GetLocalTime
GetFileSize
CreateFileW
LockResource
MultiByteToWideChar
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetCommandLineW
CreateProcessW
GetTempFileNameW
GetTempPathW
GlobalLock
GlobalAlloc
LoadResource
SizeofResource
FindResourceW
WideCharToMultiByte
FreeResource
GlobalUnlock
LoadLibraryW
GetProcAddress
FreeLibrary
OpenEventA
CreateWaitableTimerA
FormatMessageA
InterlockedDecrement

user32

IsDialogMessageW
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CharNextW
MapDialogRect
SetWindowContextHelpId
CopyAcceleratorTableW
IsRectEmpty
SetRect
InvalidateRgn
SetCapture
ReleaseCapture
PostQuitMessage
ValidateRect
GetMessageW
SetCursor
GetNextDlgGroupItem
MessageBeep
DestroyMenu
GetSysColorBrush
LoadCursorW
UnregisterClassW
RegisterClipboardFormatW
CharUpperW
PostThreadMessageW
GetClassLongW
EndPaint
IntersectRect
SystemParametersInfoA
GetWindowPlacement
IsWindowVisible
GetWindowThreadProcessId
GetWindow
GetWindowTextW
SetWindowTextW
SetWindowPos
GetForegroundWindow
GetActiveWindow
GetDlgItem
ShowWindow
SendMessageTimeoutW
GetDC
LoadIconW
DrawIcon
GetSystemMetrics
GetSystemMenu
TranslateMessage
DispatchMessageW
IsIconic
ReleaseDC
LoadImageW
PeekMessageW
SetWindowRgn
MoveWindow
CreatePopupMenu
SetWindowLongW
GetWindowLongW
AppendMenuW
SetForegroundWindow
GetCursorPos
GetParent
RegisterWindowMessageW
PostMessageW
IsWindow
SendMessageW
SystemParametersInfoW
GetClientRect
InvalidateRect
PtInRect
SetTimer
EnableWindow
KillTimer
GetWindowRect
GetDesktopWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
SendDlgItemMessageW
SendDlgItemMessageA
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetLastActivePopup
SetActiveWindow
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
TrackPopupMenu
GetKeyState
UpdateWindow
GetMenu
GetSubMenu
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
MapWindowPoints
CallNextHookEx
GetMenuItemID
GetMenuItemCount
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
GetDlgCtrlID
DefWindowProcW
UnregisterClassA
CallWindowProcW
OffsetRect

gdi32

SelectObject
GetRgnBox
GetTextColor
GetBkColor
GetDeviceCaps
GetStockObject
GetMapMode
CreateBitmap
ExtSelectClipRgn
CreateCompatibleBitmap
CreateCompatibleDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
DeleteObject
DeleteDC
CreateDIBSection
CreateRoundRectRgn
CreateRectRgnIndirect
CombineRgn
GetClipBox
SetTextColor
SetBkColor
GetObjectW
SaveDC
RestoreDC
SetMapMode
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
BitBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegQueryValueW
RegEnumKeyW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW

shell32

ShellExecuteW
Shell_NotifyIconW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetFileInfoW
CommandLineToArgvW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathStripToRootW
UrlUnescapeW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromGUID2
CreateStreamOnHGlobal

oleaut32

OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
VariantChangeType
SysAllocStringLen
SysStringLen
SysFreeString
VariantInit
SysAllocString
VariantClear

ws2_32

getsockname
bind
htonl
WSASocketW
__WSAFDIsSet
getservbyname
ntohs
WSASetLastError
getsockopt
accept
WSAIoctl
getpeername
WSAStringToAddressA
WSARecvFrom
WSASendTo
ntohl
listen
ioctlsocket
WSAAddressToStringA
WSARecv
WSASend
connect
inet_ntoa
WSAStartup
inet_addr
select
WSAGetLastError
htons
setsockopt
WSACleanup
recv
socket
closesocket
gethostbyname
send

mswsock

GetAcceptExSockaddrs
AcceptEx

Exports

Exports

DecodeFile

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 312KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 808KB - Virtual size: 807KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 176KB

.rsrc Size: 6KB - Virtual size: 6KB

0ece15e7d9bb35972aec701f46192460

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 503B

.data Size: 512B - Virtual size: 128B

.reloc Size: 512B - Virtual size: 220B

9cb11d0d4bed69c64ae8d0549b4ce4ce

Headers

File Characteristics

PDB Paths

Imports

shlwapi

wininet

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 440KB - Virtual size: 436KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 12KB - Virtual size: 28KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 17KB

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 25KB

.reloc Size: 1024B - Virtual size: 836B

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 176KB

.rsrc
Size: 6KB - Virtual size: 6KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 503B

.data
Size: 512B - Virtual size: 128B

.reloc
Size: 512B - Virtual size: 220B

.text
Size: 440KB - Virtual size: 436KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 12KB - Virtual size: 28KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 17KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 836B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 6KB

.reloc
Size: 1024B - Virtual size: 848B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B

UPX0
Size: - Virtual size: 44KB

UPX1
Size: 19KB - Virtual size: 20KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 28KB - Virtual size: 28KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 73B

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.text
Size: 89KB - Virtual size: 89KB

.rdata
Size: 16KB - Virtual size: 15KB