Overview
overview
10Static
static
3FileApp.exe
windows7-x64
10FileApp.exe
windows10-2004-x64
7mi/CbsCore.dll
windows10-2004-x64
3mi/libglib-2.0-0.dll
windows7-x64
3mi/libglib-2.0-0.dll
windows10-2004-x64
3mi/meshsystem.dll
windows7-x64
1mi/meshsystem.dll
windows10-2004-x64
1mi/tmp/Pre...re.dll
windows7-x64
3mi/tmp/Pre...re.dll
windows10-2004-x64
3mi/tmp/cmi...rt.dll
windows10-2004-x64
3mi/tmp/msc...ks.dll
windows7-x64
3mi/tmp/msc...ks.dll
windows10-2004-x64
3mi/tmp/upd...nt.dll
windows10-2004-x64
3mi/wcp.dll
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
FileApp.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
FileApp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
mi/CbsCore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
mi/libglib-2.0-0.dll
Resource
win7-20240705-en
Behavioral task
behavioral5
Sample
mi/libglib-2.0-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
mi/meshsystem.dll
Resource
win7-20240704-en
Behavioral task
behavioral7
Sample
mi/meshsystem.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
mi/tmp/PresentationCore.dll
Resource
win7-20240704-en
Behavioral task
behavioral9
Sample
mi/tmp/PresentationCore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
mi/tmp/cmiaisupport.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
mi/tmp/mscordacwks.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
mi/tmp/mscordacwks.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
mi/tmp/updateagent.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
mi/wcp.dll
Resource
win10v2004-20240802-en
General
-
Target
archi743.7z
-
Size
7.7MB
-
MD5
59f4f9ea8bf1a099b379a618d5d4ba79
-
SHA1
0a7bbf4afbbffe733faad435b18426f57e759696
-
SHA256
22c87c01fb31d7ae241eeaa7d560e3c063ba68bfdd519533927929a66f618c9c
-
SHA512
6a04aaa1c26d1129bd14d9e366ab027f397ea041a09ffcd0ac34e347f6b761aa3c157d992883b918882ef6eafcc58ad653ce254b333077774b8d10a6219621a6
-
SSDEEP
196608:j0ZE4drEta86a1CThRAQ2tflMWXclhvv8Ye6aYII4tEGfYX:A1dr0uhRAntVXcnXbGtEGfI
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/mi/libglib-2.0-0.dll unpack001/mi/tmp/PresentationCore.dll
Files
-
archi743.7z.7z
Password: 1234
-
FileApp.exe.exe windows:5 windows x86 arch:x86
Password: 1234
be41bf7b8cc010b614bd36bbca606973
Code Sign
16:0a:dc:a6:df:5a:e6:8d:43:8c:df:81:b2:10:0a:efCertificate
IssuerCN=434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇsNot Before28-08-2024 02:49Not After29-08-2034 02:49SubjectCN=434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs434qq90029ɟǝɐ0ɟ424219ǝ5ɔ9ɟ5ɔ717405ɐ8qɟ7349ɟ85ɟ9ɐ6ɐɐ92986ɟp54ɟ7ǝ0 - 652ⱯHS ɹı̣ɐdǝꓤ-ǝsɐqɐʇɐꓷ-ꓶÒSʎW-uosʎɹⱯ79234326ǝƃɐɯı̣-ʇǝs-uƃı̣sǝp-suƃı̣sǝp-ɹǝʌoɔ-ʎɐɹ-nןq-pʌp-pɔ-snoı̣ɹɐʌ-uoı̣ʇɐɹʇsnןןı̣-ʞɔoʇs3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate
IssuerCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBNot Before15-01-2024 00:00Not After14-04-2035 23:59SubjectCN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate
IssuerCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBNot Before22-03-2021 00:00Not After21-03-2036 23:59SubjectCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before22-03-2021 00:00Not After18-01-2038 23:59SubjectCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
2a:43:96:2d:ed:6c:79:06:17:4a:c1:07:71:d4:a0:f2:7d:f0:25:c1:12:0c:9a:87:a7:f1:b8:29:92:e7:0b:7eSigner
Actual PE Digest2a:43:96:2d:ed:6c:79:06:17:4a:c1:07:71:d4:a0:f2:7d:f0:25:c1:12:0c:9a:87:a7:f1:b8:29:92:e7:0b:7eDigest Algorithmsha256PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 516KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 389KB - Virtual size: 389KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mi/CbsCore.dll.dll windows:10 windows x86 arch:x86
Password: 1234
3dc39c0b781a598f93b4c0dd61011ffc
Code Sign
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate
IssuerCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16-11-2023 19:20Not After14-11-2024 19:20SubjectCN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:07:76:56:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before19-10-2011 18:41Not After19-10-2026 18:51SubjectCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
2c:f8:72:5f:50:e8:27:d6:e9:77:f4:62:a1:76:e7:90:ee:82:4a:b1:d2:59:74:f2:c3:e9:1c:c9:47:8c:ce:51Signer
Actual PE Digest2c:f8:72:5f:50:e8:27:d6:e9:77:f4:62:a1:76:e7:90:ee:82:4a:b1:d2:59:74:f2:c3:e9:1c:c9:47:8c:ce:51Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
cbscore.pdb
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__strnicmp
_o__ui64tow_s
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o__wtol
memmove
_o_free
_o_isdigit
_o_isspace
_o_malloc
_o_memcpy_s
_o_strncpy_s
_o_strtol
_o_toupper
_o_towlower
_o_wcscat_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstoul
_o_wmemcpy_s
wcsstr
wcsrchr
wcschr
_except_handler4_common
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o__execute_onexit_table
_o__errno
__CxxFrameHandler3
strrchr
strchr
strstr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strncmp
wcsnlen
wcsncmp
memset
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleExW
LoadLibraryExA
LoadStringW
GetProcAddress
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
FreeLibrary
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
WaitForMultipleObjectsEx
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
CreateSemaphoreExW
TryEnterCriticalSection
InitializeCriticalSection
OpenEventW
ReleaseMutex
CreateEventW
ReleaseSRWLockExclusive
CreateMutexW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
SetEvent
ResetEvent
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockShared
OpenSemaphoreW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegSetKeySecurity
RegQueryInfoKeyW
RegDeleteValueW
RegUnLoadKeyW
RegCreateKeyExW
RegSaveKeyExW
RegRestoreKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegFlushKey
RegLoadKeyW
RegOpenKeyExW
RegGetKeySecurity
api-ms-win-core-localization-obsolete-l1-2-0
EnumUILanguagesW
CompareStringA
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
ExpandEnvironmentStringsW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-file-l1-1-0
SetFileInformationByHandle
CreateFileW
GetFileAttributesExW
FindClose
GetFileAttributesW
DeleteFileW
GetFileInformationByHandle
SetEndOfFile
SetFilePointer
GetVolumePathNameW
FindNextFileW
GetFinalPathNameByHandleW
GetFileTime
FindFirstFileW
CompareFileTime
GetFileSize
FlushFileBuffers
SetFileTime
GetFullPathNameW
GetFileSizeEx
GetDiskFreeSpaceExW
ReadFile
CreateDirectoryW
SetFileAttributesW
WriteFile
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
SetThreadToken
GetCurrentThreadId
OpenThreadToken
GetThreadPriority
TlsSetValue
OpenProcessToken
GetCurrentThread
CreateProcessW
CreateThread
SetThreadPriority
GetExitCodeProcess
InitializeProcThreadAttributeList
ResumeThread
UpdateProcThreadAttribute
TlsAlloc
GetExitCodeThread
TlsGetValue
TlsFree
GetCurrentProcess
DeleteProcThreadAttributeList
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
GetThreadPreferredUILanguages
LocaleNameToLCID
FormatMessageW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemInfo
GetTickCount64
GetTickCount
GetSystemTime
GetWindowsDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-registry-l2-1-0
RegOpenKeyTransactedW
RegDeleteKeyW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
api-ms-win-security-base-l1-1-0
GetKernelObjectSecurity
ImpersonateSelf
GetAclInformation
SetSecurityDescriptorDacl
GetAce
CreateRestrictedToken
DuplicateToken
InitializeSecurityDescriptor
GetTokenInformation
GetLengthSid
IsValidSid
CopySid
RevertToSelf
SetFileSecurityW
AdjustTokenPrivileges
DuplicateTokenEx
IsValidAcl
AddAccessAllowedAceEx
IsValidSecurityDescriptor
DestroyPrivateObjectSecurity
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorControl
CreatePrivateObjectSecurityWithMultipleInheritance
InitializeAcl
CheckTokenMembership
FreeSid
AddAce
AllocateAndInitializeSid
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-security-sddl-l1-1-0
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
api-ms-win-core-com-l1-1-0
CoGetCallContext
CoGetMalloc
StringFromCLSID
CoImpersonateClient
CLSIDFromString
CoRevertToSelf
CoTaskMemAlloc
CoUnmarshalInterface
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
CreateStreamOnHGlobal
StringFromGUID2
CoCreateGuid
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
RaiseFailFastException
LoadLibraryW
CopyFileW
api-ms-win-core-file-l2-1-0
CreateHardLinkW
GetFileInformationByHandleEx
MoveFileExW
CopyFileExW
api-ms-win-eventing-provider-l1-1-0
EventWrite
EventRegister
EventUnregister
EventProviderEnabled
EventWriteTransfer
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-kernel32-private-l1-1-1
PrivCopyFileExW
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
GetNamedSecurityInfoW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpA
lstrcmpW
api-ms-win-eventing-legacy-l1-1-0
FlushTraceW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
api-ms-win-core-memory-l1-1-0
VirtualQueryEx
UnmapViewOfFile
ReadProcessMemory
WriteProcessMemory
CreateFileMappingW
MapViewOfFile
api-ms-win-security-cryptoapi-l1-1-0
CryptReleaseContext
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileStringW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-core-file-l1-2-1
GetCompressedFileSizeW
ntdll
RtlGetCurrentTransaction
NtDeleteValueKey
RtlAddAce
NtQueryAttributesFile
NtFlushBuffersFile
NtDuplicateObject
NtFsControlFile
NtYieldExecution
NtOpenThreadToken
RtlCreateAcl
NtCreateKey
NtOpenKeyTransactedEx
NtQueryVolumeInformationFile
RtlCreateSecurityDescriptor
RtlDestroyEnvironment
NtQueryDirectoryFile
NtQuerySecurityObject
NtSetValueKey
RtlGetDaclSecurityDescriptor
RtlDeleteSecurityObject
RtlCopyUnicodeString
RtlDuplicateUnicodeString
RtlAppendUnicodeStringToString
RtlEqualUnicodeString
RtlLengthSecurityDescriptor
RtlGetControlSecurityDescriptor
RtlMakeSelfRelativeSD
RtlSetEnvironmentVariable
RtlCreateEnvironment
RtlpApplyLengthFunction
RtlEnterCriticalSection
RtlDestroyHeap
RtlLeaveCriticalSection
NtQuerySystemTime
RtlSetControlSecurityDescriptor
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
RtlIsTextUnicode
RtlUnicodeToMultiByteSize
RtlConvertSidToUnicodeString
RtlValidAcl
NtAdjustPrivilegesToken
RtlSetSaclSecurityDescriptor
RtlValidSid
NtDuplicateToken
RtlGetSaclSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlAllocateAndInitializeSid
RtlGetGroupSecurityDescriptor
RtlCopySid
RtlSetGroupSecurityDescriptor
RtlFindAceByType
NtQueryInformationToken
NtDelayExecution
RtlQueryEnvironmentVariable_U
RtlExpandEnvironmentStrings_U
NtQueryLicenseValue
RtlNtStatusToDosErrorNoTeb
RtlTimeToTimeFields
LdrGetDllHandle
DbgPrint
RtlCreateUnicodeStringFromAsciiz
RtlRunOnceComplete
RtlRunOnceBeginInitialize
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryPerformanceCounter
RtlGetAce
NtOpenKeyEx
RtlSetDaclSecurityDescriptor
NtEnumerateValueKey
NtWriteFile
RtlGetLengthWithoutLastFullDosOrNtPathElement
NtEnumerateKey
RtlSetCurrentTransaction
RtlSetOwnerSecurityDescriptor
NtOpenProcessToken
NtDeleteKey
NtQueryKey
RtlReAllocateHeap
RtlUpcaseUnicodeChar
RtlDowncaseUnicodeChar
DbgPrintEx
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
NtWaitForSingleObject
NtQueryEaFile
RtlReleaseRelativeName
NtSetEaFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtLoadKey2
NtOpenFile
NtReadFile
NtSetSecurityObject
NtDeleteFile
RtlNewSecurityObjectEx
NtCreateKeyTransacted
RtlAddAccessAllowedAceEx
NtSetInformationFile
RtlCreateEnvironmentEx
RtlQueryInformationAcl
NtClose
NtQueryInformationProcess
NtQueryOpenSubKeysEx
RtlInitUnicodeString
NtQueryObject
NtSetInformationThread
NtQueryInformationThread
NtCreateTransaction
NtRollbackTransaction
RtlInitUnicodeStringEx
NtQueryInformationTransaction
NtCommitTransaction
RtlDosPathNameToNtPathName_U
NtQueryInformationFile
RtlFreeHeap
NtCreateFile
RtlAllocateHeap
RtlLengthSid
NtOpenKey
NtQueryValueKey
LdrGetProcedureAddress
LdrUnloadDll
LdrLoadDll
RtlNtStatusToDosError
RtlDestroyProcessParameters
RtlCreateHeap
RtlCreateProcessParameters
RtlCreateUserProcess
NtResumeThread
RtlFreeSid
NtUnloadKey2
RtlDeleteCriticalSection
RtlTimeToSecondsSince1980
RtlRaiseStatus
RtlInitializeCriticalSection
userenv
GetProfilesDirectoryW
rpcrt4
UuidCreate
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
crypt32
CryptMsgUpdate
CertGetSubjectCertificateFromStore
CertVerifyCertificateChainPolicy
CertOpenStore
CertFreeCertificateChain
CryptHashCertificate2
CertCreateCTLContext
CryptDecodeObject
CertFreeCTLContext
CertCreateContext
CryptStringToBinaryW
CertAddStoreToCollection
CertAddEncodedCertificateToStore
CryptMsgClose
CertGetEnhancedKeyUsage
CertCloseStore
CertGetCertificateChain
CertFreeCertificateContext
CryptMsgGetAndVerifySigner
CertFindSubjectInCTL
CryptMsgOpenToDecode
CryptMsgGetParam
bcrypt
BCryptDestroyHash
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptFinishHash
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperGetProvSignerFromChain
Exports
Exports
CbsCoreEnsureNoStartupProcessing
CbsCoreFinalize
CbsCoreFinalizeShutdownProcessing
CbsCoreGetActiveOfflineSession
CbsCoreInitialize
CbsCoreInitializeDelayedPortion
CbsCoreIsExecutionEngineIdle
CbsCoreLoadComponentStore
CbsCorePrepareShutdownProcessing
CbsCoreServiceIdleProcessing
CbsCoreSetCustomLogging
CbsCoreSetState
CbsCoreShutdownProcessing
CbsCoreStartupProcessing
CbsCoreStopIdleProcessing
CbsCreateSessionNotify
CbsCreateSessionNotifyFinalize
CbsCreateSessionNotifyInitialize
CbsSetCbsCorePathInOfflineImage
SetRebootInProgressFlag
SetTestMode
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mi/libglib-2.0-0.dll.dll windows:4 windows x86 arch:x86
Password: 1234
98e80099e37838257540063ca7ab737d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
intl
libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_dcgettext
libintl_dgettext
libintl_dngettext
libintl_fprintf
libintl_gettext
libintl_sprintf
libintl_textdomain
advapi32
GetUserNameW
kernel32
CloseHandle
CreateEventA
CreateFileMappingA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfoExA
GetComputerNameA
GetConsoleCursorInfo
GetCurrentDirectoryW
GetCurrentProcess
GetDateFormatW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetShortPathNameW
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadLocale
GetTimeFormatW
GetTimeZoneInformation
GetVersion
GetWindowsDirectoryW
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
IsDebuggerPresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFile
MoveFileExW
MultiByteToWideChar
PeekConsoleInputA
PeekNamedPipe
ReadConsoleInputA
ReadFile
ReleaseSemaphore
ResetEvent
SetEnvironmentVariableW
SetEvent
Sleep
SleepEx
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjectsEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
_close
_fdopen
_getpid
_lseek
_open
_read
_write
__dllonexit
__mb_cur_max
_beginthreadex
_chsize
_errno
_exit
_findclose
_fstati64
_get_osfhandle
_iob
_isctype
_kbhit
_open_osfhandle
_osver
_pctype
_pipe
_stricmp
_strnicmp
_waccess
_wchdir
_wchmod
_wcreat
_wfindfirst
_wfindnext
_wfopen
_wfreopen
_wfullpath
_winmajor
_wmkdir
_wopen
_wputenv
_wremove
_wrmdir
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wstat
_wunlink
_wutime
abort
atoi
atol
bsearch
calloc
exit
fclose
fflush
fprintf
fputc
fputs
fread
free
fwrite
getenv
gmtime
localeconv
localtime
malloc
memchr
memcmp
memcpy
memmove
mktime
printf
qsort
realloc
setlocale
sprintf
strchr
strcmp
strcoll
strcpy
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
strxfrm
time
tolower
toupper
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsrchr
ole32
CoTaskMemFree
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
user32
IsWindow
MessageBoxA
MsgWaitForMultipleObjectsEx
PeekMessageA
PostMessageA
ws2_32
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASetEvent
closesocket
getsockopt
ioctlsocket
recv
send
Exports
Exports
_g_debug_flags
_g_debug_initialized
g_access
g_allocator_free
g_allocator_new
g_array_append_vals
g_array_free
g_array_get_element_size
g_array_insert_vals
g_array_new
g_array_prepend_vals
g_array_ref
g_array_remove_index
g_array_remove_index_fast
g_array_remove_range
g_array_set_size
g_array_sized_new
g_array_sort
g_array_sort_with_data
g_array_unref
g_ascii_digit_value
g_ascii_dtostr
g_ascii_formatd
g_ascii_strcasecmp
g_ascii_strdown
g_ascii_strncasecmp
g_ascii_strtod
g_ascii_strtoll
g_ascii_strtoull
g_ascii_strup
g_ascii_table
g_ascii_tolower
g_ascii_toupper
g_ascii_xdigit_value
g_assert_warning
g_assertion_message
g_assertion_message_cmpnum
g_assertion_message_cmpstr
g_assertion_message_error
g_assertion_message_expr
g_async_queue_length
g_async_queue_length_unlocked
g_async_queue_lock
g_async_queue_new
g_async_queue_new_full
g_async_queue_pop
g_async_queue_pop_unlocked
g_async_queue_push
g_async_queue_push_sorted
g_async_queue_push_sorted_unlocked
g_async_queue_push_unlocked
g_async_queue_ref
g_async_queue_ref_unlocked
g_async_queue_sort
g_async_queue_sort_unlocked
g_async_queue_timed_pop
g_async_queue_timed_pop_unlocked
g_async_queue_try_pop
g_async_queue_try_pop_unlocked
g_async_queue_unlock
g_async_queue_unref
g_async_queue_unref_and_unlock
g_atexit
g_atomic_int_add
g_atomic_int_compare_and_exchange
g_atomic_int_exchange_and_add
g_atomic_int_get
g_atomic_int_set
g_atomic_pointer_compare_and_exchange
g_atomic_pointer_get
g_atomic_pointer_set
g_base64_decode
g_base64_decode_inplace
g_base64_decode_step
g_base64_encode
g_base64_encode_close
g_base64_encode_step
g_basename
g_bit_lock
g_bit_nth_lsf
g_bit_nth_msf
g_bit_storage
g_bit_trylock
g_bit_unlock
g_blow_chunks
g_bookmark_file_add_application
g_bookmark_file_add_group
g_bookmark_file_error_quark
g_bookmark_file_free
g_bookmark_file_get_added
g_bookmark_file_get_app_info
g_bookmark_file_get_applications
g_bookmark_file_get_description
g_bookmark_file_get_groups
g_bookmark_file_get_icon
g_bookmark_file_get_is_private
g_bookmark_file_get_mime_type
g_bookmark_file_get_modified
g_bookmark_file_get_size
g_bookmark_file_get_title
g_bookmark_file_get_uris
g_bookmark_file_get_visited
g_bookmark_file_has_application
g_bookmark_file_has_group
g_bookmark_file_has_item
g_bookmark_file_load_from_data
g_bookmark_file_load_from_data_dirs
g_bookmark_file_load_from_file
g_bookmark_file_move_item
g_bookmark_file_new
g_bookmark_file_remove_application
g_bookmark_file_remove_group
g_bookmark_file_remove_item
g_bookmark_file_set_added
g_bookmark_file_set_app_info
g_bookmark_file_set_description
g_bookmark_file_set_groups
g_bookmark_file_set_icon
g_bookmark_file_set_is_private
g_bookmark_file_set_mime_type
g_bookmark_file_set_modified
g_bookmark_file_set_title
g_bookmark_file_set_visited
g_bookmark_file_to_data
g_bookmark_file_to_file
g_build_filename
g_build_filenamev
g_build_path
g_build_pathv
g_byte_array_append
g_byte_array_free
g_byte_array_new
g_byte_array_prepend
g_byte_array_ref
g_byte_array_remove_index
g_byte_array_remove_index_fast
g_byte_array_remove_range
g_byte_array_set_size
g_byte_array_sized_new
g_byte_array_sort
g_byte_array_sort_with_data
g_byte_array_unref
g_cache_destroy
g_cache_insert
g_cache_key_foreach
g_cache_new
g_cache_remove
g_cache_value_foreach
g_chdir
g_checksum_copy
g_checksum_free
g_checksum_get_digest
g_checksum_get_string
g_checksum_new
g_checksum_reset
g_checksum_type_get_length
g_checksum_update
g_child_watch_add
g_child_watch_add_full
g_child_watch_funcs
g_child_watch_source_new
g_chmod
g_clear_error
g_completion_add_items
g_completion_clear_items
g_completion_complete
g_completion_complete_utf8
g_completion_free
g_completion_new
g_completion_remove_items
g_completion_set_compare
g_compute_checksum_for_data
g_compute_checksum_for_string
g_convert
g_convert_error_quark
g_convert_with_fallback
g_convert_with_iconv
g_creat
g_datalist_clear
g_datalist_foreach
g_datalist_get_flags
g_datalist_id_get_data
g_datalist_id_remove_no_notify
g_datalist_id_set_data_full
g_datalist_init
g_datalist_set_flags
g_datalist_unset_flags
g_dataset_destroy
g_dataset_foreach
g_dataset_id_get_data
g_dataset_id_remove_no_notify
g_dataset_id_set_data_full
g_date_add_days
g_date_add_months
g_date_add_years
g_date_clamp
g_date_clear
g_date_compare
g_date_days_between
g_date_free
g_date_get_day
g_date_get_day_of_year
g_date_get_days_in_month
g_date_get_iso8601_week_of_year
g_date_get_julian
g_date_get_monday_week_of_year
g_date_get_monday_weeks_in_year
g_date_get_month
g_date_get_sunday_week_of_year
g_date_get_sunday_weeks_in_year
g_date_get_weekday
g_date_get_year
g_date_is_first_of_month
g_date_is_last_of_month
g_date_is_leap_year
g_date_new
g_date_new_dmy
g_date_new_julian
g_date_order
g_date_set_day
g_date_set_dmy
g_date_set_julian
g_date_set_month
g_date_set_parse
g_date_set_time
g_date_set_time_t
g_date_set_time_val
g_date_set_year
g_date_strftime
g_date_subtract_days
g_date_subtract_months
g_date_subtract_years
g_date_time_add
g_date_time_add_days
g_date_time_add_full
g_date_time_add_hours
g_date_time_add_minutes
g_date_time_add_months
g_date_time_add_seconds
g_date_time_add_weeks
g_date_time_add_years
g_date_time_compare
g_date_time_difference
g_date_time_equal
g_date_time_format
g_date_time_get_day_of_month
g_date_time_get_day_of_week
g_date_time_get_day_of_year
g_date_time_get_hour
g_date_time_get_microsecond
g_date_time_get_minute
g_date_time_get_month
g_date_time_get_second
g_date_time_get_seconds
g_date_time_get_timezone_abbreviation
g_date_time_get_utc_offset
g_date_time_get_week_numbering_year
g_date_time_get_week_of_year
g_date_time_get_year
g_date_time_get_ymd
g_date_time_hash
g_date_time_is_daylight_savings
g_date_time_new
g_date_time_new_from_timeval_local
g_date_time_new_from_timeval_utc
g_date_time_new_from_unix_local
g_date_time_new_from_unix_utc
g_date_time_new_local
g_date_time_new_now
g_date_time_new_now_local
g_date_time_new_now_utc
g_date_time_new_utc
g_date_time_ref
g_date_time_to_local
g_date_time_to_timeval
g_date_time_to_timezone
g_date_time_to_unix
g_date_time_to_utc
g_date_time_unref
g_date_to_struct_tm
g_date_valid
g_date_valid_day
g_date_valid_dmy
g_date_valid_julian
g_date_valid_month
g_date_valid_weekday
g_date_valid_year
g_dcgettext
g_dgettext
g_dir_close
g_dir_open
g_dir_open_utf8
g_dir_read_name
g_dir_read_name_utf8
g_dir_rewind
g_direct_equal
g_direct_hash
g_dngettext
g_double_equal
g_double_hash
g_dpgettext
g_dpgettext2
g_error_copy
g_error_free
g_error_matches
g_error_new
g_error_new_literal
g_error_new_valist
g_file_error_from_errno
g_file_error_quark
g_file_get_contents
g_file_get_contents_utf8
g_file_open_tmp
g_file_open_tmp_utf8
g_file_read_link
g_file_set_contents
g_file_test
g_file_test_utf8
g_filename_display_basename
g_filename_display_name
g_filename_from_uri
g_filename_from_uri_utf8
g_filename_from_utf8
g_filename_from_utf8_utf8
g_filename_to_uri
g_filename_to_uri_utf8
g_filename_to_utf8
g_filename_to_utf8_utf8
g_find_program_in_path
g_find_program_in_path_utf8
g_fopen
g_format_size_for_display
g_fprintf
g_free
g_freopen
g_get_application_name
g_get_charset
g_get_codeset
g_get_current_dir
g_get_current_dir_utf8
g_get_current_time
g_get_environ
g_get_filename_charsets
g_get_home_dir
g_get_home_dir_utf8
g_get_host_name
g_get_language_names
g_get_locale_variants
g_get_monotonic_time
g_get_prgname
g_get_real_name
g_get_real_name_utf8
g_get_real_time
g_get_system_config_dirs
g_get_system_data_dirs
g_get_tmp_dir
g_get_tmp_dir_utf8
g_get_user_cache_dir
g_get_user_config_dir
g_get_user_data_dir
g_get_user_name
g_get_user_name_utf8
g_get_user_runtime_dir
g_get_user_special_dir
g_getenv
g_getenv_utf8
g_hash_table_destroy
g_hash_table_find
g_hash_table_foreach
g_hash_table_foreach_remove
g_hash_table_foreach_steal
g_hash_table_get_keys
g_hash_table_get_values
g_hash_table_insert
g_hash_table_iter_get_hash_table
g_hash_table_iter_init
g_hash_table_iter_next
g_hash_table_iter_remove
g_hash_table_iter_steal
g_hash_table_lookup
g_hash_table_lookup_extended
g_hash_table_new
g_hash_table_new_full
g_hash_table_ref
g_hash_table_remove
g_hash_table_remove_all
g_hash_table_replace
g_hash_table_size
g_hash_table_steal
g_hash_table_steal_all
g_hash_table_unref
g_hook_alloc
g_hook_compare_ids
g_hook_destroy
g_hook_destroy_link
g_hook_find
g_hook_find_data
g_hook_find_func
g_hook_find_func_data
g_hook_first_valid
g_hook_free
g_hook_get
g_hook_insert_before
g_hook_insert_sorted
g_hook_list_clear
g_hook_list_init
g_hook_list_invoke
g_hook_list_invoke_check
g_hook_list_marshal
g_hook_list_marshal_check
g_hook_next_valid
g_hook_prepend
g_hook_ref
g_hook_unref
g_hostname_is_ascii_encoded
g_hostname_is_ip_address
g_hostname_is_non_ascii
g_hostname_to_ascii
g_hostname_to_unicode
g_iconv
g_iconv_close
g_iconv_open
g_idle_add
g_idle_add_full
g_idle_funcs
g_idle_remove_by_data
g_idle_source_new
g_int64_equal
g_int64_hash
g_int_equal
g_int_hash
g_intern_static_string
g_intern_string
g_io_add_watch
g_io_add_watch_full
g_io_channel_close
g_io_channel_error_from_errno
g_io_channel_error_quark
g_io_channel_flush
g_io_channel_get_buffer_condition
g_io_channel_get_buffer_size
g_io_channel_get_buffered
g_io_channel_get_close_on_unref
g_io_channel_get_encoding
g_io_channel_get_flags
g_io_channel_get_line_term
g_io_channel_init
g_io_channel_new_file
g_io_channel_new_file_utf8
g_io_channel_read
g_io_channel_read_chars
g_io_channel_read_line
g_io_channel_read_line_string
g_io_channel_read_to_end
g_io_channel_read_unichar
g_io_channel_ref
g_io_channel_seek
g_io_channel_seek_position
g_io_channel_set_buffer_size
g_io_channel_set_buffered
g_io_channel_set_close_on_unref
g_io_channel_set_encoding
g_io_channel_set_flags
g_io_channel_set_line_term
g_io_channel_shutdown
g_io_channel_unix_get_fd
g_io_channel_unix_new
g_io_channel_unref
g_io_channel_win32_get_fd
g_io_channel_win32_make_pollfd
g_io_channel_win32_new_fd
g_io_channel_win32_new_messages
g_io_channel_win32_new_socket
g_io_channel_win32_new_stream_socket
g_io_channel_win32_poll
g_io_channel_win32_set_debug
g_io_channel_write
g_io_channel_write_chars
g_io_channel_write_unichar
g_io_create_watch
g_io_watch_funcs
g_key_file_error_quark
g_key_file_free
g_key_file_get_boolean
g_key_file_get_boolean_list
g_key_file_get_comment
g_key_file_get_double
g_key_file_get_double_list
g_key_file_get_groups
g_key_file_get_int64
g_key_file_get_integer
g_key_file_get_integer_list
g_key_file_get_keys
g_key_file_get_locale_string
g_key_file_get_locale_string_list
g_key_file_get_start_group
g_key_file_get_string
g_key_file_get_string_list
g_key_file_get_uint64
g_key_file_get_value
Sections
.text Size: 606KB - Virtual size: 605KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 323KB - Virtual size: 322KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 512B - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mi/meshsystem.dll.dll windows:6 windows x64 arch:x64
Password: 1234
6bf53e566ba6a3c1bd9d499a1e226abb
Code Sign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2022 00:00Not After09-11-2031 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2013 12:00Not After15-01-2038 12:00SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23-03-2022 00:00Not After22-03-2037 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29-04-2021 00:00Not After28-04-2036 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14-07-2023 00:00Not After13-10-2034 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before07-10-2021 00:00Not After09-10-2024 23:59SubjectCN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
79:ed:d3:0f:68:fe:45:fe:71:ee:6e:f9:3c:8a:ca:39:d1:97:0f:d5:56:38:1b:42:04:60:4e:85:05:f4:ac:edSigner
Actual PE Digest79:ed:d3:0f:68:fe:45:fe:71:ee:6e:f9:3c:8a:ca:39:d1:97:0f:d5:56:38:1b:42:04:60:4e:85:05:f4:ac:edDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\buildworker\source2_dota_rel_2019_win64\build\_build_\meshsystem\_vpc_meshsystem\default\win64\_msvc_\Retail\meshsystem.pdb
Imports
tier0
MemAlloc_StrDupFunc
CRC32_ProcessBuffer
?Lock@CThreadSpinMutex@@AECAXPEBDHII@Z
Plat_CPUTickFrequency
?LooksLikeKV3TextData@@YA_NPEBXHPEAUKV3ID_t@@PEADH@Z
?LoadKV3FromKV1Text_Translated@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEBDW4KV1TextEscapeBehavior_t@@PEBUKV1ToKV3Translation_t@@H2_N@Z
ConvertKV3Format
V_Int16ToString_Unsafe
V_StringToInt16
?Find@CUtlSymbolTable@@QEBA?AVCUtlSymbol@@PEBD@Z
V_UInt8ToString_Unsafe
V_UInt16ToString_Unsafe
V_StringToUint8
V_StringToUint16
V_strlower_fast
_V_strnicmp_fast
_V_strncat
V_sscanf
V_atoi
V_atofloat32
CharacterSetBuild
V_FixSlashes
?AllocAligned@CUtlScratchMemoryPool@@QEAAPEAXHH@Z
V_StringToInt64
V_Int8ToString_Unsafe
V_StringToInt8
?AppendFormat@CBufferString@@QEAAHPEBDZZ
??4CUtlString@@QEAAAEAV0@AEBVCBufferString@@@Z
?IsEqual_FastCaseInsensitive@CUtlString@@QEBA_NPEBD@Z
?AllocateGuts@CUtlLocalStackAllocator@@IEAAPEAXH@Z
?FreeGuts@CUtlLocalStackAllocator@@IEAAXPEBX@Z
??0CTSListBase@@QEAA@XZ
?Detach@CTSListBase@@QEAAPEAUTSLNodeBase_t@@XZ
?InternalPush@CTSListBase@@AEAAXPEAUTSLNodeBase_t@@@Z
?InternalPop@CTSListBase@@AEAAPEAUTSLNodeBase_t@@XZ
?ParallelCallQueued@CCallQueue@@QEAAXPEBDPEAVIThreadPool@@@Z
ThreadMultiWaitObjectSetDestroy
??0CThreadMultiWaitEvent@@QEAA@_N@Z
??1CThreadMultiWaitEvent@@QEAA@XZ
?Set@CThreadMultiWaitEvent@@QEAAXXZ
?Reset@CThreadMultiWaitEvent@@QEAAXXZ
g_pThreadPool
V_GetFileExtension
V_RemoveDotSlashes
V_IsAbsolutePath
?SetLength@CBufferString@@QEAAPEADH_NPEAH@Z
?RemoveAt@CBufferString@@QEAAPEBDHH@Z
?AppendConcat@CBufferString@@QEAAPEBDHPEBQEBDPEBH_N@Z
?FixSlashes@CBufferString@@QEAAPEBDD@Z
?FixupPathName@CBufferString@@QEAAPEBDD@Z
?SetExtension@CBufferString@@QEAAPEBDPEBD_N@Z
?Acquire@CUtlString@@QEAAXPEAVCBufferString@@_N@Z
??0CUtlBuffer@@QEAA@HHH@Z
V_StringToUint64
?Format@CUtlString@@QEAAHPEBDZZ
V_StringToInt32
V_Int32ToString_Unsafe
?LoadKV3@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEBDAEBUKV3ID_t@@2@Z
?GetInt@KeyValues@@QEBAHPEBDH@Z
V_snprintf
_V_strncpy
?SetLength@CUtlBinaryBlock@@QEAAXH@Z
?Set@CUtlBinaryBlock@@QEAAXPEBXH@Z
V_StringToFloat32
V_StringToUint32
V_StringParseError
V_DoubleToString_Unsafe
V_FloatToString_Unsafe
V_Int64ToString_Unsafe
V_UInt64ToString_Unsafe
V_UInt32ToString_Unsafe
RandomFloat
CommandLine
V_logf
V_expf
V_atan2f
V_asinf
V_acosf
GetCPUInformation
V_sincosf
V_frexpf
GetDefaultMiniDumpTypeFlags
Plat_ExitProcess
InvokeMiniDumpHandler
Plat_DebugPrint
Plat_IsInDebugSession
?LoggingSystem_Log@@YA?AW4LoggingResponse_t@@HW4LoggingSeverity_t@@VColor@@PEBDZZ
LOG_GENERAL
?TruncateAt@CBufferString@@QEAAPEBDPEBD_N@Z
?Insert@CBufferString@@QEAAPEBDHPEBDH_N@Z
?Format@CBufferString@@QEAAHPEBDZZ
?ToLowerFast@CBufferString@@QEAAXH@Z
??0CUtlSymbolTable@@QEAA@HH_N@Z
??1CUtlSymbolTable@@QEAA@XZ
Plat_RegisterModule
V_qsort_s
?TrimTail@CBufferString@@QEAAPEBDPEBD@Z
?MoveFrom@CBufferString@@QEAAXAEAV1@@Z
V_StringToBool
V_StringToFloat64
?Split@CSplitString@@AEAAXPEBDHPEAPEBDH_N@Z
?Alloc@CRawAllocator@@SAPEAXW4RawAllocatorType_t@@_KPEA_K@Z
??0CUtlMemoryBlockAllocator@@QEAA@HIW4RawAllocatorType_t@@@Z
??1CUtlMemoryBlockAllocator@@QEAA@XZ
?Purge@CUtlMemoryBlockAllocator@@QEAAXXZ
?Alloc@CUtlMemoryBlockAllocator@@QEAAII@Z
V_StringToVector2D
V_StringToVector
V_StringToVector4D
V_StringToQAngle
V_StringToColor
Plat_NonFatalErrorFunc
GetThreadLocalStackAllocator
ThreadMultiWait
?AddString@CUtlSymbolTable@@QEAA?AVCUtlSymbol@@PEBDPEA_N@Z
?String@CUtlSymbolTable@@QEBAPEBDVCUtlSymbol@@@Z
g_bUpdateStringTokenDatabase
??0CUtlString@@QEAA@AEBVCBufferString@@@Z
?Set@CUtlString@@QEAAXPEBD@Z
?SetDirect@CUtlString@@QEAAXPEBDH@Z
??8CUtlString@@QEBA_NAEBV0@@Z
RegisterStringToken
?V_stristr_fast@@YAPEBDPEBD0@Z
V_cosf
V_sinf
?Purge@CUtlString@@QEAAXXZ
V_powf
?Lock@CThreadMutex@@QEAAXPEBDH@Z
?Unlock@CThreadMutex@@QEAAXPEBDH@Z
?AppendFormatV@CBufferString@@QEAAHPEBDPEAD@Z
?Purge@CBufferString@@QEAAXH@Z
ToolsStallMonitorInternal_BeginScope
?GetGameInfoBool@@YA_NPEBD_N@Z
?Free@CRawAllocator@@SAXW4RawAllocatorType_t@@PEAX_K@Z
LoggingSystem_RegisterLoggingChannel
?Assert_ConditionFailed@@YA_NAEBU_AssertCompileTimeConstantStruct_t@@PEBDZZ
?LoadKV3@@YA_NPEAVCKeyValues3Context@@PEAVCUtlString@@PEAVCUtlBuffer@@AEBUKV3ID_t@@PEBD@Z
?LoadKV3@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEAVCUtlBuffer@@AEBUKV3ID_t@@PEBD@Z
V_stricmp_fast
?ClearDestruct@CUtlMemoryPoolBase@@IEAAXP6AXPEAX@Z@Z
??0CUtlBuffer@@QEAA@PEBXHH@Z
LoggingSystem_Log
Msg
Plat_FatalErrorFunc
?FreeMemoryBlock@CUtlString@@AEAAXXZ
?DebugPrintKV3@@YAXPEBVKeyValues3@@@Z
LoggingSystem_IsChannelEnabled
??0CThreadMutex@@QEAA@PEBD@Z
??1CThreadMutex@@QEAA@XZ
?LockForRead@CThreadSpinRWLock@@QEAAXPEBDH@Z
?UnlockRead@CThreadSpinRWLock@@QEAAXPEBDH@Z
?UnlockWrite@CThreadSpinRWLock@@QEAAXPEBDH@Z
?SpinLockForWrite@CThreadSpinRWLock@@AEAAXPEBDHI@Z
ToolsStallMonitorInternal_EndScope
UtlMemory_FailedAllocation
?Assert_ConditionFailed@@YA_NAEBU_AssertCompileTimeConstantStruct_t@@@Z
??0CUtlMemoryPoolBase@@QEAA@HHHW4MemoryPoolGrowType_t@@PEBDW4MemAllocAttribute_t@@@Z
??1CUtlMemoryPoolBase@@QEAA@XZ
?Alloc@CUtlMemoryPoolBase@@QEAAPEAXXZ
?Free@CUtlMemoryPoolBase@@QEAAXPEAX@Z
CMemAllocSystemInitialize
Warning
UtlMemory_Alloc
UtlMemory_CalcNewAllocationCount
g_pMemAlloc
kernel32
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileType
GetStdHandle
LCMapStringW
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
EncodePointer
SetLastError
InterlockedFlushSList
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
EnterCriticalSection
CloseHandle
GetModuleHandleW
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
QueryPerformanceCounter
LeaveCriticalSection
LoadLibraryExW
TlsFree
TlsGetValue
FreeLibrary
GetProcAddress
TlsAlloc
GetLastError
InitializeCriticalSectionAndSpinCount
TlsSetValue
GetCurrentThreadId
WriteConsoleW
CreateFileW
Exports
Exports
BinaryProperties_GetValue
CreateInterface
GetResourceManifestCount
GetResourceManifests
InstallSchemaBindings
Sections
.text Size: 898KB - Virtual size: 898KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mi/tmp/PresentationCore.dll.dll windows:5 windows x86 arch:x86
Password: 1234
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
PresentationCore.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 348KB - Virtual size: 347KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mi/tmp/cmiaisupport.dll.dll regsvr32 windows:10 windows x86 arch:x86
Password: 1234
3951938e1c4daf37c2f3f24757b43fd5
Code Sign
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15Certificate
IssuerCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before03-02-2023 00:05Not After01-02-2024 00:05SubjectCN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:07:76:56:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before19-10-2011 18:41Not After19-10-2026 18:51SubjectCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
57:64:98:b3:d7:bf:62:68:8a:74:8f:4a:97:7b:67:6b:aa:82:14:45:6a:2a:a6:4b:a2:9e:f7:34:2b:da:d2:7dSigner
Actual PE Digest57:64:98:b3:d7:bf:62:68:8a:74:8f:4a:97:7b:67:6b:aa:82:14:45:6a:2a:a6:4b:a2:9e:f7:34:2b:da:d2:7dDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
cmiaisupport.pdb
Imports
msvcrt
toupper
iswctype
tolower
towupper
_vsnprintf
_wtoi
_itow_s
wcstoul
printf
wcsrchr
_itow
_purecall
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_ltow
wcstol
wcschr
towlower
iswspace
wcsncmp
_wcsicmp
_vsnwprintf
??_V@YAXPAX@Z
??0exception@@QAE@ABQBD@Z
_callnewh
_CxxThrowException
?terminate@@YAXXZ
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
wcscpy_s
realloc
??3@YAXPAX@Z
wcscat_s
__CxxFrameHandler3
??1type_info@@UAE@XZ
_isctype
wcsstr
memcpy
memcmp
memchr
_XcptFilter
_wcsupr
memmove
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_waccess
memset
api-ms-win-core-synch-l1-2-0
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
OpenThreadToken
CreateProcessW
GetCurrentThread
TerminateProcess
OpenProcessToken
GetExitCodeProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
GlobalMemoryStatusEx
GetSystemInfo
GetLocalTime
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-1-0
DisableThreadLibraryCalls
FindResourceExW
LoadResource
SizeofResource
GetProcAddress
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
LockResource
GetModuleHandleW
api-ms-win-core-com-l1-1-0
CreateStreamOnHGlobal
CLSIDFromString
CoCreateGuid
StringFromGUID2
CoTaskMemAlloc
GetHGlobalFromStream
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
api-ms-win-core-string-l2-1-0
CharPrevW
CharNextW
api-ms-win-core-registry-l1-1-0
RegSaveKeyExW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegUnLoadKeyW
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcpyW
lstrcmpW
lstrcmpiW
lstrcpynW
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualQuery
CreateFileMappingW
FlushViewOfFile
UnmapViewOfFile
VirtualFree
MapViewOfFile
VirtualProtect
ReadProcessMemory
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-debug-l1-1-0
DebugBreak
api-ms-win-core-file-l1-1-0
FindNextFileW
FindFirstFileW
GetFileAttributesExW
GetFileAttributesW
SetFileAttributesW
GetVolumePathNameW
CreateDirectoryW
RemoveDirectoryW
GetTempFileNameW
GetFullPathNameW
FindClose
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
WriteFile
CreateFileW
SetFilePointer
ReadFile
GetVolumeInformationW
DeleteFileW
api-ms-win-core-kernel32-legacy-l1-1-0
FindResourceW
CopyFileW
LoadLibraryW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
LCMapStringW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
GlobalUnlock
GlobalLock
LocalAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-security-provider-l1-1-0
GetNamedSecurityInfoW
SetNamedSecurityInfoW
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorControl
SetSecurityDescriptorControl
AdjustTokenPrivileges
api-ms-win-core-io-l1-1-0
DeviceIoControl
oleaut32
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayGetVartype
SafeArrayCreateVectorEx
SafeArrayDestroy
SafeArrayGetDim
VariantChangeType
VariantInit
SetErrorInfo
VariantCopy
VariantClear
SysAllocStringLen
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
RegisterTypeLi
VarUI4FromStr
SafeArrayGetLBound
SafeArrayGetElement
VariantCopyInd
SafeArrayPutElement
LoadRegTypeLi
DispCallFunc
SysStringByteLen
VarCmp
LoadTypeLibEx
SafeArrayGetUBound
UnRegisterTypeLi
GetErrorInfo
CreateErrorInfo
xmllite
CreateXmlReader
CreateXmlWriter
CreateXmlWriterOutputWithEncodingName
api-ms-win-core-kernel32-private-l1-1-1
PrivCopyFileExW
api-ms-win-core-file-l1-2-0
GetTempPathW
ntdll
LdrLoadDll
NtSetInformationFile
RtlDosPathNameToNtPathName_U
NtCreateFile
LdrUnloadDll
NtOpenProcess
RtlDosPathNameToRelativeNtPathName_U
NtOpenFile
NtQueryInformationFile
NtLoadKey2
NtQueryInformationProcess
RtlInitString
RtlUpcaseUnicodeChar
LdrGetDllHandle
LdrGetProcedureAddress
RtlNtStatusToDosError
RtlFreeHeap
NtClose
RtlCopyUnicodeString
RtlInitUnicodeString
RtlAllocateHeap
RtlAppendUnicodeStringToString
wcp
RtlCopyLUnicodeString
ConvertNtStatusToHResult
RtlReportErrorOrigination
?FsnpDowncaseChar@@YIKK@Z
RtlInitUnicodeStringFromLUnicodeString
RtlFreeLUnicodeString
RtlAllocateLUnicodeString
RtlHashLUnicodeString
RtlInitLUnicodeStringFromNullTerminatedString
RtlAppendLUnicodeStringToLUnicodeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mi/tmp/mscordacwks.dll.dll windows:6 windows x86 arch:x86
Password: 1234
d9d48fea08a34f62d8d66ca02ebb931a
Code Sign
33:00:00:04:c2:5b:61:fb:3e:70:b4:28:c4:00:00:00:00:04:c2Certificate
IssuerCN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before30-06-2022 17:37Not After30-06-2023 17:37SubjectCN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0c:52:4c:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before06-07-2010 20:40Not After06-07-2025 20:50SubjectCN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
d2:cf:3d:b4:de:14:45:22:59:91:79:82:d1:bd:bc:81:9f:ab:56:37:6c:ef:80:ed:2a:a7:9c:06:e0:3b:f3:0aSigner
Actual PE Digestd2:cf:3d:b4:de:14:45:22:59:91:79:82:d1:bd:bc:81:9f:ab:56:37:6c:ef:80:ed:2a:a7:9c:06:e0:3b:f3:0aDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
mscordacwks.pdb
Imports
ntdll
RtlUnwind
kernel32
LoadLibraryExA
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetLastError
WideCharToMultiByte
GetEnvironmentVariableA
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetProcAddress
GetSystemInfo
FreeLibrary
CloseHandle
DebugBreak
GetCurrentProcess
HeapCreate
TlsSetValue
VirtualProtect
HeapFree
VirtualFree
ReleaseSemaphore
VirtualAlloc
CreateMutexW
ReleaseMutex
HeapValidate
CreateEventW
SetEvent
WaitForSingleObjectEx
TlsAlloc
RaiseException
ResetEvent
HeapAlloc
HeapDestroy
GetProcessHeap
CreateSemaphoreW
SleepEx
TlsGetValue
TlsFree
VirtualQuery
GetCPInfo
GetACP
FormatMessageW
IsDBCSLeadByte
LocalFree
LCMapStringW
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryExW
ReadProcessMemory
QueryInformationJobObject
GetProcessAffinityMask
GetModuleFileNameW
GetEnvironmentVariableW
FindClose
CreateFileW
SwitchToThread
TerminateProcess
UnmapViewOfFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
OutputDebugStringW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetFileType
GetStringTypeW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
SetStdHandle
SetFilePointerEx
WriteConsoleW
HeapSize
HeapReAlloc
DecodePointer
GetFileAttributesExW
SetFilePointer
CreateFileMappingW
MapViewOfFile
ReadFile
Exports
Exports
CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mi/tmp/updateagent.dll.dll windows:10 windows x86 arch:x86
Password: 1234
6b5fb648cf0444f16e130a5f46addc46
Code Sign
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate
IssuerCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before03-02-2023 00:05Not After01-02-2024 00:05SubjectCN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:07:76:56:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before19-10-2011 18:41Not After19-10-2026 18:51SubjectCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
58:b7:a6:41:fe:06:95:a3:f5:53:2f:01:b7:2d:4d:7a:5b:e5:48:00:07:ab:e4:9f:ec:4f:30:8d:47:26:76:edSigner
Actual PE Digest58:b7:a6:41:fe:06:95:a3:f5:53:2f:01:b7:2d:4d:7a:5b:e5:48:00:07:ab:e4:9f:ec:4f:30:8d:47:26:76:edDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB Paths
UpdateAgent.pdb
Imports
ntdll
NtSetInformationFile
RtlReAllocateHeap
RtlUpcaseUnicodeChar
RtlDowncaseUnicodeChar
DbgPrintEx
RtlNtStatusToDosError
RtlDeleteSecurityObject
RtlAdjustPrivilege
NtSetInformationProcess
RtlSetEnvironmentVariable
RtlDuplicateUnicodeString
RtlLengthSid
NtQueryVolumeInformationFile
RtlValidAcl
NtAdjustPrivilegesToken
RtlSetSaclSecurityDescriptor
RtlInitUnicodeString
RtlQueryInformationAcl
NtSetInformationThread
NtQueryInformationThread
RtlGetOwnerSecurityDescriptor
RtlDosPathNameToNtPathName_U_WithStatus
RtlCompareUnicodeString
NtUnloadKey2
RtlInitUnicodeStringEx
NtShutdownSystem
RtlLengthSecurityDescriptor
RtlValidSid
NtDelayExecution
RtlAllocateAndInitializeSid
NtOpenProcessToken
RtlGetGroupSecurityDescriptor
RtlCopySid
NtOpenThreadToken
NtQueryLicenseValue
NtLoadKey2
NtQueryPerformanceCounter
NtFlushKey
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlDestroyEnvironment
RtlCreateEnvironmentEx
RtlExpandEnvironmentStrings_U
VerSetConditionMask
RtlGetDaclSecurityDescriptor
RtlGetControlSecurityDescriptor
RtlMakeSelfRelativeSD
NtDuplicateToken
RtlGetVersion
RtlSetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlCreateUnicodeStringFromAsciiz
RtlCreateSecurityDescriptor
NtYieldExecution
NtQueryKey
NtDeleteKey
RtlSetCurrentTransaction
NtEnumerateKey
RtlGetLengthWithoutLastFullDosOrNtPathElement
NtEnumerateValueKey
NtOpenKeyEx
RtlGetAce
RtlpApplyLengthFunction
RtlAddAccessAllowedAceEx
NtReadFile
NtCreateKeyTransacted
RtlNewSecurityObjectEx
NtDeleteFile
RtlCaptureStackBackTrace
NtSetSecurityObject
RtlGetCurrentTransaction
NtDeleteValueKey
RtlAddAce
NtQueryAttributesFile
NtFlushBuffersFile
NtDuplicateObject
NtFsControlFile
NtQueryInformationFile
RtlCreateAcl
NtCreateKey
NtOpenKeyTransactedEx
NtQueryDirectoryFile
NtQuerySecurityObject
NtSetValueKey
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetEaFile
RtlReleaseRelativeName
NtQueryEaFile
NtWaitForSingleObject
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlEqualUnicodeString
RtlCreateEnvironment
NtQuerySystemTime
RtlSetControlSecurityDescriptor
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
RtlIsTextUnicode
RtlUnicodeToMultiByteSize
RtlConvertSidToUnicodeString
RtlRunOnceComplete
RtlRunOnceBeginInitialize
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlExpandEnvironmentStrings
NtQueryInformationToken
NtQueryValueKey
DbgPrint
NtCreateFile
RtlFreeHeap
NtClose
RtlQueryEnvironmentVariable_U
LdrLoadDll
RtlDosPathNameToNtPathName_U
LdrUnloadDll
LdrGetDllHandle
NtOpenKey
NtWriteFile
LdrGetProcedureAddress
NtQueryObject
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlTimeToTimeFields
RtlDeleteCriticalSection
RtlNtStatusToDosErrorNoTeb
RtlRaiseStatus
RtlCreateHeap
RtlAllocateHeap
RtlDestroyHeap
RtlUnwind
RtlFindAceByType
advapi32
CreatePrivateObjectSecurityWithMultipleInheritance
MakeSelfRelativeSD
DestroyPrivateObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorLength
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
GetTokenInformation
ConvertStringSidToSidW
CheckTokenMembership
RegQueryValueExW
AddAccessAllowedAceEx
IsValidAcl
AdjustTokenPrivileges
IsValidSid
OpenThreadToken
AddAccessAllowedAce
InitiateSystemShutdownExW
RegDeleteKeyW
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
RegEnumValueW
EventUnregister
RegEnumKeyExW
RegOpenKeyExW
InitializeAcl
EqualSid
EventProviderEnabled
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
SetSecurityInfo
RegSetValueExW
RegSetKeySecurity
GetSecurityDescriptorControl
EventWriteString
EnableTraceEx2
ControlTraceW
CopySid
SetSecurityDescriptorDacl
RegCreateKeyExW
RegCloseKey
EventWriteTransfer
EventRegister
AllocateAndInitializeSid
kernel32
CopyFileW
SetEvent
DebugBreak
GetSystemWindowsDirectoryW
OutputDebugStringW
MoveFileW
IsWow64Process
LoadLibraryExW
IsDebuggerPresent
SetUnhandledExceptionFilter
GetExitCodeProcess
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
ExitProcess
HeapSize
HeapReAlloc
RaiseException
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
VirtualQuery
GetModuleFileNameW
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
CompareStringOrdinal
LocalAlloc
FreeLibrary
GetModuleHandleW
CreateProcessW
ReleaseSRWLockExclusive
CloseThreadpoolTimer
GetProcessHeap
WideCharToMultiByte
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
LocalFree
CreateMutexExW
GetProcAddress
GetDiskFreeSpaceExW
HeapAlloc
GetCurrentThread
VerifyVersionInfoW
GetLastError
GetTickCount64
ResetEvent
RaiseFailFastException
FormatMessageW
Sleep
MultiByteToWideChar
GlobalMemoryStatusEx
CreateEventW
CreateThreadpoolTimer
GetVolumeNameForVolumeMountPointW
OpenProcess
GetVolumePathNamesForVolumeNameW
GetSystemDirectoryW
ReleaseMutex
GetVersionExW
GetSystemInfo
ReleaseSRWLockShared
TryEnterCriticalSection
lstrcmpW
GetErrorMode
DecodePointer
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetStdHandle
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
LoadLibraryExA
VirtualProtect
SetFilePointerEx
GetPriorityClass
GetTimeZoneInformation
GetExitCodeThread
GetFileAttributesW
WaitForMultipleObjects
SetPriorityClass
GlobalUnlock
GlobalMemoryStatus
GetFileType
CreateProcessA
GlobalLock
HeapDestroy
HeapCompact
GetOverlappedResult
GetVersionExA
GlobalSize
GetPrivateProfileStringW
GetLogicalDriveStringsW
HeapValidate
DuplicateHandle
HeapWalk
GetComputerNameExW
SetEndOfFile
SetErrorMode
SetFileTime
VirtualAlloc
GetShortPathNameW
VirtualFree
HeapCreate
GetLogicalDrives
GetVolumeInformationW
CreateFileW
WaitForSingleObject
FindClose
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
OpenEventW
CreateMutexW
GetEnvironmentVariableW
GetCommandLineW
CopyFileExW
GetFileInformationByHandle
GetDiskFreeSpaceW
RemoveDirectoryW
WaitForMultipleObjectsEx
SetThreadpoolTimer
LeaveCriticalSection
CreateFileMappingA
InitializeCriticalSectionAndSpinCount
DeleteFileA
CreateFileA
GetVersion
OutputDebugStringA
SystemTimeToTzSpecificLocalTime
GetSystemTime
CreateMutexA
GetProcessId
LoadLibraryW
GetWindowsDirectoryW
MoveFileExW
GetFullPathNameW
CloseHandle
OpenSemaphoreW
ExpandEnvironmentStringsW
GetModuleHandleExW
ReleaseSemaphore
GetCurrentProcess
GetFileInformationByHandleEx
DeviceIoControl
SetFileAttributesW
SetThreadPriority
SetFilePointer
SetFileInformationByHandle
GetThreadPriority
GlobalAlloc
GlobalFree
FlushFileBuffers
FindNextFileW
DeleteFileW
EnterCriticalSection
SetLastError
HeapFree
CreateSemaphoreExW
CompareStringW
GetFileSizeEx
FindFirstFileW
GetModuleFileNameA
ReadFile
CreateDirectoryW
WaitForSingleObjectEx
GetCurrentThreadId
FileTimeToSystemTime
GetTickCount
InitializeSRWLock
InitOnceExecuteOnce
AcquireSRWLockExclusive
GetDriveTypeW
LCIDToLocaleName
WriteFile
ResolveLocaleName
CreateThread
InitializeCriticalSection
GetTempPathW
UnmapViewOfFile
GetLocalTime
GetFileSize
GetTempFileNameW
CreateFileMappingW
MapViewOfFile
GetCurrentDirectoryW
GetLongPathNameW
GetFinalPathNameByHandleW
ole32
CoTaskMemAlloc
CoUninitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CoCreateGuid
CoInitializeEx
CoGetMalloc
user32
CharNextW
UnregisterClassA
oleaut32
SysAllocString
SystemTimeToVariantTime
SysFreeString
VariantTimeToSystemTime
crypt32
CryptHashCertificate2
CertVerifyCertificateChainPolicy
wintrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
rpcrt4
UuidCreate
I_RpcMapWin32Status
UuidToStringW
RpcStringFreeW
UuidFromStringW
shlwapi
PathMatchSpecW
wer
WerReportCloseHandle
WerReportAddFile
WerReportSetParameter
WerReportSetUIOption
WerReportSubmit
WerReportCreate
version
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
cfgmgr32
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_PropertyW
Exports
Exports
CreateDeploymentSession
CreateDeploymentSessionEx
CreateOfflineDeploymentSession
UA_CommitActionList
UA_CreateActionList
UA_CreateDownloadList
UA_CreateDownloadListFromActionList
UA_CreatePackageListFromDownloadList
UA_InstallActionList
UA_ReleaseDownloadList
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mi/wcp.dll.dll windows:10 windows x86 arch:x86
6b9cfcb666e394aa26d4cd0ce4f901c0
Code Sign
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate
IssuerCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before03-02-2023 00:05Not After01-02-2024 00:05SubjectCN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:07:76:56:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before19-10-2011 18:41Not After19-10-2026 18:51SubjectCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
84:12:c5:a1:4b:4f:2d:cd:25:f6:77:0e:ef:6f:53:30:4c:9f:72:b4:26:3d:83:95:1c:d0:72:08:b2:7f:2c:ebSigner
Actual PE Digest84:12:c5:a1:4b:4f:2d:cd:25:f6:77:0e:ef:6f:53:30:4c:9f:72:b4:26:3d:83:95:1c:d0:72:08:b2:7f:2c:ebDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
wcp.pdb
Imports
api-ms-win-crt-string-l1-1-0
memset
strncmp
wcsnlen
memmove_s
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__ltow_s
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
_o__ultow
_o__ultow_s
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wcstoi64
_o__wcstoui64
_o__wcsupr
memmove
_o_bsearch
_o_fflush
_o_free
_o_iswctype
_o_malloc
_o_memcpy_s
_o_qsort
_o_strcpy_s
_o_tolower
_o_toupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstoul
strrchr
wcsstr
wcsrchr
_except_handler4_common
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
strstr
wcschr
_o__execute_onexit_table
_o__errno
_o___acrt_iob_func
strchr
memcmp
memcpy
_o__wtol
rpcrt4
UuidFromStringW
UuidToStringW
RpcStringFreeW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegFlushKey
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
api-ms-win-core-libraryloader-l1-1-0
GetProcAddress
LoadResource
GetModuleHandleW
SizeofResource
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
LockResource
FindResourceExW
GetModuleFileNameW
GetModuleHandleExW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
CreateThread
GetExitCodeProcess
CreateProcessW
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
TlsAlloc
TlsGetValue
TlsFree
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
WaitForSingleObjectEx
ResetEvent
SetEvent
ReleaseMutex
WaitForMultipleObjectsEx
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
CreateEventW
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject
ReleaseSRWLockShared
OpenSemaphoreW
CreateMutexExW
LeaveCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount64
GetSystemInfo
GlobalMemoryStatusEx
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
GetNativeSystemInfo
GetProductInfo
api-ms-win-eventing-legacy-l1-1-0
FlushTraceW
api-ms-win-core-heap-obsolete-l1-1-0
LocalReAlloc
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
GetSidSubAuthority
GetSidLengthRequired
CreateWellKnownSid
GetSecurityDescriptorControl
GetAce
CreatePrivateObjectSecurityWithMultipleInheritance
InitializeSid
IsValidSid
GetTokenInformation
InitializeAcl
SetPrivateObjectSecurityEx
GetLengthSid
AddAccessAllowedAce
IsValidSecurityDescriptor
DestroyPrivateObjectSecurity
GetSecurityDescriptorLength
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
MakeSelfRelativeSD
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
api-ms-win-core-kernel32-legacy-l1-1-0
LoadLibraryA
LoadLibraryW
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-security-provider-l1-1-0
GetNamedSecurityInfoW
api-ms-win-core-file-l1-1-0
WriteFile
CreateFileW
SetEndOfFile
GetFileAttributesW
DeleteFileW
GetFinalPathNameByHandleW
ReadFile
GetFileSizeEx
SetFileAttributesW
FlushFileBuffers
SetFilePointerEx
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-service-management-l1-1-0
OpenServiceW
DeleteService
OpenSCManagerW
CloseServiceHandle
StartServiceW
api-ms-win-service-winsvc-l1-1-0
ControlService
QueryServiceStatus
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-security-cryptoapi-l1-1-0
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptAcquireContextW
CryptExportKey
CryptReleaseContext
CryptGetHashParam
CryptAcquireContextA
CryptCreateHash
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpA
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
api-ms-win-core-libraryloader-l1-1-1
EnumResourceLanguagesExW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-security-lsapolicy-l1-1-0
LsaOpenPolicy
LsaClose
LsaQueryInformationPolicy
LsaFreeMemory
ntdll
NtSetEaFile
RtlReleaseRelativeName
NtQueryEaFile
RtlCopyUnicodeString
RtlDuplicateUnicodeString
RtlAppendUnicodeStringToString
RtlEqualUnicodeString
RtlGetControlSecurityDescriptor
RtlMakeSelfRelativeSD
RtlSetControlSecurityDescriptor
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
RtlIsTextUnicode
RtlUnicodeToMultiByteSize
RtlConvertSidToUnicodeString
NtAllocateLocallyUniqueId
NtQueryInformationToken
RtlLengthRequiredSid
RtlFreeSid
RtlTimeToTimeFields
RtlDosPathNameToNtPathName_U
RtlMultiByteToUnicodeSize
RtlMultiByteToUnicodeN
RtlFormatCurrentUserKeyPath
RtlDowncaseUnicodeChar
RtlUpcaseUnicodeChar
DbgPrintEx
RtlReAllocateHeap
RtlCompareMemory
RtlMapGenericMask
RtlGetSaclSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlAllocateAndInitializeSid
RtlAddAccessAllowedAce
RtlGetGroupSecurityDescriptor
RtlEqualSid
NtQueryLicenseValue
RtlValidAcl
NtAdjustPrivilegesToken
RtlSetSaclSecurityDescriptor
RtlValidSid
NtDuplicateToken
NtSetInformationThread
RtlSetGroupSecurityDescriptor
RtlFindAceByType
NtQuerySystemInformation
RtlCreateEnvironmentEx
RtlExpandEnvironmentStrings_U
RtlNtStatusToDosError
RtlAbsoluteToSelfRelativeSD
NtFsControlFile
RtlRunOnceBeginInitialize
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlInitializeSRWLock
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlAcquireSRWLockExclusive
NtSetIoCompletion
NtWaitForMultipleObjects
NtCreateIoCompletion
RtlCreateAcl
RtlCreateUnicodeStringFromAsciiz
NtRemoveIoCompletion
NtSetEvent
RtlFreeUnicodeString
RtlInitializeSid
RtlAddAuditAccessObjectAce
RtlAddAuditAccessAceEx
RtlAddAccessDeniedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedObjectAce
RtlFirstFreeAce
RtlRaiseException
RtlDeleteSecurityObject
NtQueryValueKey
RtlGetDaclSecurityDescriptor
NtSetValueKey
NtQuerySecurityObject
NtQueryDirectoryFile
NtQueryObject
NtQueryVolumeInformationFile
LdrDisableThreadCalloutsForDll
NtQueryInformationProcess
RtlPcToFileHeader
RtlAllocateHeap
RtlDeleteCriticalSection
NtDuplicateObject
NtFlushBuffersFile
RtlInitUnicodeStringEx
NtOpenKeyTransactedEx
NtQueryAttributesFile
RtlAddAce
NtDeleteValueKey
RtlGetCurrentTransaction
NtSetSecurityObject
NtDeleteFile
RtlNewSecurityObjectEx
NtCreateKeyTransacted
RtlAddAccessAllowedAceEx
NtSetInformationFile
RtlQueryInformationAcl
RtlpApplyLengthFunction
RtlGetAce
NtOpenKeyEx
NtEnumerateValueKey
NtWriteFile
RtlGetLengthWithoutLastFullDosOrNtPathElement
RtlComputeCrc32
NtQueryInformationThread
NtEnumerateKey
RtlReleaseSRWLockExclusive
NtCreateKey
RtlSetCurrentTransaction
RtlSetOwnerSecurityDescriptor
NtOpenProcessToken
NtDeleteKey
NtQueryKey
NtReadFile
RtlNtStatusToDosErrorNoTeb
RtlLengthSecurityDescriptor
RtlCreateEnvironment
RtlDestroyEnvironment
RtlSetEnvironmentVariable
NtDelayExecution
LdrUnloadDll
LdrLoadDll
RtlInitUnicodeString
RtlLengthSid
RtlAppendUnicodeToString
RtlCompareUnicodeString
RtlCreateServiceSid
RtlSubAuthoritySid
RtlSubAuthorityCountSid
RtlCopySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAnsiStringToUnicodeString
RtlInitAnsiString
NtLoadKey2
NtOpenKey
NtFlushKey
NtUnloadKey2
NtCreateFile
LdrGetProcedureAddress
NtCreateEvent
LdrGetDllHandle
NtOpenThreadToken
NtOpenProcess
NtQueryInformationFile
NtOpenFile
RtlTimeToSecondsSince1980
NtWaitForSingleObject
RtlQueryEnvironmentVariable_U
NtClose
NtQuerySystemTime
NtYieldExecution
RtlHashUnicodeString
DbgPrint
RtlRaiseStatus
RtlLeaveCriticalSection
RtlFreeHeap
RtlInitializeCriticalSection
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlRunOnceComplete
NtQueryPerformanceCounter
NtDeviceIoControlFile
ZwQuerySystemInformation
RtlGUIDFromString
RtlStringFromGUID
ZwQueryAttributesFile
ZwWaitForSingleObject
ZwQueryKey
ZwReleaseMutant
ZwOpenFile
ZwOpenMutant
ZwClose
ZwCreateKey
ZwLoadKey
ZwDeleteValueKey
ZwDeleteKey
ZwEnumerateKey
ZwQueryValueKey
ZwSetSecurityObject
ZwUnloadKey
ZwSetValueKey
ZwOpenKey
ZwAllocateUuids
ZwQuerySymbolicLinkObject
ZwDeviceIoControlFile
ZwQueryDirectoryObject
ZwOpenSymbolicLinkObject
RtlGetVersion
ZwOpenDirectoryObject
ZwQueryInformationProcess
ZwQueryInformationFile
ZwOpenProcess
NtOpenProcessTokenEx
NtOpenThreadTokenEx
RtlImpersonateSelf
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryBootEntryOrder
NtQueryBootOptions
NtTranslateFilePath
NtOpenDirectoryObject
NtQueryDirectoryObject
NtEnumerateBootEntries
TpSimpleTryPost
RtlEnterCriticalSection
bcrypt
BCryptHashData
BCryptGetProperty
BCryptFinishHash
BCryptDestroyHash
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
crypt32
CertAddStoreToCollection
CertFreeCTLContext
CertAddEncodedCertificateToStore
CryptMsgClose
CertGetEnhancedKeyUsage
CryptMsgUpdate
CertGetCertificateChain
CertFreeCertificateContext
CryptMsgGetAndVerifySigner
CertFindSubjectInCTL
CryptMsgOpenToDecode
CertCloseStore
CryptMsgGetParam
CertCreateCTLContext
CryptHashCertificate2
CertFreeCertificateChain
CryptImportPublicKeyInfoEx
CertOpenStore
CertVerifyCertificateChainPolicy
CertGetSubjectCertificateFromStore
CryptDecodeObject
Exports
Exports
??$ReplaceVariablesInStringCallthrough@U_LUNICODE_STRING@@@Rtl@Implementation@WCP@Windows@@YGJPAXP6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@PBE1@ZPBU_LBLOB@@PAU_RTL_SMART_LBLOB_UCSCHAR_WRITING_CONTEXT@@@Z
??0AIAsimovProvider@COM@Windows@@QAE@XZ
??0CBackupFileCreator@PrimitiveInstaller@@QAE@XZ
??0CBaseInstaller@PrimitiveInstaller@@IAE@XZ
??0CCoordinator@PrimitiveInstaller@@QAE@XZ
??0CFileInstaller@@QAE@XZ
??0CGacPrimitiveInstaller@@QAE@XZ
??0CMigInfoInstaller@@QAE@XZ
??0CQueueExecutor@COM@Windows@@QAE@XZ
??0CRawInstallMap@InstallMap@@QAE@XZ
??0CRawStoreLayout@ComponentStore@@QAE@XZ
??0CRegistryInstaller@@QAE@XZ
??0CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QAE@XZ
??0CXmlCursor@@QAE@XZ
??1AIAsimovProvider@COM@Windows@@QAE@XZ
??1AutoLZMSDecoder@Rtl@WCP@Windows@@QAE@XZ
??1AutoLZMSEncoder@Rtl@WCP@Windows@@QAE@XZ
??1CBackupFileCreator@PrimitiveInstaller@@QAE@XZ
??1CComponentInformation@COM@Windows@@QAE@XZ
??1CCoordinator@PrimitiveInstaller@@QAE@XZ
??1CGacPrimitiveInstaller@@QAE@XZ
??1CMigInfoInstaller@@QAE@XZ
??1CQueueExecutor@COM@Windows@@QAE@XZ
??1CRawInstallMap@InstallMap@@QAE@XZ
??1CRawStoreLayout@ComponentStore@@QAE@XZ
??1CRegistryInstaller@@QAE@XZ
??1CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QAE@XZ
??1CSettingsInstaller@@QAE@XZ
??1CShortcutInstaller@@QAE@XZ
??1CSysprepInstaller@@QAE@XZ
??1PrivilegeAcquisition@RtlSystemUtil@@QAE@XZ
?Acquire@PrivilegeAcquisition@RtlSystemUtil@@QAEJABU?$Vector@$$CBJ@Windows@@@Z
?AcquireInstallerComponentPath@LocalInstallerServices@COM@WCP@Windows@@UAGJKPAUIDefinitionIdentity@@PAPA_WPAK@Z
?AddCatalogMarkFromTlc@CRawStoreLayout@ComponentStore@@QAEJABU_LUNICODE_STRING@@PAUTlcData@2@@Z
?AddChange@ExecutionQueueDeriver@AiQueue@@QAEJPBVWcpManifest@@0@Z
?AddComponentImplication@CRawStoreLayout@ComponentStore@@QAEJABUComponentData@2@PAUTlcData@2@@Z
?AddInspect@ExecutionQueueDeriver@AiQueue@@QAEJABVWcpManifest@@@Z
?AddInstallMarkToFamily@CRawInstallMap@InstallMap@@QAEJPAUMapForFamily@2@ABT_FOUR_PART_VERSION@@@Z
?AddInstallerFailureAnnotation@LocalInstallerServices@COM@WCP@Windows@@UAGJKPA_W@Z
?AddRef@LocalInstallerServices@COM@WCP@Windows@@UAGKXZ
?AddRef@LocalTransformerServices@COM@WCP@Windows@@UAGKXZ
?AddTlcMark@CRawStoreLayout@ComponentStore@@QAEJKABUTlcInstaller@2@PAUTlcData@2@@Z
?Canonicalize@CBaseCanonicalizer@@QAEJPAUIRtlMicrodom@Rtl@Microdom@Windows@@ABU?$Vector@UNode@Rtl@Microdom@Windows@@@5@PAUIRtlWOFOStream@35@@Z
?Canonicalize@CC14NCanonicalizer@@MAEJUElement@Rtl@Microdom@Windows@@@Z
?Canonicalize@CC14NCanonicalizer@@MAEJUProcessingInstruction@Rtl@Microdom@Windows@@@Z
?Canonicalize@CC14NCanonicalizer@@MAEJUText@Rtl@Microdom@Windows@@@Z
?CheckComponentFileFlag@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@U_LUNICODE_STRING@@PA_N@Z
?CheckComponentFlag@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PA_N@Z
?ChooseBitnessFromIdentityAndTarget@MacroReplacement@@YGJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAK@Z
?CleanupInstallMap@CRawInstallMap@InstallMap@@QAEJXZ
?ClearServicingFamilyWinningVersion@CRawInstallMap@InstallMap@@QAEJPAUMapForFamily@2@PAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@@Z
?Close@?$Auto@U_ACL@@@Windows@@QAEXXZ
?Close@?$Auto@U_SECURITY_DESCRIPTOR@@@Windows@@QAEXXZ
?Close@?$Auto@U_SID@@@Windows@@QAEXXZ
?Close@AutoDeltaBlob@Rtl@Windows@@QAEXXZ
?Close@CApplicationAccessor@@QAEXXZ
?Close@CCatalog@@QAEJXZ
?CmsGetFileHashInformation@WcpManifest@@SGJABUFile@WcpManifestParser@@PAUHashInfo@Rtl@ManifestParser@Windows@@@Z
?CoTaskMemAlloc@COM@Windows@@YGPAXK@Z
?CoTaskMemFree@COM@Windows@@YGXPBX@Z
?CompareIdentityAttributeValue@Rtl@Identity@Windows@@YGJPBU_LUNICODE_STRING@@0PAH@Z
?CompareSecurityDescriptorFromObjectAgainstManifest@Rtl@Implementation@WCP@Windows@@YGJKPBU_SECURITY_DESCRIPTOR@@0PA_N@Z
?CompressManifest@Rtl@Implementation@WCP@Windows@@YGJK_NPBU_LBLOB@@PAUIRtlFile@14@@Z
?ConvertIn@COM@Windows@@YGJPAUIDefinitionIdentity@@PAPAUIRtlDefinitionIdentity@Rtl@Identity@2@@Z
?ConvertSecurityDescriptorToString@CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QBEJKPAXKPAV?$Auto@U_LUNICODE_STRING@@@5@PAK@Z
?ConvertStringSecurityDescriptor@CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QBEJKABU_LUNICODE_STRING@@PAV?$Auto@U_SECURITY_DESCRIPTOR@@@5@PAK@Z
?CopyOutPath@COM@Windows@@YGJPBU_LUNICODE_STRING@@PAPA_W@Z
?Create@CCatalog@@QAEJKKPBU_LBLOB@@PAK@Z
?DecomposeSecurityDescriptor@Rtl@Implementation@WCP@Windows@@YGJPBU_SECURITY_DESCRIPTOR@@PAKPAV?$Auto@U_SID@@@4@2PAV?$Auto@U_ACL@@@4@3PAG@Z
?DecompressManifest@Rtl@Implementation@WCP@Windows@@YGJKPAV?$Auto@U_LBLOB@@@4@PAK@Z
?DeletePendingFiles@CRawStoreLayout@ComponentStore@@QAEJXZ
?DeltaCompressFile@Rtl@Windows@@YGJKKPAU_LBLOB@@PBU3@0PAUIRtlFile@12@@Z
?DeltaCompressFile@Rtl@Windows@@YGJKPAUIRtlFile@12@PBU_LBLOB@@00@Z
?DeltaDecompressBuffer@Rtl@Windows@@YGJKPAU_LBLOB@@K0PAVAutoDeltaBlob@12@1@Z
?DeltaDecompressBuffer@Rtl@Windows@@YGJKPAU_LBLOB@@K0PAVAutoDeltaBlob@12@@Z
?DeltaDecompressFile@Rtl@Windows@@YGJPAUIRtlFile@12@K00@Z
?DeltaDecompressFile@Rtl@Windows@@YGJPAUIRtlFile@12@K00PAVAutoDeltaBlob@12@@Z
?DestroyOutputStream@Tracing@Windows@@YGXPAUIRtlFormattedOutputStream@Rtl@2@@Z
?DoesManifestContainAIs@ExecutionQueueDeriver@AiQueue@@QAEJABVWcpManifest@@PA_N@Z
?DoesTargetHaveTestRootCert@@YGJPAUIRtlSystemIsolationLayerPublic@Rtl@Windows@@PA_N@Z
?FileHashAlgorithmToDigest@Rtl@Cms@Windows@@YG?AW4_CMS_HASH_DIGESTMETHOD@23@K@Z
?FilePathCombine@COM@Windows@@YGJPBGABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@2@@Z
?Finalize@CC14NCanonicalizer@@MAEJXZ
?Finalize@ExecutionQueueDeriver@AiQueue@@QAEJPAV?$Auto@U?$Vector@VExecutionQueueEntry@AiQueue@@@Windows@@@Windows@@PAK@Z
?FinalizeChanges@CCoordinator@PrimitiveInstaller@@QAEJXZ
?FinalizeValue@CComponentInformationTableTraits@COM@Windows@@SGXAAV?$Auto@PAVCComponentInformation@COM@Windows@@@3@@Z
?FindSubject@CCatalog@@QBEJKPBU_LBLOB@@PA_NPAJ@Z
?FindUnchangedMatchingVersions@VersionedIndexHelper@ComponentStore@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@KKABU_LBLOB@@PAV?$CVector@T_FOUR_PART_VERSION@@VCCallDisposition@Rtl@BUCL@@@BUCL@@@Z
?FormatFourPartVersion@Rtl@Implementation@WCP@Windows@@YGJKABT_FOUR_PART_VERSION@@PAE1P6I?AU_RTL_UCSCHAR_ENCODER_RETURN_VALUE@@K11@ZPAPAE@Z
?FormatFourPartVersion@Rtl@Implementation@WCP@Windows@@YGJKPBT_FOUR_PART_VERSION@@PAV?$Auto@U_LUNICODE_STRING@@@4@@Z
?FormatNumberIntoBuffer@Rtl@Implementation@WCP@Windows@@YGJ_KKPAE1P6I?AU_RTL_UCSCHAR_ENCODER_RETURN_VALUE@@K11@ZPAPAE@Z
?FsnpDowncaseChar@@YIKK@Z
?GenerateCatalogThumbprint@@YGJPAUIRtlFile@Rtl@Windows@@PAV?$Auto@U_LUNICODE_STRING@@@3@@Z
?GenerateCatalogThumbprint@@YGJPBU_LBLOB@@PAV?$Auto@U_LUNICODE_STRING@@@Windows@@@Z
?GetComponentAbsolutePath@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAV?$Auto@U_LUNICODE_STRING@@@6@@Z
?GetComponentFileAbsolutePath@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@6@2@Z
?GetComponentWinningVersion@CRawInstallMap@InstallMap@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAT_FOUR_PART_VERSION@@PA_N_N@Z
?GetCompressedFileType@Rtl@WCP@Windows@@YGKPBU_LBLOB@@@Z
?GetCurrentDllWin32Path@COM@Windows@@YGJPAXPAV?$Auto@U_LUNICODE_STRING@@@2@@Z
?GetExternalDirPath@CRawStoreLayout@ComponentStore@@QAEJPAPBU_LUNICODE_STRING@@@Z
?GetIsolationAllocator@LocalTransformerServices@COM@WCP@Windows@@UAGJPAPAUIMalloc@@@Z
?GetLUnicodeParameter@Rtl@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@4@PAK@Z
?GetNtFilePathParameter@Rtl@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@4@PAKK@Z
?GetNtRegistryPathParameter@Rtl@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@4@PAKK@Z
?GetOutputStreamStreamFromSink@Tracing@Windows@@YGXPAUIRtlOutputSink@Rtl@2@PAPAUIRtlFormattedOutputStream@42@@Z
?GetParameter@LocalTransformerServices@COM@WCP@Windows@@UAGJKPB_WPAPA_WPAK@Z
?GetRootDirPath@CRawStoreLayout@ComponentStore@@QAEJPAPBU_LUNICODE_STRING@@@Z
?GetSignerPublicKeyToken@CCatalog@@QAEJPAUIRtlSystemIsolationLayer@Rtl@Windows@@PAU_LBLOB@@@Z
?GetSystem@LocalTransformerServices@COM@WCP@Windows@@UAGJPAPAUIRtlSystemIsolationLayerPublic@Rtl@4@@Z
?GetTemporaryDirectory@CRawStoreLayout@ComponentStore@@QAEJKPAV?$Auto@PAUIRtlDirectory@Rtl@Windows@@@Windows@@@Z
?GetUTF8FileWriterStream@Rtl@Windows@@YGJPAUIRtlFile@12@PAV?$Auto@PAUIRtlWOFOUCSStream@Rtl@Windows@@@2@@Z
?GetUserProfile@LocalTransformerServices@COM@WCP@Windows@@UAGJPAPAUIRtlUserProfile@Rtl@4@@Z
?GetWin32FilePathParameter@COM@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@PBGPAPAGPAKK@Z
?GetWin32PathOfSiblingFile@COM@Windows@@YGJPAXPBGPAV?$Auto@U_LUNICODE_STRING@@@2@@Z
?GetWin32PathOfSiblingFile@COM@Windows@@YGJPAXPB_WPAV?$Auto@U_LUNICODE_STRING@@@2@@Z
?GetWin32RegistryPathParameter@COM@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@PBGPAPAUHKEY__@@PAPAGPAKK@Z
?InitComponentData@VersionedIndexHelper@ComponentStore@@QAEJ_NPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAUComponentData@2@PA_N@Z
?Initialize@AutoLZMSDecoder@Rtl@WCP@Windows@@QAEJXZ
?Initialize@AutoLZMSEncoder@Rtl@WCP@Windows@@QAEJXZ
?Initialize@CApplicationAccessor@@QAEJPAUIRtlDefinitionAppId@Rtl@AppId@Windows@@PAUIRtlAppIdAuthority@345@@Z
?Initialize@CBaseCanonicalizer@@MAEJPAUIRtlMicrodom@Rtl@Microdom@Windows@@ABU?$Vector@UNode@Rtl@Microdom@Windows@@@5@PAUIRtlWOFOStream@35@@Z
?Initialize@CC14NCanonicalizer@@MAEJPAUIRtlMicrodom@Rtl@Microdom@Windows@@ABU?$Vector@UNode@Rtl@Microdom@Windows@@@5@PAUIRtlWOFOStream@35@@Z
?Initialize@CComponentAccessor@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAUIRtlIdentityAuthority@345@@Z
?Initialize@CCoordinator@PrimitiveInstaller@@QAEJKKKPAUIRtlPrimitiveInstallerSupport@Rtl@PrimitiveInstallers@Windows@@PAUIRtlPrimitiveInstallerRepairCallback@456@PAUIRtlSystemIsolationLayer@46@@Z
?Initialize@CQueueExecutor@COM@Windows@@QAEJKPB_WPAVIComponentStoreHelper@23@PAUIRtlSystemIsolationLayer@Rtl@3@PAVCTransactionContent@23@@Z
?Initialize@CRawInstallMap@InstallMap@@QAEJ_NPAUIRtlIdentityAuthority@Rtl@Identity@Windows@@PAUIRtlKey@46@PAUIRtlSystemIsolationLayer@46@@Z
?Initialize@CXmlCursor@@QAEJPAXK@Z
?Initialize@ExecutionQueueDeriver@AiQueue@@QAEJKKK_KPAUIRtlSystemIsolationLayer@Rtl@Windows@@1PBV?$CVector@UTransformsChangeQueueEntry@AiQueue@@VCCallDisposition@Rtl@BUCL@@@BUCL@@@Z
?Initialize@VersionedIndexHelper@ComponentStore@@QAEJPAUIRtlKey@Rtl@Windows@@_NPAVIStoreLayoutHelper@2@PAUIRtlIdentityAuthority@4Identity@5@@Z
?InitializeDeltaCompressor@Rtl@Windows@@YGJPAX@Z
?InitializeStoreContext@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlIdentityAuthority@Rtl@Identity@Windows@@PAUIRtlAppIdAuthority@4AppId@6@PAUIRtlSystemIsolationLayer@46@2PAUIRtlKey@46@3AAVCRawInstallMap@InstallMap@@PAUIRtlDirectory@46@5@Z
?InitializeTlcCanonicalData@CRawStoreLayout@ComponentStore@@QAEJABVCApplicationAccessor@@PAUTlcData@2@PA_N@Z
?IsComponentFileDeltaOrLZMSCompressed@CRawStoreLayout@ComponentStore@@QAEJABUComponentData@2@ABU_LUNICODE_STRING@@PA_N@Z
?IsComponentFileStaged@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@PA_N@Z
?IsComponentFileStaged@CRawStoreLayout@ComponentStore@@SGJKABUComponentData@2@ABU_LUNICODE_STRING@@PA_N@Z
?IsDeltaCompressorAvailable@Rtl@Windows@@YGJPA_N@Z
?IsManifestCompressed@Rtl@Implementation@WCP@Windows@@YGJPBU_LBLOB@@PA_N@Z
?IsMobileStore@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
?IsPhysicallyOffline@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
?IsSafeMode@LocalInstallerServices@COM@WCP@Windows@@UAGJPA_N@Z
?IsSkuAssembly@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
?IsStateSeparated@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
?LZMSCompressFile@Rtl@WCP@Windows@@YGJPBU_LBLOB@@PAUIRtlFile@13@1@Z
?LZMSDecompressBuffer@Rtl@WCP@Windows@@YGJKPBU_LBLOB@@AAV?$Auto@U_LBLOB@@@3@@Z
?LZMSDecompressFile@Rtl@WCP@Windows@@YGJKPAUIRtlFile@13@0@Z
?LoadFirstResourceLanguageAgnostic@Rtl@Windows@@YGJKPAUHINSTANCE__@@PBG1PAU_LBLOB@@@Z
?LookupStringReplacement@MacroReplacement@@YGJKKABU_LUNICODE_STRING@@PAUIRtlSystemIsolationLayer@Rtl@Windows@@PAXPAUIRtlDefinitionIdentity@4Identity@5@PAV?$Auto@U_LUNICODE_STRING@@@5@PAK@Z
?ManuallyMarkComponentStaged@CRawStoreLayout@ComponentStore@@QAEJABVCComponentAccessor@@PBU_LBLOB@@@Z
?MarkServicingStackCorruptHelper@LocalInstallerServices@COM@WCP@Windows@@UAGJXZ
?Next@CXmlCursor@@QAEJXZ
?OpenComponentDerivedData@VersionedIndexHelper@ComponentStore@@QAEJ_NPBU_LUNICODE_STRING@@1PAUComponentData@2@PA_N@Z
?OpenFamilyMap@CRawInstallMap@InstallMap@@QAEJ_NPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAUMapForFamily@2@PA_N@Z
?ParseBase16String@Rtl@Implementation@WCP@Windows@@YGJKPBE0P6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@00@ZPAU_LBLOB@@PA_N@Z
?ParseDottedVersion@Rtl@Implementation@WCP@Windows@@YGJKPBE0P6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@00@ZPAT_FOUR_PART_VERSION@@PAKPA_N@Z
?ParseFromBlob@WcpManifest@@QAEJABU_LBLOB@@PAVStopWatch@Rtl@Windows@@@Z
?ParseFromBlob@WcpManifest@@QAEJW4ParseDocumentFlags@XmlParserGenerator@@ABU_LBLOB@@PAVStopWatch@Rtl@Windows@@@Z
?ParseGuid@Rtl@Implementation@WCP@Windows@@YGJPBE0P6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@00@ZPAU_GUID@@PA_N@Z
?ParseProcessorArchitecture@Rtl@Identity@Windows@@YGJABU_LUNICODE_STRING@@PAVPSEUDO_ARCH@123@PA_N@Z
?PoqWasExecutedInline@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
?ProcessChange@CCoordinator@PrimitiveInstaller@@QAEJABUComponentChange@2@@Z
?QueryComponentFlag@CRawStoreLayout@ComponentStore@@SGJABUComponentData@2@PA_NPAK@Z
?QueryConfigurationOption@CRawStoreLayout@ComponentStore@@QBEJABU_GUID@@KPAK@Z
?QueryConfigurationOption@CRawStoreLayout@ComponentStore@@QBEJABU_GUID@@_NPA_N@Z
?QueryInterface@LocalInstallerServices@COM@WCP@Windows@@UAGJABU_GUID@@PAPAX@Z
?QueryInterface@LocalTransformerServices@COM@WCP@Windows@@UAGJABU_GUID@@PAPAX@Z
?QuerySingleResourceOwnershipConfiguration@LocalInstallerServices@COM@WCP@Windows@@UAGJPA_N@Z
?QuerySmiHiveUpdatesConfiguration@LocalInstallerServices@COM@WCP@Windows@@UAGJPAK@Z
?QueryUnchangedFileVersions@VersionedIndexHelper@ComponentStore@@QAEJ_N0PAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@ABU_LBLOB@@PAV?$CVector@T_FOUR_PART_VERSION@@VCCallDisposition@Rtl@BUCL@@@BUCL@@PA_N@Z
?ReadAt@CBufferedStream@@QAEJ_KKPAXPAK@Z
?ReadKeyValue@ComponentStore@@YGJPAUIRtlKey@Rtl@Windows@@PBU_LUNICODE_STRING@@PAV?$Auto@U_LBLOB@@@4@PAPBU_KEY_VALUE_PARTIAL_INFORMATION@@PA_N@Z
?Release@LocalInstallerServices@COM@WCP@Windows@@UAGKXZ
?Release@LocalTransformerServices@COM@WCP@Windows@@UAGKXZ
?RemoveComponentImplication@CRawStoreLayout@ComponentStore@@QAEJABUComponentData@2@PAUTlcData@2@@Z
?RemoveInstallMarkFromFamily@CRawInstallMap@InstallMap@@QAEJPAUMapForFamily@2@ABT_FOUR_PART_VERSION@@@Z
?RemoveTlcMark@CRawStoreLayout@ComponentStore@@QAEJKABUTlcInstaller@2@PAUTlcData@2@@Z
?ReplaceMacros@LocalInstallerServices@COM@WCP@Windows@@UAGJKPB_WPAPA_WPAUIDefinitionIdentity@@@Z
?ReplaceMacros@LocalTransformerServices@COM@WCP@Windows@@UAGJKPB_WPAPA_WK@Z
?ReplaceSystemPathStringWithDefaultMacro@Rtl@ComponentMacroReplacement@@YGJW4ReplaceSystemPathStringWithDefaultMacroFlags@12@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@Windows@@PAW4ReplaceSystemPathStringWithDefaultMacroDisposition@12@@Z
?ReplaceVariablesInString@Rtl@Implementation@WCP@Windows@@YGJPBU_LBLOB@@P6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@PBE1@ZPAXP6GJ320PAU_RTL_SMART_LBLOB_UCSCHAR_WRITING_CONTEXT@@@ZP6IJKPAU_RTL_SMART_LBLOB_WRITING_CONTEXT@@@ZP6IJQBKK6@ZPAU5@@Z
?ResolvePendingPhases@COM@Windows@@YGJKPAVCQueueExecutor@12@PA_N@Z
?RtlCaptureTracingParameterList@Rtl@WCP@Windows@@YIXKKPADQAU_RTL_TRACING_PARAMETER@123@@Z
?RtlFormatIntoStreamFromParameterList@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@QBDKQBU_RTL_TRACING_PARAMETER@123@@Z
?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z
?RtlGetVersionResourceFromSelf@@YGXPAU_RTL_VERSION_RESOURCE@@@Z
?RtlIsTracingEnabled@Rtl@WCP@Windows@@YI_NPAU_RTL_TRACING_FACILITY@123@K@Z
?RtlRunPrimitiveOperationsInXmlAgainstSil@@YGJW4RtlRunPrimitivesFlags@@KPAUIRtlSystemIsolationLayer@Rtl@Windows@@PBU_LBLOB@@ABU?$Vector@QBU_UNICODE_STRING@@@4@P6GJPBU_UNICODE_STRING@@PAX@ZPBU_POQ_PROGRESS_INFORMATION@@PAU_POQ_CHECKPOINT_INFORMATION@@PAU_POQ_FAILURE_INFORMATION@@PAW4RtlRunPrimitivesDisposition@@@Z
?RtlShutdownTracing@Rtl@WCP@Windows@@YIXXZ
?RtlTraceEx@Rtl@WCP@Windows@@YIXPBU_RTL_TRACING_STATIC_DATA@123@QBQBX@Z
?RtlTraceFailureFromGroupList@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@PBU_RTL_TRACING_FAILURE_DATA@123@KQBU_RTL_FORMATTING_GROUP@123@@Z
?RtlTraceFormat@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBUIRtlSystemIsolationLayerWithPOQ@13@@Z
?RtlTraceFormat_FormattableObject@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_HANDLE@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_IRtlBaseIdentity@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_IRtlDefinitionAppId@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCBOOLEAN@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCFOUR_PART_VERSION@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCGUID@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCHRESULT@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLARGE_INTEGER_AsReadableTime@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLARGE_INTEGER_AsTime@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLBLOB@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLBLOB_AsBase64@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLBLOB_LimitLength@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLONG@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLUNICODE_STRING@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLUNICODE_STRING_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLUTF8_STRING@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCLUTF8_STRING_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCNTSTATUS@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCPCVOID@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCPCVOID_AsOptDerefPCVOID@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCSIZE_T@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCSTR_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONG@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONGLONG@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONGLONG_AsDecimalOnly@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONGLONG_AsTickDelta@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONG_AsDecimalOnly@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONG_AsHexadecimalOnly@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONG_AsHexadecimalOnly_ShortZero@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONG_AsRegValueType@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONG_AsSpecialCount@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONG_AsWin32Error@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCULONG_PTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCUNICODE_STRING@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCUSHORT_AsProcessorArchitecture@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCVOID@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCWSTR_Array@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCWSTR_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCbool@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_PCbool_AsSuccessIndicator@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFormat_RegistryValue@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?RtlTraceFromGroupList@Rtl@WCP@Windows@@YIXKPAU_RTL_TRACING_FACILITY@123@PBU_RTL_TRACING_FAILURE_DATA@123@KQBU_RTL_FORMATTING_GROUP@123@@Z
?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z
?RtlWcpParseManifestFromXml@Rtl@Implementation@WCP@Windows@@YGJKPBU_LBLOB@@PAUIParseErrorCallback@1Microdom@4@PAUIRtlManifestParseErrorCallback@1ManifestParser@4@PAV?$Auto@PAVIRtlCdf@Rtl@Cdf@Windows@@@4@@Z
?RtlpSetSystem@WcpDllDebug@@YGJKPAUIRtlSystemIsolationLayer@Rtl@Windows@@@Z
?Scavenge@CRawStoreLayout@ComponentStore@@QAEJ_NABUScavengeControl@12@PAUIRtlDirectory@Rtl@Windows@@PAUIScavengeLastDitch@12@@Z
?SetComponentFileStageFlag@CRawStoreLayout@ComponentStore@@QAEJ_NPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@@Z
?SetComponentFlag@CRawStoreLayout@ComponentStore@@QAEJ_NKABUComponentData@2@@Z
?SetComponentFlag@CRawStoreLayout@ComponentStore@@QAEJ_NKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@@Z
?SetFamilyWinningVersion@CRawInstallMap@InstallMap@@QAEJPAUMapForFamily@2@PAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@@Z
?ShouldRunAIs@ExecutionQueueDeriver@AiQueue@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PA_N@Z
?SilCreateDirectories@Rtl@Windows@@YGJPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@@Z
?SilCreateKeys@Rtl@Windows@@YGJPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@@Z
?SilGetRegistryDWORD@Rtl@Windows@@YGJKPAUIRtlKey@12@ABU_LUNICODE_STRING@@PAK2@Z
?SilGetRegistryDWORD@Rtl@Windows@@YGJKPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@1PAK2@Z
?SilGetRegistryString@Rtl@Windows@@YGJKPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@1PAV?$Auto@U_LUNICODE_STRING@@@2@PAK@Z
?SplitWin32RegistryPathIntoBaseAndSubKey@COM@Windows@@YGJPBGPAPAUHKEY__@@PAPBG@Z
?TraceChangeList@Rtl@ComponentStore@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
?TraceETWEvent@Rtl@WCP@Windows@@YAXU_EVENT_DESCRIPTOR@@PBGZZ
?TrimNamespaceTable@CC14NCanonicalizer@@MAEJUElement@Rtl@Microdom@Windows@@PAVCNamespaceTable@@PAVCAttributeTable@@@Z
?TryGetRollbackStorageDirectory@LocalTransformerServices@COM@WCP@Windows@@UAGJKPAPAUIRtlDirectory@Rtl@4@@Z
?TryGetRollbackStorageKey@LocalTransformerServices@COM@WCP@Windows@@UAGJKPAPAUIRtlKey@Rtl@4@@Z
?TryGetWin32DirectoryRollbackStoragePath@COM@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@PAPAG@Z
?TryGetWin32RegistryRollbackStoragePath@COM@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@PAPAUHKEY__@@PAPAG@Z
?VerifyAdvancedInstaller@LocalInstallerServices@COM@WCP@Windows@@UAGJPB_W00PAK@Z
?VerifyCertChainRoot@CCatalog@@QAEJKPAK@Z
?VerifySigner@CCatalog@@QAEJPAUIRtlSystemIsolationLayer@Rtl@Windows@@@Z
?VirtualNtRegistryPathToPhysical@Rtl@Transformers@WCP@Windows@@YGJPAUICSITransformerServices@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@4@K@Z
?VirtualPathToPhysical@LocalInstallerServices@COM@WCP@Windows@@UAGJKPB_WPAPA_W@Z
?VirtualWin32RegistryPathToPhysical@COM@Transformers@WCP@Windows@@YGJPAUICSITransformerServices@@PBGPAPAUHKEY__@@PAPAGK@Z
?WriteAt@CBufferedStream@@QAEJ_KKPBXPAK@Z
?get_IsolationAllocator@LocalInstallerServices@COM@WCP@Windows@@UAGJPAPAUIMalloc@@@Z
?get_RebootIndicator@LocalInstallerServices@COM@WCP@Windows@@UAGJPAW4RebootIndicators@@@Z
?get_System@LocalInstallerServices@COM@WCP@Windows@@UAGJPAPAUIRtlSystemIsolationLayerPublic@Rtl@4@@Z
?get_TargetProcessorArchitecture@LocalInstallerServices@COM@WCP@Windows@@UAGJPAK@Z
?get_UserProfile@LocalInstallerServices@COM@WCP@Windows@@UAGJPAPAUIRtlUserProfile@Rtl@4@@Z
?put_RebootIndicator@LocalInstallerServices@COM@WCP@Windows@@UAGJW4RebootIndicators@@@Z
?utiludom_GetElementImmediateChildrenByName@@YGJPAUIRtlMicrodom@Rtl@Microdom@Windows@@UElement@234@PBU_LUTF8_STRING@@2PAV?$Auto@U?$Vector@UElement@Rtl@Microdom@Windows@@@Windows@@@4@@Z
?utiludom_GetElementNameDetails@@YGJPAUIRtlMicrodom@Rtl@Microdom@Windows@@UElement@234@PAPBU_LUTF8_STRING@@22@Z
AddTrusteeCapabilities
AllocateTrusteeData
ApplyTransactionPOQsToSil
ConvertHResultToNtStatus
ConvertNtStatusToHResult
CreateNewOfflineStore
CreateNewPseudoWindows
CreateNewPseudoWindowsEx
CreateNewWindows
DelayExecution
DeleteTrusteeCapabilities
DeleteTrusteeData
DismountRegistryHives
DllCsiGetHandler
EnumerateFileRedirections
EnumerateRegistryRedirections
ExecuteMidgroundInstallers
ExpandAndNullTerminateEnvironmentVariableString
FreeAndZeroCSI_BROKEN_COMPONENT
FreeAndZeroCSI_REPAIRED_COMPONENT
FreeRedirectionsMemory
GetAppIdAuthority
GetFriendlyInstallerName
GetGroupTrusteeDataCountFromManifest
GetGroupTrusteeDataFromManifest
GetIdentityAuthority
GetPrimitiveInstallerSupport
GetSystemStore
GetVersionString
InitializeCSI_BROKEN_COMPONENT
InitializeCSI_REPAIRED_COMPONENT
IsCompactOSEnabled
IsIdentityPnPDriver
IsSkuAssembly
MapToPrivilegeName
MapToWellKnownSidType
MergeTwoChangeLists
ORAdvanceSubkeyEnumerator
ORAdvanceValueEnumerator
ORCleanupSubkeyEnumerator
ORCleanupValueEnumerator
ORCloseHive
ORCloseKey
ORCreateHive
ORCreateKey
ORDeleteKey
ORDeleteValue
ORGetKeySecurity
ORGetValue
ORInitializeSubkeyEnumerator
ORInitializeValueEnumerator
OROpenHive
OROpenKey
ORQueryInfoKey
ORQuerySubkeyEnumerator
ORQueryValueEnumerator
ORSaveHive
ORSetKeySecurity
ORSetValue
ORStartSubkeyEnumerator
ORStartValueEnumerator
OpenExistingOfflineStore
ParseManifest
ParseManifestEx
PoqParsePoqexecLog
RtlAllocateLBlob
RtlAllocateLUnicodeString
RtlAllocateLUtf8String
RtlAllocateUnicodeString
RtlAppendLUnicodeStringToLUnicodeString
RtlAppendLUtf8StringToLUnicodeString
RtlAppendLUtf8StringToLUtf8String
RtlAppendUcsCharacterToLUnicodeString
RtlAppendUcsCharactersToLUnicodeString
RtlBase64EncodeLBlobToLUnicodeString
RtlCalculateUtf16StringLengthFromLUtf8String
RtlCombineNtPathSegments
RtlCommitSmartLBlobUcsWritingContext
RtlCompareEncodedLBlobs
RtlCompareLUnicodeStringToLUtf8String
RtlCompareLUnicodeStrings
RtlCompareLUtf8Strings
RtlConcatenateLUnicodeStrings
RtlConcatenateLUtf8Strings
RtlConvertNtFilePathToWin32FilePath
RtlConvertNtRegistryPathToWin32RegistryPath
RtlConvertWin32FilePathToNtFilePath
RtlConvertWin32RegistryPathToNtRegistryPath
RtlConvertWin32RegistryPathToNtRegistryPathWithSid
RtlCopyLBlob
RtlCopyLUnicodeString
RtlCopyLUtf8String
RtlCopyLUtf8StringToLUnicodeString
RtlCreateCdfEx
RtlCreateDefaultMicrodomXmlWriter
RtlCreateDefaultXmlWriter
RtlCreateMicrodom
RtlCreateMicrodomUpdateContext
RtlCreateUpdatedMicrodomAsMicrodom
RtlCreateUpdatedMicrodomAsUtf8
RtlCreateUtf16LEUCSStringBuilder
RtlCreateUtf8UCSStringBuilder
RtlDeallocateUnicodeString
RtlDecodeBase64LUnicodeStringToLBlob
RtlDecodeBase64LUtf8StringToLBlob
RtlDecodeUtf16LE
RtlDecodeUtf8
RtlDestroyGrowingList
RtlDestroyMicrodomUpdateContext
RtlDetermineTranscodedLBlobSize
RtlDoesLUnicodeStringMatchExpression
RtlDowncaseUCSCharacter
RtlDuplicateCountedStringToLUnicodeString
RtlDuplicateLBlob
RtlDuplicateLUnicodeString
RtlDuplicateLUnicodeStringToLUtf8String
RtlDuplicateLUtf8String
RtlDuplicateLUtf8StringToLUnicodeString
RtlDuplicateNullTerminatedAnsiStringToLUnicodeString
RtlDuplicateNullTerminatedStringToLUnicodeString
RtlDuplicateUnicodeStringToLUnicodeString
RtlDuplicateUnicodeStringToLUtf8String
RtlEncodeUtf16LE
RtlEncodeUtf8
RtlEqualLUnicodeStringPrefix
RtlEqualLUnicodeStringSuffix
RtlEqualLUnicodeStrings
RtlEqualLUtf8StringPrefix
RtlEqualLUtf8Strings
RtlExecuteXPathOverMicrodom
RtlFilterLUnicodeString
RtlFinalizeSmartLBlobUcsWritingContext
RtlFreeLBlob
RtlFreeLUnicodeString
RtlFreeLUtf8String
RtlGetAppIdAuthority
RtlGetCharacterSetDecoder
RtlGetDirectSystem
RtlGetEncodingSizeUtf16
RtlGetEncodingSizeUtf8
RtlGetHashAlgorithmHashLength
RtlGetIdentityAuthority
RtlGetSystem
RtlHashLBlob
RtlHashLUnicodeString
RtlHashLUtf8String
RtlIndexIntoGrowingList
RtlInitLUnicodeStringFromNullTerminatedString
RtlInitLUnicodeStringFromUnicodeString
RtlInitUnicodeStringFromLUnicodeString
RtlInitializeGrowingList
RtlInitializeSmartLBlobWritingContext
RtlInitializeSmartLUnicodeStringWritingContext
RtlInitializeSmartLUtf8StringWritingContext
RtlIsLBlobValid
RtlIsLUnicodeStringValid
RtlLengthOfUcsCharacterEncodedAsUtf8
RtlMatchLUnicodeStringAgainstLUtf8StringList
RtlMatchLUnicodeStringAgainstList
RtlMatchLUnicodeStringAgainstPointerList
RtlMatchLUtf8StringAgainstList
RtlMatchLUtf8StringAgainstPointerList
RtlMicrodomUpdateCreateAttributeNs
RtlMicrodomUpdateCreateElementNs
RtlMicrodomUpdateCreateTextual
RtlMicrodomUpdateGetCookieForExistingAttribute
RtlMicrodomUpdateGetCookieForExistingElement
RtlMicrodomUpdateGetCookieForExistingNode
RtlMicrodomUpdateInsertChild
RtlMicrodomUpdateInsertMicrodomNode
RtlMicrodomUpdateRemoveChild
RtlMicrodomUpdateRemoveElement
RtlMicrodomUpdateSetNodeName
RtlMicrodomUpdateSetNodeTextContent
RtlMurmurHashLBlob
RtlNsDestroy
RtlNsInitialize
RtlParseDottedVersion
RtlParseManifestMicrodomIntoCdf
RtlPreInitializeSmartLBlobUcsWritingContext
RtlReallocateLBlob
RtlReallocateLUnicodeString
RtlReallocateLUtf8String
RtlReallocateUnicodeString
RtlRegisterErrorOriginationCallback
RtlReplaceSystemPathMappings
RtlReportErrorOrigination
RtlReportErrorPropagation
RtlSmartMultiUcsEncoder_Utf16LE
RtlSmartMultiUcsEncoder_Utf8
RtlSmartUcsEncoder_Utf16LE
RtlSmartUcsEncoder_Utf8
RtlSplitEncodedLBlob
RtlSplitLUnicodeString
RtlSplitLUtf8String
RtlSplitNtPath
RtlSplitWin32RegistryPathIntoRootAndLeaves
RtlTranscodeLBlobs
RtlUpcaseUCSCharacter
RtlWcpDllDebugEntrypoint
RtlWriteDecodedUcsDataIntoSmartLBlobUcsWritingContext
RtlWriteMicrodomXml
RtlWriteUcsDataIntoSmartLBlobUcsWritingContext
RtlXmlCloneRawTokenizationState
RtlXmlCopyStringOut
RtlXmlDefaultCompareStrings
RtlXmlDestroyNextLogicalThing
RtlXmlDetermineStreamEncoding
RtlXmlExtentToString
RtlXmlExtentToUtf8String
RtlXmlInitializeNextLogicalThing
RtlXmlInitializeTokenization
RtlXmlNextLogicalThing
RtlXmlNextToken
SetIsolationIMalloc
SilCreateBufferedSil
SilCreateRerootedSil
WcpInitialize
WcpReportExternalErrorOrigination
WcpSetHelperCallback
WcpShutdown
WriteWinnersFromChangelist
_ORCreateHiveEx@8
_OREnumKey@28
_OREnumValue@28
_ORFlushHive@4
_ORGetVirtualFlags@8
_OROpenHiveByHandle@8
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ