v6[.]19[.]2_installer_x64_[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

v6.19.2_installer_x64_.zip
Size

52.2MB
MD5

6426389941195cb9bfb318a692ef7efb
SHA1

71157ec5d5141e2b02c2a7df56ced4f282dfd8dd
SHA256

5238ee7d5c277bed2b000c1c39f1654a780051433b2b39bbbbc3c08acea1ef88
SHA512

091714f4023bf599f3962628a1980900e28d082d476cfb5d58b478131deadcfe4d3a636f7c8bec2399bf5502b1e3ebb08fce4b681dbdf131bec4897fb47524f5
SSDEEP

1572864:Bp+AkxOx6mkMspNbawUPlE6Z7NqR2nWXHxMW:9+M6mk5pshPlE6Z7NqR2nYMW

Score

3^/10

Malware Config

Signatures

Unsigned PE 21 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PerceptionSimulation/PerceptionSimulationInput.dll
unpack001/PerceptionSimulation/SixDofControllerManager.ProxyStubs.dll
unpack001/PerceptionSimulation/VirtualCameraManager.dll
unpack001/PerceptionSimulation/VirtualDisplayManager.ProxyStubs.dll
unpack001/SHARED/ChxUserDictDS.DLL
unpack001/SHARED/ImeSystrayMenu.dll
unpack001/SHARED/JpnKorRoaming.dll
unpack001/SHARED/MoIME_ps.dll
unpack001/WinBioPlugIns/NUIVoiceWBSAdapters.dll
unpack001/WinBioPlugIns/winbiosensoradapter.dll
unpack001/WinBioPlugIns/winbiostorageadapter.dll
unpack001/WinBioPlugIns/winbiovsmstorageadapter.dll
unpack001/oobe/msoobeFirstLogonAnim.dll
unpack001/oobe/msoobedui.dll
unpack001/oobe/msoobeplugins.dll
unpack001/oobe/msoobewirelessplugin.dll
unpack001/oobe/oobecoreadapters.dll
unpack001/wbem/MMFUtil.dll
unpack001/wbem/mofd.dll
unpack001/wbem/mofinstall.dll
unpack001/wbem/msdtcwmi.dll

Files

v6.19.2_installer_x64_.zip
.zip
PerceptionSimulation/PerceptionSimulationInput.dll
.dll windows:10 windows x64 arch:x64

9e6fff2f92245c27e084f0c265fd241f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

PerceptionSimulationInput.pdb

Imports

msvcp_win

?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_init_in_situ
_Mtx_init_in_situ
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Cnd_broadcast
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_XGetLastError@std@@YAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_lock
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_wait
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
_Mtx_unlock
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Xbad_alloc@std@@YAXXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xlength_error@std@@YAXPEBD@Z
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
_Wcsxfrm
_Wcscoll
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$collate@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memmove
_o__wtoi
_o_free
_o_malloc
_o_realloc
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler3
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
wcsrchr
strchr
wcsstr
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcslen

shlwapi

PathRemoveFileSpecW

api-ms-win-appmodel-unlock-l1-1-0

IsDeveloperModeEnabled

xinput1_4

ord2

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
LoadStringW
GetModuleFileNameW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseMutex
CreateEventExW
ResetEvent
CreateSemaphoreExW
CreateMutexExW
SetEvent
ReleaseSRWLockShared
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
OpenMutexW
EnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForSingleObjectEx
InitializeSRWLock
CreateEventW
AcquireSRWLockExclusive
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsDuplicateString
WindowsGetStringLen
WindowsIsStringEmpty

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoGetContextToken
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegGetValueW

oleaut32

SysFreeString
SysAllocString

wincorlib

?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
??0InvalidArgumentException@Platform@@QE$AAA@XZ
??0NullReferenceException@Platform@@QE$AAA@XZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
??0DisconnectedException@Platform@@QE$AAA@XZ
??0Delegate@Platform@@QE$AAA@XZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?GetType@Object@Platform@@QE$AAAPE$AAVType@2@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0ChangedStateException@Platform@@QE$AAA@XZ
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?ToString@int32@default@@QEAAPE$AAVString@Platform@@XZ
??0AccessDeniedException@Platform@@QE$AAA@XZ
?InitializeData@Details@Platform@@YAJH@Z
?UninitializeData@Details@Platform@@YAXH@Z
?__abi_FailFast@@YAXXZ
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z

ntdll

RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData

credui

CredUIPromptForCredentialsW

user32

IsWindowVisible
UnhookWindowsHookEx
SetWindowsHookExW
KillTimer
SetTimer
GetForegroundWindow
CallNextHookEx
ShowWindow
GetParent
SetWindowPos
EqualRect
GetClientRect
MonitorFromRect
GetPhysicalCursorPos
WindowFromPhysicalPoint
ScreenToClient
IsIconic
ReleaseCapture
ShowCursor
GetKeyState
SetParent
SetWindowLongW
DefWindowProcW
RegisterWindowMessageW
SetCapture
BeginPaint
EndPaint
PostQuitMessage
CreateWindowExW
IsWindow
PostMessageW
FindWindowW
LoadIconW
RegisterClassExW
GetMessageW
TranslateMessage
DispatchMessageW
GetKeyboardState
wsprintfW
SetCursorPos
SetFocus
SendInput
GetCursorPos
GetSystemMetrics
FindWindowExW
GetWindowLongW
GetWindowRect
GetAncestor

gdi32

CreateSolidBrush

comdlg32

GetOpenFileNameW

api-ms-win-rtcore-ntuser-shell-l1-1-0

DeregisterShellHookWindow
RegisterShellHookWindow

api-ms-win-shcore-scaling-l1-1-1

GetScaleFactorForMonitor

api-ms-win-core-shlwapi-legacy-l1-1-0

PathStripPathW
PathFindExtensionW

api-ms-win-core-util-l1-1-0

DecodePointer

inputcontroller

CreateInputControllerEx

perceptionsimulationmanager

LoadPerceptionSimulationRecording
CreatePerceptionSimulationManager

api-ms-win-crt-math-l1-1-0

tanf
sqrtf

Exports

Exports

CloseSimulationConnection
HidePerceptionSimulationControlUx
ShowPerceptionSimulationControlUx
StartPerceptionSimulationControlUx
StopPerceptionSimulationControlUx
TogglePerceptionSimulationControlUx
UpdatePerceptionSimulationControlUx

Sections

.text
Size: 747KB - Virtual size: 747KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 341KB - Virtual size: 341KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PerceptionSimulation/SixDofControllerManager.ProxyStubs.dll
.dll regsvr32 windows:10 windows x64 arch:x64

4bc1e878581971900e09f50a5d0dbb69

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

SixDofControllerManager.ProxyStubs.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
_o___std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

memset

rpcrt4

NdrDllRegisterProxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
NdrOleFree
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrOleAllocate

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient4
ObjectStublessClient5

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PerceptionSimulation/VirtualCameraManager.dll
.dll regsvr32 windows:10 windows x64 arch:x64

75e3ba21d88065c9a9e470307b1fc7ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

VirtualCameraManager.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
__C_specific_handler
__CxxFrameHandler3
_o__callnewh
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_o__cexit

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject
EnterCriticalSection
DeleteCriticalSection
ReleaseMutex
LeaveCriticalSection
ResetEvent
WaitForSingleObjectEx
InitializeCriticalSectionEx
OpenSemaphoreW
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegCreateKeyExW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWait

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

dcomp

DCompositionCreateDevice3

api-ms-win-crt-math-l1-1-0

tanf

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PerceptionSimulation/VirtualDisplayManager.ProxyStubs.dll
.dll regsvr32 windows:10 windows x64 arch:x64

6b5c7bae3579138583b5521c32542eba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

VirtualDisplayManager.ProxyStubs.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcmp
__C_specific_handler
_o___std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

memset

rpcrt4

NdrDllRegisterProxy
CStdStubBuffer_Invoke
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
NdrOleFree
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient7
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SHARED/ChxUserDictDS.DLL
.dll windows:10 windows x64 arch:x64

0b3124abbeed556277f274890c313fe6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ChxUserDictDS.pdb

Imports

msvcrt

_vsnwprintf
_vsnprintf_s
memmove_s
wcschr
tolower
??3@YAXPEAX@Z
memcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
wcsncmp
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_callnewh
malloc
free
qsort
wcscpy_s
fwprintf_s
fclose
_wfopen_s
memcpy_s
__C_specific_handler
??_V@YAXPEAX@Z
_purecall
__CxxFrameHandler3
_XcptFilter
?terminate@@YAXXZ
floorf
memset

advapi32

GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSid
OpenProcessToken
ConvertSidToStringSidW
RegGetValueW

kernel32

CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
FormatMessageW
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
GetModuleHandleExW
ReleaseSemaphore
SetLastError
CreateSemaphoreExW
GetModuleFileNameA
GetFileSize
LocalFree
CreateMutexExW
AcquireSRWLockShared
GetModuleHandleW
GetProcAddress
HeapFree
GetProcessHeap
DebugBreak
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WriteFile
SetEndOfFile
CreateFileW
GetLastError
FlushViewOfFile
DeleteFileW
CloseHandle
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
IsDebuggerPresent
MulDiv
WakeAllConditionVariable
SleepConditionVariableSRW
HeapReAlloc

oleaut32

SysStringLen
SysAllocString
SysFreeString
SysAllocStringLen

api-ms-win-core-memory-l1-1-1

PrefetchVirtualMemory

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance

shell32

SHCreateDirectoryExW
SHGetKnownFolderPath

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SHARED/ImeSystrayMenu.dll
.dll windows:10 windows x64 arch:x64

8c3b66a26902b144fc49045e4f769d2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ImeSystrayMenu.pdb

Imports

msvcrt

_initterm
malloc
free
__C_specific_handler
_XcptFilter
_purecall
__CxxFrameHandler3
??3@YAXPEAX@Z
_lock
_unlock
__dllonexit
_onexit
_amsg_exit
memmove
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
??1type_info@@UEAA@XZ

kernel32

GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
AcquireSRWLockShared
ReleaseSRWLockShared
DisableThreadLibraryCalls
DecodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitOnceExecuteOnce
EncodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SHARED/JpnKorRoaming.dll
.dll windows:10 windows x64 arch:x64

428a049f2fb095d23252c19c392fe6e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

JpnKorRoaming.pdb

Imports

msvcrt

_unlock
__dllonexit
_onexit
memmove
free
??1exception@@UEAA@XZ
_purecall
_vsnprintf_s
_XcptFilter
malloc
realloc
memmove_s
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
??1type_info@@UEAA@XZ
_time32
_CxxThrowException
??0exception@@QEAA@XZ
memcpy
_amsg_exit
_initterm
__C_specific_handler
?terminate@@YAXXZ
??0exception@@QEAA@AEBV0@@Z
_lock
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
memset

advapi32

RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW
RegSetKeyValueW
ConvertSidToStringSidW
IsValidSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegGetValueW
EventActivityIdControl
EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister

kernel32

SetEvent
OpenEventW
GetCurrentProcess
GetSystemTimeAsFileTime
ReleaseSRWLockShared
InitializeSRWLock
RaiseException
InitOnceComplete
InitOnceBeginInitialize
GetFileSize
GetFileTime
CreateFileW
MoveFileExW
LocalFree
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetTickCount
FindStringOrdinal
AcquireSRWLockShared
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
GetFileAttributesW
AcquireSRWLockExclusive
CompareStringOrdinal
ReleaseSRWLockExclusive

ole32

CoCreateFreeThreadedMarshaler
CoGetMalloc
CoTaskMemFree
CoCreateInstance
PropVariantClear
CoTaskMemAlloc

oleaut32

SysFreeString

shell32

ord165

shlwapi

ord219
SHSetValueW
SHCreateStreamOnFileEx
PathFindFileNameW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoTransformError

shcore

SHDeleteKeyW
SHCreateMemStream
ord100
IStream_Reset
SHRegGetValueW

propsys

InitPropVariantFromBuffer
PSCreateMemoryPropertyStore

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SHARED/MoIME_ps.dll
.dll regsvr32 windows:10 windows x64 arch:x64

8a61d57f60268d146110cd6a863bbf92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MoIME_ps.pdb

Imports

msvcrt

__C_specific_handler
_XcptFilter
_initterm
malloc
free
_amsg_exit

kernel32

GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
QueryPerformanceCounter
DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter

oleaut32

BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal64
BSTR_UserMarshal
BSTR_UserFree64
BSTR_UserSize64
BSTR_UserMarshal64
BSTR_UserUnmarshal

rpcrt4

CStdStubBuffer_Connect
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
CStdStubBuffer_Disconnect
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
IUnknown_QueryInterface_Proxy

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient4

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinBioPlugIns/FaceBootstrapAdapter.dll
.dll windows:10 windows x64 arch:x64

b86b775ded6e4965bc085ca37be2cd29

Code Sign

33:00:00:04:5c:3d:56:72:66:6c:b7:54:17:00:00:00:00:04:5c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14/09/2023, 18:20

Not After

04/09/2024, 18:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:61:69:1c:39:35:48:84:18:fa:2c:72:f5:28:90:7c:41:4f:f2:25:78:04:c7:2e:99:18:32:83:6f:df:bf:fe
Signer

Actual PE Digest

9b:61:69:1c:39:35:48:84:18:fa:2c:72:f5:28:90:7c:41:4f:f2:25:78:04:c7:2e:99:18:32:83:6f:df:bf:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

FaceBootstrapAdapter.pdb

Imports

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales

api-ms-win-crt-string-l1-1-0

__strncnt
wcsnlen
strcspn
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__free_base
_o__fseeki64
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__lock_file
_o__malloc_base
_o__purecall
_o__realloc_base
_o__register_onexit_function
_o__seh_filter_dll
_o__Strftime
_o__unlock_file
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__wcsdup
_o__Wcsftime
_o__wfsopen
_o_abort
_o_calloc
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_frexp
_o_fsetpos
_o_fwrite
_o_islower
_o_isspace
_o_isupper
_o_ldexp
_o_localeconv
_o_malloc
_o_pow
_o_powf
_o_realloc
_o_setlocale
_o_setvbuf
_o_strtod
_o_strtof
_o_terminate
_o_tolower
_o_towupper
_o_ungetc
_o_ungetwc
_o_wcscpy_s
__uncaught_exception
__C_specific_handler
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__CxxFrameHandler3
memchr
memcmp
memcpy
memmove

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

ext-ms-win-rtcore-ntuser-cursor-l1-1-0

SetCursor
LoadCursorW

api-ms-win-rtcore-ntuser-window-l1-1-0

PeekMessageW
TranslateMessage
PostQuitMessage
DispatchMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
ReleaseMutex
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateMutexExW
ReleaseSRWLockShared
ResetEvent
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSemaphore
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
CreateEventW
ReleaseSRWLockExclusive
CreateEventExW
LeaveCriticalSection
CreateSemaphoreExW
EnterCriticalSection
OpenSemaphoreW
AcquireSRWLockShared
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW
GetPersistedFileLocationW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetExitCodeThread

api-ms-win-core-localization-l1-2-0

GetCPInfo
LCMapStringEx
GetLocaleInfoEx
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventActivityIdControl
EventWriteTransfer
EventSetInformation

api-ms-win-devices-config-l1-1-1

CM_MapCrToWin32Err
CM_Open_DevNode_Key
CM_Open_Device_Interface_KeyW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_List_SizeW
CM_Locate_DevNodeW
CM_Get_Device_Interface_ListW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoUninitialize
StringFromGUID2
CoGetApartmentType
StringFromCLSID
CoTaskMemAlloc
CoWaitForMultipleHandles

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegGetValueW
RegCreateKeyExW

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDuplicateString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

api-ms-win-core-file-l1-1-0

GetFileAttributesW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
CompareStringEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

rpcrt4

UuidCreate

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoTransformError
SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

newdev

UpdateDriverForPlugAndPlayDevicesW
DiInstallDriverW

ole32

CoInitialize
CoGetObject

winbio

WinBioGetEnrolledFactors

Exports

Exports

WbioQueryEngineInterface
WbioQuerySensorInterface
WbioQueryStorageInterface

Sections

.text
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinBioPlugIns/NUIVoiceWBSAdapters.dll
.dll windows:10 windows x64 arch:x64

74032b8f717a313a46ad8f2cd822deba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

NUIVoiceWBSAdapters.pdb

Imports

msvcrt

_snprintf_s
_amsg_exit
_initterm
memset
powf
sin
fclose
fprintf_s
_vsnprintf_s
fopen
__CxxFrameHandler3
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
sinf
__C_specific_handler
_XcptFilter
_callnewh
_vsnwprintf
_lock
malloc
_unlock
__dllonexit
_onexit
free
strcpy_s
sqrt
wcscpy_s
vsprintf_s
_vscprintf
strchr
_purecall
memcpy_s
swprintf_s
fprintf
strcat_s
_CxxThrowException
atan2f
cos
cosf
expf
log10f
logf
memcmp
memcpy
memmove
sqrtf

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetModuleHandleExW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
ReleaseSemaphore
ResetEvent
WaitForSingleObject
CreateEventW
SetEvent
EnterCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
DeleteCriticalSection
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
InitializeCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

ntdll

RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

mfplat

MFCreateMemoryBuffer

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpool
CloseThreadpoolCleanupGroup

api-ms-win-core-file-l1-1-0

GetFileSize
CreateFileA
ReadFile
WriteFile

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

Exports

Exports

WbioQueryEngineInterface
WbioQuerySensorInterface

Sections

.text
Size: 480KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinBioPlugIns/winbiosensoradapter.dll
.dll windows:10 windows x64 arch:x64

702289644f1e8e3f5f23ac37a066e759

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WinBioSensorAdapter.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
__C_specific_handler
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler4
_CxxThrowException

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-io-l1-1-0

CancelIoEx
DeviceIoControl
GetOverlappedResult

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Exports

Exports

WbioQuerySensorInterface

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinBioPlugIns/winbiostorageadapter.dll
.dll windows:10 windows x64 arch:x64

627226df4150ff7dcc6e35e01c00395d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WinBioStorageAdapter.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
FindStringOrdinal

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptExportKey
BCryptDestroyKey
BCryptImportKey
BCryptSetProperty
BCryptEncrypt
BCryptDecrypt
BCryptCloseAlgorithmProvider

api-ms-win-core-file-l1-1-0

ReadFile
LockFileEx
DeleteFileW
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
SetFileInformationByHandle
FlushFileBuffers
WriteFile
CreateFileW
CreateDirectoryW
UnlockFileEx

crypt32

CryptProtectData
CryptUnprotectData

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-path-l1-1-0

PathCchSkipRoot

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-file-l2-1-0

ReplaceFileW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-security-base-l1-1-0

EqualSid
IsValidSid

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Exports

Exports

WbioQueryStorageInterface

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinBioPlugIns/winbiovsmstorageadapter.dll
.dll windows:10 windows x64 arch:x64

e83140c4d4b1e8c69ff8c8ac16989368

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WinBioVsmStorageAdapter.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FindStringOrdinal
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-path-l1-1-0

PathCchSkipRoot

api-ms-win-core-file-l1-1-0

DeleteFileW
SetFileInformationByHandle
ReadFile
CreateFileW
CreateDirectoryW
SetFilePointerEx
UnlockFileEx
LockFileEx
WriteFile

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-file-l2-1-0

ReplaceFileW

api-ms-win-security-base-l1-1-0

EqualSid

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

Exports

Exports

WbioQueryStorageInterface

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
app__v6.19.2_.msi
.msi
oobe/diagER.dll
.dll windows:10 windows x64 arch:x64

a6dfab2f841183f78d7ba325d5888c10

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:6e:e0:ff:39:f2:b9:8a:3b:f1:2b:a6:19:64:5a:ef:12:79:4c:c8:be:b3:18:d7:ba:2f:12:9c:2d:67:c8:04
Signer

Actual PE Digest

78:6e:e0:ff:39:f2:b9:8a:3b:f1:2b:a6:19:64:5a:ef:12:79:4c:c8:be:b3:18:d7:ba:2f:12:9c:2d:67:c8:04

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

diagER.pdb

Imports

msvcrt

malloc
free
fwprintf
_callnewh
_XcptFilter
_wfopen
fclose
_vsnwprintf
_amsg_exit
_initterm
__C_specific_handler
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
_CxxThrowException
wcsrchr
_purecall
__CxxFrameHandler3
memset

advapi32

RegCloseKey
RegDeleteKeyExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW

kernel32

GetExitCodeProcess
LoadLibraryExW
GetDriveTypeW
QueryPerformanceCounter
GetTickCount
MapViewOfFile
CreateFileMappingW
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualQuery
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
VirtualProtect
GlobalUnlock
OpenProcess
GetLastError
GetUserDefaultLangID
GetModuleFileNameW
GetTempPathW
WaitForSingleObject
CloseHandle
CopyFileW
CreateDirectoryW
ReadFile
GetVolumeInformationW
GetLogicalDrives
FindFirstFileW
HeapCreate
HeapFree
SetLastError
EnterCriticalSection
VirtualFree
GetCommandLineW
GetFullPathNameW
FindNextFileW
GetCurrentProcess
WriteFile
ExpandEnvironmentStringsW
GetShortPathNameW
GetDiskFreeSpaceW
VirtualAlloc
TerminateProcess
RemoveDirectoryW
SetFileTime
LeaveCriticalSection
InitializeCriticalSection
SetErrorMode
SetFilePointer
SetEndOfFile
WaitForMultipleObjectsEx
FindClose
GetLocaleInfoW
CreateFileW
GetFileAttributesW
GetCurrentThreadId
OpenEventW
GetVersionExW
GetComputerNameExW
HeapWalk
UnmapViewOfFile
DuplicateHandle
HeapValidate
DebugBreak
SetFileAttributesW
GetLogicalDriveStringsW
CreateEventW
GetPrivateProfileStringW
Sleep
GlobalSize
SetEvent
GetDiskFreeSpaceExW
GetVersionExA
GlobalAlloc
DeleteFileW
GlobalFree
HeapReAlloc
RaiseException
GetSystemInfo
CreateThread
ResetEvent
HeapAlloc
GetOverlappedResult
HeapCompact
HeapDestroy
GetWindowsDirectoryW
GetProcAddress
GlobalLock
MoveFileExW
GetFileSize
DeleteCriticalSection
ExitProcess
GetProcessHeap
CreateProcessW
FreeLibrary
GetTempFileNameW
CreateProcessA
GetFileType
GlobalMemoryStatus
CopyFileExW
LoadLibraryExA

ntdll

RtlAllocateHeap
RtlFreeHeap

shell32

ShellExecuteExW
ExtractIconExW

user32

CharNextW

wdscore

WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP
WdsSetupLogInit
WdsSetupLogDestroy

Exports

Exports

??0CDwWinER@@QEAA@AEBV0@@Z
??0CDwWinER@@QEAA@PEBGH@Z
??0CWfpER@@QEAA@AEBV0@@Z
??0CWfpER@@QEAA@PEBGW4_DIAG_REPORT_TYPE@@H@Z
??0IDiagER@@QEAA@AEBV0@@Z
??0IDiagER@@QEAA@PEBGH@Z
??1CDwWinER@@UEAA@XZ
??1CWfpER@@UEAA@XZ
??1IDiagER@@UEAA@XZ
??4CDiagERFactory@@QEAAAEAV0@$$QEAV0@@Z
??4CDiagERFactory@@QEAAAEAV0@AEBV0@@Z
??4CDwWinER@@QEAAAEAV0@AEBV0@@Z
??4CWfpER@@QEAAAEAV0@AEBV0@@Z
??4IDiagER@@QEAAAEAV0@AEBV0@@Z
??_7CDwWinER@@6B@
??_7CWfpER@@6B@
??_7IDiagER@@6B@
?AddBucketingParameters@CDwWinER@@UEAAKPEAPEBGI@Z
?AddBucketingParameters@CWfpER@@UEAAKPEAPEBGI@Z
?AddBucketingParameters@IDiagER@@UEAAKPEAPEBGI@Z
?AddFiles@CDwWinER@@UEAAKPEAPEBGI@Z
?AddFiles@CWfpER@@UEAAKPEAPEBGI@Z
?AddFiles@IDiagER@@UEAAKPEAPEBGI@Z
?CreateInstance@CDiagERFactory@@SAKPEBGW4_DIAG_REPORT_TYPE@@HPEAPEAVIDiagER@@@Z
?GetErrorReporter@CDiagERFactory@@SAPEAVIDiagER@@XZ
?Initialize@CDwWinER@@UEAAKXZ
?Initialize@CWfpER@@UEAAKXZ
?ReleaseInstance@CDiagERFactory@@SAXXZ
?SetHeader@CDwWinER@@UEAAKPEBG@Z
?SetHeader@CWfpER@@UEAAKPEBG@Z
?SetHeader@IDiagER@@UEAAKPEBG@Z
?Submit@CDwWinER@@UEAAKK@Z
?Submit@CWfpER@@UEAAKK@Z
?m_diagER@CDiagERFactory@@0PEAVIDiagER@@EA
DiagERAddBucketingParameters
DiagERAddFiles
DiagERInitialize
DiagERSetHeader
DiagERSubmit
DiagERSubmitEx
DiagERTerminate
g_Kernel32
g_Shell32
g_WerApi

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
oobe/msoobeFirstLogonAnim.dll
.dll windows:10 windows x64 arch:x64

44b8e51c17fec0ac876f9e7df5b4f34d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

msoobeFirstLogonAnim.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_floor
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_wcstok_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

shcore

GetScaleFactorForDevice
RegisterScaleChangeNotifications
RevokeScaleChangeNotifications
SHTaskPoolQueueTask

shlwapi

StrStrW

uxtheme

ord120
ord121
ord106

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleExW
LoadStringW
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
FindResourceExW
LoadResource
LockResource

api-ms-win-core-synch-l1-1-0

OpenEventW
CreateEventW
WaitForMultipleObjectsEx
OpenSemaphoreW
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSectionEx
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateMutexW
CreateSemaphoreExW
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
FormatMessageW
GetThreadUILanguage

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

api-ms-win-core-com-l1-1-0

CoGetApartmentType
CoTaskMemAlloc
CoTaskMemFree
CoWaitForMultipleHandles
CoCreateInstance
CoTaskMemRealloc

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegQueryValueExW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

urlmon

ord498
RegisterWebPlatformPermanentSecurityManager
UnregisterWebPlatformPermanentSecurityManager

imm32

ImmDisableIME

kernel32

GetSystemPowerStatus

dui70

?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?SetActive@Element@DirectUI@@QEAAJH@Z
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
InitProcessPriv
UnInitProcessPriv
?Register@TouchHWNDElement@DirectUI@@SAJXZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
??1CritSecLock@DirectUI@@QEAA@XZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
??0NativeHWNDHost@DirectUI@@QEAA@XZ
??1NativeHWNDHost@DirectUI@@UEAA@XZ
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHI@Z
??0TouchHWNDElement@DirectUI@@QEAA@XZ
??1TouchHWNDElement@DirectUI@@UEAA@XZ
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
StrToID
DuiCreateObject
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
InitThread
AllowAllScalingPlateaus
RegisterPVLBehaviorFactory
UnInitThread
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z
??0ClassInfoBase@DirectUI@@QEAA@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?SetForegroundColor@Element@DirectUI@@QEAAJK@Z
GetScaleFactor
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ

duser

SetGadgetFlags
AddLayeredRef
GetGadget

dwmapi

DwmIsCompositionEnabled

user32

TranslateMessage
SetTimer
UnhookWinEvent
GetMonitorInfoW
MonitorFromWindow
SetWindowsHookExW
LoadCursorW
SetCursor
PostQuitMessage
MsgWaitForMultipleObjectsEx
UnhookWindowsHookEx
LockSetForegroundWindow
UnregisterClassW
DefWindowProcW
RegisterClassExW
EnumDisplayMonitors
DestroyWindow
CreateWindowInBand
ShowWindow
PostMessageW
DispatchMessageW
KillTimer
SetWindowPos
InvalidateRect
SetDisplayAutoRotationPreferences
ord2513
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
GetSystemMetrics
GetClientRect
SetWindowCompositionAttribute
GetParent
EnableWindow
CreateWindowExW
SetWindowLongPtrW
GetWindowLongPtrW
SetFocus
WaitMessage
SetWinEventHook
SystemParametersInfoW
FindWindowExW
PeekMessageW
PostThreadMessageW
GetMessageW
RegisterClassW
GetThreadDesktop
GetUserObjectInformationW
CloseDesktop

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
oobe/msoobedui.dll
.dll windows:10 windows x64 arch:x64

024b9b696597f3911910410f9987407e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

msoobedui.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcscspn

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o_floor
_o_free
_o_malloc
_o_memcpy_s
memmove
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstombs
_o_wcstoul
__CxxFrameHandler3
_CxxThrowException
_o__wcsnicmp
_o__wcsicmp
_o__seh_filter_dll
_o__register_onexit_function
_o__purecall
wcsrchr
wcsstr
wcschr
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

shcore

SHStrDupW
ord222
ord188
IUnknown_Set
SHDeleteKeyW
SHEnumKeyExW
ord172

shell32

SHExtractIconsW
SHGetFolderPathEx

shlwapi

ord219
ord487
PathFileExistsW
StrDupW

uxtheme

ord121
ord106
ord120
IsCompositionActive
ord122
ord99

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetModuleFileNameA
SizeofResource
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleExW
FindResourceExW
LockResource
LoadStringW
LoadResource

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
LeaveCriticalSection
AcquireSRWLockExclusive
DeleteCriticalSection
ReleaseSemaphore
EnterCriticalSection
InitializeSRWLock
InitializeCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObjectEx
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
OpenEventW
SetEvent
OpenSemaphoreW
WaitForMultipleObjectsEx
CreateEventW
CreateEventExW
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventActivityIdControl
EventSetInformation

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetExitCodeProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
CreateProcessW
TerminateProcess

api-ms-win-core-localization-l1-2-0

GetFileMUIPath
GetLocaleInfoW
GetLocaleInfoEx
FormatMessageW
GetUILanguageInfo
SetThreadUILanguage
GetThreadUILanguage

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoGetMalloc
CoTaskMemFree
CoWaitForMultipleHandles
CoGetApartmentType
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryInfoKeyW
RegGetValueW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-file-l1-1-0

FindClose
CreateFileW
FindFirstFileW
FindNextFileW
GetLogicalDrives
GetDriveTypeW
ReadFile

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchAppend

oleaut32

SysAllocString
SysFreeString

comctl32

ord334
ord386
ord329
ord328
ord336

gdi32

GdiAlphaBlend
AddFontMemResourceEx
CreateDIBitmap
SetGraphicsMode
SetLayout
GetTextAlign
TextOutW
SetMapMode
SetTextAlign
SetWorldTransform
SetBrushOrgEx
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
StretchBlt
GetStockObject
DeleteDC
GetTextExtentPoint32W
SetTextColor
SetBkMode
SetBkColor
CreateDIBSection
DeleteObject
GetObjectW
GetDeviceCaps
SelectObject
GetTextMetricsW
SetTextCharacterExtra
CreateFontIndirectW
RemoveFontMemResourceEx
CreateSolidBrush
SetStretchBltMode

kernel32

OpenMutexW
GetExitCodeThread
GetSystemDefaultUILanguage
DeactivateActCtx
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
QueryActCtxW
GetFileAttributesW
CreateDirectoryW
GetFullPathNameW
MulDiv
ResetEvent
CreateThread
CreateMutexW

ntdll

RtlUnsubscribeWnfStateChangeNotification
WinSqmSetDWORD
WinSqmStartSession
EtwTraceMessage
WinSqmAddToStream
NtQuerySystemInformation
RtlAllocateHeap
RtlFreeHeap
WinSqmEndSession
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData

ole32

CoInitializeEx
CoUninitialize

uiautomationcore

UiaRaiseAutomationEvent

user32

GetSystemMetrics
RegisterClassExW
RegisterWindowMessageW
RegisterShellHookWindow
SetWindowPos
SendInput
SystemParametersInfoW
GetMessageW
SetDisplayAutoRotationPreferences
RegisterHotKey
UpdateWindow
GetParent
GetWindowRect
GetSysColor
SetSysColors
IsWindowEnabled
GetDisplayAutoRotationPreferences
PostMessageW
NotifyWinEvent
SetTimer
KillTimer
LoadImageW
GetDC
ReleaseDC
PostThreadMessageW
DestroyIcon
MapWindowPoints
GetActiveWindow
EnumDisplaySettingsW
GetMonitorInfoW
SetCursor
PeekMessageW
GetWindowLongPtrW
DefWindowProcW
ClientToScreen
SetRect
SetRectEmpty
GetForegroundWindow
CharUpperW
GetWindowTextW
EndPaint
BeginPaint
InvalidateRect
DrawTextW
GetClientRect
SetPropW
SetFocus
ShowWindow
SetThreadDesktop
SetClassLongPtrW
RemovePropW
FindWindowW
GetAncestor
LoadCursorW
DispatchMessageW
SetWindowTextW
MsgWaitForMultipleObjectsEx
PostQuitMessage
SendMessageW
CreateWindowExW
MonitorFromWindow
IsWindowVisible
SetWindowCompositionAttribute
ord2513
FindWindowExW
GetWindowLongW
FillRect
LoadBitmapW
GetKeyState
RealGetWindowClassW
TranslateMessage
DestroyWindow
GetPropW

dui70

?EventFromEventId@Schema@DirectUI@@SA?AW4Event@12@H@Z
?WantEvent@EventManager@DirectUI@@SA_NW4Event@Schema@2@@Z
?FWantAnyEvent@EventManager@DirectUI@@SA_NPEAVElement@2@@Z
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z
?GetFontSize@Element@DirectUI@@QEAAHXZ
?SetFontFace@Element@DirectUI@@QEAAJPEBG@Z
?SetFontSize@Element@DirectUI@@QEAAJH@Z
?SetVerticalScript@RichText@DirectUI@@QEAAJ_N@Z
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?PaddingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?FontFaceProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?FontSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?Register@TouchButton@DirectUI@@SAJXZ
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetPressed@TouchButton@DirectUI@@QEAA_NXZ
?SetFontColorRuns@RichText@DirectUI@@QEAAJPEBG@Z
?SetOverhang@Element@DirectUI@@QEAAJ_N@Z
?SetFont@Element@DirectUI@@QEAAJPEBG@Z
?SetDisableAccTextExtend@RichText@DirectUI@@QEAAJ_N@Z
??1TouchButton@DirectUI@@UEAA@XZ
??0TouchButton@DirectUI@@QEAA@XZ
?SetPromptWithCaret@TouchEdit2@DirectUI@@QEAAJ_N@Z
?SetPromptText@TouchEdit2@DirectUI@@QEAAJPEBG@Z
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z
?SetEncodedContentString@Element@DirectUI@@QEAAJPEBG@Z
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z
?SetActive@Element@DirectUI@@QEAAJH@Z
?Create@TouchCommandButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z
?SetSelection@TouchSelect@DirectUI@@QEAAJPEAVElement@2@@Z
?AddString@TouchSelect@DirectUI@@QEAAJPEBGPEAPEAVElement@2@@Z
?GetClassInfoPtr@TouchSelect@DirectUI@@SAPEAUIClassInfo@2@XZ
?RemoveItem@TouchSelect@DirectUI@@QEAAJH@Z
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z
?SetItemData@TouchSelect@DirectUI@@QEAAJHPEAUIUnknown@@@Z
?GetItemCount@TouchSelect@DirectUI@@QEAAKXZ
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ
?GetItemData@TouchSelect@DirectUI@@QEAAJHPEAPEAUIUnknown@@@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?RemoveAll@Element@DirectUI@@QEAAJXZ
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?Paste@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z
?DisableSelectionHandlesOnEmptyContent@TouchEdit2@DirectUI@@QEAAXXZ
??1AutoLock@DirectUI@@QEAA@XZ
??0ElementProvider@DirectUI@@QEAA@XZ
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z
?ShowContextMenu@ElementProvider@DirectUI@@UEAAJXZ
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z
?AddRef@ElementProvider@DirectUI@@UEAAKXZ
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?TossElement@ElementProvider@DirectUI@@UEAAXXZ
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ
?GetForegroundColorRef@RichText@DirectUI@@UEAAJPEAK@Z
?OnHosted@RichText@DirectUI@@UEAAXPEAVElement@2@@Z
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@RichText@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnPropertyChanged@RichText@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z
?Release@ElementProvider@DirectUI@@UEAAKXZ
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z
?Initialize@RichText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z
??1RichText@DirectUI@@UEAA@XZ
??0RichText@DirectUI@@QEAA@XZ
??1ElementProvider@DirectUI@@UEAA@XZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
??1Element@DirectUI@@UEAA@XZ
??0Element@DirectUI@@QEAA@XZ
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z
?GetTopLevel@Element@DirectUI@@QEAAPEAV12@XZ
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z
?AccNameProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?BroadcastEvent@Element@DirectUI@@QEAAXPEAUEvent@2@@Z
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ
?GetAnimation@Element@DirectUI@@QEAAHXZ
?SetAnimation@Element@DirectUI@@QEAAJH@Z
?LocationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetLocation@Element@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z
?Destroy@Layout@DirectUI@@QEAAXXZ
?SetID@Element@DirectUI@@QEAAJPEBG@Z
?SetAccRole@Element@DirectUI@@QEAAJH@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
??1ClassInfoBase@DirectUI@@UEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?_PostEvent@Element@DirectUI@@AEAAXPEAUEvent@2@H@Z
?GetClassInfoPtr@TouchSwitch@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?Register@Element@DirectUI@@SAJXZ
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?Init@Schema@DirectUI@@SAJXZ
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
RegisterPVLBehaviorFactory
?HideWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ
?SyncDestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z
?ShowUIState@HWNDElement@DirectUI@@QEAAX_N0@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
UnInitProcessPriv
AllowAllScalingPlateaus
InitProcessPriv
?Detach@CSafeElementProxy@@QEAAXXZ
?Initialize@CSafeElementProxy@@IEAAJPEAVElement@DirectUI@@@Z
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
?SetSheet@Element@DirectUI@@QEAAJPEAVStyleSheet@2@@Z
?GetSheet@DUIXmlParser@DirectUI@@QEAAJPEBGPEAPEAVValue@2@@Z
?SetMinSize@Element@DirectUI@@QEAAJHH@Z
?SetHeight@Element@DirectUI@@QEAAJH@Z
?SetPadding@Element@DirectUI@@QEAAJHHHH@Z
?GetYScrollWidth@BaseScrollViewer@DirectUI@@QEAAHXZ
?SetYScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z
?GetKeyWithinChild@Element@DirectUI@@QEAAPEAV12@XZ
?UpdateSheets@DUIXmlParser@DirectUI@@QEAAJPEAVElement@2@@Z
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetBackgroundColor@Element@DirectUI@@QEAAJKKE@Z
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?SetYOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
DUIStopPVLAnimation
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?SetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAAJ_N@Z
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?ScaleChanged@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?EnsureVisible@Element@DirectUI@@QEAA_NXZ
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?SetPressed@TouchButton@DirectUI@@QEAAJ_N@Z
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ
?GetHandleEnter@TouchButton@DirectUI@@QEAA_NXZ
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
??1TouchHWNDElement@DirectUI@@UEAA@XZ
??0TouchHWNDElement@DirectUI@@QEAA@XZ
DuiCreateObject
??0NativeHWNDHost@DirectUI@@QEAA@XZ
InitThread
UnInitThread
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
StrToID
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
GetScaleFactor
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?RemoveLocalValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@@Z
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?GetUnset@Value@DirectUI@@SAPEAV12@XZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?GetHeight@Element@DirectUI@@QEAAHXZ
?Release@Value@DirectUI@@QEAAXXZ
?GetWidth@Element@DirectUI@@QEAAHXZ
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z
?WndProc@NativeHWNDHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z
??1NativeHWNDHost@DirectUI@@UEAA@XZ
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetDirection@Element@DirectUI@@QEAAJH@Z
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z
??1RefcountBase@DirectUI@@UEAA@XZ
??0RefcountBase@DirectUI@@QEAA@XZ
?GetSelection@TouchEdit2@DirectUI@@QEAAJPEAJ0@Z
?SetCaretPosition@TouchEdit2@DirectUI@@QEAAJJ@Z
?Release@RefcountBase@DirectUI@@QEAAJXZ
?AddRef@RefcountBase@DirectUI@@QEAAJXZ
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UEAAXPEAUtagRECT@@@Z
?GetClassInfoW@TouchButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ

duser

SetTransitionVisualProperties
SetGadgetFlags
SetGadgetRect
EndInputPaneAnimation
BeginHideInputPaneAnimation
BeginShowInputPaneAnimation
DeleteHandle
DUserPostEvent
InitGadgets
SetGadgetStyle
InvalidateGadget
ReleaseLayeredRef
AddLayeredRef
DUserSendEvent
SetGadgetRootInfo

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
oobe/msoobeplugins.dll
.dll windows:10 windows x64 arch:x64

e7f3441a4462d49565bbb76cac8b7bfb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

msoobeplugins.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o__wtol
_o_bsearch
_o_free
memmove
_o_iswascii
_o_iswspace
_o_iswupper
_o_malloc
_o_memcpy_s
_o_rand
_o_realloc
_o_terminate
_o_toupper
_o_towlower
_o_wcscpy_s
_o_wcstok_s
_o_wcstol
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__set_errno
_o__seh_filter_dll
_o__register_onexit_function
_o__purecall
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
wcsrchr
wcschr
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcscspn
memset
wcscmp

shell32

ord262
ShellExecuteExW
SHGetKnownFolderPath
SHGetFolderPathEx

shlwapi

ord260
SHCreateStreamOnFileW
PathAppendW
StrStrW
ord437
StrChrW
StrTrimW
SHDeleteValueW
ord278
ord487
ord628
SHStrDupW
ord219
ord12

winlangdb

SetUserLanguages

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LoadLibraryExW
LockResource
FindResourceExW
LoadStringW
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
SizeofResource
GetModuleFileNameA
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CreateMutexExW
AcquireSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
WaitForMultipleObjectsEx
CreateEventExW
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

HeapSize
HeapDestroy
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

SetUserGeoID
FormatMessageW
GetGeoInfoW
GetLocaleInfoEx
EnumSystemGeoID
GetCPInfo
LCMapStringEx
GetUserDefaultLCID
GetLocaleInfoW
GetUserGeoID
GetFileMUIPath
GetSystemPreferredUILanguages
SetThreadUILanguage
GetACP
GetUserDefaultLocaleName
SetThreadPreferredUILanguages
LocaleNameToLCID
EnumSystemLocalesW
GetThreadUILanguage
GetThreadPreferredUILanguages

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
RoTransformError
GetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
Sleep

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsConcatString
WindowsCreateString
HSTRING_UserUnmarshal64
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
HSTRING_UserUnmarshal
HSTRING_UserSize
HSTRING_UserMarshal
HSTRING_UserFree64
HSTRING_UserSize64
HSTRING_UserFree
HSTRING_UserMarshal64

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFileSize
FindFirstVolumeW
ReadFile
GetDriveTypeW
GetTempFileNameW
WriteFile
CreateFileW
FindNextVolumeW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetComputerNameExW
GetSystemDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidLengthRequired
CopySid
GetTokenInformation
IsWellKnownSid
DuplicateTokenEx

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalFree
LocalReAlloc
GlobalAlloc

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegEnumValueW
RegDeleteValueW
RegGetValueW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW

api-ms-win-service-management-l1-1-0

OpenServiceW
StartServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceStatusEx
QueryServiceConfigW

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-core-file-l1-2-0

GetTempPathW
GetVolumePathNamesForVolumeNameW

api-ms-win-core-sysinfo-l1-2-0

SetComputerNameExW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
SetThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-localization-l1-2-3

GetUserDefaultGeoName

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-localization-l1-2-2

GetSystemDefaultLocaleName
LCIDToLocaleName

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW
LookupPrivilegeValueW

userenv

UnloadUserProfile
ord206
DeleteProfileW
LoadUserProfileW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize
RoActivateInstance

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcExceptionFilter
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
UuidCreate
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrStubForwardingFunction
NdrStubCall3
NdrClientCall3
RpcBindingFree

api-ms-win-core-timezone-l1-1-0

SetDynamicTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient7
CStdStubBuffer2_Connect
NdrProxyForwardingFunction3
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient3
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient15
CStdStubBuffer2_Disconnect
ObjectStublessClient13
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchRenameExtension

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock
GlobalSize

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
GetComputerNameW
DnsHostnameToComputerNameW

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest
PowerClearRequest
PowerSetRequest

api-ms-win-core-kernel32-legacy-l1-1-5

SetThreadExecutionState

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-localization-private-l1-1-0

NlsUpdateLocale

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-security-capability-l1-1-0

CapabilityCheck

bcp47langs

Bcp47FromLcid
AppendUserLanguageInternal
GetUserLanguageInputMethods

winbrand

GetInstalledEULAPath
EulaFreeBuffer
InstallEULA
GetEULAFile

api-ms-win-security-lsapolicy-l1-1-0

LsaStorePrivateData
LsaRetrievePrivateData
LsaOpenPolicy
LsaQueryInformationPolicy
LsaSetInformationPolicy
LsaFreeMemory
LsaClose

cryptsp

CryptGenKey
CryptAcquireContextW
CryptImportKey
CryptEncrypt
CryptExportKey
CryptReleaseContext
CryptDestroyKey

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyExW
LogonUserW
RegQueryInfoKeyW
DuplicateToken
RegSetKeySecurity
TraceMessage
CreateWellKnownSid
CheckTokenMembership

comctl32

ord328
ord385
ord329
ord334
ord386
ord337
ord338

credui

CredUnPackAuthenticationBufferW
CredPackAuthenticationBufferW

kernel32

GetModuleFileNameW
GetPrivateProfileSectionW
EnumUILanguagesW
GetSystemDefaultUILanguage
CreateDirectoryW
GetFullPathNameW
FindFirstFileW
ResolveLocaleName
FindNextFileW
FindClose
GetFileAttributesW

ntdll

RtlGetUILanguageInfo
NtUpdateWnfStateData
RtlpVerifyAndCommitUILanguageSettings
RtlNtStatusToDosError
RtlpSetPreferredUILanguages
RtlFreeHeap
NtQueryLicenseValue
NtDeviceIoControlFile
NtClose
NtOpenFile
RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
WinSqmStartSession
WinSqmEndSession
WinSqmSetDWORD
WinSqmIncrementDWORD
WinSqmAddToStream
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
RtlSubscribeWnfStateChangeNotification
RtlCanonicalizeDomainName
RtlConvertSidToUnicodeString
RtlIsMultiSessionSku
RtlAllocateHeap
RtlEqualUnicodeString
NtQueryInformationToken
RtlFreeUnicodeString

user32

GetForegroundWindow
DestroyWindow
PostMessageW
RegisterWindowMessageW
UnregisterClassA
GetWindowLongPtrW
DefWindowProcW
SetTimer
GetMessageW
RegisterDeviceNotificationW
KillTimer
UnregisterDeviceNotification
GetPointerDevices
SetWindowLongPtrW
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
TranslateMessage
SetCursor
LoadCursorW
DispatchMessageW
ExitWindowsEx

input

ord110
ord106
ord105
ord107
ord104

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 684KB - Virtual size: 683KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
oobe/msoobewirelessplugin.dll
.dll windows:10 windows x64 arch:x64

8587d93315174f7e8ae940bc6fc2ffd3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

msoobewirelessplugin.pdb

Imports

msvcrt

_lock
?terminate@@YAXXZ
__C_specific_handler
_unlock
malloc
_amsg_exit
__dllonexit
_onexit
??1type_info@@UEAA@XZ
_XcptFilter
free
_purecall
_vsnprintf_s
_vsnprintf
wcsrchr
wcschr
_wcsnicmp
mbtowc
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
??3@YAXPEAX@Z
__CxxFrameHandler3
_initterm
memset

shlwapi

SHStrDupW
ord219

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
CreateMutexExW
OpenSemaphoreW
DeleteCriticalSection
ReleaseMutex
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObjectEx
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegGetValueW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-com-l1-1-0

CoTaskMemFree
PropVariantClear
StringFromGUID2
CoCreateInstance

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-security-base-l1-1-0

GetLengthSid

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-service-management-l1-1-0

StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
QueryServiceStatusEx

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

kernel32

GetFullPathNameW
CreateDirectoryW
LoadLibraryExW
FreeLibrary
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
GetFileAttributesW
MultiByteToWideChar

ntdll

RtlFreeHeap
RtlAllocateHeap
WinSqmEndSession
WinSqmStartSession
RtlCheckPortableOperatingSystem

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
oobe/oobecoreadapters.dll
.dll windows:10 windows x64 arch:x64

d4cafeab638f7379ad5e059c4cd4ec60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

oobecoreadapters.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
_o__execute_onexit_table
memmove
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_wcscpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__errno
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__crt_atexit
_o__initialize_onexit_table
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o__initialize_narrow_environment
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
wcsrchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
LoadResource
LockResource
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
CreateEventExW
CreateEventW
DeleteCriticalSection
CreateMutexExW
ResetEvent
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockExclusive
SetEvent
ReleaseMutex
InitializeCriticalSectionEx
WaitForSingleObject
WaitForMultipleObjectsEx
ReleaseSemaphore
CreateSemaphoreExW
InitializeSRWLock
InitializeCriticalSection

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
WindowsConcatString
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize
WindowsCreateString
WindowsDeleteString
HSTRING_UserFree
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsPreallocateStringBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDeleteStringBuffer
WindowsPromoteStringBuffer

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegGetValueW
RegDeleteKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoTransformError

api-ms-win-core-localization-l1-2-0

GetThreadUILanguage
GetLocaleInfoW
GetGeoInfoW
GetUserGeoID
GetUserDefaultLocaleName
GetLocaleInfoEx
GetUserPreferredUILanguages
ResolveLocaleName
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList

api-ms-win-security-base-l1-1-0

EqualSid
DuplicateTokenEx
FreeSid
GetAce
AllocateAndInitializeSid
CreateWellKnownSid
GetTokenInformation
RevertToSelf

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoReleaseServerProcess
CoAddRefServerProcess
CoGetCallContext
StringFromCLSID
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoIncrementMTAUsage
CoTaskMemAlloc
CoGetMalloc
CoGetApartmentType
CoCreateInstance

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

rpcrt4

NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrClientCall3
RpcBindingFree
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
RpcStringFreeW
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
RpcBindingFromStringBindingW
CStdStubBuffer_Disconnect
RpcStringBindingComposeW
NdrStubCall3
CStdStubBuffer_IsIIDSupported
RpcExceptionFilter
CStdStubBuffer_Connect
NdrStubForwardingFunction
IUnknown_QueryInterface_Proxy
UuidCreate

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-localization-l1-2-2

GetSystemDefaultLocaleName

oleaut32

SysAllocString
SysStringLen
VariantInit
VariantClear
SysFreeString

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest
PowerClearRequest
PowerSetRequest

api-ms-win-core-kernel32-legacy-l1-1-5

SetThreadExecutionState

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

samcli

NetLocalGroupAddMembers

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CreateThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolTimer

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient16
NdrProxyForwardingFunction3
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
CStdStubBuffer2_Connect
ObjectStublessClient3
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
ObjectStublessClient9
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-localization-l1-2-3

SetUserGeoName
GetUserDefaultGeoName

api-ms-win-core-localization-l1-2-1

EnumSystemLocalesEx

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

powrprof

PowerDeterminePlatformRole

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

winlangdb

SetUserLanguagesCore
GetLocaleFromLanguageAndRegion

api-ms-win-rtcore-ntuser-window-l1-1-0

DispatchMessageW
TranslateMessage
PostQuitMessage
PeekMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-localization-private-l1-1-0

NlsUpdateLocale

ntdll

RtlFreeUnicodeString
RtlAddAccessAllowedAce
NtQuerySecurityObject
RtlAddAce
RtlGetAce
RtlCreateAcl
RtlAllocateHeap
RtlSetDaclSecurityDescriptor
RtlFreeHeap
RtlConvertSidToUnicodeString
RtlIsMultiSessionSku
RtlCreateSecurityDescriptor
NtSetSecurityObject
NtQueryLicenseValue
RtlLengthSid
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

bcp47langs

Bcp47GetUnIsoRegionCode

combase

ord148

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

GetFileAttributesW
GetFullPathNameW
CreateDirectoryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-capability-l1-1-0

CapabilityCheck

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wbem/MMFUtil.dll
.dll regsvr32 windows:10 windows x64 arch:x64

c6e5816e6c46e6a02be0c5e01ff50ba3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MMFUtil.pdb

Imports

msvcrt

_vsnwprintf
_XcptFilter
_amsg_exit
memset
free
malloc
_initterm
__C_specific_handler
_wcsicmp

atl

ord18
ord15
ord21
ord16
ord22

kernel32

QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcessId
RtlLookupFunctionEntry
GetLastError
Sleep
DisableThreadLibraryCalls
LocalFree
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
FormatMessageW
RtlVirtualUnwind
RtlCaptureContext
GetModuleHandleW

user32

EndDialog
DialogBoxParamW
SendMessageW
GetDlgItem
SetWindowLongPtrW
MessageBoxW
SetWindowTextW
GetWindowLongPtrW
LoadStringW

oleaut32

SysFreeString

ole32

CoUninitialize
CoCreateInstance
CoInitialize

Exports

Exports

DisplayAVIBox
DisplayUserMessage
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ErrorStringEx

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wbem/mofd.dll
.dll regsvr32 windows:10 windows x64 arch:x64

5df9346c9a2d1f8b98404b8b6b855c2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

mofd.pdb

Imports

msvcrt

wcstombs
printf
_wcsdup
_wtoi
_wtol
??0exception@@QEAA@AEBQEBD@Z
_wsplitpath_s
swscanf
towupper
_errno
iswxdigit
_open
_write
_close
fwrite
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
_ui64tow_s
wcsncpy_s
mbstowcs
_XcptFilter
ferror
fread
__CxxFrameHandler3
fclose
ftell
_wcserror
_waccess
fseek
realloc
_wfullpath
_amsg_exit
_initterm
_wfopen
calloc
wcstok
?terminate@@YAXXZ
_purecall
malloc
??1type_info@@UEAA@XZ
_resetstkoflw
wcsrchr
_wcsnicmp
memcmp
_wcsicmp
wcschr
iswspace
_onexit
__dllonexit
_unlock
wcsncmp
memcpy_s
_vsnwprintf
free
__C_specific_handler
_lock
memset

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
CreateProcessW
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
OpenProcessToken

api-ms-win-security-base-l1-1-0

RevertToSelf
AdjustTokenPrivileges
ImpersonateSelf

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-file-l1-1-0

CreateFileW
WriteFile
DeleteFileW
GetFullPathNameW
ReadFile
SetFilePointer
GetTempFileNameW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
SizeofResource
LoadResource
LoadStringW
FindResourceExW
DisableThreadLibraryCalls

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerBuffW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetStdHandle

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
GetStringTypeExW
MultiByteToWideChar

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

wbemcomn

?AddEnvironmentValue@CWbemInstallObject@@SAJPEBG0@Z
?Shutdown@CWbemInstallObject@@SAXXZ
?SetOffline@CWbemInstallObject@@SAX_N@Z
?SetBinaryPath@CWbemInstallObject@@SAXPEBG@Z
?SetRepositoryFolder@CWbemInstallObject@@SAXPEBG@Z
?SetAutoRecoverFolder@CWbemInstallObject@@SAXPEBG@Z
?SetRegistryPathWbem@CWbemInstallObject@@SAXPEBG@Z
?SetRegistryPathCIMOM@CWbemInstallObject@@SAXPEBG@Z
RemoveFileFromAutoRecoverFolder
?FlushRepository@CWbemInstallObject@@SAJXZ
?CleanUp@CWbemInstallObject@@SAXXZ
??4WString@@QEAAAEAV0@PEBG@Z
RegisterDLL
RegisterDllAppid
UnRegisterDLL
UnregisterDllAppid
CopyFileToAutorecover
??0Registry@@QEAA@PEBGK@Z
??1Registry@@QEAA@XZ
?GetMultiStr@Registry@@QEAAPEAGPEBGAEAK@Z
?SetMultiStr@Registry@@QEAAHPEBGPEAGK@Z
??0WString@@QEAA@XZ
?CoCreateInstance@CWbemInstallObject@@SAJAEBU_GUID@@PEAUIUnknown@@K0PEAPEAX@Z
??0CMRCICompression@@QEAA@XZ
?Mrci1Decompress@CBaseMrciCompression@@QEAAIPEAEI0I@Z
?ExpandEnvironmentStringsW@CWbemInstallObject@@SAKPEBGPEAGK@Z
?GetRepositoryFolder@CWbemInstallObject@@SAPEBGXZ
??0CFlexArray@@QEAA@HH@Z
??1CFlexArray@@QEAA@XZ
?GetAt@CFlexArray@@QEBAPEAXH@Z
??1CMRCICompression@@QEAA@XZ
ExtractMachineName
bAreWeLocal
??0WString@@QEAA@PEBG@Z
WbemVariantChangeType
?ms_XXX_Locale_To_LCID@CMUILocale@@SAJPEBGPEAK@Z
?LocaleName_To_LCID@CMUILocale@@SAJPEBGPEA_NPEAK@Z
?Init@CVar@@AEAAXXZ
?SetVariant@CVar@@QEAAHPEAUtagVARIANT@@H@Z
??1CVar@@QEAA@XZ
?GetText@CVar@@QEAAPEAGJJPEBG@Z
?InsertAt@CFlexArray@@QEAAHHPEAX@Z
?RemoveAt@CFlexArray@@QEAAHH@Z
?Mrci1MaxCompress@CBaseMrciCompression@@QEAAIPEAEI0I@Z
?SetStr@Registry@@QEAAHPEBG0@Z
GetMemLogObject
?Write@CMemoryLog@@QEAAXJ@Z
?DeleteString@WString@@AEAAXPEAG@Z
_ThrowMemoryException_
?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z
?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z
?IsOffline@CWbemInstallObject@@SA_NXZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CompileFileViaDLL
CreateBMOFViaDLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wbem/mofinstall.dll
.dll windows:10 windows x64 arch:x64

904c33bbfd97dd19bd1af4e3eefbdc75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

mofinstall.pdb

Imports

msvcrt

malloc
??3@YAXPEAX@Z
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
calloc
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
wcsncpy_s
memcmp
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_purecall
free
memcpy_s
wcsrchr
wcsstr
_wcsicmp
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler3
memmove
memset

oleaut32

SysAllocString
SysStringLen
VariantClear
SysAllocStringLen
SafeArrayCreate
SafeArrayPutElement
SysFreeString
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureStackBackTrace
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadLibraryExW
FreeLibrary
SizeofResource
GetProcAddress
LoadResource
FindResourceExW
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

user32

UnregisterClassA

kernel32

lstrcmpiW
lstrcmpW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wbem/msdtcwmi.dll
.dll regsvr32 windows:10 windows x64 arch:x64

6372c5278b5b164858334c467cfb430c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MsDtcWmi.pdb

Imports

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetSystemWindowsDirectoryA
GetSystemDirectoryW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadStringW
GetModuleFileNameA
FreeLibrary
GetModuleHandleExW
LoadResource
FindResourceExW
GetProcAddress
GetModuleFileNameW
FreeResource
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleW

msvcrt

??0exception@@QEAA@AEBV0@@Z
memcpy
_wcsicmp
__CxxFrameHandler3
memcmp
_vsnwprintf
_local_unwind
?terminate@@YAXXZ
_onexit
_CxxThrowException
__dllonexit
_unlock
swprintf_s
_lock
__C_specific_handler
free
malloc
_XcptFilter
??1type_info@@UEAA@XZ
_wfopen
_initterm
_amsg_exit
_stricmp
_wtoi
iswdigit
wcsrchr
memcpy_s
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
memset
_vsnprintf_s
memmove_s
fopen
fflush
fclose
fwprintf
_waccess
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
strchr

ntdll

RtlReportException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetExitCodeProcess
GetCurrentThread
TlsAlloc
GetCurrentProcessId
TlsFree
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
TlsGetValue
CreateProcessW
OpenThreadToken

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoGetObjectContext
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

rpcrt4

RpcStringFreeW
UuidFromStringW
RpcImpersonateClient
RpcRevertToSelf
UuidToStringW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

CreateEventA
ResetEvent
SetEvent
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
CreateMutexExW
WaitForSingleObjectEx
ReleaseSemaphore
ReleaseSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
ReleaseMutex
LeaveCriticalSection
ReleaseSRWLockExclusive
EnterCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW

api-ms-win-core-handle-l1-1-0

CloseHandle

kernel32

FindResourceA
UnregisterWaitEx
QueueUserWorkItem

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExA
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCommandLineA

api-ms-win-core-file-l1-1-0

FindClose
SetFileAttributesW
CreateFileW
GetFullPathNameW
DeleteFileW
FindFirstFileW
CreateDirectoryW
FindNextFileW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-security-base-l1-1-0

GetTokenInformation
CheckTokenMembership

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e6fff2f92245c27e084f0c265fd241f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

shlwapi

api-ms-win-appmodel-unlock-l1-1-0

xinput1_4

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-registry-l1-1-0

oleaut32

wincorlib

ntdll

credui

user32

gdi32

comdlg32

api-ms-win-rtcore-ntuser-shell-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-util-l1-1-0

inputcontroller

perceptionsimulationmanager

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 747KB - Virtual size: 747KB

.rdata Size: 341KB - Virtual size: 341KB

.data Size: 44KB - Virtual size: 65KB

.pdata Size: 45KB - Virtual size: 45KB

.rsrc Size: 110KB - Virtual size: 109KB

.reloc Size: 11KB - Virtual size: 11KB

4bc1e878581971900e09f50a5d0dbb69

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

.text
Size: 747KB - Virtual size: 747KB

.rdata
Size: 341KB - Virtual size: 341KB

.data
Size: 44KB - Virtual size: 65KB

.pdata
Size: 45KB - Virtual size: 45KB

.rsrc
Size: 110KB - Virtual size: 109KB

.reloc
Size: 11KB - Virtual size: 11KB

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 456B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 136B

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 660B