Release[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Release.rar
Size

92.4MB
MD5

42b9ab1ee8ae2a74bdf57c07efa0b1d6
SHA1

ebc2464258bf6b2a3b90a28508b3ffdd9c722af5
SHA256

b954ea7244909b2c81999cd7c1a4d9d508352464bd61ceba5e65d9e1141dc634
SHA512

4497163ca119622a7a47619b2d767097f65f0ffe4669f5bcebb9a42c0307b7860308c71ccbb6095b6b5516a4e7eded54c218b8c953467057718b6fb0b91d7bbb
SSDEEP

1572864:UKVrgtJ8TY6fzFvi5qztIbVT/u5WwiO/uRHLrsw2fLnXL/sg9YjG:pgtJOJZvau+xmLmFLrswol9YjG

Score

3^/10

Malware Config

Signatures

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/Themida.exe
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/Themida64.exe
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/Debug/TestPlugin.dll
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/x64/Debug/TestPlugin.dll
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/TestPlugin.dll
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/SecureEngineSDK32.dll
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/SecureEngineSDK64.dll
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/WinlicenseSDK.dll
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/demangler.dll
unpack001/Release/Themida_x32_x64_v3.0.4.0_Repacked/libspv.dll
unpack001/Release/dma.exe
unpack001/Release/dma.exe
unpack001/Release/ucrtbased.dll
unpack001/Release/vmm.dll

Files

Release.rar
.rar

Password: 123
Release/FTD3XX.dll
.dll windows:6 windows x64 arch:x64

Password: 123

94eff8313f705d14c2421a2e17c00648

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:e4:41:cb:6d:7c:0b:ab:94:2c:24:2e:b3:05:8f:ed
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20/04/2023, 00:00

Not After

19/04/2024, 23:59

Subject

SERIALNUMBER=SC136640,CN=Future Technology Devices International Ltd,O=Future Technology Devices International Ltd,L=Glasgow,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:28:89:be:7d:37:74:eb:d4:aa:93:5b:3f:4d:cf:ca:ca:53:77:02:b9:0c:65:21:f6:36:3e:70:1e:5d:7d:fe
Signer

Actual PE Digest

bd:28:89:be:7d:37:74:eb:d4:aa:93:5b:3f:4d:cf:ca:ca:53:77:02:b9:0c:65:21:f6:36:3e:70:1e:5d:7d:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Work\Project\D3xx\trunk\D3XX\d2xxdll\x64\Release\FTD3XX.pdb

Imports

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

kernel32

ExitThread
WriteConsoleW
OutputDebugStringW
ReadConsoleW
ReadFile
SetFilePointerEx
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
GetOverlappedResult
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
WaitForMultipleObjects
GetFileSizeEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
CreateThread
RtlUnwind
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetCurrentThread
HeapFree
HeapAlloc
MultiByteToWideChar
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode

Exports

Exports

FT_AbortPipe
FT_ClearNotificationCallback
FT_ClearStreamPipe
FT_Close
FT_ControlTransfer
FT_Create
FT_CreateDeviceInfoList
FT_CycleDevicePort
FT_EnableGPIO
FT_FlushPipe
FT_GetChipConfiguration
FT_GetConfigurationDescriptor
FT_GetDescriptor
FT_GetDeviceDescriptor
FT_GetDeviceInfo
FT_GetDeviceInfoDetail
FT_GetDeviceInfoList
FT_GetDriverVersion
FT_GetFirmwareVersion
FT_GetGPIO
FT_GetInterfaceDescriptor
FT_GetLibraryVersion
FT_GetOverlappedResult
FT_GetPipeInformation
FT_GetPipeTimeout
FT_GetStringDescriptor
FT_GetSuspendTimeout
FT_GetVIDPID
FT_InitializeOverlapped
FT_IsDevicePath
FT_ListDevices
FT_ReadGPIO
FT_ReadPipe
FT_ReadPipeEx
FT_ReleaseOverlapped
FT_ResetDevicePort
FT_SetChipConfiguration
FT_SetGPIO
FT_SetGPIOLevel
FT_SetGPIOPull
FT_SetNotificationCallback
FT_SetPipeTimeout
FT_SetStreamPipe
FT_SetSuspendTimeout
FT_WriteGPIO
FT_WritePipe
FT_WritePipeEx

Sections

.text
Size: 384KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/SecureEngineSDK64.dll
.dll windows:4 windows x64 arch:x64

Password: 123

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:47:63:a6:f3:2b:19:d0:03:65:b0:44:74:5a:6f:4d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/08/2017, 00:00

Not After

13/09/2020, 23:59

Subject

CN=NSSTUDIO INC.,OU=IT Team,O=NSSTUDIO INC.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:47:63:a6:f3:2b:19:d0:03:65:b0:44:74:5a:6f:4d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/08/2017, 00:00

Not After

13/09/2020, 23:59

Subject

CN=NSSTUDIO INC.,OU=IT Team,O=NSSTUDIO INC.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:4b:04:ab:8a:c2:cc:dc:c7:9b:97:95:53:0c:68:7b:b6:e7:40:6d:bd:b5:f2:f9:fe:ea:29:70:3a:06:68:a1
Signer

Actual PE Digest

6e:4b:04:ab:8a:c2:cc:dc:c7:9b:97:95:53:0c:68:7b:b6:e7:40:6d:bd:b5:f2:f9:fe:ea:29:70:3a:06:68:a1

Digest Algorithm

sha256

PE Digest Matches

true

d6:e6:bf:bd:c3:12:7e:e4:a9:a1:4d:6d:79:ca:76:57:d3:0f:8b:ee
Signer

Actual PE Digest

d6:e6:bf:bd:c3:12:7e:e4:a9:a1:4d:6d:79:ca:76:57:d3:0f:8b:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ClearEnd
ClearStart
CodeReplaceEnd
CodeReplaceStart
CustomVM00000100_End
CustomVM00000100_Start
CustomVM00000101_End
CustomVM00000101_Start
CustomVM00000102_End
CustomVM00000102_Start
CustomVM00000103_End
CustomVM00000103_Start
CustomVM00000104_End
CustomVM00000104_Start
CustomVM00000105_End
CustomVM00000105_Start
CustomVM00000106_End
CustomVM00000106_Start
CustomVM00000107_End
CustomVM00000107_Start
CustomVM00000108_End
CustomVM00000108_Start
CustomVM00000109_End
CustomVM00000109_Start
CustomVM00000110_End
CustomVM00000110_Start
CustomVM00000111_End
CustomVM00000111_Start
CustomVM00000112_End
CustomVM00000112_Start
CustomVM00000113_End
CustomVM00000113_Start
CustomVM00000114_End
CustomVM00000114_Start
CustomVM00000115_End
CustomVM00000115_Start
CustomVM00000116_End
CustomVM00000116_Start
CustomVM00000117_End
CustomVM00000117_Start
CustomVM00000118_End
CustomVM00000118_Start
CustomVM00000119_End
CustomVM00000119_Start
CustomVM00000120_End
CustomVM00000120_Start
CustomVM00000121_End
CustomVM00000121_Start
CustomVM00000122_End
CustomVM00000122_Start
CustomVM00000123_End
CustomVM00000123_Start
CustomVM00000124_End
CustomVM00000124_Start
CustomVM00000125_End
CustomVM00000125_Start
CustomVM00000126_End
CustomVM00000126_Start
CustomVM00000127_End
CustomVM00000127_Start
CustomVM00000128_End
CustomVM00000128_Start
CustomVM00000129_End
CustomVM00000129_Start
CustomVM00000130_End
CustomVM00000130_Start
CustomVM00000131_End
CustomVM00000131_Start
CustomVM00000132_End
CustomVM00000132_Start
CustomVM00000133_End
CustomVM00000133_Start
CustomVM00000134_End
CustomVM00000134_Start
CustomVM00000135_End
CustomVM00000135_Start
CustomVM00000136_End
CustomVM00000136_Start
CustomVM00000137_End
CustomVM00000137_Start
CustomVM00000138_End
CustomVM00000138_Start
CustomVM00000139_End
CustomVM00000139_Start
CustomVM00000140_End
CustomVM00000140_Start
CustomVM00000141_End
CustomVM00000141_Start
CustomVM00000142_End
CustomVM00000142_Start
CustomVM00000143_End
CustomVM00000143_Start
CustomVM00000144_End
CustomVM00000144_Start
CustomVM00000145_End
CustomVM00000145_Start
CustomVM00000146_End
CustomVM00000146_Start
CustomVM00000147_End
CustomVM00000147_Start
CustomVM00000148_End
CustomVM00000148_Start
CustomVM00000149_End
CustomVM00000149_Start
CustomVM00000150_End
CustomVM00000150_Start
CustomVM00000151_End
CustomVM00000151_Start
CustomVM00000152_End
CustomVM00000152_Start
CustomVM00000153_End
CustomVM00000153_Start
CustomVM00000154_End
CustomVM00000154_Start
CustomVM00000155_End
CustomVM00000155_Start
CustomVM00000156_End
CustomVM00000156_Start
CustomVM00000157_End
CustomVM00000157_Start
CustomVM00000158_End
CustomVM00000158_Start
CustomVM00000159_End
CustomVM00000159_Start
CustomVM00000160_End
CustomVM00000160_Start
CustomVM00000161_End
CustomVM00000161_Start
CustomVM00000162_End
CustomVM00000162_Start
CustomVM00000163_End
CustomVM00000163_Start
CustomVM00000164_End
CustomVM00000164_Start
CustomVM00000165_End
CustomVM00000165_Start
CustomVM00000166_End
CustomVM00000166_Start
CustomVM00000167_End
CustomVM00000167_Start
CustomVM00000168_End
CustomVM00000168_Start
CustomVM00000169_End
CustomVM00000169_Start
CustomVM00000170_End
CustomVM00000170_Start
CustomVM00000171_End
CustomVM00000171_Start
CustomVM00000172_End
CustomVM00000172_Start
CustomVM00000173_End
CustomVM00000173_Start
CustomVM00000174_End
CustomVM00000174_Start
CustomVM00000175_End
CustomVM00000175_Start
CustomVM00000176_End
CustomVM00000176_Start
CustomVM00000177_End
CustomVM00000177_Start
CustomVM00000178_End
CustomVM00000178_Start
CustomVM00000179_End
CustomVM00000179_Start
CustomVM00000180_End
CustomVM00000180_Start
CustomVM00000181_End
CustomVM00000181_Start
CustomVM00000182_End
CustomVM00000182_Start
CustomVM00000183_End
CustomVM00000183_Start
CustomVM00000184_End
CustomVM00000184_Start
CustomVM00000185_End
CustomVM00000185_Start
CustomVM00000186_End
CustomVM00000186_Start
CustomVM00000187_End
CustomVM00000187_Start
CustomVM00000188_End
CustomVM00000188_Start
CustomVM00000189_End
CustomVM00000189_Start
CustomVM00000190_End
CustomVM00000190_Start
CustomVM00000191_End
CustomVM00000191_Start
CustomVM00000192_End
CustomVM00000192_Start
CustomVM00000193_End
CustomVM00000193_Start
CustomVM00000194_End
CustomVM00000194_Start
CustomVM00000195_End
CustomVM00000195_Start
CustomVM00000196_End
CustomVM00000196_Start
CustomVM00000197_End
CustomVM00000197_Start
CustomVM00000198_End
CustomVM00000198_Start
CustomVM00000199_End
CustomVM00000199_Start
CustomVM00000200_End
CustomVM00000200_Start
CustomVM00000201_End
CustomVM00000201_Start
CustomVM00000202_End
CustomVM00000202_Start
CustomVM00000203_End
CustomVM00000203_Start
CustomVM00000204_End
CustomVM00000204_Start
CustomVM00000205_End
CustomVM00000205_Start
CustomVM00000206_End
CustomVM00000206_Start
CustomVM00000207_End
CustomVM00000207_Start
CustomVM00000208_End
CustomVM00000208_Start
CustomVM00000209_End
CustomVM00000209_Start
CustomVM00000210_End
CustomVM00000210_Start
CustomVM00000211_End
CustomVM00000211_Start
CustomVM00000212_End
CustomVM00000212_Start
CustomVM00000213_End
CustomVM00000213_Start
CustomVM00000214_End
CustomVM00000214_Start
CustomVM00000215_End
CustomVM00000215_Start
CustomVM00000216_End
CustomVM00000216_Start
CustomVM00000217_End
CustomVM00000217_Start
CustomVM00000218_End
CustomVM00000218_Start
CustomVM00000219_End
CustomVM00000219_Start
CustomVM00000220_End
CustomVM00000220_Start
CustomVM00000221_End
CustomVM00000221_Start
CustomVM00000222_End
CustomVM00000222_Start
CustomVM00000223_End
CustomVM00000223_Start
CustomVM00000224_End
CustomVM00000224_Start
CustomVM00000225_End
CustomVM00000225_Start
CustomVM00000226_End
CustomVM00000226_Start
CustomVM00000227_End
CustomVM00000227_Start
CustomVM00000228_End
CustomVM00000228_Start
CustomVM00000229_End
CustomVM00000229_Start
CustomVM00000230_End
CustomVM00000230_Start
CustomVM00000231_End
CustomVM00000231_Start
CustomVM00000232_End
CustomVM00000232_Start
CustomVM00000233_End
CustomVM00000233_Start
CustomVM00000234_End
CustomVM00000234_Start
CustomVM00000235_End
CustomVM00000235_Start
CustomVM00000236_End
CustomVM00000236_Start
CustomVM00000237_End
CustomVM00000237_Start
CustomVM00000238_End
CustomVM00000238_Start
CustomVM00000239_End
CustomVM00000239_Start
CustomVM00000240_End
CustomVM00000240_Start
CustomVM00000241_End
CustomVM00000241_Start
CustomVM00000242_End
CustomVM00000242_Start
CustomVM00000243_End
CustomVM00000243_Start
CustomVM00000244_End
CustomVM00000244_Start
CustomVM00000245_End
CustomVM00000245_Start
CustomVM00000246_End
CustomVM00000246_Start
CustomVM00000247_End
CustomVM00000247_Start
CustomVM00000248_End
CustomVM00000248_Start
CustomVM00000249_End
CustomVM00000249_Start
CustomVM00000250_End
CustomVM00000250_Start
CustomVM00000251_End
CustomVM00000251_Start
CustomVM00000252_End
CustomVM00000252_Start
CustomVM00000253_End
CustomVM00000253_Start
CustomVM00000254_End
CustomVM00000254_Start
CustomVM00000255_End
CustomVM00000255_Start
CustomVM00000256_End
CustomVM00000256_Start
CustomVM00000257_End
CustomVM00000257_Start
CustomVM00000258_End
CustomVM00000258_Start
CustomVM00000259_End
CustomVM00000259_Start
CustomVM00000260_End
CustomVM00000260_Start
CustomVM00000261_End
CustomVM00000261_Start
CustomVM00000262_End
CustomVM00000262_Start
CustomVM00000263_End
CustomVM00000263_Start
CustomVM00000264_End
CustomVM00000264_Start
CustomVM00000265_End
CustomVM00000265_Start
CustomVM00000266_End
CustomVM00000266_Start
CustomVM00000267_End
CustomVM00000267_Start
CustomVM00000268_End
CustomVM00000268_Start
CustomVM00000269_End
CustomVM00000269_Start
CustomVM00000270_End
CustomVM00000270_Start
CustomVM00000271_End
CustomVM00000271_Start
CustomVM00000272_End
CustomVM00000272_Start
CustomVM00000273_End
CustomVM00000273_Start
CustomVM00000274_End
CustomVM00000274_Start
CustomVM00000275_End
CustomVM00000275_Start
CustomVM00000276_End
CustomVM00000276_Start
CustomVM00000277_End
CustomVM00000277_Start
CustomVM00000278_End
CustomVM00000278_Start
CustomVM00000279_End
CustomVM00000279_Start
CustomVM00000280_End
CustomVM00000280_Start
CustomVM00000281_End
CustomVM00000281_Start
CustomVM00000282_End
CustomVM00000282_Start
CustomVM00000283_End
CustomVM00000283_Start
CustomVM00000284_End
CustomVM00000284_Start
CustomVM00000285_End
CustomVM00000285_Start
CustomVM00000286_End
CustomVM00000286_Start
CustomVM00000287_End
CustomVM00000287_Start
CustomVM00000288_End
CustomVM00000288_Start
CustomVM00000289_End
CustomVM00000289_Start
CustomVM00000290_End
CustomVM00000290_Start
CustomVM00000291_End
CustomVM00000291_Start
CustomVM00000292_End
CustomVM00000292_Start
CustomVM00000293_End
CustomVM00000293_Start
CustomVM00000294_End
CustomVM00000294_Start
CustomVM00000295_End
CustomVM00000295_Start
CustomVM00000296_End
CustomVM00000296_Start
CustomVM00000297_End
CustomVM00000297_Start
CustomVM00000298_End
CustomVM00000298_Start
CustomVM00000299_End
CustomVM00000299_Start
CustomVM00000300_End
CustomVM00000300_Start
CustomVM00000301_End
CustomVM00000301_Start
CustomVM00000302_End
CustomVM00000302_Start
CustomVM00000303_End
CustomVM00000303_Start
CustomVM00000304_End
CustomVM00000304_Start
CustomVM00000305_End
CustomVM00000305_Start
CustomVM00000306_End
CustomVM00000306_Start
CustomVM00000307_End
CustomVM00000307_Start
CustomVM00000308_End
CustomVM00000308_Start
CustomVM00000309_End
CustomVM00000309_Start
CustomVM00000310_End
CustomVM00000310_Start
CustomVM00000311_End
CustomVM00000311_Start
CustomVM00000312_End
CustomVM00000312_Start
CustomVM00000313_End
CustomVM00000313_Start
CustomVM00000314_End
CustomVM00000314_Start
CustomVM00000315_End
CustomVM00000315_Start
CustomVM00000316_End
CustomVM00000316_Start
CustomVM00000317_End
CustomVM00000317_Start
CustomVM00000318_End
CustomVM00000318_Start
CustomVM00000319_End
CustomVM00000319_Start
CustomVM00000320_End
CustomVM00000320_Start
CustomVM00000321_End
CustomVM00000321_Start
CustomVM00000322_End
CustomVM00000322_Start
CustomVM00000323_End
CustomVM00000323_Start
CustomVM00000324_End
CustomVM00000324_Start
CustomVM00000325_End
CustomVM00000325_Start
CustomVM00000326_End
CustomVM00000326_Start
CustomVM00000327_End
CustomVM00000327_Start
CustomVM00000328_End
CustomVM00000328_Start
CustomVM00000329_End
CustomVM00000329_Start
CustomVM00000330_End
CustomVM00000330_Start
CustomVM00000331_End
CustomVM00000331_Start
CustomVM00000332_End
CustomVM00000332_Start
CustomVM00000333_End
CustomVM00000333_Start
CustomVM00000334_End
CustomVM00000334_Start
CustomVM00000335_End
CustomVM00000335_Start
CustomVM00000336_End
CustomVM00000336_Start
CustomVM00000337_End
CustomVM00000337_Start
CustomVM00000338_End
CustomVM00000338_Start
CustomVM00000339_End
CustomVM00000339_Start
CustomVM00000340_End
CustomVM00000340_Start
CustomVM00000341_End
CustomVM00000341_Start
CustomVM00000342_End
CustomVM00000342_Start
CustomVM00000343_End
CustomVM00000343_Start
CustomVM00000344_End
CustomVM00000344_Start
CustomVM00000345_End
CustomVM00000345_Start
CustomVM00000346_End
CustomVM00000346_Start
CustomVM00000347_End
CustomVM00000347_Start

Sections

.text
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Release/Symbols/ntkrnlmp.pdb/4DBE144182FF4156845CD3BD8B654E561/ntkrnlmp.pdb
Release/Symbols/ntkrnlmp.pdb/89284D0CA6ACC8274B9A44BD5AF9290B1/ntkrnlmp.pdb
Release/Themida_x32_x64_v3.0.4.0_Repacked/LICENSE.TXT
Release/Themida_x32_x64_v3.0.4.0_Repacked/TMLicenseA1.dat
Release/Themida_x32_x64_v3.0.4.0_Repacked/Themida.exe
.exe windows:5 windows x86 arch:x86

Password: 123

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
madTraceProcess

Sections

Size: 5.5MB - Virtual size: 15.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 15KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 71KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 39KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1011B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 142B - Virtual size: 179B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 92B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 733KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 3.1MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.exports
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.winlice
Size: - Virtual size: 23.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 17.0MB - Virtual size: 17.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.taggant
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/Themida.ini
Release/Themida_x32_x64_v3.0.4.0_Repacked/Themida64.exe
.exe windows:5 windows x86 arch:x86

Password: 123

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
madTraceProcess

Sections

Size: 5.5MB - Virtual size: 15.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 15KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 71KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 39KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1011B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 142B - Virtual size: 179B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 92B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 733KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 3.1MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.exports
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.winlice
Size: - Virtual size: 23.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 17.0MB - Virtual size: 17.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.taggant
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaGuiSettings.ini
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaHelp.chm
.chm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/Debug/TestPlugin.dll
.dll windows:5 windows x86 arch:x86

Password: 123

495a630d3f51271d065fe43464b32a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

X:\Problematic Apps\Benjamin\Problem 2\C\Debug\TestPlugin.pdb

Imports

user32

MessageBoxA

kernel32

GetEnvironmentStringsW
IsProcessorFeaturePresent
GetCurrentThreadId
DecodePointer
GetCommandLineA
RaiseException
WideCharToMultiByte
IsDebuggerPresent
MultiByteToWideChar
lstrlenA
GetProcAddress
LoadLibraryW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThread
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
HeapAlloc
GetProcessHeap
GetModuleFileNameW
VirtualQuery
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
SetConsoleCtrlHandler
InterlockedExchange
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
WriteFile
RtlUnwind
LCMapStringW
GetStringTypeW
HeapSize

Exports

Exports

_SecureEngineFinalize@0
_SecureEngineGetEncryptionKey@8
_SecureEngineInitialize@0
_SecureEngineShowCustomMessageA@8

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/Debug/TestPlugin.exp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/Debug/TestPlugin.ilk
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/Debug/TestPlugin.lib
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/Debug/TestPlugin.pdb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin.sln
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin.suo
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin/TestPlugin.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin/TestPlugin.vcproj
.xml
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin/TestPlugin.vcxproj
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin/stdafx.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin/stdafx.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/x64/Debug/TestPlugin.dll
.dll windows:5 windows x64 arch:x64

Password: 123

b40181f3c6a466635a4a737ec1a5f37b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

X:\Problematic Apps\Benjamin\Problem 2\C\x64\Debug\TestPlugin.pdb

Imports

user32

MessageBoxA

kernel32

GetTickCount
HeapSize
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RtlUnwindEx
EncodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
GetCurrentThread
FlsAlloc
HeapFree
Sleep
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
IsDebuggerPresent
MultiByteToWideChar
lstrlenA
LoadLibraryW
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
WriteFile
GetModuleFileNameW
GetProcessHeap
VirtualQuery
LCMapStringW
GetStringTypeW

Exports

Exports

SecureEngineFinalize
SecureEngineGetEncryptionKey
SecureEngineInitialize
SecureEngineShowCustomMessageA

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 738B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/x64/Debug/TestPlugin.exp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/x64/Debug/TestPlugin.ilk
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/x64/Debug/TestPlugin.lib
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/C/x64/Debug/TestPlugin.pdb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/TestPlugin.dll
.dll windows:4 windows x86 arch:x86

Password: 123

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

SecureEngineFinalize
SecureEngineGetEncryptionKey
SecureEngineInitialize
SecureEngineShowCustomMessageA
madTraceProcess

Sections

CODE
Size: 688KB - Virtual size: 687KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 225B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/TestPlugin.dpr
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/TestPlugin.res
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/Unit1.ddp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/Unit1.dfm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/Unit1.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Include/C/CustomMessagesConstantsDefinitions.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Plugins/Include/Delphi/CustomMessagesConstantsDefinitions.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Project1.bpr
.xml
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Project1.cpp
.js
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Project1.obj
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Project1.res
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.ddp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.dfm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.obj
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.~cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.~ddp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.~dfm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Unit1.~h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/StdAfx.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/StdAfx.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/UpgradeLog.XML
.xml
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/UpgradeLog2.XML
.xml
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/resource.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/small.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.aps
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.dsp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.dsw
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.plg
.html
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.rc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.res
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.sln
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.suo
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.suo.old
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.vcproj
.xml
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.vcxproj
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.vcxproj.filters
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.vcxproj.user
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Functions/Project1.cfg
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Functions/Project1.dpr
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Functions/Project1_Icon.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Functions/SecureEngineSDK.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Functions/SecureEngineSDK_CustomVMsImplementation.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Functions/SecureEngineSDK_CustomVMsInterface.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Functions/Unit1.dfm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Functions/Unit1.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Inline Assembly/Project1.cfg
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Inline Assembly/Project1.dpr
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Inline Assembly/Project1_Icon.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Inline Assembly/Unit1.dfm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Delphi/Via Inline Assembly/Unit1.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/PureBasic/ThemidaSDKMacros.pbi
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/PureBasic/example.pb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Assembly/Example.asm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Assembly/MAKEFILE
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Project1.bpr
.xml
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Project1.cpp
.js
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Project1.res
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Unit1.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Unit1.ddp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Unit1.dfm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Unit1.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/StdAfx.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/StdAfx.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/resource.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/small.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.dsp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.dsw
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.rc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.res
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.sln
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.suo
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.vcproj
.xml
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.vcxproj
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.vcxproj.filters
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.vcxproj.user
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/StdAfx.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/StdAfx.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/resource.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/small.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.aps
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.cpp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.dsp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.dsw
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.rc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.res
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.sln
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.suo
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++/vc_example.vcxproj
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Functions/Project1.dpr
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Functions/Project1.res
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Functions/Project1_Icon.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Functions/SecureEngineSDK.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Functions/SecureEngineSDK_CustomVMsImplementation.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Functions/SecureEngineSDK_CustomVMsInterface.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Functions/Unit1.dfm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Functions/Unit1.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/Project1.dpr
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/Project1_Icon.ico
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/Unit1.dfm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/Unit1.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/VM_FISH_RED_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/VM_FISH_RED_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/VM_FISH_WHITE_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/VM_FISH_WHITE_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/VM_TIGER_WHITE_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Delphi/Via Inline Assembly/VM_TIGER_WHITE_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Golang/main.go
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Golang/readme.txt
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/PureBasic/ThemidaSDK.pbi
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/PureBasic/example.pb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/PureBasic/x64/MacrosExample.pb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/PureBasic/x64/SecureEngineMacrosX64.pb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Visual Basic/Form1.frm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Visual Basic/Project1.vbp
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/ExamplesSDK/Protection Macros/Visual Basic/Project1.vbw
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Assembly/SecureEngineCustomVMs_fasm32.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Assembly/SecureEngineCustomVMs_fasm64.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Assembly/SecureEngineCustomVMs_masm32.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Assembly/SecureEngineCustomVMs_masm64.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Assembly/ThemidaSDK_masm.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/Readme.txt
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/SecureEngineCustomVMs.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/SecureEngineCustomVMs_BorlandC_inline.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/SecureEngineCustomVMs_GNU_inline.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/SecureEngineCustomVMs_ICL_inline.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/SecureEngineCustomVMs_LCC_inline.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/SecureEngineCustomVMs_VC_inline.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/ThemidaSDK.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/Via ASM module/How to add ASM files in your Solution.pdf
.pdf

Password: 123
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/Via ASM module/Readme.txt
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/Via ASM module/SecureEngineCustomVMsMacros.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/Via ASM module/SecureEngineCustomVmMacros.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/Via ASM module/SecureEngineMacros.asm
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/C/Via ASM module/SecureEngineMacros.h
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/D language/SecureEngineCustomVMs32.d
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/D language/SecureEngineCustomVMs64.d
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/D language/ThemidaSDK.d
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/CheckCodeIntegrity_Epilog.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/CheckCodeIntegrity_Prolog.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/CheckProtection_Epilog.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/CheckProtection_Prolog.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/CheckVirtualPC_Epilog.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/CheckVirtualPC_Prolog.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Clear_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Clear_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/CodeReplace_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/CodeReplace_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Encode_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Encode_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Mutate_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Mutate_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Registered_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Registered_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/SecureEngineSDK.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/SecureEngineSDK_CustomVMsImplementation.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/SecureEngineSDK_CustomVMsInterface.pas
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/StrEncryptW_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/StrEncryptW_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/StrEncrypt_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/StrEncrypt_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Unprotected_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/Unprotected_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_DOLPHIN_BLACK_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_DOLPHIN_BLACK_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_DOLPHIN_RED_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_DOLPHIN_RED_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_DOLPHIN_WHITE_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_DOLPHIN_WHITE_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_EAGLE_BLACK_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_EAGLE_BLACK_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_EAGLE_RED_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_EAGLE_RED_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_EAGLE_WHITE_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_EAGLE_WHITE_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_End.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_FISH_BLACK_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_FISH_BLACK_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_FISH_RED_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_FISH_RED_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_FISH_WHITE_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_FISH_WHITE_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_MUTATE_ONLY_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_MUTATE_ONLY_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_PUMA_BLACK_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_PUMA_BLACK_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_PUMA_RED_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_PUMA_RED_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_PUMA_WHITE_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_PUMA_WHITE_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_SHARK_BLACK_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_SHARK_BLACK_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_SHARK_RED_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_SHARK_RED_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_SHARK_WHITE_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_SHARK_WHITE_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_Start.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_Start_WithLevel.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_TIGER_BLACK_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_TIGER_BLACK_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_TIGER_RED_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_TIGER_RED_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_TIGER_WHITE_END.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Delphi/VM_TIGER_WHITE_START.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Go language/SecureEngineSDK_386.go
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/Go language/SecureEngineSDK_amd64.go
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PowerBasic/SecureEngineCustomVMs32.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PowerBasic/SecureEngineCustomVMs64.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PowerBasic/ThemidaSDK.inc
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PureBasic/Readme.txt
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PureBasic/SecureEngineCustomVMs32.pb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PureBasic/SecureEngineCustomVMs32.pbi
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PureBasic/SecureEngineCustomVMs64.pb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PureBasic/SecureEngineCustomVMs64.pbi
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PureBasic/SecureEngineMacrosX64.pb
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Include/PureBasic/ThemidaSDK.pbi
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Lib/COFF/SecureEngineSDK32.lib
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Lib/COFF/SecureEngineSDK64.lib
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Lib/OMF/SecureEngineSDK32.lib
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/Lib/OMF/SecureEngineSDK64.lib
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/SF loader.zip
.zip
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/SecureEngineSDK32.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ClearEnd
ClearStart
CodeReplaceEnd
CodeReplaceStart
CustomVM00000100_End
CustomVM00000100_Start
CustomVM00000101_End
CustomVM00000101_Start
CustomVM00000102_End
CustomVM00000102_Start
CustomVM00000103_End
CustomVM00000103_Start
CustomVM00000104_End
CustomVM00000104_Start
CustomVM00000105_End
CustomVM00000105_Start
CustomVM00000106_End
CustomVM00000106_Start
CustomVM00000107_End
CustomVM00000107_Start
CustomVM00000108_End
CustomVM00000108_Start
CustomVM00000109_End
CustomVM00000109_Start
CustomVM00000110_End
CustomVM00000110_Start
CustomVM00000111_End
CustomVM00000111_Start
CustomVM00000112_End
CustomVM00000112_Start
CustomVM00000113_End
CustomVM00000113_Start
CustomVM00000114_End
CustomVM00000114_Start
CustomVM00000115_End
CustomVM00000115_Start
CustomVM00000116_End
CustomVM00000116_Start
CustomVM00000117_End
CustomVM00000117_Start
CustomVM00000118_End
CustomVM00000118_Start
CustomVM00000119_End
CustomVM00000119_Start
CustomVM00000120_End
CustomVM00000120_Start
CustomVM00000121_End
CustomVM00000121_Start
CustomVM00000122_End
CustomVM00000122_Start
CustomVM00000123_End
CustomVM00000123_Start
CustomVM00000124_End
CustomVM00000124_Start
CustomVM00000125_End
CustomVM00000125_Start
CustomVM00000126_End
CustomVM00000126_Start
CustomVM00000127_End
CustomVM00000127_Start
CustomVM00000128_End
CustomVM00000128_Start
CustomVM00000129_End
CustomVM00000129_Start
CustomVM00000130_End
CustomVM00000130_Start
CustomVM00000131_End
CustomVM00000131_Start
CustomVM00000132_End
CustomVM00000132_Start
CustomVM00000133_End
CustomVM00000133_Start
CustomVM00000134_End
CustomVM00000134_Start
CustomVM00000135_End
CustomVM00000135_Start
CustomVM00000136_End
CustomVM00000136_Start
CustomVM00000137_End
CustomVM00000137_Start
CustomVM00000138_End
CustomVM00000138_Start
CustomVM00000139_End
CustomVM00000139_Start
CustomVM00000140_End
CustomVM00000140_Start
CustomVM00000141_End
CustomVM00000141_Start
CustomVM00000142_End
CustomVM00000142_Start
CustomVM00000143_End
CustomVM00000143_Start
CustomVM00000144_End
CustomVM00000144_Start
CustomVM00000145_End
CustomVM00000145_Start
CustomVM00000146_End
CustomVM00000146_Start
CustomVM00000147_End
CustomVM00000147_Start
CustomVM00000148_End
CustomVM00000148_Start
CustomVM00000149_End
CustomVM00000149_Start
CustomVM00000150_End
CustomVM00000150_Start
CustomVM00000151_End
CustomVM00000151_Start
CustomVM00000152_End
CustomVM00000152_Start
CustomVM00000153_End
CustomVM00000153_Start
CustomVM00000154_End
CustomVM00000154_Start
CustomVM00000155_End
CustomVM00000155_Start
CustomVM00000156_End
CustomVM00000156_Start
CustomVM00000157_End
CustomVM00000157_Start
CustomVM00000158_End
CustomVM00000158_Start
CustomVM00000159_End
CustomVM00000159_Start
CustomVM00000160_End
CustomVM00000160_Start
CustomVM00000161_End
CustomVM00000161_Start
CustomVM00000162_End
CustomVM00000162_Start
CustomVM00000163_End
CustomVM00000163_Start
CustomVM00000164_End
CustomVM00000164_Start
CustomVM00000165_End
CustomVM00000165_Start
CustomVM00000166_End
CustomVM00000166_Start
CustomVM00000167_End
CustomVM00000167_Start
CustomVM00000168_End
CustomVM00000168_Start
CustomVM00000169_End
CustomVM00000169_Start
CustomVM00000170_End
CustomVM00000170_Start
CustomVM00000171_End
CustomVM00000171_Start
CustomVM00000172_End
CustomVM00000172_Start
CustomVM00000173_End
CustomVM00000173_Start
CustomVM00000174_End
CustomVM00000174_Start
CustomVM00000175_End
CustomVM00000175_Start
CustomVM00000176_End
CustomVM00000176_Start
CustomVM00000177_End
CustomVM00000177_Start
CustomVM00000178_End
CustomVM00000178_Start
CustomVM00000179_End
CustomVM00000179_Start
CustomVM00000180_End
CustomVM00000180_Start
CustomVM00000181_End
CustomVM00000181_Start
CustomVM00000182_End
CustomVM00000182_Start
CustomVM00000183_End
CustomVM00000183_Start
CustomVM00000184_End
CustomVM00000184_Start
CustomVM00000185_End
CustomVM00000185_Start
CustomVM00000186_End
CustomVM00000186_Start
CustomVM00000187_End
CustomVM00000187_Start
CustomVM00000188_End
CustomVM00000188_Start
CustomVM00000189_End
CustomVM00000189_Start
CustomVM00000190_End
CustomVM00000190_Start
CustomVM00000191_End
CustomVM00000191_Start
CustomVM00000192_End
CustomVM00000192_Start
CustomVM00000193_End
CustomVM00000193_Start
CustomVM00000194_End
CustomVM00000194_Start
CustomVM00000195_End
CustomVM00000195_Start
CustomVM00000196_End
CustomVM00000196_Start
CustomVM00000197_End
CustomVM00000197_Start
CustomVM00000198_End
CustomVM00000198_Start
CustomVM00000199_End
CustomVM00000199_Start
CustomVM00000200_End
CustomVM00000200_Start
CustomVM00000201_End
CustomVM00000201_Start
CustomVM00000202_End
CustomVM00000202_Start
CustomVM00000203_End
CustomVM00000203_Start
CustomVM00000204_End
CustomVM00000204_Start
CustomVM00000205_End
CustomVM00000205_Start
CustomVM00000206_End
CustomVM00000206_Start
CustomVM00000207_End
CustomVM00000207_Start
CustomVM00000208_End
CustomVM00000208_Start
CustomVM00000209_End
CustomVM00000209_Start
CustomVM00000210_End
CustomVM00000210_Start
CustomVM00000211_End
CustomVM00000211_Start
CustomVM00000212_End
CustomVM00000212_Start
CustomVM00000213_End
CustomVM00000213_Start
CustomVM00000214_End
CustomVM00000214_Start
CustomVM00000215_End
CustomVM00000215_Start
CustomVM00000216_End
CustomVM00000216_Start
CustomVM00000217_End
CustomVM00000217_Start
CustomVM00000218_End
CustomVM00000218_Start
CustomVM00000219_End
CustomVM00000219_Start
CustomVM00000220_End
CustomVM00000220_Start
CustomVM00000221_End
CustomVM00000221_Start
CustomVM00000222_End
CustomVM00000222_Start
CustomVM00000223_End
CustomVM00000223_Start
CustomVM00000224_End
CustomVM00000224_Start
CustomVM00000225_End
CustomVM00000225_Start
CustomVM00000226_End
CustomVM00000226_Start
CustomVM00000227_End
CustomVM00000227_Start
CustomVM00000228_End
CustomVM00000228_Start
CustomVM00000229_End
CustomVM00000229_Start
CustomVM00000230_End
CustomVM00000230_Start
CustomVM00000231_End
CustomVM00000231_Start
CustomVM00000232_End
CustomVM00000232_Start
CustomVM00000233_End
CustomVM00000233_Start
CustomVM00000234_End
CustomVM00000234_Start
CustomVM00000235_End
CustomVM00000235_Start
CustomVM00000236_End
CustomVM00000236_Start
CustomVM00000237_End
CustomVM00000237_Start
CustomVM00000238_End
CustomVM00000238_Start
CustomVM00000239_End
CustomVM00000239_Start
CustomVM00000240_End
CustomVM00000240_Start
CustomVM00000241_End
CustomVM00000241_Start
CustomVM00000242_End
CustomVM00000242_Start
CustomVM00000243_End
CustomVM00000243_Start
CustomVM00000244_End
CustomVM00000244_Start
CustomVM00000245_End
CustomVM00000245_Start
CustomVM00000246_End
CustomVM00000246_Start
CustomVM00000247_End
CustomVM00000247_Start
CustomVM00000248_End
CustomVM00000248_Start
CustomVM00000249_End
CustomVM00000249_Start
CustomVM00000250_End
CustomVM00000250_Start
CustomVM00000251_End
CustomVM00000251_Start
CustomVM00000252_End
CustomVM00000252_Start
CustomVM00000253_End
CustomVM00000253_Start
CustomVM00000254_End
CustomVM00000254_Start
CustomVM00000255_End
CustomVM00000255_Start
CustomVM00000256_End
CustomVM00000256_Start
CustomVM00000257_End
CustomVM00000257_Start
CustomVM00000258_End
CustomVM00000258_Start
CustomVM00000259_End
CustomVM00000259_Start
CustomVM00000260_End
CustomVM00000260_Start
CustomVM00000261_End
CustomVM00000261_Start
CustomVM00000262_End
CustomVM00000262_Start
CustomVM00000263_End
CustomVM00000263_Start
CustomVM00000264_End
CustomVM00000264_Start
CustomVM00000265_End
CustomVM00000265_Start
CustomVM00000266_End
CustomVM00000266_Start
CustomVM00000267_End
CustomVM00000267_Start
CustomVM00000268_End
CustomVM00000268_Start
CustomVM00000269_End
CustomVM00000269_Start
CustomVM00000270_End
CustomVM00000270_Start
CustomVM00000271_End
CustomVM00000271_Start
CustomVM00000272_End
CustomVM00000272_Start
CustomVM00000273_End
CustomVM00000273_Start
CustomVM00000274_End
CustomVM00000274_Start
CustomVM00000275_End
CustomVM00000275_Start
CustomVM00000276_End
CustomVM00000276_Start
CustomVM00000277_End
CustomVM00000277_Start
CustomVM00000278_End
CustomVM00000278_Start
CustomVM00000279_End
CustomVM00000279_Start
CustomVM00000280_End
CustomVM00000280_Start
CustomVM00000281_End
CustomVM00000281_Start
CustomVM00000282_End
CustomVM00000282_Start
CustomVM00000283_End
CustomVM00000283_Start
CustomVM00000284_End
CustomVM00000284_Start
CustomVM00000285_End
CustomVM00000285_Start
CustomVM00000286_End
CustomVM00000286_Start
CustomVM00000287_End
CustomVM00000287_Start
CustomVM00000288_End
CustomVM00000288_Start
CustomVM00000289_End
CustomVM00000289_Start
CustomVM00000290_End
CustomVM00000290_Start
CustomVM00000291_End
CustomVM00000291_Start
CustomVM00000292_End
CustomVM00000292_Start
CustomVM00000293_End
CustomVM00000293_Start
CustomVM00000294_End
CustomVM00000294_Start
CustomVM00000295_End
CustomVM00000295_Start
CustomVM00000296_End
CustomVM00000296_Start
CustomVM00000297_End
CustomVM00000297_Start
CustomVM00000298_End
CustomVM00000298_Start
CustomVM00000299_End
CustomVM00000299_Start
CustomVM00000300_End
CustomVM00000300_Start
CustomVM00000301_End
CustomVM00000301_Start
CustomVM00000302_End
CustomVM00000302_Start
CustomVM00000303_End
CustomVM00000303_Start
CustomVM00000304_End
CustomVM00000304_Start
CustomVM00000305_End
CustomVM00000305_Start
CustomVM00000306_End
CustomVM00000306_Start
CustomVM00000307_End
CustomVM00000307_Start
CustomVM00000308_End
CustomVM00000308_Start
CustomVM00000309_End
CustomVM00000309_Start
CustomVM00000310_End
CustomVM00000310_Start
CustomVM00000311_End
CustomVM00000311_Start
CustomVM00000312_End
CustomVM00000312_Start
CustomVM00000313_End
CustomVM00000313_Start
CustomVM00000314_End
CustomVM00000314_Start
CustomVM00000315_End
CustomVM00000315_Start
CustomVM00000316_End
CustomVM00000316_Start
CustomVM00000317_End
CustomVM00000317_Start
CustomVM00000318_End
CustomVM00000318_Start
CustomVM00000319_End
CustomVM00000319_Start
CustomVM00000320_End
CustomVM00000320_Start
CustomVM00000321_End
CustomVM00000321_Start
CustomVM00000322_End
CustomVM00000322_Start
CustomVM00000323_End
CustomVM00000323_Start
CustomVM00000324_End
CustomVM00000324_Start
CustomVM00000325_End
CustomVM00000325_Start
CustomVM00000326_End
CustomVM00000326_Start
CustomVM00000327_End
CustomVM00000327_Start
CustomVM00000328_End
CustomVM00000328_Start
CustomVM00000329_End
CustomVM00000329_Start
CustomVM00000330_End
CustomVM00000330_Start
CustomVM00000331_End
CustomVM00000331_Start
CustomVM00000332_End
CustomVM00000332_Start
CustomVM00000333_End
CustomVM00000333_Start
CustomVM00000334_End
CustomVM00000334_Start
CustomVM00000335_End
CustomVM00000335_Start
CustomVM00000336_End
CustomVM00000336_Start
CustomVM00000337_End
CustomVM00000337_Start
CustomVM00000338_End
CustomVM00000338_Start
CustomVM00000339_End
CustomVM00000339_Start
CustomVM00000340_End
CustomVM00000340_Start
CustomVM00000341_End
CustomVM00000341_Start
CustomVM00000342_End
CustomVM00000342_Start
CustomVM00000343_End
CustomVM00000343_Start
CustomVM00000344_End
CustomVM00000344_Start
CustomVM00000345_End
CustomVM00000345_Start
CustomVM00000346_End
CustomVM00000346_Start
CustomVM00000347_End
CustomVM00000347_Start

Sections

.text
Size: 1024B - Virtual size: 910B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/ThemidaSDK/SecureEngineSDK64.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ClearEnd
ClearStart
CodeReplaceEnd
CodeReplaceStart
CustomVM00000100_End
CustomVM00000100_Start
CustomVM00000101_End
CustomVM00000101_Start
CustomVM00000102_End
CustomVM00000102_Start
CustomVM00000103_End
CustomVM00000103_Start
CustomVM00000104_End
CustomVM00000104_Start
CustomVM00000105_End
CustomVM00000105_Start
CustomVM00000106_End
CustomVM00000106_Start
CustomVM00000107_End
CustomVM00000107_Start
CustomVM00000108_End
CustomVM00000108_Start
CustomVM00000109_End
CustomVM00000109_Start
CustomVM00000110_End
CustomVM00000110_Start
CustomVM00000111_End
CustomVM00000111_Start
CustomVM00000112_End
CustomVM00000112_Start
CustomVM00000113_End
CustomVM00000113_Start
CustomVM00000114_End
CustomVM00000114_Start
CustomVM00000115_End
CustomVM00000115_Start
CustomVM00000116_End
CustomVM00000116_Start
CustomVM00000117_End
CustomVM00000117_Start
CustomVM00000118_End
CustomVM00000118_Start
CustomVM00000119_End
CustomVM00000119_Start
CustomVM00000120_End
CustomVM00000120_Start
CustomVM00000121_End
CustomVM00000121_Start
CustomVM00000122_End
CustomVM00000122_Start
CustomVM00000123_End
CustomVM00000123_Start
CustomVM00000124_End
CustomVM00000124_Start
CustomVM00000125_End
CustomVM00000125_Start
CustomVM00000126_End
CustomVM00000126_Start
CustomVM00000127_End
CustomVM00000127_Start
CustomVM00000128_End
CustomVM00000128_Start
CustomVM00000129_End
CustomVM00000129_Start
CustomVM00000130_End
CustomVM00000130_Start
CustomVM00000131_End
CustomVM00000131_Start
CustomVM00000132_End
CustomVM00000132_Start
CustomVM00000133_End
CustomVM00000133_Start
CustomVM00000134_End
CustomVM00000134_Start
CustomVM00000135_End
CustomVM00000135_Start
CustomVM00000136_End
CustomVM00000136_Start
CustomVM00000137_End
CustomVM00000137_Start
CustomVM00000138_End
CustomVM00000138_Start
CustomVM00000139_End
CustomVM00000139_Start
CustomVM00000140_End
CustomVM00000140_Start
CustomVM00000141_End
CustomVM00000141_Start
CustomVM00000142_End
CustomVM00000142_Start
CustomVM00000143_End
CustomVM00000143_Start
CustomVM00000144_End
CustomVM00000144_Start
CustomVM00000145_End
CustomVM00000145_Start
CustomVM00000146_End
CustomVM00000146_Start
CustomVM00000147_End
CustomVM00000147_Start
CustomVM00000148_End
CustomVM00000148_Start
CustomVM00000149_End
CustomVM00000149_Start
CustomVM00000150_End
CustomVM00000150_Start
CustomVM00000151_End
CustomVM00000151_Start
CustomVM00000152_End
CustomVM00000152_Start
CustomVM00000153_End
CustomVM00000153_Start
CustomVM00000154_End
CustomVM00000154_Start
CustomVM00000155_End
CustomVM00000155_Start
CustomVM00000156_End
CustomVM00000156_Start
CustomVM00000157_End
CustomVM00000157_Start
CustomVM00000158_End
CustomVM00000158_Start
CustomVM00000159_End
CustomVM00000159_Start
CustomVM00000160_End
CustomVM00000160_Start
CustomVM00000161_End
CustomVM00000161_Start
CustomVM00000162_End
CustomVM00000162_Start
CustomVM00000163_End
CustomVM00000163_Start
CustomVM00000164_End
CustomVM00000164_Start
CustomVM00000165_End
CustomVM00000165_Start
CustomVM00000166_End
CustomVM00000166_Start
CustomVM00000167_End
CustomVM00000167_Start
CustomVM00000168_End
CustomVM00000168_Start
CustomVM00000169_End
CustomVM00000169_Start
CustomVM00000170_End
CustomVM00000170_Start
CustomVM00000171_End
CustomVM00000171_Start
CustomVM00000172_End
CustomVM00000172_Start
CustomVM00000173_End
CustomVM00000173_Start
CustomVM00000174_End
CustomVM00000174_Start
CustomVM00000175_End
CustomVM00000175_Start
CustomVM00000176_End
CustomVM00000176_Start
CustomVM00000177_End
CustomVM00000177_Start
CustomVM00000178_End
CustomVM00000178_Start
CustomVM00000179_End
CustomVM00000179_Start
CustomVM00000180_End
CustomVM00000180_Start
CustomVM00000181_End
CustomVM00000181_Start
CustomVM00000182_End
CustomVM00000182_Start
CustomVM00000183_End
CustomVM00000183_Start
CustomVM00000184_End
CustomVM00000184_Start
CustomVM00000185_End
CustomVM00000185_Start
CustomVM00000186_End
CustomVM00000186_Start
CustomVM00000187_End
CustomVM00000187_Start
CustomVM00000188_End
CustomVM00000188_Start
CustomVM00000189_End
CustomVM00000189_Start
CustomVM00000190_End
CustomVM00000190_Start
CustomVM00000191_End
CustomVM00000191_Start
CustomVM00000192_End
CustomVM00000192_Start
CustomVM00000193_End
CustomVM00000193_Start
CustomVM00000194_End
CustomVM00000194_Start
CustomVM00000195_End
CustomVM00000195_Start
CustomVM00000196_End
CustomVM00000196_Start
CustomVM00000197_End
CustomVM00000197_Start
CustomVM00000198_End
CustomVM00000198_Start
CustomVM00000199_End
CustomVM00000199_Start
CustomVM00000200_End
CustomVM00000200_Start
CustomVM00000201_End
CustomVM00000201_Start
CustomVM00000202_End
CustomVM00000202_Start
CustomVM00000203_End
CustomVM00000203_Start
CustomVM00000204_End
CustomVM00000204_Start
CustomVM00000205_End
CustomVM00000205_Start
CustomVM00000206_End
CustomVM00000206_Start
CustomVM00000207_End
CustomVM00000207_Start
CustomVM00000208_End
CustomVM00000208_Start
CustomVM00000209_End
CustomVM00000209_Start
CustomVM00000210_End
CustomVM00000210_Start
CustomVM00000211_End
CustomVM00000211_Start
CustomVM00000212_End
CustomVM00000212_Start
CustomVM00000213_End
CustomVM00000213_Start
CustomVM00000214_End
CustomVM00000214_Start
CustomVM00000215_End
CustomVM00000215_Start
CustomVM00000216_End
CustomVM00000216_Start
CustomVM00000217_End
CustomVM00000217_Start
CustomVM00000218_End
CustomVM00000218_Start
CustomVM00000219_End
CustomVM00000219_Start
CustomVM00000220_End
CustomVM00000220_Start
CustomVM00000221_End
CustomVM00000221_Start
CustomVM00000222_End
CustomVM00000222_Start
CustomVM00000223_End
CustomVM00000223_Start
CustomVM00000224_End
CustomVM00000224_Start
CustomVM00000225_End
CustomVM00000225_Start
CustomVM00000226_End
CustomVM00000226_Start
CustomVM00000227_End
CustomVM00000227_Start
CustomVM00000228_End
CustomVM00000228_Start
CustomVM00000229_End
CustomVM00000229_Start
CustomVM00000230_End
CustomVM00000230_Start
CustomVM00000231_End
CustomVM00000231_Start
CustomVM00000232_End
CustomVM00000232_Start
CustomVM00000233_End
CustomVM00000233_Start
CustomVM00000234_End
CustomVM00000234_Start
CustomVM00000235_End
CustomVM00000235_Start
CustomVM00000236_End
CustomVM00000236_Start
CustomVM00000237_End
CustomVM00000237_Start
CustomVM00000238_End
CustomVM00000238_Start
CustomVM00000239_End
CustomVM00000239_Start
CustomVM00000240_End
CustomVM00000240_Start
CustomVM00000241_End
CustomVM00000241_Start
CustomVM00000242_End
CustomVM00000242_Start
CustomVM00000243_End
CustomVM00000243_Start
CustomVM00000244_End
CustomVM00000244_Start
CustomVM00000245_End
CustomVM00000245_Start
CustomVM00000246_End
CustomVM00000246_Start
CustomVM00000247_End
CustomVM00000247_Start
CustomVM00000248_End
CustomVM00000248_Start
CustomVM00000249_End
CustomVM00000249_Start
CustomVM00000250_End
CustomVM00000250_Start
CustomVM00000251_End
CustomVM00000251_Start
CustomVM00000252_End
CustomVM00000252_Start
CustomVM00000253_End
CustomVM00000253_Start
CustomVM00000254_End
CustomVM00000254_Start
CustomVM00000255_End
CustomVM00000255_Start
CustomVM00000256_End
CustomVM00000256_Start
CustomVM00000257_End
CustomVM00000257_Start
CustomVM00000258_End
CustomVM00000258_Start
CustomVM00000259_End
CustomVM00000259_Start
CustomVM00000260_End
CustomVM00000260_Start
CustomVM00000261_End
CustomVM00000261_Start
CustomVM00000262_End
CustomVM00000262_Start
CustomVM00000263_End
CustomVM00000263_Start
CustomVM00000264_End
CustomVM00000264_Start
CustomVM00000265_End
CustomVM00000265_Start
CustomVM00000266_End
CustomVM00000266_Start
CustomVM00000267_End
CustomVM00000267_Start
CustomVM00000268_End
CustomVM00000268_Start
CustomVM00000269_End
CustomVM00000269_Start
CustomVM00000270_End
CustomVM00000270_Start
CustomVM00000271_End
CustomVM00000271_Start
CustomVM00000272_End
CustomVM00000272_Start
CustomVM00000273_End
CustomVM00000273_Start
CustomVM00000274_End
CustomVM00000274_Start
CustomVM00000275_End
CustomVM00000275_Start
CustomVM00000276_End
CustomVM00000276_Start
CustomVM00000277_End
CustomVM00000277_Start
CustomVM00000278_End
CustomVM00000278_Start
CustomVM00000279_End
CustomVM00000279_Start
CustomVM00000280_End
CustomVM00000280_Start
CustomVM00000281_End
CustomVM00000281_Start
CustomVM00000282_End
CustomVM00000282_Start
CustomVM00000283_End
CustomVM00000283_Start
CustomVM00000284_End
CustomVM00000284_Start
CustomVM00000285_End
CustomVM00000285_Start
CustomVM00000286_End
CustomVM00000286_Start
CustomVM00000287_End
CustomVM00000287_Start
CustomVM00000288_End
CustomVM00000288_Start
CustomVM00000289_End
CustomVM00000289_Start
CustomVM00000290_End
CustomVM00000290_Start
CustomVM00000291_End
CustomVM00000291_Start
CustomVM00000292_End
CustomVM00000292_Start
CustomVM00000293_End
CustomVM00000293_Start
CustomVM00000294_End
CustomVM00000294_Start
CustomVM00000295_End
CustomVM00000295_Start
CustomVM00000296_End
CustomVM00000296_Start
CustomVM00000297_End
CustomVM00000297_Start
CustomVM00000298_End
CustomVM00000298_Start
CustomVM00000299_End
CustomVM00000299_Start
CustomVM00000300_End
CustomVM00000300_Start
CustomVM00000301_End
CustomVM00000301_Start
CustomVM00000302_End
CustomVM00000302_Start
CustomVM00000303_End
CustomVM00000303_Start
CustomVM00000304_End
CustomVM00000304_Start
CustomVM00000305_End
CustomVM00000305_Start
CustomVM00000306_End
CustomVM00000306_Start
CustomVM00000307_End
CustomVM00000307_Start
CustomVM00000308_End
CustomVM00000308_Start
CustomVM00000309_End
CustomVM00000309_Start
CustomVM00000310_End
CustomVM00000310_Start
CustomVM00000311_End
CustomVM00000311_Start
CustomVM00000312_End
CustomVM00000312_Start
CustomVM00000313_End
CustomVM00000313_Start
CustomVM00000314_End
CustomVM00000314_Start
CustomVM00000315_End
CustomVM00000315_Start
CustomVM00000316_End
CustomVM00000316_Start
CustomVM00000317_End
CustomVM00000317_Start
CustomVM00000318_End
CustomVM00000318_Start
CustomVM00000319_End
CustomVM00000319_Start
CustomVM00000320_End
CustomVM00000320_Start
CustomVM00000321_End
CustomVM00000321_Start
CustomVM00000322_End
CustomVM00000322_Start
CustomVM00000323_End
CustomVM00000323_Start
CustomVM00000324_End
CustomVM00000324_Start
CustomVM00000325_End
CustomVM00000325_Start
CustomVM00000326_End
CustomVM00000326_Start
CustomVM00000327_End
CustomVM00000327_Start
CustomVM00000328_End
CustomVM00000328_Start
CustomVM00000329_End
CustomVM00000329_Start
CustomVM00000330_End
CustomVM00000330_Start
CustomVM00000331_End
CustomVM00000331_Start
CustomVM00000332_End
CustomVM00000332_Start
CustomVM00000333_End
CustomVM00000333_Start
CustomVM00000334_End
CustomVM00000334_Start
CustomVM00000335_End
CustomVM00000335_Start
CustomVM00000336_End
CustomVM00000336_Start
CustomVM00000337_End
CustomVM00000337_Start
CustomVM00000338_End
CustomVM00000338_Start
CustomVM00000339_End
CustomVM00000339_Start
CustomVM00000340_End
CustomVM00000340_Start
CustomVM00000341_End
CustomVM00000341_Start
CustomVM00000342_End
CustomVM00000342_Start
CustomVM00000343_End
CustomVM00000343_Start
CustomVM00000344_End
CustomVM00000344_Start
CustomVM00000345_End
CustomVM00000345_Start
CustomVM00000346_End
CustomVM00000346_Start
CustomVM00000347_End
CustomVM00000347_Start

Sections

.text
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/WinlicenseSDK.dll
.dll windows:6 windows x86 arch:x86

b78020bd80886ef26c961debfd7fa0fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\Oreans Projects\SecureEngine\src\sdk_dlls\WinLicenseSDK\WinlicenseSDK\Release\WinlicenseSDK.pdb

Imports

kernel32

lstrlenA
GetPrivateProfileStringW
GetLocalTime
ExitProcess
SetEnvironmentVariableA
SystemTimeToFileTime
GetModuleHandleW
GetEnvironmentVariableW
CreateProcessA
DecodePointer
SetEnvironmentVariableW
GetModuleFileNameW
GetPrivateProfileIntW
FreeLibrary
GetProcAddress
LoadLibraryW
LoadLibraryA
GetModuleHandleA
WideCharToMultiByte
GetModuleFileNameA
CreateFileW
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
MultiByteToWideChar
GetModuleHandleExW
HeapFree
HeapAlloc
GetACP
CompareStringW
LCMapStringW
GetStdHandle
GetFileType
GetTimeZoneInformation
GetStringTypeW
HeapReAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetStdHandle
ReadFile
ReadConsoleW
SetFilePointerEx
HeapSize
CloseHandle
RaiseException

user32

MessageBoxA
wsprintfW
MessageBoxW
wsprintfA

advapi32

RegQueryValueExA
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

oleaut32

SysFreeString
SysAllocStringLen

Exports

Exports

ECCGenerateKeys
GenUniqueLicenseHash
WLActCheck
WLActDaysToActivate
WLActExpirationDate
WLActGetInfo
WLActInstall
WLActUninstall
WLBufferCrypt
WLBufferDecrypt
WLCheckVirtualPC
WLGenLicenseDynSmartKey
WLGenLicenseDynSmartKeyW
WLGenLicenseFileKey
WLGenLicenseFileKeyEx
WLGenLicenseFileKeyExW
WLGenLicenseFileKeyW
WLGenLicenseRegistryKey
WLGenLicenseRegistryKeyEx
WLGenLicenseRegistryKeyExW
WLGenLicenseRegistryKeyW
WLGenLicenseSmartKey
WLGenLicenseSmartKeyW
WLGenLicenseTextKey
WLGenLicenseTextKeyEx
WLGenLicenseTextKeyExW
WLGenLicenseTextKeyW
WLGenPassword
WLGenTrialExtensionFileKey
WLGenTrialExtensionRegistryKey
WLGetCurrentCountry
WLGetProtectionDate
WLGetVersion
WLHardwareCheckID
WLHardwareGetFormattedID
WLHardwareGetID
WLHardwareGetIDW
WLHardwareGetIdType
WLHardwareGetNumberUsbDrives
WLHardwareGetUsbIdAt
WLHardwareGetUsbIdAtW
WLHardwareGetUsbNameAt
WLHardwareGetUsbNameAtW
WLHardwareRuntimeCheckU3
WLLoadEncryptedLibrary
WLLoadWinlicenseDll
WLPasswordCheck
WLProtectCheckCodeIntegrity
WLProtectCheckDebugger
WLRegActivateSoftware
WLRegActivateSoftwareOffline
WLRegCheckMachineLocked
WLRegDateDaysLeft
WLRegDaysLeft
WLRegDeactivateSoftware
WLRegDeactivateSoftwareOffline
WLRegDisableCurrentKey
WLRegDisableKeyCurrentInstance
WLRegExecutionsLeft
WLRegExpirationDate
WLRegExpirationTimestamp
WLRegFirstRun
WLRegGetDynSmartKey
WLRegGetLicenseHardwareID
WLRegGetLicenseInfo
WLRegGetLicenseInfoW
WLRegGetLicenseRestrictions
WLRegGetLicenseType
WLRegGetStatus
WLRegGlobalTimeLeft
WLRegLicenseCreationDate
WLRegLicenseName
WLRegLockedCountry
WLRegNetInstancesGet
WLRegNetInstancesMax
WLRegNormalKeyCheck
WLRegNormalKeyCheckW
WLRegNormalKeyInstallToFile
WLRegNormalKeyInstallToFileW
WLRegNormalKeyInstallToRegistry
WLRegNormalKeyInstallToRegistryW
WLRegRemoveCurrentKey
WLRegRuntimeLeft
WLRegSmartKeyCheck
WLRegSmartKeyCheckW
WLRegSmartKeyInstallToFile
WLRegSmartKeyInstallToFileInFolder
WLRegSmartKeyInstallToFileInFolderW
WLRegSmartKeyInstallToFileW
WLRegSmartKeyInstallToRegistry
WLRegSmartKeyInstallToRegistryW
WLRegTotalDays
WLRegTotalExecutions
WLResetLicenseFeatures
WLRestartApplication
WLRestartApplicationArgs
WLSplashHide
WLStringDecrypt
WLStringDecryptW
WLTrialCustomCounter
WLTrialCustomCounterDec
WLTrialCustomCounterInc
WLTrialCustomCounterSet
WLTrialDateDaysLeft
WLTrialDaysLeft
WLTrialDebugCheck
WLTrialExecutionsLeft
WLTrialExpirationDate
WLTrialExpirationTimestamp
WLTrialExpireTrial
WLTrialExtGetLevel
WLTrialExtGetStatus
WLTrialExtendExpiration
WLTrialFirstRun
WLTrialGetStatus
WLTrialGetTrialRestrictions
WLTrialGlobalTimeLeft
WLTrialLockedCountry
WLTrialRuntimeLeft
WLTrialStringRead
WLTrialStringReadW
WLTrialStringWrite
WLTrialStringWriteW
WLTrialTotalDays
WLTrialTotalExecutions
_TestWinLicenseSDK@0

Sections

.text
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/bugreport.txt
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/dolphin32_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/dolphin32_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/dolphin32_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/dolphin64_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/dolphin64_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/dolphin64_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/eagle32_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/eagle32_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/eagle32_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/eagle64_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/eagle64_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/eagle64_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/fish32_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/fish32_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/fish32_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/fish64_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/fish64_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/fish64_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/puma32_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/puma32_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/puma32_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/puma64_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/puma64_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/puma64_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/shark32_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/shark32_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/shark32_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/shark64_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/shark64_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/shark64_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/tiger32_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/tiger32_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/tiger32_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/tiger64_black.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/tiger64_red.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/custom_vms/public/tiger64_white.vm
Release/Themida_x32_x64_v3.0.4.0_Repacked/demangler.dll
.dll windows:4 windows x86 arch:x86

137d954e5f75ca12c168e2b9701905b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
LCMapStringA
LeaveCriticalSection
LoadLibraryA
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WriteFile

user32

EnumThreadWindows
MessageBoxA
wsprintfA

Exports

Exports

GetUnmangledName
___CPPdebugHook

Sections

.text
Size: 48KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/dma.tmd
Release/Themida_x32_x64_v3.0.4.0_Repacked/libspv.dll
.dll windows:6 windows x86 arch:x86

66097c572747a4d30465c3691fa556f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

connect
WSAStartup
select
htons
WSACleanup
recv
socket
closesocket
gethostbyname
send

kernel32

GetStdHandle
GetFileType
WriteFile
GetLastError
GetCurrentThreadId
GetModuleHandleA
GetProcAddress
MultiByteToWideChar
CloseHandle
QueryPerformanceCounter
GetTickCount
FreeLibrary
GlobalMemoryStatus
LoadLibraryA
FlushConsoleInputBuffer
GetStringTypeW
OutputDebugStringW
CreateFileW
SetStdHandle
RtlUnwind
CompareStringW
SetEnvironmentVariableA
LCMapStringW
HeapSize
WriteConsoleW
GetCurrentProcessId
EnterCriticalSection
HeapFree
HeapAlloc
ReadFile
HeapReAlloc
GetCommandLineA
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
SetEndOfFile
LeaveCriticalSection
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetProcessHeap
GetModuleFileNameW
ReadConsoleW
SetFilePointerEx
DeleteCriticalSection
GetStartupInfoW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
FlushFileBuffers
GetConsoleCP

user32

MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation

advapi32

RegisterEventSourceA
DeregisterEventSource
ReportEventA

Exports

Exports

TaggantAddHashRegion
TaggantComputeHashes
TaggantContextFree
TaggantContextNew
TaggantContextNewEx
TaggantFinalizeLibrary
TaggantGetLicenseExpirationDate
TaggantInitializeLibrary
TaggantObjectFree
TaggantObjectNew
TaggantObjectNewEx
TaggantPackerInfo
TaggantPrepare
TaggantPutInfo
TaggantPutTimestamp

Sections

.text
Size: 570KB - Virtual size: 569KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 238KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/vcomp140.dll
.dll windows:6 windows x86 arch:x86

8f713adc16efa9ec02a5f6f5397a2922

Code Sign

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:95:25:d2:ed:19:ef:c7:60:48:69:df:7a:f5:d4:43:c3:7c:20:61:e5:f2:48:2a:d8:1b:93:de:9c:c0:05:3e
Signer

Actual PE Digest

8c:95:25:d2:ed:19:ef:c7:60:48:69:df:7a:f5:d4:43:c3:7c:20:61:e5:f2:48:2a:d8:1b:93:de:9c:c0:05:3e

Digest Algorithm

sha256

PE Digest Matches

true

48:dc:f9:d3:e3:0e:d5:27:bd:de:79:fa:3f:9e:b2:cb:b5:de:53:29
Signer

Actual PE Digest

48:dc:f9:d3:e3:0e:d5:27:bd:de:79:fa:3f:9e:b2:cb:b5:de:53:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

vcomp140.i386.pdb

Imports

kernel32

FormatMessageW
OutputDebugStringW
LocalAlloc
LocalFree
GetConsoleWindow
GetConsoleScreenBufferInfo
WriteConsoleW
WideCharToMultiByte
WriteFile
GetLastError
GetCurrentThreadId
HeapFree
GetProcessHeap
UnhandledExceptionFilter
CloseHandle
WaitForSingleObjectEx
SetEvent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapAlloc
TryEnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetTickCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
Sleep
SwitchToThread
ExitProcess
GetStdHandle
CreateThread
QueueUserWorkItem
CreateEventW
GetNativeSystemInfo
QueryPerformanceFrequency
GetSystemTimeAdjustment
GetEnvironmentVariableW
lstrlenW
lstrcmpiW
GetStringTypeExW
ResetEvent
LoadLibraryExW
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
GetUserDefaultUILanguage
FindFirstFileW
FindNextFileW
FindClose
GetModuleFileNameW
FindResourceExW
LoadResource
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
MultiByteToWideChar
SetLastError
GetACP
GetStringTypeW
GetCPInfo
FreeLibrary
LCMapStringW
IsValidCodePage
GetOEMCP
SetStdHandle
GetModuleHandleExW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
RaiseException
CreateFileW
RtlUnwind

user32

MessageBoxW

Exports

Exports

C2VectParallel
_vcomp_atomic_add_i1
_vcomp_atomic_add_i2
_vcomp_atomic_add_i4
_vcomp_atomic_add_i8
_vcomp_atomic_add_r4
_vcomp_atomic_add_r8
_vcomp_atomic_and_i1
_vcomp_atomic_and_i2
_vcomp_atomic_and_i4
_vcomp_atomic_and_i8
_vcomp_atomic_div_i1
_vcomp_atomic_div_i2
_vcomp_atomic_div_i4
_vcomp_atomic_div_i8
_vcomp_atomic_div_r4
_vcomp_atomic_div_r8
_vcomp_atomic_div_ui1
_vcomp_atomic_div_ui2
_vcomp_atomic_div_ui4
_vcomp_atomic_div_ui8
_vcomp_atomic_mul_i1
_vcomp_atomic_mul_i2
_vcomp_atomic_mul_i4
_vcomp_atomic_mul_i8
_vcomp_atomic_mul_r4
_vcomp_atomic_mul_r8
_vcomp_atomic_or_i1
_vcomp_atomic_or_i2
_vcomp_atomic_or_i4
_vcomp_atomic_or_i8
_vcomp_atomic_shl_i1
_vcomp_atomic_shl_i2
_vcomp_atomic_shl_i4
_vcomp_atomic_shl_i8
_vcomp_atomic_shr_i1
_vcomp_atomic_shr_i2
_vcomp_atomic_shr_i4
_vcomp_atomic_shr_i8
_vcomp_atomic_shr_ui1
_vcomp_atomic_shr_ui2
_vcomp_atomic_shr_ui4
_vcomp_atomic_shr_ui8
_vcomp_atomic_sub_i1
_vcomp_atomic_sub_i2
_vcomp_atomic_sub_i4
_vcomp_atomic_sub_i8
_vcomp_atomic_sub_r4
_vcomp_atomic_sub_r8
_vcomp_atomic_xor_i1
_vcomp_atomic_xor_i2
_vcomp_atomic_xor_i4
_vcomp_atomic_xor_i8
_vcomp_barrier
_vcomp_copyprivate_broadcast
_vcomp_copyprivate_receive
_vcomp_enter_critsect
_vcomp_flush
_vcomp_for_dynamic_init
_vcomp_for_dynamic_init_i8
_vcomp_for_dynamic_next
_vcomp_for_dynamic_next_i8
_vcomp_for_static_end
_vcomp_for_static_init
_vcomp_for_static_init_i8
_vcomp_for_static_simple_init
_vcomp_for_static_simple_init_i8
_vcomp_fork
_vcomp_get_thread_num
_vcomp_leave_critsect
_vcomp_master_barrier
_vcomp_master_begin
_vcomp_master_end
_vcomp_ordered_begin
_vcomp_ordered_end
_vcomp_ordered_loop_end
_vcomp_reduction_i1
_vcomp_reduction_i2
_vcomp_reduction_i4
_vcomp_reduction_i8
_vcomp_reduction_r4
_vcomp_reduction_r8
_vcomp_reduction_u1
_vcomp_reduction_u2
_vcomp_reduction_u4
_vcomp_reduction_u8
_vcomp_sections_init
_vcomp_sections_next
_vcomp_set_num_threads
_vcomp_single_begin
_vcomp_single_end
omp_destroy_lock
omp_destroy_nest_lock
omp_get_dynamic
omp_get_max_threads
omp_get_nested
omp_get_num_procs
omp_get_num_threads
omp_get_thread_num
omp_get_wtick
omp_get_wtime
omp_in_parallel
omp_init_lock
omp_init_nest_lock
omp_set_dynamic
omp_set_lock
omp_set_nest_lock
omp_set_nested
omp_set_num_threads
omp_test_lock
omp_test_nest_lock
omp_unset_lock
omp_unset_nest_lock

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/Themida_x32_x64_v3.0.4.0_Repacked/x32.png
.png
Release/Themida_x32_x64_v3.0.4.0_Repacked/x64.png
.png
Release/Themida_x32_x64_v3.0.4.0_Repacked/吾爱破解论坛.url
Release/dbghelp.dll
.dll windows:6 windows x64 arch:x64

3d64c0b7659a72157d6f0180ea1141c1

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

09/05/2001, 23:19

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

e8:5b:d3:92:b4:88:bf:c8:c3:bd:86:0c:de:15:56:93:dd:70:8d:9c
Signer

Actual PE Digest

e8:5b:d3:92:b4:88:bf:c8:c3:bd:86:0c:de:15:56:93:dd:70:8d:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dbghelp.pdb

Imports

msvcrt

_isatty
_write
_lseeki64
_fileno
_read
__pioinfo
__badioinfo
??1type_info@@UEAA@XZ
ferror
wctomb
_snprintf
_iob
isleadbyte
__mb_cur_max
mbtowc
_onexit
_lock
__dllonexit
_unlock
_CxxThrowException
memset
memcpy
_ismbblead
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
memmove
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
_wctime
time
??_V@YAXPEAX@Z
_ltoa
_strnicmp
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
free
_strlwr
wcsrchr
strstr
_wcsicmp
qsort
iswxdigit
wcsncmp
_vsnwprintf
iswprint
fprintf
fflush
atol
fclose
__unDName
iswdigit
memcmp
bsearch
_wfsopen
fread
fseek
wcstol
strchr
??_U@YAPEAX_K@Z
_time64
_wfullpath
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
_wgetenv
wcsstr
wcschr
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_wsopen

kernel32

MoveFileW
SetFilePointer
DeleteFileW
CreateDirectoryW
FlushViewOfFile
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
__chkstk
CreateFileMappingW
LCMapStringW
LocalFree
GetVersion
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
VirtualQueryEx
GetThreadTimes
GetThreadPriority
GetPriorityClass
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
IsProcessorFeaturePresent
GetSystemInfo
GetSystemTimeAsFileTime
lstrcmpiW
Sleep
DelayLoadFailureHook
LoadLibraryExA
ReadProcessMemory
GetProcessHeap
LoadLibraryW
GetSystemDirectoryW
GetFileAttributesA
SetErrorMode
GetVersionExW
OutputDebugStringW
OutputDebugStringA
WriteFile
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetCurrentProcess
DuplicateHandle
VirtualProtect
VirtualAlloc
CreateDirectoryA
GetFileAttributesW
GetFullPathNameW
WideCharToMultiByte
MultiByteToWideChar
SetLastError
FindFirstFileW
FindClose
FindNextFileW
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
CreateFileA
GetFileSize
ReadFile
CloseHandle
GetLastError
TlsGetValue
TlsSetValue
LoadLibraryA
GetProcAddress
FreeLibrary
TlsAlloc
TlsFree
GetVersionExA
InitializeCriticalSection
HeapCreate
HeapDestroy
DeleteCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
IsDBCSLeadByte
GetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
CopyFileW
ExpandEnvironmentStringsW

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/dma.exe
.exe windows:6 windows x64 arch:x64

6be00ded4938b3e9d71d4cbbd8b01d95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSACleanup
bind
closesocket
WSAStartup
socket
recvfrom
htonl
htons
sendto
ntohl
gethostname
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
accept
WSAIoctl
WSASetLastError
setsockopt
ntohs
getsockopt
getsockname
getpeername
connect
WSAGetLastError
send
recv

ntdll

VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlInitUnicodeString
RtlCompareMemory
RtlCaptureContext

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GlobalFree
GlobalLock
GlobalUnlock
GetModuleHandleA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
SetLastError
GetLastError
SetCommState
SleepEx
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetPrivateProfileStringA
ReleaseSRWLockExclusive
GlobalAlloc
SleepConditionVariableSRW
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
SetCommTimeouts
GetPrivateProfileIntA
WideCharToMultiByte
CreateThread
WritePrivateProfileStringA
CloseHandle
GetCommState
CreateFileA
GetTickCount64
Sleep
MultiByteToWideChar
SetupComm
GetCommTimeouts
CreateFileW
SetThreadPriority
PurgeComm
WriteFile
GetStdHandle
IsProcessorFeaturePresent
WakeAllConditionVariable
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetCurrentProcess
SetConsoleTitleA
SetConsoleTextAttribute
LoadLibraryA
GetConsoleScreenBufferInfo
GetSystemDirectoryA
ReadFile
VerifyVersionInfoW
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
QueryFullProcessImageNameW
GetModuleHandleW
CreateFileMappingW
AcquireSRWLockExclusive
GetModuleFileNameA
VirtualProtect
DeleteCriticalSection
InitializeCriticalSectionEx
HeapSize
HeapDestroy
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
GetFileSizeEx

user32

SetClipboardData
GetClientRect
SetCursor
GetForegroundWindow
ClientToScreen
ScreenToClient
SetCursorPos
SetWindowPos
GetSystemMetrics
ShowWindow
GetAsyncKeyState
GetDesktopWindow
GetWindowRect
LoadCursorA
SetWindowLongA
DefWindowProcA
TranslateMessage
PeekMessageA
UpdateWindow
SetForegroundWindow
GetCursorPos
DispatchMessageA
CreateWindowExA
SetLayeredWindowAttributes
LoadIconA
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
MessageBoxA
RegisterClassExA
GetKeyState

advapi32

GetLengthSid
CopySid
SetSecurityInfo
InitializeAcl
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidA
CryptCreateHash
CryptGenRandom
CryptAcquireContextA
IsValidSid
CryptReleaseContext
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptGetHashParam
AddAccessAllowedAce

oleaut32

VariantClear
SysFreeString
SysAllocString

secureenginesdk64

ord105
ord24
ord505
ord23
ord18

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Xtime_get_ticks
_Query_perf_counter
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

psapi

GetModuleInformation

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vmm

VMMDLL_ProcessGetInformationAll
VMMDLL_MemReadEx
VMMDLL_PidGetFromName
VMMDLL_ProcessGetModuleBaseU
VMMDLL_MemFree
VMMDLL_WinReg_QueryValueExU
VMMDLL_Map_GetEATU
VMMDLL_Scatter_Initialize
VMMDLL_Scatter_PrepareEx
VMMDLL_Scatter_Clear
VMMDLL_ConfigGet
VMMDLL_VfsListU
VMMDLL_Scatter_ExecuteRead
VMMDLL_Initialize
VMMDLL_ProcessGetModuleBaseW
VMMDLL_ConfigSet
VMMDLL_Map_GetModuleFromNameU
VMMDLL_InitializePlugins
VMMDLL_VfsReadW
VMMDLL_Scatter_CloseHandle

imm32

ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow

normaliz

IdnToAscii

wldap32

ord301
ord200
ord30
ord79
ord35
ord33
ord143
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord32

crypt32

CertGetCertificateChain
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertFreeCertificateChainEngine
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
PFXImportCertStore
CertCreateCertificateChainEngine

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

userenv

UnloadUserProfile

vcruntime140

memchr
memset
memmove
memcpy
longjmp
strrchr
__intrinsic_setjmp
strstr
wcsstr
_purecall
__std_exception_copy
__std_exception_destroy
__std_terminate
__C_specific_handler
__current_exception
__current_exception_context
strchr
memcmp
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy
strcmp
strpbrk
tolower
isupper
_strdup
strspn
strncmp
strcspn

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_beginthreadex
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
exit
_crt_atexit
_resetstkoflw
_cexit
_invalid_parameter_noinfo
__sys_nerr
strerror
terminate
_seh_filter_exe
_set_app_type
system
_register_thread_local_exe_atexit_callback
_c_exit
_errno
__p___argv
_getpid
__p___argc
_exit
_initterm_e
_initterm
_configure_narrow_argv
_get_initial_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
calloc
_set_new_mode
realloc
free

api-ms-win-crt-stdio-l1-1-0

fseek
ftell
_write
_wfopen
_read
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
__stdio_common_vsscanf
ungetc
_lseeki64
setvbuf
fgetpos
_open
__stdio_common_vsprintf
__acrt_iob_func
fwrite
__stdio_common_vfprintf
fgets
_pclose
__stdio_common_vsnprintf_s
fgetc
__stdio_common_vsprintf_s
_popen
fclose
__p__commode
fflush
fputs
fopen
fputc
feof
_set_fmode
_close

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-time-l1-1-0

_time64
_difftime64
_gmtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr
cos
_dclass
fmodf
pow
powf
roundf
sin
tanf
sinf
sqrt
sqrtf
cosf
ceilf
atan2
asin
acosf

api-ms-win-crt-convert-l1-1-0

strtol
atof
atoi
strtoull
strtoul
strtod
strtoll

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_lock_file
_stat64
_unlink
_access
_unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

shell32

ShellExecuteA

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.5MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rbdata
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Release/dma.exe
.exe windows:6 windows x64 arch:x64

3b988d5d75a64d343861f8198e2cfbcf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\1337\Downloads\dma\dmafortnite\x64\Release\dma.pdb

Imports

ws2_32

WSACleanup
bind
closesocket
WSAStartup
socket
recvfrom
htonl
htons
sendto
ntohl
gethostname
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
accept
WSAIoctl
WSASetLastError
setsockopt
ntohs
getsockopt
getsockname
getpeername
connect
WSAGetLastError
send
recv

ntdll

VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlInitUnicodeString
RtlCompareMemory
RtlCaptureContext

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GlobalFree
GlobalLock
GlobalUnlock
GetModuleHandleA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
SetLastError
GetLastError
SetCommState
SleepEx
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetPrivateProfileStringA
ReleaseSRWLockExclusive
GlobalAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WakeAllConditionVariable
SetCommTimeouts
GetPrivateProfileIntA
WideCharToMultiByte
CreateThread
WritePrivateProfileStringA
CloseHandle
GetCommState
CreateFileA
GetTickCount64
Sleep
MultiByteToWideChar
SetupComm
GetCommTimeouts
CreateFileW
SetThreadPriority
PurgeComm
WriteFile
GetStdHandle
SleepConditionVariableSRW
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetCurrentProcess
SetConsoleTitleA
SetConsoleTextAttribute
LoadLibraryA
GetConsoleScreenBufferInfo
GetSystemDirectoryA
ReadFile
VerifyVersionInfoW
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
QueryFullProcessImageNameW
GetModuleHandleW
CreateFileMappingW
AcquireSRWLockExclusive
GetModuleFileNameA
VirtualProtect
DeleteCriticalSection
InitializeCriticalSectionEx
HeapSize
HeapDestroy
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
GetFileSizeEx

user32

SetClipboardData
GetClientRect
SetCursor
GetForegroundWindow
ClientToScreen
ScreenToClient
SetCursorPos
SetWindowPos
GetSystemMetrics
ShowWindow
GetAsyncKeyState
GetDesktopWindow
GetWindowRect
LoadCursorA
SetWindowLongA
DefWindowProcA
TranslateMessage
PeekMessageA
UpdateWindow
SetForegroundWindow
GetCursorPos
DispatchMessageA
CreateWindowExA
SetLayeredWindowAttributes
LoadIconA
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
MessageBoxA
RegisterClassExA
GetKeyState

advapi32

GetLengthSid
CopySid
SetSecurityInfo
InitializeAcl
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidA
CryptCreateHash
CryptGenRandom
CryptAcquireContextA
IsValidSid
CryptReleaseContext
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptGetHashParam
AddAccessAllowedAce

oleaut32

VariantClear
SysFreeString
SysAllocString

secureenginesdk64

ord105
ord24
ord505
ord23
ord18

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Xtime_get_ticks
_Query_perf_counter
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

psapi

GetModuleInformation

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vmm

VMMDLL_ProcessGetInformationAll
VMMDLL_MemReadEx
VMMDLL_PidGetFromName
VMMDLL_ProcessGetModuleBaseU
VMMDLL_MemFree
VMMDLL_WinReg_QueryValueExU
VMMDLL_Map_GetEATU
VMMDLL_Scatter_Initialize
VMMDLL_Scatter_PrepareEx
VMMDLL_Scatter_Clear
VMMDLL_ConfigGet
VMMDLL_VfsListU
VMMDLL_Scatter_ExecuteRead
VMMDLL_Initialize
VMMDLL_ProcessGetModuleBaseW
VMMDLL_ConfigSet
VMMDLL_Map_GetModuleFromNameU
VMMDLL_InitializePlugins
VMMDLL_VfsReadW
VMMDLL_Scatter_CloseHandle

imm32

ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow

normaliz

IdnToAscii

wldap32

ord301
ord200
ord30
ord79
ord35
ord33
ord143
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord32

crypt32

CertGetCertificateChain
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertFreeCertificateChainEngine
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
PFXImportCertStore
CertCreateCertificateChainEngine

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

userenv

UnloadUserProfile

vcruntime140

memchr
memset
memmove
memcpy
longjmp
strrchr
__intrinsic_setjmp
strstr
wcsstr
_purecall
__std_exception_copy
__std_exception_destroy
__std_terminate
__C_specific_handler
__current_exception
__current_exception_context
strchr
memcmp
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy
strcmp
strpbrk
tolower
isupper
_strdup
strspn
strncmp
strcspn

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_beginthreadex
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
exit
_crt_atexit
_resetstkoflw
_cexit
_invalid_parameter_noinfo
__sys_nerr
strerror
terminate
_seh_filter_exe
_set_app_type
system
_register_thread_local_exe_atexit_callback
_c_exit
_errno
__p___argv
_getpid
__p___argc
_exit
_initterm_e
_initterm
_configure_narrow_argv
_get_initial_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
calloc
_set_new_mode
realloc
free

api-ms-win-crt-stdio-l1-1-0

fseek
ftell
_write
_wfopen
_read
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
__stdio_common_vsscanf
ungetc
_lseeki64
setvbuf
fgetpos
_open
__stdio_common_vsprintf
__acrt_iob_func
fwrite
__stdio_common_vfprintf
fgets
_pclose
__stdio_common_vsnprintf_s
fgetc
__stdio_common_vsprintf_s
_popen
fclose
__p__commode
fflush
fputs
fopen
fputc
feof
_set_fmode
_close

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-time-l1-1-0

_time64
_difftime64
_gmtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr
cos
_dclass
fmodf
pow
powf
roundf
sin
tanf
sinf
sqrt
sqrtf
cosf
ceilf
atan2
asin
acosf

api-ms-win-crt-convert-l1-1-0

strtol
atof
atoi
strtoull
strtoul
strtod
strtoll

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_lock_file
_stat64
_unlink
_access
_unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

shell32

ShellExecuteA

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.5MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/dma.pdb
Release/imgui.ini
Release/info.db
Release/kmboxnet/ip.txt
Release/kmboxnet/port.txt
Release/kmboxnet/uuid.txt
Release/leechcore.dll
.dll windows:6 windows x64 arch:x64

245f8d40de6893b471d1e488cfaf8c43

Code Sign

14:6e:e2:13:38:1e:4b:f2:fb:2a:42:4d:53:cb:02:e8
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

21/12/2022, 10:36

Not After

21/12/2023, 10:36

Subject

CN=Open Source Developer\, Ulf Frisk,O=Open Source Developer,L=Stockholm,C=SE,1.2.840.113549.1.9.1=#0c16756c662e667269736b40756c66667269736b2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ea:2a:f1:3a:71:18:cd:f4:e6:27:64:2b:26:bb:f0:33:3a:43:bc:fa:f5:12:f1:8e:f6:2d:0d:1e:6c:bb:8f:90
Signer

Actual PE Digest

ea:2a:f1:3a:71:18:cd:f4:e6:27:64:2b:26:bb:f0:33:3a:43:bc:fa:f5:12:f1:8e:f6:2d:0d:1e:6c:bb:8f:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Github\production\LeechCore\files\lib\leechcore.pdb

Imports

credui

CredUIPromptForWindowsCredentialsW
CredUnPackAuthenticationBufferW

rpcrt4

NdrClientCall3
RpcBindingSetAuthInfoExA
RpcBindingFree
RpcStringFreeA
RpcBindingSetAuthInfoExW
RpcStringBindingComposeA
RpcBindingFromStringBindingA

secur32

LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaConnectUntrusted

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW

winusb

WinUsb_WritePipe
WinUsb_Free
WinUsb_SetPipePolicy
WinUsb_ReadPipe
WinUsb_Initialize

ws2_32

setsockopt
WSAGetLastError
htons
recvfrom
connect
socket
send
inet_addr
WSAStartup
closesocket
ioctlsocket

kernel32

IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetTickCount64
GetModuleFileNameA
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceCounter
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalAlloc
LocalFree
DeleteCriticalSection
Sleep
LoadLibraryA
CloseHandle
CreateThread
SwitchToThread
GetProcAddress
FreeLibrary
ReadFile
DeviceIoControl
GetLastError
CreateFileA
SetFilePointerEx
VirtualFree
VirtualAlloc
CreateFileW
VerSetConditionMask
VerifyVersionInfoW
WriteProcessMemory
GetCurrentProcess
K32GetModuleFileNameExW
OpenProcess
K32EnumProcesses
ReadProcessMemory
K32GetMappedFileNameW
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
SetEvent
QueryPerformanceFrequency
ResetEvent
IsProcessorFeaturePresent

advapi32

StartServiceA
ControlService
DeleteService
OpenSCManagerA
OpenSCManagerW
CloseServiceHandle
CreateServiceA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenServiceA

ole32

CoTaskMemFree

vcruntime140

memset
memcpy
__C_specific_handler
strstr
__std_type_info_destroy_list
memcmp
wcsstr

api-ms-win-crt-stdio-l1-1-0

fread
fopen_s
fwrite
__stdio_common_vsnwprintf_s
_fseeki64
__stdio_common_vswprintf_s
__stdio_common_vfprintf
fclose
__acrt_iob_func
getchar
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
_ftelli64

api-ms-win-crt-string-l1-1-0

strncat_s
strtok_s
wcsncpy_s
strcpy_s
wcsncat_s
_strnicmp
_wcsicmp
strncpy_s
wcscpy_s
strcat_s
strcmp
_stricmp

api-ms-win-crt-convert-l1-1-0

atoi
_itoa_s
strtoull

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_execute_onexit_table
_initterm
_cexit
_initterm_e
_seh_filter_dll

Exports

Exports

LcAllocScatter1
LcAllocScatter2
LcAllocScatter3
LcClose
LcCommand
LcCreate
LcCreateEx
LcDeviceParameterGet
LcDeviceParameterGetNumeric
LcGetOption
LcMemFree
LcMemMap_AddRange
LcMemMap_GetMaxAddress
LcMemMap_IsInitialized
LcRead
LcReadScatter
LcSetOption
LcWrite
LcWriteScatter

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/symsrv.dll
.dll windows:6 windows x64 arch:x64

5d54f5d721e301667338323ac07578e3

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

42:7a:2b:33:4d:c7:52:a5:93:71:4e:8a:01:94:82:dd:13:04:5b:13
Signer

Actual PE Digest

42:7a:2b:33:4d:c7:52:a5:93:71:4e:8a:01:94:82:dd:13:04:5b:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

symsrv.pdb

Imports

msvcrt

_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
ferror
wctomb
_itoa
_snprintf
_iob
isleadbyte
__mb_cur_max
mbtowc
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
_errno
_wtoi64
_wcslwr
strrchr
wcsstr
??2@YAPEAX_K@Z
fclose
??3@YAXPEAX@Z
wcsrchr
fgetws
_wfopen
_stricmp
getenv
iswspace
tolower
isspace
towlower
_wcsnicmp
_wcsicmp
wcschr
memcmp

kernel32

SetLastError
FreeLibrary
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
Sleep
GlobalFree
ReleaseMutex
OpenMutexW
LoadLibraryW
GetSystemDirectoryW
GetPrivateProfileSectionW
GetPrivateProfileIntW
GetModuleFileNameW
LocalFileTimeToFileTime
ExpandEnvironmentStringsW
DeleteFileA
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFileTime
SetFilePointer
CreateFileA
DosDateTimeToFileTime
FileTimeToDosDateTime
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetSystemTime
DeleteFileW
GetFileTime
CreateWaitableTimerW
MoveFileW
ReadFile
WaitForSingleObject
SetWaitableTimer
CopyFileExW
GetFileSize
LoadLibraryA
LocalFree
DebugBreak
CloseHandle
RemoveDirectoryW
LocalAlloc
GetProcAddress
MultiByteToWideChar
CreateFileW
LocalReAlloc
GetVersionExW
FormatMessageW
WideCharToMultiByte
WriteFile
GetSystemTimeAsFileTime
GetModuleHandleW
OutputDebugStringW
CreateDirectoryW
GetCurrentProcess
CopyFileW
LeaveCriticalSection
GetFileAttributesW
GetLastError
GetEnvironmentVariableW
EnterCriticalSection
RaiseException

advapi32

RegQueryValueExW
GetTokenInformation
RegCloseKey
RegOpenKeyExW
RegEnumValueW
OpenProcessToken
FreeSid
AllocateAndInitializeSid
EqualSid

Exports

Exports

EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/ucrtbased.dll
.dll windows:10 windows x64 arch:x64

b55fd631afff103d396e8e1df0093baa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ucrtbased.pdb

Imports

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
CompareStringW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceW
FlushFileBuffers
SetEndOfFile
LockFileEx
SetFileTime
UnlockFileEx
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
FindClose
GetFullPathNameA
SetFileAttributesW
GetFullPathNameW
GetFileAttributesExW
WriteFile
FindNextFileA
FindFirstFileExA
FindNextFileW
GetLogicalDrives
FindFirstFileExW
SetFilePointerEx
GetFileType
GetDriveTypeW
CreateFileW
ReadFile

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-namedpipe-l1-1-0

CreatePipe
PeekNamedPipe

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapQueryInformation
HeapReAlloc
HeapCompact
HeapWalk
GetProcessHeap
HeapValidate
HeapSize
HeapAlloc

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
SetLocalTime
GetSystemInfo
GetLocalTime
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExA
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
FreeLibraryAndExitThread

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-processthreads-l1-1-0

ResumeThread
ExitThread
ExitProcess
TerminateProcess
GetCurrentProcessId
CreateProcessW
CreateProcessA
CreateThread
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetExitCodeProcess
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryA
GetCurrentDirectoryW
GetStdHandle
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCommandLineW
GetCommandLineA
FreeEnvironmentStringsW
GetCurrentDirectoryA
GetEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-localization-l1-2-0

GetCPInfo
IsValidCodePage
GetUserDefaultLCID
GetACP
GetLocaleInfoW
LCMapStringW
GetOEMCP
EnumSystemLocalesW
IsValidLocale

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-console-l1-1-0

SetConsoleMode
GetConsoleMode
ReadConsoleW
GetConsoleCP
WriteConsoleW
ReadConsoleInputW
SetConsoleCtrlHandler
PeekConsoleInputA
ReadConsoleInputA
GetNumberOfConsoleInputEvents

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery
VirtualAlloc

api-ms-win-core-util-l1-1-0

EncodePointer
Beep

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList

Exports

Exports

_Cbuild
_Cmulcc
_Cmulcr
_CreateFrameInfo
_CrtCheckMemory
_CrtDbgReport
_CrtDbgReportW
_CrtDoForAllClientObjects
_CrtDumpMemoryLeaks
_CrtGetAllocHook
_CrtGetDebugFillThreshold
_CrtGetDumpClient
_CrtGetReportHook
_CrtIsMemoryBlock
_CrtIsValidHeapPointer
_CrtIsValidPointer
_CrtMemCheckpoint
_CrtMemDifference
_CrtMemDumpAllObjectsSince
_CrtMemDumpStatistics
_CrtReportBlockType
_CrtSetAllocHook
_CrtSetBreakAlloc
_CrtSetDbgBlockType
_CrtSetDbgFlag
_CrtSetDebugFillThreshold
_CrtSetDumpClient
_CrtSetReportFile
_CrtSetReportHook
_CrtSetReportHook2
_CrtSetReportHookW2
_CrtSetReportMode
_CxxThrowException
_Exit
_FCbuild
_FCmulcc
_FCmulcr
_FindAndUnlinkFrame
_GetImageBase
_GetThrowImageBase
_Getdays
_Getmonths
_Gettnames
_IsExceptionObjectToBeDestroyed
_LCbuild
_LCmulcc
_LCmulcr
_SetImageBase
_SetThrowImageBase
_SetWinRTOutOfMemoryExceptionCallback
_Strftime
_VCrtDbgReportA
_VCrtDbgReportW
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
__acrt_iob_func
__conio_common_vcprintf
__conio_common_vcprintf_p
__conio_common_vcprintf_s
__conio_common_vcscanf
__conio_common_vcwprintf
__conio_common_vcwprintf_p
__conio_common_vcwprintf_s
__conio_common_vcwscanf
__current_exception
__current_exception_context
__daylight
__dcrt_get_wide_environment_from_os
__dcrt_initial_narrow_environment
__doserrno
__dstbias
__fpe_flt_rounds
__fpecode
__initialize_lconv_for_unsigned_char
__intrinsic_setjmp
__intrinsic_setjmpex
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__commode
__p__crtBreakAlloc
__p__crtDbgFlag
__p__environ
__p__fmode
__p__mbcasemap
__p__mbctype
__p__pgmptr
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__processing_throw
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__setusermatherr
__std_exception_copy
__std_exception_destroy
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__stdio_common_vfprintf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vswscanf
__strncnt
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__uncaught_exception
__wcserror
__wcserror_s
__wcsncnt
_abs64
_access
_access_s
_aligned_free
_aligned_free_dbg
_aligned_malloc
_aligned_malloc_dbg
_aligned_msize
_aligned_msize_dbg
_aligned_offset_malloc
_aligned_offset_malloc_dbg
_aligned_offset_realloc
_aligned_offset_realloc_dbg
_aligned_offset_recalloc
_aligned_offset_recalloc_dbg
_aligned_realloc
_aligned_realloc_dbg
_aligned_recalloc
_aligned_recalloc_dbg
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_atoll_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_base
_calloc_dbg
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chgsignf
_chmod
_chsize
_chsize_s
_chvalidator
_chvalidator_l
_clearfp
_close
_commit
_configthreadlocale
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_copysign
_copysignf
_cputs
_cputws
_creat
_create_locale
_crt_at_quick_exit
_crt_atexit
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_d_int
_dclass
_dexp
_difftime32
_difftime64
_dlog
_dnorm
_dpcomp
_dpoly
_dscale
_dsign
_dsin
_dtest
_dunscale
_dup
_dup2
_dupenv_s
_dupenv_s_dbg
_ecvt
_ecvt_s
_endthread
_endthreadex
_eof
_errno
_except1
_execl
_execle
_execlp
_execlpe
_execute_onexit_table
_execv
_execve
_execvp
_execvpe
_exit
_expand
_expand_dbg
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fd_int
_fdclass
_fdexp
_fdlog
_fdnorm
_fdopen
_fdpcomp
_fdpoly
_fdscale
_fdsign
_fdsin
_fdtest
_fdunscale
_fflush_nolock
_fgetc_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_finitef
_flushall
_fpclass
_fpclassf
_fpieee_flt
_fpreset
_fputc_nolock
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_base
_free_dbg
_free_locale
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_fullpath
_fullpath_dbg
_futime32
_futime64
_fwrite_nolock
_gcvt
_gcvt_s
_get_FMA3_enable
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_osfhandle
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_stream_buffer_pointers
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_timezone
_get_tzname
_get_unexpected
_get_wide_winmain_command_line
_get_wpgmptr
_getc_nolock
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getcwd_dbg
_getdcwd
_getdcwd_dbg
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwc_nolock
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_heapchk
_heapmin
_heapwalk
_hypot
_hypotf
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_is_exception_typeof
_isalnum_l
_isalpha_l
_isatty
_isblank_l
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbblank
_ismbbblank_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcblank
_ismbcblank_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/vcruntime140d.dll
.dll windows:6 windows x64 arch:x64

0ec3c3c7f981e5ae8205d85c9009ac26

Code Sign

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:18:78:bd:4d:05:00:1e:bc:b9:fa:5f:cc:84:92:15:e0:b0:fd:7a:cf:ed:92:09:0f:72:3f:91:30:9f:38:3e
Signer

Actual PE Digest

7d:18:78:bd:4d:05:00:1e:bc:b9:fa:5f:cc:84:92:15:e0:b0:fd:7a:cf:ed:92:09:0f:72:3f:91:30:9f:38:3e

Digest Algorithm

sha256

PE Digest Matches

true

0b:d3:4a:10:e3:10:59:d9:59:09:01:b3:0b:64:29:0a:86:af:80:42
Signer

Actual PE Digest

0b:d3:4a:10:e3:10:59:d9:59:09:01:b3:0b:64:29:0a:86:af:80:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

vcruntime140d.amd64.pdb

Imports

ucrtbased

atol
__stdio_common_vsprintf_s
abort
_calloc_dbg
_malloc_dbg
_free_dbg
strlen
strcpy_s
malloc
free
_CrtDbgReportW
strcmp
terminate

kernel32

SetLastError
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleFileNameW

Exports

Exports

_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release/vmm.dll
.dll windows:6 windows x64 arch:x64

ea196e0aefaf7316953f1097c6ea0ae4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\pc\source\repos\MemProcFS-master\files\lib\vmm.pdb

Imports

leechcore

LcCommand
LcGetOption
LcAllocScatter1
LcReadScatter
LcWriteScatter
LcSetOption
LcCreateEx
LcClose
LcRead
LcAllocScatter2
LcMemFree

bcrypt

BCryptCreateHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptGetProperty

crypt32

CertCreateCertificateContext
CertFreeCertificateContext
CertGetNameStringW

shlwapi

StrStrIA

ws2_32

inet_ntop

kernel32

UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcess
SetUnhandledExceptionFilter
RtlVirtualUnwind
RaiseException
VirtualQuery
GetStartupInfoW
InterlockedPopEntrySList
LocalAlloc
LocalFree
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetLongPathNameW
SetEvent
CreateEventW
WaitForMultipleObjects
ExitProcess
GetLocalTime
GetTickCount64
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
VerSetConditionMask
VerifyVersionInfoW
QueryPerformanceFrequency
GetModuleFileNameA
LoadResource
LockResource
SizeofResource
FindResourceW
FileTimeToSystemTime
InitializeCriticalSectionAndSpinCount
InitializeSListHead
GetModuleHandleW
InterlockedPushEntrySList
QueryDepthSList
GetModuleHandleA
GetStdHandle
SwitchToThread
ReadConsoleA
CreateThread
FindClose
FindFirstFileA
FindNextFileA
LoadLibraryExA
ResetEvent

advapi32

ConvertStringSidToSidA
ConvertSidToStringSidA
RegCloseKey
RegCreateKeyA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegGetValueA
IsValidSid
LookupAccountSidA

vcruntime140d

__current_exception
__current_exception_context
__std_type_info_destroy_list
__vcrt_LoadLibraryExW
__vcrt_GetModuleHandleW
__vcrt_GetModuleFileNameW
__C_specific_handler
__C_specific_handler_noexcept
strstr
memcpy
memset
memcmp
memmove
strrchr

ucrtbased

fabs
_beginthreadex
_endthreadex
strcpy_s
strcat_s
strncat_s
strncpy_s
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
_byteswap_uint64
qsort
_byteswap_ulong
fopen_s
strspn
fread
_fseeki64
strtok_s
strtoull
tmpnam_s
fwrite
remove
__stdio_common_vsprintf_s
strtoul
__acrt_iob_func
__stdio_common_vfprintf
wcscmp
_wcsnicmp
__stdio_common_vsnwprintf_s
_access_s
strnlen
log10
floor
fflush
_fsopen
_byteswap_ushort
toupper
_CrtDbgReport
_CrtDbgReportW
_initterm
_initterm_e
_wmakepath_s
_wsplitpath_s
wcscpy_s
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
strcmp
strcspn
_localtime64_s
_msize
realloc
malloc
free
_wassert
_strnicmp
strncmp
strlen
_stricmp
fclose

Exports

Exports

VMMDLL_Close
VMMDLL_CloseAll
VMMDLL_ConfigGet
VMMDLL_ConfigSet
VMMDLL_ForensicFileAppend
VMMDLL_Initialize
VMMDLL_InitializeEx
VMMDLL_InitializePlugins
VMMDLL_Log
VMMDLL_LogEx
VMMDLL_Map_GetEATU
VMMDLL_Map_GetEATW
VMMDLL_Map_GetHandleU
VMMDLL_Map_GetHandleW
VMMDLL_Map_GetHeap
VMMDLL_Map_GetHeapAlloc
VMMDLL_Map_GetIATU
VMMDLL_Map_GetIATW
VMMDLL_Map_GetModuleFromNameU
VMMDLL_Map_GetModuleFromNameW
VMMDLL_Map_GetModuleU
VMMDLL_Map_GetModuleW
VMMDLL_Map_GetNetU
VMMDLL_Map_GetNetW
VMMDLL_Map_GetPfn
VMMDLL_Map_GetPfnEx
VMMDLL_Map_GetPhysMem
VMMDLL_Map_GetPool
VMMDLL_Map_GetPteU
VMMDLL_Map_GetPteW
VMMDLL_Map_GetServicesU
VMMDLL_Map_GetServicesW
VMMDLL_Map_GetThread
VMMDLL_Map_GetUnloadedModuleU
VMMDLL_Map_GetUnloadedModuleW
VMMDLL_Map_GetUsersU
VMMDLL_Map_GetUsersW
VMMDLL_Map_GetVMU
VMMDLL_Map_GetVMW
VMMDLL_Map_GetVadEx
VMMDLL_Map_GetVadU
VMMDLL_Map_GetVadW
VMMDLL_MemFree
VMMDLL_MemPrefetchPages
VMMDLL_MemRead
VMMDLL_MemReadEx
VMMDLL_MemReadPage
VMMDLL_MemReadScatter
VMMDLL_MemSearch
VMMDLL_MemSize
VMMDLL_MemVirt2Phys
VMMDLL_MemWrite
VMMDLL_MemWriteScatter
VMMDLL_PdbLoad
VMMDLL_PdbSymbolAddress
VMMDLL_PdbSymbolName
VMMDLL_PdbTypeChildOffset
VMMDLL_PdbTypeSize
VMMDLL_PidGetFromName
VMMDLL_PidList
VMMDLL_ProcessGetDirectoriesU
VMMDLL_ProcessGetDirectoriesW
VMMDLL_ProcessGetInformation
VMMDLL_ProcessGetInformationAll
VMMDLL_ProcessGetInformationString
VMMDLL_ProcessGetModuleBaseU
VMMDLL_ProcessGetModuleBaseW
VMMDLL_ProcessGetProcAddressU
VMMDLL_ProcessGetProcAddressW
VMMDLL_ProcessGetSectionsU
VMMDLL_ProcessGetSectionsW
VMMDLL_Scatter_Clear
VMMDLL_Scatter_CloseHandle
VMMDLL_Scatter_Execute
VMMDLL_Scatter_ExecuteRead
VMMDLL_Scatter_Initialize
VMMDLL_Scatter_Prepare
VMMDLL_Scatter_PrepareEx
VMMDLL_Scatter_PrepareWrite
VMMDLL_Scatter_PrepareWriteEx
VMMDLL_Scatter_Read
VMMDLL_UtilFillHexAscii
VMMDLL_UtilVfsReadFile_FromBOOL
VMMDLL_UtilVfsReadFile_FromDWORD
VMMDLL_UtilVfsReadFile_FromPBYTE
VMMDLL_UtilVfsReadFile_FromQWORD
VMMDLL_UtilVfsWriteFile_BOOL
VMMDLL_UtilVfsWriteFile_DWORD
VMMDLL_VfsListBlobU
VMMDLL_VfsListU
VMMDLL_VfsListW
VMMDLL_VfsList_AddDirectory
VMMDLL_VfsList_AddDirectoryW
VMMDLL_VfsList_AddFile
VMMDLL_VfsList_AddFileW
VMMDLL_VfsReadU
VMMDLL_VfsReadW
VMMDLL_VfsWriteU
VMMDLL_VfsWriteW
VMMDLL_VmGetVmmHandle
VMMDLL_VmMemRead
VMMDLL_VmMemReadScatter
VMMDLL_VmMemTranslateGPA
VMMDLL_VmMemWrite
VMMDLL_VmMemWriteScatter
VMMDLL_VmScatterInitialize
VMMDLL_WinGetThunkInfoIATU
VMMDLL_WinGetThunkInfoIATW
VMMDLL_WinReg_EnumKeyExU
VMMDLL_WinReg_EnumKeyExW
VMMDLL_WinReg_EnumValueU
VMMDLL_WinReg_EnumValueW
VMMDLL_WinReg_HiveList
VMMDLL_WinReg_HiveReadEx
VMMDLL_WinReg_HiveWrite
VMMDLL_WinReg_QueryValueExU
VMMDLL_WinReg_QueryValueExW
VMMDLL_YaraSearch

Sections

.textbss
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 596KB - Virtual size: 595KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 123

Password: 123

94eff8313f705d14c2421a2e17c00648

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:e4:41:cb:6d:7c:0b:ab:94:2c:24:2e:b3:05:8f:edCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

bd:28:89:be:7d:37:74:eb:d4:aa:93:5b:3f:4d:cf:ca:ca:53:77:02:b9:0c:65:21:f6:36:3e:70:1e:5d:7d:feSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

kernel32

Exports

Exports

Sections

.text Size: 384KB - Virtual size: 384KB

.rdata Size: 77KB - Virtual size: 77KB

.data Size: 4KB - Virtual size: 11KB

.pdata Size: 19KB - Virtual size: 19KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

Password: 123

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

06:47:63:a6:f3:2b:19:d0:03:65:b0:44:74:5a:6f:4dCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

06:47:63:a6:f3:2b:19:d0:03:65:b0:44:74:5a:6f:4dCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

6e:4b:04:ab:8a:c2:cc:dc:c7:9b:97:95:53:0c:68:7b:b6:e7:40:6d:bd:b5:f2:f9:fe:ea:29:70:3a:06:68:a1Signer

d6:e6:bf:bd:c3:12:7e:e4:a9:a1:4d:6d:79:ca:76:57:d3:0f:8b:eeSigner

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 840B

.rdata Size: 26KB - Virtual size: 25KB

Password: 123

Headers

DLL Characteristics

File Characteristics

Exports

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:e4:41:cb:6d:7c:0b:ab:94:2c:24:2e:b3:05:8f:ed
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

bd:28:89:be:7d:37:74:eb:d4:aa:93:5b:3f:4d:cf:ca:ca:53:77:02:b9:0c:65:21:f6:36:3e:70:1e:5d:7d:fe
Signer

.text
Size: 384KB - Virtual size: 384KB

.rdata
Size: 77KB - Virtual size: 77KB

.data
Size: 4KB - Virtual size: 11KB

.pdata
Size: 19KB - Virtual size: 19KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

06:47:63:a6:f3:2b:19:d0:03:65:b0:44:74:5a:6f:4d
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

06:47:63:a6:f3:2b:19:d0:03:65:b0:44:74:5a:6f:4d
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

6e:4b:04:ab:8a:c2:cc:dc:c7:9b:97:95:53:0c:68:7b:b6:e7:40:6d:bd:b5:f2:f9:fe:ea:29:70:3a:06:68:a1
Signer

d6:e6:bf:bd:c3:12:7e:e4:a9:a1:4d:6d:79:ca:76:57:d3:0f:8b:ee
Signer

.text
Size: 1024B - Virtual size: 840B

.rdata
Size: 26KB - Virtual size: 25KB

.exports
Size: 512B - Virtual size: 4KB

.imports
Size: 1KB - Virtual size: 4KB

.tls
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 47KB - Virtual size: 47KB

.winlice
Size: - Virtual size: 23.0MB

.boot
Size: 17.0MB - Virtual size: 17.0MB

.data
Size: 1024B - Virtual size: 1024B

.text
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 4KB

.taggant
Size: 8KB - Virtual size: 8KB

.exports
Size: 512B - Virtual size: 4KB

.imports
Size: 1KB - Virtual size: 4KB

.tls
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 47KB - Virtual size: 47KB

.winlice
Size: - Virtual size: 23.0MB

.boot
Size: 17.0MB - Virtual size: 17.0MB

.data
Size: 1024B - Virtual size: 1024B

.text
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 4KB

.taggant
Size: 8KB - Virtual size: 8KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 7KB