Laun3cher_E@zy[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

[email protected]
Size

148.4MB
MD5

e9a7edfdb82ed2b9f6cb31bcc438c690
SHA1

cd51fd08928961645f1b238ad0ad3f78f4a54289
SHA256

8e0543407eeeae125e31d12c41c6678eb46dd8737ed58e5a17a6ff48bd56fd6a
SHA512

9f131cfbfc25492fa2eca7ab112a93cbf5056d1c87b2e12953d4ee2aef6792ba012d28a4fbebfdbbc4454fa79e11e97d65f25449416a084575b11dc7cf96b106
SSDEEP

3145728:3lT2amsbjBDXyF1f6QaOZcEeDdI2bOBc1hI6OHiekMGfRuUmuLpRhv:VT2AjBDCHf6QPZc/iBc1hDOHiQGsiv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack002/d3d9xx.dll

resource
unpack002/d3d9xx.dll

Files

[email protected]
.zip

Password: 1212
Laun3cher_E@zy_(password_1212).zip
.zip

Password: 1212
Settings.ini
d3d9xx.dll
.dll windows:10 windows x64 arch:x64

Password: 1212

0ae50ea3aed6f00594ba6b7b37a93ba8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wabimp.pdb

Imports

msvcrt

__C_specific_handler
_initterm
memcpy
free
_amsg_exit
_XcptFilter
rand
srand
_vsnwprintf
_vsnprintf
malloc
memset

kernel32

GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlVirtualUnwind
WriteFile
SetFilePointer
LocalAlloc
CreateFileW
GetLocaleInfoA
MultiByteToWideChar
GetLastError
CloseHandle
LocalFree
WideCharToMultiByte
ReadFile
LocalReAlloc
GetFileAttributesW
FormatMessageW
lstrcmpiW
lstrcmpiA
LoadLibraryA
FreeLibrary
GetTickCount
ExpandEnvironmentStringsA
GetFileAttributesA
DisableThreadLibraryCalls
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
QueryPerformanceCounter

user32

GetDlgItem
GetClientRect
SendMessageA
CharNextW
SetDlgItemTextW
EndDialog
SendMessageW
CheckDlgButton
PostMessageA
GetMessagePos
DialogBoxParamA
GetWindowTextW
SetPropW
IsDlgButtonChecked
GetPropW
MessageBoxW
GetParent
SetWindowLongPtrA
EnableWindow
CharNextA
GetWindowLongPtrA
LoadStringW
DialogBoxParamW
ScreenToClient

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comctl32

PropertySheetA
ord17
ImageList_LoadImageA

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shlwapi

PathRemoveBackslashW
PathIsDirectoryW
PathAddExtensionW
PathRemoveFileSpecA
PathAppendW
PathAppendA
SHCreateStreamOnFileEx
PathRemoveFileSpecW

api-ms-win-core-com-l1-1-0

CoTaskMemFree

Exports

Exports

CSVExport
CSVImport
LDIFImport
VCFExport
VCFImport
WABImport

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
e@zy_start.exe
.exe windows:4 windows x86 arch:x86

Password: 1212

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16-04-2020 18:36

Not After

16-04-2045 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:01:0e:5d:84:bb:11:2d:ca:fc:03:e7:00:00:00:01:0e:5d
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Not Before

04-06-2024 17:01

Not After

07-06-2024 17:01

Subject

CN=GitHub\, Inc.,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:01:0e:5d:84:bb:11:2d:ca:fc:03:e7:00:00:00:01:0e:5d
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Not Before

04-06-2024 17:01

Not After

07-06-2024 17:01

Subject

CN=GitHub\, Inc.,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13-04-2021 17:31

Not After

13-04-2026 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01-04-2021 20:05

Not After

01-04-2036 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19-11-2020 20:32

Not After

19-11-2035 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:35:09:05:b5:b2:e7:84:ef:0c:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

15-02-2024 20:35

Not After

15-02-2025 20:35

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

74:e4:35:56:3b:45:e1:44:5d:8d:39:dc:23:b6:c8:da:e4:64:c2:5f:1c:65:fb:f4:de:a8:6f:76:11:60:ea:c5
Signer

Actual PE Digest

74:e4:35:56:3b:45:e1:44:5d:8d:39:dc:23:b6:c8:da:e4:64:c2:5f:1c:65:fb:f4:de:a8:6f:76:11:60:ea:c5

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

console_programNew_app.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcef.dll
.dll windows:5 windows x86 arch:x86

Password: 1212

6096502ff1cf47e5f1d9a8f9d4f303a1

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

16-07-2036 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2012 00:00

Not After

23-11-2015 23:59

Subject

CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a9:da:ac:72:97:8e:b6:a1:d2:67:3e:69:60:11:0c:5c:a8:1d:0c:e4
Signer

Actual PE Digest

a9:da:ac:72:97:8e:b6:a1:d2:67:3e:69:60:11:0c:5c:a8:1d:0c:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\buildslave_steam\cef_win32\build\dev\src\cef\Release\libcef.pdb

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetCommandLineA
GetConsoleCP
GetConsoleMode
ExitProcess
HeapAlloc
HeapReAlloc
ExitThread
FileTimeToLocalFileTime
FindFirstFileExA
RtlUnwind
LCMapStringW
GetCPInfo
GetLocaleInfoW
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
SetHandleCount
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleW
SetStdHandle
GetOEMCP
GetTimeZoneInformation
GetStringTypeW
HeapSize
PeekNamedPipe
GetCurrentDirectoryW
SetCurrentDirectoryW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetDriveTypeW
GetProcessHeap
CompareStringW
GetThreadContext
OpenThread
VirtualProtect
IsBadWritePtr
GetTempFileNameA
GetFileType
GetThreadTimes
GetSystemDirectoryA
CreateFileMappingW
GetDiskFreeSpaceW
GetFullPathNameW
FormatMessageW
GetTempPathA
VirtualFree
VirtualAlloc
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
UnlockFileEx
LockFileEx
GetFileSize
SetEndOfFile
AreFileApisANSI
LoadLibraryA
GlobalMemoryStatus
GetLogicalDrives
GetComputerNameA
GetVolumeInformationA
GetDiskFreeSpaceA
FindFirstFileW
FindNextFileW
SetEnvironmentVariableA
FindFirstFileExW
SetFileAttributesA
CreateSemaphoreW
GetEnvironmentVariableA
lstrcmpiA
GlobalDeleteAtom
GlobalAddAtomW
GetPrivateProfileStringW
GlobalSize
GetThreadLocale
GetTimeFormatW
GetDateFormatW
GetCurrencyFormatW
GetNumberFormatW
GetFileSizeEx
CancelIo
RegisterWaitForSingleObject
UnregisterWaitEx
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
RtlCaptureStackBackTrace
GetWindowsDirectoryW
GetSystemDirectoryW
AssignProcessToJobObject
DecodePointer
LoadLibraryW
InterlockedExchange
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExW
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
CreateFileMappingA
TerminateProcess
GetStdHandle
GetSystemTime
UnlockFile
LockFile
CreateDirectoryA
MoveFileA
GetHandleInformation
GetFileInformationByHandle
GetFullPathNameA
GetDriveTypeA
DeleteFileA
FindClose
FlushFileBuffers
ReadFile
CreateFileA
ReleaseSemaphore
ResumeThread
SuspendThread
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
LocalAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathW
GetTempFileNameW
GlobalFree
InitializeCriticalSection
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
InterlockedExchangeAdd
TlsAlloc
TlsSetValue
InterlockedIncrement
SetFileTime
SetFilePointerEx
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
ExpandEnvironmentStringsW
FindResourceW
SizeofResource
LoadResource
LockResource
GetLogicalDriveStringsW
CreateDirectoryW
GetLongPathNameW
RemoveDirectoryW
CopyFileW
ReplaceFileW
MoveFileExW
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
EncodePointer
GetACP
GetModuleHandleExW
TlsFree
TlsGetValue
GetCurrentProcess
GetVersionExW
GetNativeSystemInfo
GetModuleHandleW
GetProcAddress
SetThreadPriority
Sleep
CreateThread
RaiseException
InterlockedCompareExchange
GetCommandLineW
LocalFree
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
FormatMessageA
OutputDebugStringA
WriteFile
CreateFileW
SetFilePointer
CreateMutexW
GetModuleFileNameW
CreateProcessW
DeleteFileW
SetLastError
GetLastError
ReleaseMutex
WaitForSingleObject
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueueUserWorkItem
GetUserDefaultLangID
InterlockedDecrement
IsValidCodePage

winhttp

WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser

ws2_32

WSAResetEvent
WSARecv
WSAEventSelect
WSASocketW
WSAIoctl
WSAGetOverlappedResult
WSAEnumNetworkEvents
WSASend
getservbyport
getservbyname
inet_ntoa
inet_addr
recvfrom
sendto
send
recv
connect
accept
select
__WSAFDIsSet
getpeername
WSARecvFrom
shutdown
listen
bind
socket
ioctlsocket
closesocket
setsockopt
ntohl
htonl
htons
gethostbyaddr
gethostbyname
ntohs
WSALookupServiceNextW
WSALookupServiceEnd
WSACreateEvent
WSACloseEvent
getnameinfo
WSAStartup
WSAGetLastError
getsockopt
WSASendTo
getsockname
WSASetLastError
WSALookupServiceBeginW

usp10

ScriptCPtoX
ScriptXtoCP
ScriptItemize
ScriptJustify
ScriptShape
ScriptPlace
ScriptFreeCache
ScriptGetFontProperties

winmm

waveInStart
waveInReset
waveInGetDevCapsW
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInClose
timeGetTime
timeEndPeriod
waveOutGetNumDevs
waveInGetNumDevs
waveInMessage
waveInUnprepareHeader
timeBeginPeriod
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutReset
waveOutClose
waveOutWrite
waveOutOpen
waveOutRestart
waveOutPause

comctl32

InitCommonControlsEx

user32

CreateIconIndirect
InvertRect
DrawEdge
GetSysColorBrush
FrameRect
InflateRect
DrawFocusRect
DrawFrameControl
MessageBoxW
CharUpperW
CreateWindowExW
RegisterClassExW
LoadCursorW
EnableWindow
GetAncestor
PostMessageW
IsWindowVisible
DefWindowProcW
MoveWindow
GetClientRect
SetWindowPos
DrawTextW
SendMessageW
EnumChildWindows
IsWindow
DestroyWindow
GetKeyState
SetCursor
SetClassLongW
TrackMouseEvent
ReleaseCapture
GetCapture
SetFocus
SetCapture
InvalidateRect
ScrollDC
UpdateWindow
EndPaint
MessageBeep
EnumThreadWindows
RealGetWindowClassW
RegisterWindowMessageW
RedrawWindow
RemovePropW
CallWindowProcW
GetFocus
SendInput
SetPropW
DefWindowProcA
GetSysColor
GetCaretBlinkTime
GetAsyncKeyState
GetSystemMetrics
SystemParametersInfoW
LoadIconW
RegisterClassW
UnregisterClassW
GetCursorPos
SetWindowsHookExW
AttachThreadInput
UnhookWindowsHookEx
PostThreadMessageW
CallNextHookEx
ScreenToClient
GetDC
ReleaseDC
GetForegroundWindow
MapWindowPoints
CreatePopupMenu
TrackPopupMenu
DestroyMenu
SetWindowRgn
GetParent
SetParent
SetWindowLongW
IsWindowEnabled
GetWindowLongW
ShowWindow
InsertMenuItemW
GetWindowRect
PtInRect
BeginPaint
KillTimer
DispatchMessageW
TranslateMessage
CallMsgFilterW
PostQuitMessage
PeekMessageW
GetQueueStatus
SetTimer
WaitMessage
MsgWaitForMultipleObjectsEx
GetGuiResources
GetMessageTime
GetDoubleClickTime
ClientToScreen
EnumDisplaySettingsW
SetWindowLongA
MonitorFromWindow
GetWindowThreadProcessId
GetClassNameW
GetKeyboardLayout
DestroyCaret
SetCaretPos
CreateCaret
RegisterClipboardFormatW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetClipboardData
GetClipboardSequenceNumber
IsClipboardFormatAvailable
FillRect
DestroyIcon
GetMonitorInfoW
LoadImageW
GetCursor
GetPropW

gdi32

StretchBlt
CombineRgn
SetRectRgn
SetDIBitsToDevice
IntersectClipRect
CreateBitmap
SetDIBits
RemoveFontMemResourceEx
AddFontMemResourceEx
BeginPath
SetPolyFillMode
PathToRegion
CreateRectRgnIndirect
GdiFlush
GetObjectType
SetTextAlign
PolyBezier
GetFontData
GetGlyphIndicesW
CreateFontW
EnumFontFamiliesExW
GetFontUnicodeRanges
GetStockObject
EnumFontFamiliesW
GetTextFaceW
GetCharWidthI
GetTextMetricsW
GetOutlineTextMetricsW
GetGlyphOutlineW
SwapBuffers
ChoosePixelFormat
SetPixelFormat
CreateDIBSection
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
StretchDIBits
CreateDCW
SetAbortProc
StartDocW
GetDeviceCaps
EndDoc
EndPage
StartPage
DeleteDC
CreateRectRgn
GetClipRgn
OffsetRgn
SelectClipRgn
SetViewportOrgEx
SaveDC
RestoreDC
CreateFontIndirectW
SelectObject
SetTextColor
SetBkMode
DeleteObject
GetTextColor
ExtTextOutW
CreateSolidBrush
SetMiterLimit
ExtCreatePen
CreatePen
AbortPath
GetCurrentObject
GdiAlphaBlend
SetStretchBltMode
GetStretchBltMode
Rectangle
StrokeAndFillPath
StrokePath
SetROP2
SetDCPenColor
SetDCBrushColor
SetBkColor
SetArcDirection
SetBrushOrgEx
SetGraphicsMode
SetWorldTransform
EndPath
BitBlt

winspool.drv

GetPrinterW
OpenPrinterW
ClosePrinter
ord203

comdlg32

GetSaveFileNameW
PrintDlgExW

advapi32

InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptGetUserKey
CryptGetKeyParam
CryptSignHashW
CryptCreateHash
CryptSetHashParam
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptExportKey
CryptImportKey
CryptGenKey
CryptAcquireContextW
CryptDestroyKey
CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
CryptContextAddRef
TraceEvent
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
CreateProcessAsUserW
ConvertSidToStringSidW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathW
DragFinish
CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
DragQueryFileW
ShellExecuteW
ShellExecuteA

ole32

ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
RegisterDragDrop
CoTaskMemFree
CoInitializeEx
PropVariantClear
RevokeDragDrop
CoCreateGuid
CoCreateInstance
DoDragDrop
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

setupapi

SetupDiDestroyDriverInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstallParamsW
SetupDiEnumDeviceInterfaces
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoW

iphlpapi

CancelIPChangeNotify
NotifyAddrChange

urlmon

CoInternetCreateSecurityManager

crypt32

CryptAcquireCertificatePrivateKey
CertOpenSystemStoreW
CertFindChainInStore
CertGetIntendedKeyUsage
CertVerifyTimeValidity
CertGetCertificateContextProperty
CertSetCertificateContextProperty
CertCreateCertificateChainEngine
CertAddSerializedElementToStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertRDNValueToStrA
CryptHashCertificate
CertAddCertificateContextToStore
CertSerializeCertificateStoreElement
CertCloseStore
CryptFindOIDInfo
CertGetPublicKeyLength
CertFindExtension
CryptDecodeObjectEx
CertDuplicateCertificateContext
CertOpenStore
CertFreeCertificateChain
CertFreeCertificateContext
CertFreeCertificateChainEngine
CertAddEncodedCertificateToStore

secur32

EncryptMessage
FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
QuerySecurityPackageInfoW
InitializeSecurityContextW
AcquireCredentialsHandleW
DecryptMessage
QueryContextAttributesW

msimg32

AlphaBlend

psapi

GetProcessMemoryInfo

shlwapi

PathGetCharTypeW
PathFindFileNameW
PathFindExtensionW
UrlCreateFromPathA
PathIsUNCA
PathFileExistsA
UrlCreateFromPathW
PathIsUNCW
PathRemoveExtensionW
PathFileExistsW

imm32

ImmSetOpenStatus
ImmGetCompositionStringW
ImmAssociateContextEx
ImmNotifyIME
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmIsIME

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

cef_add_cross_origin_whitelist_entry
cef_browser_create
cef_browser_create_sync
cef_build_revision
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_create_url
cef_currently_on
cef_delete_cookies
cef_delete_storage
cef_do_message_loop_work
cef_initialize
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_quit_message_loop
cef_register_custom_scheme
cef_register_extension
cef_register_plugin
cef_register_scheme_handler_factory
cef_remove_cross_origin_whitelist_entry
cef_request_create
cef_run_message_loop
cef_set_cookie
cef_set_cookie_path
cef_set_storage
cef_set_storage_path
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_time_from_doublet
cef_time_from_timet
cef_time_to_doublet
cef_time_to_timet
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object_with_accessor
cef_v8value_create_string
cef_v8value_create_undefined
cef_visit_all_cookies
cef_visit_storage
cef_visit_url_cookies
cef_web_urlrequest_create
cef_xml_reader_create
cef_zip_reader_create

Sections

.text
Size: 15.4MB - Virtual size: 15.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unwante
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 408KB - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 766KB - Virtual size: 765KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
licension.dll
.dll windows:6 windows x64 arch:x64

Password: 1212

f98a09cfa940c7da760d5ada88a8ea1e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2013 12:00

Not After

15-01-2038 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07-10-2021 00:00

Not After

09-10-2024 23:59

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b2:b4:f4:49:e3:ed:81:01:7f:05:62:a8:1b:c8:ea:0c:74:31:28:32:3f:88:4e:96:87:14:a8:ca:1e:cf:d3:3b
Signer

Actual PE Digest

b2:b4:f4:49:e3:ed:81:01:7f:05:62:a8:1b:c8:ea:0c:74:31:28:32:3f:88:4e:96:87:14:a8:ca:1e:cf:d3:3b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\buildworker\csgo_rel_win64\build\_build_\utils\resourcecompiler\_vpc_resourcecompiler\default\win64\_msvc_\Retail\resourcecompiler.pdb

Imports

libfbxsdk_2020_3_1

?Create@FbxManager@fbxsdk@@SAPEAV12@XZ
?Create@FbxIOSettings@fbxsdk@@SAPEAV12@PEAVFbxManager@2@PEBD@Z

embree3

rtcCommitScene
rtcAttachGeometry
rtcReleaseScene
rtcNewScene
rtcSetSharedGeometryBuffer
rtcCommitGeometry
rtcReleaseGeometry
rtcNewGeometry
rtcSetDeviceErrorFunction
rtcGetDeviceError
rtcReleaseDevice
rtcIntersect1
rtcNewDevice
rtcPointQuery

ws2_32

recv
send
shutdown
WSASetLastError
closesocket
WSACleanup
WSAStartup
WSAGetLastError

steam_api64

SteamInternal_FindOrCreateUserInterface
SteamInternal_SteamAPI_Init
SteamAPI_IsSteamRunning
SteamAPI_GetHSteamUser
SteamAPI_Shutdown
SteamAPI_UseBreakpadCrashHandler
SteamInternal_ContextInit
SteamAPI_SetBreakpadAppID
SteamAPI_WriteMiniDump

tier0

?IsParticleSystemBehaviorVersionDeprecated@@YA_NPEAVKeyValues3@@PEAH@Z
?DebugPrintKV3@@YAXPEBVKeyValues3@@@Z
?SetLength@CUtlBinaryBlock@@QEAAXH@Z
?RemoveAll@CUtlSymbolTable@@QEAAXXZ
?IsKV3Data@@YA_NPEBVCUtlBuffer@@PEAUKV3ID_t@@PEADH@Z
V_log10f
V_powf
V_cosd
V_sind
??HCUtlString@@QEBA?AV0@AEBV0@@Z
?LoggingSystem_Log@@YA?AW4LoggingResponse_t@@HW4LoggingSeverity_t@@AEBULeafCodeInfo_t@@PEBDZZ
?V_SplitNumbers@@YAHPEBDDAEAV?$CUtlVector@MHV?$CUtlMemory@MH@@@@@Z
?V_SplitStringInPlace@@YAXPEADPEBDAEAV?$CUtlVector@PEBDHV?$CUtlMemory@PEBDH@@@@@Z
?EatCComment@CUtlBuffer@@QEAA_NPEAH@Z
?EatCPPComment@CUtlBuffer@@QEAA_NXZ
?EatWhiteSpace@CUtlBuffer@@QEAAXXZ
?GetLine@CUtlBuffer@@QEAAXPEAVCBufferString@@@Z
?LoadKV3@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEAVCUtlBuffer@@AEBUKV3ID_t@@PEBD@Z
?SaveKV3ToFile@@YA_NAEBUKV3ID_t@@0PEBVKeyValues3@@PEAVCUtlString@@PEBD3I@Z
?SetBufferType@CUtlBuffer@@QEAAX_N0@Z
V_atan2f
?GetGameInfoString@@YAPEBDPEBD0PEAD_K@Z
?LoggingSystem_IsChannelEnabled@@YA_NHW4LoggingVerbosity_t@@@Z
V_ZSTD_compress
V_LZ4_compress_HC
??ACUtlString@@QEBADH@Z
V_powd
V_ZSTD_compressBound
?LoggingSystem_Log@@YA?AW4LoggingResponse_t@@HW4LoggingSeverity_t@@PEBULoggingMetaData_t@@PEBDZZ
V_LZ4_compressBound
Plat_IsConsoleApplication
?GetGameInfoBool@@YA_NPEBD_N@Z
V_acosf
Plat_IsInDebugSession
Plat_IsFile
Plat_TickDiffSecF
V_expf
Plat_RelativeTicks
?RemoveFromStart@CUtlString@@QEBA?AV1@PEBD_N@Z
V_logf
?ParallelCallQueued@CCallQueue@@QEAAXPEBDPEAVIThreadPool@@@Z
V_sinf
??0CTSListBase@@QEAA@XZ
V_cosf
?AppendFormat@CBufferString@@QEAAHPEBDZZ
?Pop@CTSListBase@@QEAAPEAUTSLNodeBase_t@@XZ
?Push@CTSListBase@@QEAAXPEAUTSLNodeBase_t@@@Z
??1CTSListBase@@QEAA@XZ
?FioGetBaseFileInfo@@YAHPEBDPEAUFioBaseFileInfo_t@@I@Z
V_GetPathForm
V_PathsMatch
?Acquire@CUtlString@@QEAAXPEAVCBufferString@@_N@Z
?ExtendPath@CBufferString@@QEAAPEBDPEBDD_N@Z
V_XXH64
?SeekPut@CUtlBuffer@@QEAAXW4SeekType_t@1@H@Z
?EnsureCapacity@CBufferString@@QEAAHHPEAPEAD_N1@Z
?SetBigEndian@CUtlBuffer@@QEAAX_N@Z
V_logd
?ConMsg@@YAXPEBDZZ
Plat_UUIDFromString
Plat_GetProcAddresses
Plat_UnloadModule
?FioClose@@YAHPEAX@Z
Plat_CreateOpenTempFile
?FioWrite@@YAHPEAXPEBXHPEAH@Z
V_log2_uint
V_qsort
V_PrettifyNum
UnregisterAssertionFailureListener
?GetPtr@KeyValues@@QEBAPEAXPEBDPEAX@Z
V_PathNamesAreEquivalent
?OutputReport@CVProfile@@QEAAXAEBUVProfReportSettings_t@@PEBDH@Z
?DirName@CUtlString@@QEBA?AV1@XZ
?UnqualifiedFilenameAlloc@CUtlString@@QEBA?AV1@XZ
RegisterAssertionFailureListener
V_MakeAbsolutePathBuffer
?CheckForPendingChanges@CDirTreeWatchManager@@SAXXZ
V_snprintf
?LooksLikeKV3TextData@@YA_NPEBXHPEAUKV3ID_t@@PEADH@Z
?FioGetDiskInfo@@YAHPEBDPEAUFioDiskInfo_t@@@Z
g_VProfCurrentProfile
?ExtractFileBase@CBufferString@@QEAAPEBDPEBD_N@Z
?MakeAbsolutePath@CBufferString@@QEAAPEBDPEBD0@Z
?EndsWith@CBufferString@@QEBA_NPEBD@Z
?StartsWith@CBufferString@@QEBA_NPEBD@Z
V_StripLeadingSlash
?GetTotalSecondsSampled@CVProfile@@QEBANXZ
?MarkFrame@CVProfile@@QEAAXXZ
?ResetPeaks@CVProfile@@QEAAXXZ
?Reset@CVProfile@@QEAAXXZ
?Stop@CVProfile@@QEAAXXZ
?Start@CVProfile@@QEAAXXZ
?HideBudgetGroup@CVProfile@@QEAAXPEBD_N@Z
?EnsureTrailingSlash@CBufferString@@QEAAPEBDD_N@Z
LoggingSystem_EnableLogCapture
?FioGetFileCRC32@@YAHPEBDPEAIH@Z
Plat_SetEnv
MiniDumpExceptionHandler
KeyValuesSystem
Plat_OnExecutableExitingMain
Plat_GetModuleFilename
GetCPUInformation
LoggingSystem_SetMaxLogCaptureLines
V_FixDoubleSlashes
Plat_SetGameDirectories
?FioGetFileCRC32Buffer@@YAHPEBDPEAIPEAEH@Z
??1CThreadLocalScope@@QEAA@XZ
??0CThreadLocalScope@@QEAA@PEAUThreadHandle_t__@@_N@Z
Tier0GenericMiniDumpHandler
Plat_AttachDebuggerToProcess
LoggingSystem_RegisterLoggingListener
V_fgets
LoggingSystem_PushLoggingState
MinidumpLog
Plat_HasEnv
?GetDelimitedString@CUtlBuffer@@QEAAXPEAVCUtlCharConversion@@PEAVCBufferString@@@Z
?LoadKV3FromKV1Text_Translated@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEBDW4KV1TextEscapeBehavior_t@@PEBUKV1ToKV3Translation_t@@H2_N@Z
LoggingSystem_PopLoggingState
Tier0GenericMiniDumpHandler_SetOptions
?LoadKV3@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEBDAEBUKV3ID_t@@2@Z
LoggingSystem_EnableLogCaptureInMiniDumpComment
V_atoui64
SetDefaultMiniDumpHandler
Plat_GetGameDirectory
?ExtractFirstDir@CBufferString@@QEAAPEBDPEBD@Z
?RemoveDotSlashes@CBufferString@@QEAAPEBDD@Z
?StripTrailingSlash@CBufferString@@QEAAPEBDXZ
DeclareCurrentThreadIsMainThread
??8CUtlBinaryBlock@@QEBA_NAEBV0@@Z
??4CUtlBinaryBlock@@QEAAAEAV0@AEBV0@@Z
V_frexpf
MakeGlobalSymbol
V_roundf
Plat_UUIDToString
?LoadKV3FromKV1Text@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEBDW4KV1TextEscapeBehavior_t@@2_N@Z
?Swap@CUtlString@@QEAAXAEAV1@@Z
Plat_DebugPrint
InvokeMiniDumpHandler
Plat_ExitProcess
GetDefaultMiniDumpTypeFlags
_V_strncat
ThreadInitOnceCall_Finish
?EnterScopeInternalBudgetFlags@?$VProfScopeHelper@$0A@$0A@@@SAP6AXXZPEBDAEAUVProfBudgetGroupCallSite@@@Z
ThreadInitOnceCall_ShouldRun
_V_SetExtension
_V_FixupPathName
Plat_IgnoreContentAsserts
Plat_WindowToOsSpecificHandle
Plat_GetMonitorBounds
Plat_GetCurrentDirectory
Plat_SetDesktopNotifyIconPath
Plat_GetComputerName
LoggingSystem_RegisterBackdoorLoggingListener
Plat_DestroyWindow
Plat_LoadSDL
LoggingSystem_ResetBackdoorLoggingState
V_AreSlashesCorrect
Plat_SetWindowIcon
Plat_SetFullscreenMinimizeOnFocusLoss
Plat_LoadModule
SetAssertionPrompt
Plat_GetDefaultMonitorIndex
Plat_MinimizeWindow
Plat_IsDirectory
Plat_RestartCurrentProcess
Plat_GetWindowClientBounds
Plat_DisableIOBuffering
Plat_GetWindowClientSize
Plat_MessageBox
Plat_GetDesktopResolution
Plat_RequireSDL
Plat_IsWindowMinimized
?GetString@CUtlBuffer@@QEAAXPEADH@Z
?LoadKV3Text_NoHeader@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEBDAEBUKV3ID_t@@2@Z
?SaveKV3Text_NoHeader@@YA_NPEBVKeyValues3@@PEAVCUtlString@@PEAVCUtlBuffer@@I@Z
?RandomInt@?$CUniformRandomStreamImpl@VCThreadNullMutex@@@@QEAAHHH@Z
??0?$CUniformRandomStreamImpl@VCThreadNullMutex@@@@QEAA@H@Z
Plat_IsInHeadlessMode
ThreadInMainThread
?Allocate3D@CUtl3DAllocator@@QEAA_NHHH_NPEAURect3D_t@@@Z
?Reset@CUtl3DAllocator@@QEAAXHHH@Z
_V_StripExtension
?MakeRelativePath@CBufferString@@QEAAPEBDPEBD0_N@Z
?SetPtr@CBufferString@@QEAAXPEADHH_N1@Z
V_FixSlashes
?GetGameInfoFloat@@YAMPEBDM@Z
V_StripFilename
V_exp2f
_V_StripLastDir
?FindVertsInBox@CVertexKDTree@@QEBAXAEAV?$CUtlVectorFixedGrowable@PEBM$0EA@H@@AEBV?$Vec3D@M@@1H@Z
?BuildMidpoint@CVertexKDTree@@QEAAXPEBMHH@Z
?GetGameInfoInt@@YAHPEBDH@Z
?FreeInts@CVariableBitStringBase@@AEAAXXZ
?AllocInts@CVariableBitStringBase@@AEAAXH@Z
??0?$CUniformRandomStreamImpl@VCThreadNullMutex@@@@QEAA@XZ
V_FixupPathCharToUnderscore
?CopySubkeys@KeyValues@@QEBAXPEAV1@@Z
??4KeyValues@@QEAAAEAV0@AEBV0@@Z
?StripFilename@CUtlString@@QEBA?AV1@XZ
V_sscanf_s
Plat_GetTime
?Replace@CBufferString@@QEAAHDD@Z
?FormatTo@@YAXPEAVIFormatOutputStream@@VCFormatStringElement@@H@Z
?FormatTo@@YAXPEAVIFormatOutputStream@@VCFormatStringElement@@I@Z
?GetBaseFilename@CUtlString@@QEBA?AV1@XZ
_V_FileBase
?ForEachInBox@CVertexKDTree@@QEBAXAEBV?$Vec3D@M@@0AEBV?$function@$$A6AXPEBM@Z@std@@H@Z
V_fmodf
?V_SplitString@@YAXPEBD0AEAV?$CUtlVector@VCUtlString@@HV?$CUtlMemory@VCUtlString@@H@@@@_N@Z
??YCUtlString@@QEAAAEAV0@AEBVCBufferString@@@Z
??8CUtlString@@QEBA_NAEBVCBufferString@@@Z
?SaveKV3Text_ToString@@YA_NAEBUKV3ID_t@@PEBVKeyValues3@@PEAVCUtlString@@2I@Z
?String@CUtlSymbolTable@@QEBAPEBDVCUtlSymbol@@@Z
?Right@CUtlString@@QEBA?AV1@H@Z
?Left@CUtlString@@QEBA?AV1@H@Z
?FastCompress@CBlockCompress@@SAIPEBEIPEAEI@Z
V_DoubleToString_Unsafe
V_FloatToString_Unsafe
V_Int32ToString_Unsafe
?TryCullParticleSystemDisabledBlocks@@YA_NPEAVKeyValues3@@@Z
V_StringParseError
V_UInt8ToString_Unsafe
V_StringToUint8
??4CUtlBinaryBlock@@QEAAAEAV0@$$QEAV0@@Z
V_Int16ToString_Unsafe
V_StringToInt16
V_UInt16ToString_Unsafe
Plat_CreateUUIDImpl
V_IndexAfterPrefix
V_StringToBool
V_StringToQAngle
?TrimRight@CUtlString@@QEAAXPEBD@Z
?LoggingSystem_Log@@YA?AW4LoggingResponse_t@@HW4LoggingSeverity_t@@AEBULeafCodeInfo_t@@PEBULoggingMetaData_t@@PEBDZZ
V_Int8ToString_Unsafe
V_StringToInt8
V_atof
??HCUtlString@@QEBA?AV0@H@Z
RandomSeed
?ToUpperFast@CUtlString@@QEAAXXZ
FindGlobalSymbolByHash
?Resize@CVariableBitStringBase@@QEAAXH@Z
?GetEmptyString@CUtlString@@SAAEBV1@XZ
??0?$CUniformRandomStreamImpl@VCThreadSpinMutex@@@@QEAA@XZ
?SetSeed@?$CUniformRandomStreamImpl@VCThreadSpinMutex@@@@QEAAXH@Z
?RandomFloat@?$CUniformRandomStreamImpl@VCThreadSpinMutex@@@@QEAAMMM@Z
?RandomInt@?$CUniformRandomStreamImpl@VCThreadSpinMutex@@@@QEAAHHH@Z
V_modff
Plat_IsCPUEmulated
?FindAndDeleteSubKey@KeyValues@@QEAA_NPEBD@Z
?FioReadFileToBuffer@@YAHPEBDPEAVCUtlBuffer@@H@Z
Plat_DebugString
Plat_TickDiffMilliSecF
Plat_FileExists
Plat_LoadModuleRaw
Plat_GetModuleInterfaceFactory
Plat_InitializeCOM
Plat_ShutdownCOM
COM_TimestampedLog
?DefaultExtension@CBufferString@@QEAAPEBDPEBD@Z
V_Get_stdout
V_fflush
Plat_CreateWindow
Plat_GetDesktopBounds
Plat_SetActiveWindow
InitWin32ConsoleColorContext
SetWin32ConsoleColor
RestoreWin32ConsoleColor
GetWin32ConsoleCursorColumnIndex
LoggingSystem_ResetCurrentLoggingState
LoggingSystem_CurrentStateIndex
LoggingSystem_SetChannelVerbosity
Plat_CheckSDL
Plat_UnloadSDL
TimestampedEvent
TimestampedEventMsgV
LOG_DEVELOPER
LOG_DEVELOPER_CONSOLE
g_Mathlib_GammaToLinearByteTable
?PeekGet@CUtlBuffer@@QEAAPEBXHH@Z
?GetOverflow@CUtlBuffer@@IEAA_NH@Z
V_CopyMemory3D
V_atanf
V_fprintf
Plat_RemoveFile
Plat_GetModuleProcAddress
?InternalPush@CTSListBase@@AEAAXPEAUTSLNodeBase_t@@@Z
?InternalPop@CTSListBase@@AEAAPEAUTSLNodeBase_t@@XZ
VProf_FindOrCreateCounter
?Detach@CTSListBase@@QEAAPEAUTSLNodeBase_t@@XZ
?Trim@CUtlString@@QEAAXPEBD@Z
?Construct@CSplitString@@AEAAXPEBDPEAPEBDH_N@Z
??0CUtlMemoryPoolBase@@QEAA@HHHW4MemoryPoolGrowType_t@@PEBDW4MemAllocAttribute_t@@@Z
??1CUtlMemoryPoolBase@@QEAA@XZ
?Alloc@CUtlMemoryPoolBase@@QEAAPEAXXZ
?Free@CUtlMemoryPoolBase@@QEAAXPEAX@Z
_V_StringAfterPrefixCaseSensitive
InvalidateUniqueId
IsUniqueIdEqual
CopyUniqueId
?ConColorMsg@@YAXAEBVColor@@PEBDZZ
?ParseToken@CUtlBuffer@@QEAA_NPEBD0PEADH@Z
?ConvertCRLF@CUtlBuffer@@QEAA_NAEAV1@@Z
GetDmElementTypeSymbolMap
??0KeyValues@@QEAA@PEBD00@Z
GetCStringCharConversion
UniqueIdFromString
Serialize
?GetDelimitedString@CUtlBuffer@@QEAAXPEAVCUtlCharConversion@@PEADH@Z
?PeekDelimitedStringLength@CUtlBuffer@@QEAAHPEAVCUtlCharConversion@@_N@Z
Unserialize
?PeekStringLength@CUtlBuffer@@QEAAHXZ
?ClearDestruct@CUtlMemoryPoolBase@@IEAAXP6AXPEAX@Z@Z
?AllocZero@CUtlMemoryPoolBase@@QEAAPEAXXZ
?IsAllocationWithinPool@CUtlMemoryPoolBase@@QEBA_NPEAX@Z
V_strtod
?SetPtr@KeyValues@@QEAAXPEBDPEAX@Z
?TruncateAt@CBufferString@@QEAAPEBDH_N@Z
V_StringToFloatArray
V_StringToVector2D
V_StringToVector4D
V_StringToColor
?SaveKV3Text_NoHeader@@YA_NPEBVKeyValues3@@PEAVCUtlString@@PEAVCBufferString@@I@Z
g_TSPointerListNodes
?SetLength@CBufferString@@QEAAPEADH_NPEAH@Z
??1CUtlScratchMemoryPool@@QEAA@XZ
?AllocAligned@CUtlScratchMemoryPool@@QEAAPEAXHH@Z
?RemoveAll@CUtlMemoryBlockAllocator@@QEAAX_K@Z
?LoadFromBuffer@KeyValues@@QEAA_NPEBD0PEAVIFileSystem@@0P6A_N0PEAX@ZPEAVIKeyValuesErrorSpew@@20@Z
?GetColor@KeyValues@@QEBA?AVColor@@PEBDAEBV2@@Z
?RemoveSubKey@KeyValues@@QEAAXPEAV1@_N1@Z
?MakeCopy@KeyValues@@QEBAPEAV1@XZ
Plat_GetCrtEnv
V_Get_stderr
MemAlloc_ReallocFunc
MemAlloc_StrDupWrapperFunc
V_fpclassifyd
V_atan2d
V_expd
?DetachMemory@CUtlBuffer@@QEAAPEAXXZ
ThreadMultiWaitObjectSetDestroy
??0CThreadMultiWaitEvent@@QEAA@_N@Z
??1CThreadMultiWaitEvent@@QEAA@XZ
?Set@CThreadMultiWaitEvent@@QEAAXXZ
?Reset@CThreadMultiWaitEvent@@QEAAXXZ
FindRegisteredGlobalObjectInternal
V_tanf
?TruncateAt@CBufferString@@QEAAPEBDPEBD_N@Z
?Trim@CBufferString@@QEAAPEBDPEBD@Z
V_StripLeadingWhitespace
?AddInt@KeyValues@@QEAAXPEBDH@Z
RandomFloat
?SetSeed@?$CUniformRandomStreamImpl@VCThreadNullMutex@@@@QEAAXH@Z
?RandomFloat@?$CUniformRandomStreamImpl@VCThreadNullMutex@@@@QEAAMMM@Z
?FindVertsInBox@CVertexKDTree@@QEBAXAEAV?$CUtlVectorFixed@PEBM$0EA@H@@AEBV?$Vec3D@M@@1H@Z
?Remove@CUtlString@@QEBA?AV1@PEBD_N@Z
V_fmodd
??1CThreadSyncObject@@QEAA@XZ
??0CThreadEvent@@QEAA@_N@Z
?Set@CThreadEvent@@QEAA_NXZ
?UnlockWrite@CThreadSpinRWLock@@QEAAXPEBDH@Z
?SpinLockForWrite@CThreadSpinRWLock@@AEAAXPEBDHI@Z
?LockForWrite@CThreadRWLock@@QEAAXPEBDH@Z
?UnlockWrite@CThreadRWLock@@QEAAXPEBDH@Z
?WaitForRead@CThreadRWLock@@AEAAXXZ
V_TryAndMakeFriendlyNameFromCppName
?SaveKV3Text_NoHeader@@YA_NPEBVKeyValues3@@PEAVCUtlString@@1I@Z
V_LZ4_decompress_safe
V_acosd
V_asinf
V_coshf
V_sinhf
V_tanhf
?BuildMidpointFromVertexSubSet@CVertexKDTree@@QEAAXPEBMHPEBHH@Z
CRC64_ProcessBuffer
?FormatTo@@YAXPEAVIFormatOutputStream@@VCFormatStringElement@@N@Z
V_isfinited
?TrimLeft@CUtlString@@QEAAXD@Z
?TrimRight@CUtlString@@QEAAXD@Z
?LoadKV3FromFile@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEBD2AEBUKV3ID_t@@@Z
?Nearest@CVertexKDTree@@QEBAPEBMAEBV?$Vec3D@M@@@Z
?FixupPathName@CUtlString@@QEAAXXZ
??0CUtlScratchMemoryPool@@QEAA@IIPEAX_N@Z
V_strnchr
Plat_GetLocalTime
Plat_GetUserName
?DevWarning@@YAXPEBDZZ
DestroyThreadPool
?V_SplitString2@@YAXPEBDPEAPEBDHAEAV?$CUtlVector@PEADHV?$CUtlMemory@PEADH@@@@@Z
?LoggingSystem_Log@@YA?AW4LoggingResponse_t@@HW4LoggingSeverity_t@@PEBULoggingMetaData_t@@VColor@@PEBDZZ
V_AppearsToBeANumber
?V_UnicodeLength@@YAHPEBD@Z
?V_UnicodeAdvance@@YAPEADPEADH@Z
V_RemoveDotSlashes
Plat_GetPlatformError
Plat_VirtualAlloc
Plat_VirtualFree
?Append@CUtlString@@QEAAXPEBDH@Z
V_ftell
?Swap@CUtlBuffer@@QEAAXAEAV1@@Z
V_ZSTD_decompress
??0CKeyValuesDumpContextAsDevMsg@@QEAA@H@Z
?SetLength@CUtlString@@QEAAXH@Z
?IsEmpty@KeyValues@@QEBA_NPEBD@Z
?Dump@KeyValues@@QEAA_NPEAVIKeyValuesDumpContext@@H@Z
?RemoveFilePath@CBufferString@@QEAAPEBDXZ
?Assert_ConditionFailed@@YA_NAEBU_AssertCompileTimeConstantStruct_t@@@Z
?IsEqual_FastCaseInsensitive@CUtlString@@QEBA_NPEBD@Z
??HCUtlString@@QEBA?AV0@PEBD@Z
??3KeyValues@@SAXPEAX@Z
V_Int64ToString_Unsafe
?WriteAsBinaryFiltered@KeyValues@@QEAA_NAEAVCUtlBuffer@@@Z
g_pMemAlloc
CMemAllocSystemInitialize
V_atoi
_V_strnicmp_fast
RandomInt
V_StringToInt32
VProf_ExitScope
V_fwrite
V_StringToFloat32
LOG_ASSERT
?NextFile@CDirIterator@@QEAA_NXZ
??1CDirIterator@@QEAA@XZ
??0CDirIterator@@QEAA@PEBD0I@Z
LoggingSystem_IsChannelEnabled
_V_ComposeFileName
?EnterScopeInternal@?$VProfScopeHelper@$0A@$0A@@@SAP6AXXZPEBD@Z
V_fclose
UtlMemory_CalcNewAllocationCount
V_vsnprintf
V_fopenUTF8
?FreeMemoryBlock@CUtlString@@AEAAXXZ
?Replace@CUtlString@@QEBA?AV1@PEBD0_N@Z
?FormatV@CUtlString@@QEAAHPEBDPEAD@Z
??YCUtlString@@QEAAAEAV0@PEBD@Z
??8CUtlString@@QEBA_NAEBV0@@Z
?SetDirect@CUtlString@@QEAAXPEBDH@Z
?Set@CUtlString@@QEAAXPEBD@Z
??4CUtlString@@QEAAAEAV0@AEBVCBufferString@@@Z
Plat_FatalErrorFunc
UtlMemory_Alloc
?LoadKV3FromJSON@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEBD2@Z
ThreadGetCurrentProcessId
VProf_EnterScopeAdHoc
Warning
LoggingSystem_Log
?Printf@CUtlBuffer@@QEAAXPEBDZZ
??0CUtlBuffer@@QEAA@HHH@Z
CommandLine
ThreadSleep
?Alloc@CUtlMemoryBlockAllocator@@QEAAII@Z
??1CUtlMemoryBlockAllocator@@QEAA@XZ
??0IFormatOutputStream@@QEAA@XZ
??1CCharBufferFormatOutputStream@@UEAA@XZ
?ExtractFilePath@CBufferString@@QEAAPEBDPEBD_N@Z
?SetExtension@CBufferString@@QEAAPEBDPEBD_N@Z
?ExtractFileExtension@CBufferString@@QEAAPEBDPEBD@Z
ToolsStallMonitorInternal_BeginScope
??_7IFormatOutputStream@@6B@
?Set@CUtlBinaryBlock@@QEAAXPEBXH@Z
?LoggingSystem_LogDirect@@YA?AW4LoggingResponse_t@@HW4LoggingSeverity_t@@VColor@@PEBULoggingMetaData_t@@PEBD@Z
LoggingSystem_GetChannelColor
?FormatArgumentsToBuffer@@YAXPEAVIFormatOutputStream@@PEBDPEBVCTypeErasedFormattingWrapper@@H@Z
??_7CCharBufferFormatOutputStream@@6B@
V_sscanf
Plat_LoadInterface
V_UnqualifiedFileName
?GetForModify@CUtlString@@QEAAPEADXZ
V_strlower_fast
?LoadKV3FromKV3OrKV1@@YA_NPEAVKeyValues3@@PEAVCUtlString@@PEAVCUtlBuffer@@AEBUKV3ID_t@@PEBD@Z
?PutC@CCharBufferFormatOutputStream@@UEAAXD@Z
?Terminate@CCharBufferFormatOutputStream@@UEAAXXZ
?FormatTo@@YAXPEAVIFormatOutputStream@@VCFormatStringElement@@PEBD@Z
Plat_IsInTestMode
ToolsStallMonitorInternal_EndScope
?FixupPathName@CBufferString@@QEAAPEBDD@Z
LoggingSystem_AddTagToChannel
?DevMsg@@YAXPEBDZZ
LoggingSystem_Flush
?SaveKV3@@YA_NAEBUKV3ID_t@@0PEBVKeyValues3@@PEAVCUtlString@@PEAVCUtlBuffer@@I@Z
?Replace@CBufferString@@QEAAHPEBD0_N@Z
V_PathContainsPath
V_IsAbsolutePath
?LoadKV3@@YA_NPEAVCKeyValues3Context@@PEAVCUtlString@@PEAVCUtlBuffer@@AEBUKV3ID_t@@PEBD@Z
?Append@CUtlString@@QEAAXPEBD@Z
MemAlloc_StrDupFunc
?Assert_ConditionFailed@@YA_NAEBU_AssertCompileTimeConstantStruct_t@@PEBDZZ
V_StringToUint32
V_StringToUint16
?SetExternalBuffer@CUtlBuffer@@QEAAXPEAXHHH@Z
?GetString@CUtlBuffer@@QEAAXPEAVCBufferString@@@Z
?CheckArbitraryPeekGet@CUtlBuffer@@QEAA_NHAEAH@Z
?CheckGet@CUtlBuffer@@IEAA_NH@Z
V_CompareNameWithWildcards
??0CUtlString@@QEAA@AEBVCBufferString@@@Z
?ToLowerFast@CUtlString@@QEAAXXZ
?FixSlashes@CUtlString@@QEAAXD@Z
?IsEqual_CaseSensitive@CUtlString@@QEBA_NPEBD@Z
?Slice@CUtlString@@QEBA?AV1@HH@Z
?MatchesPattern@CUtlString@@QEBA_NAEBV1@H@Z

v8

?Value@Int32@v8@@QEBAHXZ
?HasCaught@TryCatch@v8@@QEBA_NXZ
?Exception@TryCatch@v8@@QEBA?AV?$Local@VValue@v8@@@2@XZ
?ToString@Value@v8@@QEBA?AV?$MaybeLocal@VString@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?ToObject@Value@v8@@QEBA?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PEAVIsolate@2@PEAV?$Local@VValue@v8@@@2@_K@Z
?GetCurrent@Isolate@v8@@SAPEAV12@XZ
?Enter@Isolate@v8@@QEAAXXZ
?Exit@Isolate@v8@@QEAAXXZ
?New@Context@v8@@SA?AV?$Local@VContext@v8@@@2@PEAVIsolate@2@PEAVExtensionConfiguration@2@V?$MaybeLocal@VObjectTemplate@v8@@@2@V?$MaybeLocal@VValue@v8@@@2@UDeserializeInternalFieldsCallback@2@PEAVMicrotaskQueue@2@@Z
?Enter@Context@v8@@QEAAXXZ
?Exit@Context@v8@@QEAAXXZ
?Set@Object@v8@@QEAA?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z
?Get@Object@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@I@Z
?Get@Object@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z
?ToLocalEmpty@api_internal@v8@@YAXXZ
?Utf8Length@String@v8@@QEBAHPEAVIsolate@2@@Z
?WriteUtf8@String@v8@@QEBAHPEAVIsolate@2@PEADHPEAHH@Z
?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PEAVIsolate@2@PEBDW4NewStringType@2@H@Z
?New@Function@v8@@SA?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@P6AXAEBV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@HW4ConstructorBehavior@2@W4SideEffectType@2@@Z
??1Utf8Value@String@v8@@QEAA@XZ
?Compile@Script@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@PEAVScriptOrigin@2@@Z
?Run@Script@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z
??0TryCatch@v8@@QEAA@PEAVIsolate@1@@Z
??1TryCatch@v8@@QEAA@XZ
?Length@Array@v8@@QEBAIXZ
?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PEAVIsolate@2@H@Z
??0HandleScope@v8@@QEAA@PEAVIsolate@1@@Z
??1HandleScope@v8@@QEAA@XZ
?GetCurrentContext@Isolate@v8@@QEAA?AV?$Local@VContext@v8@@@2@XZ
?Global@Context@v8@@QEAA?AV?$Local@VObject@v8@@@2@XZ
?GetIsolate@Context@v8@@QEAAPEAVIsolate@2@XZ
??0Utf8Value@String@v8@@QEAA@PEAVIsolate@2@V?$Local@VValue@v8@@@2@@Z

kernel32

FreeEnvironmentStringsW
LoadLibraryExW
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryW
FindClose
FindNextFileW
SetLastError
MultiByteToWideChar
WideCharToMultiByte
LeaveCriticalSection
GetModuleFileNameW
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GetStdHandle
GetFileType
WriteFile
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
OutputDebugStringW
GetFileSizeEx
GetFullPathNameW
SetFilePointerEx
SetEndOfFile
SetStdHandle
FlushFileBuffers
ReadConsoleInputW
SetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
TlsGetValue
LCMapStringW
CompareStringW
FreeLibraryAndExitThread
ExitThread
CreateThread
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
ReadFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
SetEnvironmentVariableW
GetConsoleCP
ExitProcess
TerminateProcess
RtlUnwind
InterlockedFlushSList
RtlUnwindEx
GetModuleHandleW
RtlVirtualUnwind
CloseHandle
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
LoadLibraryW
GlobalMemoryStatus
FlushConsoleInputBuffer
VirtualAlloc
VirtualFree
GetSystemTime
SystemTimeToFileTime
TlsFree
FreeLibrary
GetProcAddress
TlsAlloc
GetLastError
TlsSetValue
InitializeCriticalSectionAndSpinCount
RemoveDirectoryA
GetLocaleInfoW
GetProcessHeap
ReleaseMutex
WaitForSingleObject
MapViewOfFile
UnmapViewOfFile
OpenMutexA
OpenFileMappingA
GetLongPathNameA
GetShortPathNameA
QueryPerformanceFrequency
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetExitCodeThread
WaitForSingleObjectEx
IsProcessorFeaturePresent
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
RaiseException
RtlPcToFileHeader
GetStringTypeW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitOnceBeginInitialize
InitOnceComplete
K32GetModuleBaseNameA
GetSystemInfo
GetCurrentProcess
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId

user32

OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW

Exports

Exports

BinaryProperties_GetValue
CreateInterface
GetResourceManifestCount
GetResourceManifests
InstallSchemaBindings
antlr3BaseRecognizerNew
antlr3BitsetCopy
antlr3BitsetList
antlr3BitsetLoad
antlr3BitsetNew
antlr3BitsetOf
antlr3BitsetSetAPI
antlr3CommonTokenDebugStreamSourceNew
antlr3CommonTokenNew
antlr3CommonTokenStreamNew
antlr3CommonTokenStreamSourceNew
antlr3EnumNew
antlr3ExceptionNew
antlr3Hash
antlr3HashTableNew
antlr3IntStreamNew
antlr3IntTrieNew
antlr3LexerNew
antlr3LexerNewStream
antlr3ListNew
antlr3MTExceptionNew
antlr3NewAsciiStringCopyStream
antlr3NewAsciiStringInPlaceStream
antlr3NewUCS2StringInPlaceStream
antlr3ParserNew
antlr3ParserNewStream
antlr3ParserNewStreamDbg
antlr3RecognitionExceptionNew
antlr3SetTokenAPI
antlr3SetVectorApi
antlr3StackNew
antlr3StringFactoryNew
antlr3TokenFactoryNew
antlr3TokenStreamNew
antlr3UCS2StringFactoryNew
antlr3VectorFactoryNew
antlr3VectorNew
antlr3dfapredict
antlr3dfaspecialStateTransition
antlr3dfaspecialTransition
compiletargetexprLexerNew
compiletargetexprLexerNewSSD
compiletargetexprParserNew
compiletargetexprParserNewSSD
fillBufferExt
generic_exprLexerNew
generic_exprLexerNewSSD
generic_exprParserNew
generic_exprParserNewSSD
morphLexerNew
morphLexerNewSSD
morphParserNew
morphParserNewSSD
vfxexprLexerNew
vfxexprLexerNewSSD
vfxexprParserNew
vfxexprParserNewSSD

Sections

.text
Size: 22.8MB - Virtual size: 22.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 751KB - Virtual size: 751KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
open me - 1212.txt
open me - 1212.txt

Sharing

General

Malware Config

Signatures

Files

Password: 1212

Password: 1212

Password: 1212

0ae50ea3aed6f00594ba6b7b37a93ba8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

user32

advapi32

shell32

comctl32

comdlg32

shlwapi

api-ms-win-core-com-l1-1-0

Exports

Exports

Sections

.text Size: 37KB - Virtual size: 36KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 960B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 28B

Password: 1212

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99Certificate

Key Usages

33:00:01:0e:5d:84:bb:11:2d:ca:fc:03:e7:00:00:00:01:0e:5dCertificate

Extended Key Usages

Key Usages

33:00:01:0e:5d:84:bb:11:2d:ca:fc:03:e7:00:00:00:01:0e:5dCertificate

Extended Key Usages

Key Usages

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:35:09:05:b5:b2:e7:84:ef:0c:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

74:e4:35:56:3b:45:e1:44:5d:8d:39:dc:23:b6:c8:da:e4:64:c2:5f:1c:65:fb:f4:de:a8:6f:76:11:60:ea:c5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rsrc Size: 111KB - Virtual size: 111KB

.reloc Size: 512B - Virtual size: 12B

Password: 1212

6096502ff1cf47e5f1d9a8f9d4f303a1

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

.text
Size: 37KB - Virtual size: 36KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 960B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 28B

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:01:0e:5d:84:bb:11:2d:ca:fc:03:e7:00:00:00:01:0e:5d
Certificate

33:00:01:0e:5d:84:bb:11:2d:ca:fc:03:e7:00:00:00:01:0e:5d
Certificate

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:35:09:05:b5:b2:e7:84:ef:0c:00:00:00:00:00:35
Certificate

74:e4:35:56:3b:45:e1:44:5d:8d:39:dc:23:b6:c8:da:e4:64:c2:5f:1c:65:fb:f4:de:a8:6f:76:11:60:ea:c5
Signer

.text
Size: 4.5MB - Virtual size: 4.5MB

.rsrc
Size: 111KB - Virtual size: 111KB

.reloc
Size: 512B - Virtual size: 12B

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

a9:da:ac:72:97:8e:b6:a1:d2:67:3e:69:60:11:0c:5c:a8:1d:0c:e4
Signer

.text
Size: 15.4MB - Virtual size: 15.4MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 160KB - Virtual size: 336KB

.unwante
Size: 3KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 408KB - Virtual size: 407KB

.reloc
Size: 766KB - Virtual size: 765KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

b2:b4:f4:49:e3:ed:81:01:7f:05:62:a8:1b:c8:ea:0c:74:31:28:32:3f:88:4e:96:87:14:a8:ca:1e:cf:d3:3b
Signer