Static | ZeroBOX

PE Compile Time

2024-05-11 03:37:11

PDB Path

F:\10月16日备份\各种源码\COD19科技源码\TOP源码\TOP历代版本源码+说明\旧版本从5.0-15.3\版本号:2.4.7- COD19版-修复自瞄版 - 修复可视版\COD_TB\x64\Release\TOP_2.4.6.pdb

PE Imphash

4e9653c358320c642fba6c227fa69d9f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0005c624 0x0005c800 6.31686333478
.rdata 0x0005e000 0x00225a54 0x00225c00 6.62885177785
.data 0x00284000 0x00001a88 0x00000800 3.38529191976
.pdata 0x00286000 0x000030c0 0x00003200 5.78181207053
.rsrc 0x0028a000 0x000001e0 0x00000200 4.71767883295
.reloc 0x0028b000 0x00000170 0x00000200 4.11148766692

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0028a060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library d3d11.dll:
Library D3DCOMPILER_43.dll:
0x14005e030 D3DCompile
Library IMM32.dll:
0x14005e040 ImmSetCompositionWindow
0x14005e048 ImmGetContext
0x14005e050 ImmReleaseContext
Library WINHTTP.dll:
0x14005e708 WinHttpOpenRequest
0x14005e710 WinHttpOpen
0x14005e718 WinHttpSendRequest
0x14005e720 WinHttpConnect
0x14005e730 WinHttpReceiveResponse
0x14005e738 WinHttpCloseHandle
0x14005e740 WinHttpReadData
Library KERNEL32.dll:
0x14005e060 UnhandledExceptionFilter
0x14005e068 GetModuleHandleW
0x14005e070 CreateEventW
0x14005e078 WaitForSingleObjectEx
0x14005e080 ResetEvent
0x14005e088 LoadLibraryA
0x14005e090 GetProcAddress
0x14005e098 GetTickCount
0x14005e0a0 GlobalAlloc
0x14005e0a8 GlobalFree
0x14005e0b0 GlobalLock
0x14005e0b8 GlobalUnlock
0x14005e0c8 QueryPerformanceCounter
0x14005e0d0 HeapFree
0x14005e0d8 VirtualFree
0x14005e0e0 DeviceIoControl
0x14005e0e8 VirtualAlloc
0x14005e0f8 CreateFileW
0x14005e100 GetCurrentThreadId
0x14005e108 GetModuleHandleA
0x14005e110 HeapSize
0x14005e118 GetLastError
0x14005e120 HeapReAlloc
0x14005e128 CloseHandle
0x14005e130 RaiseException
0x14005e138 HeapAlloc
0x14005e140 HeapDestroy
0x14005e148 DeleteCriticalSection
0x14005e150 GetCurrentProcessId
0x14005e160 ReadFile
0x14005e168 IsDebuggerPresent
0x14005e170 Process32First
0x14005e178 SetConsoleTitleA
0x14005e180 GetCurrentProcess
0x14005e188 WriteFile
0x14005e190 TerminateProcess
0x14005e198 CreatePipe
0x14005e1a0 GetTempPathW
0x14005e1a8 WaitForSingleObject
0x14005e1b0 OpenProcess
0x14005e1b8 CreateToolhelp32Snapshot
0x14005e1c0 MultiByteToWideChar
0x14005e1c8 Sleep
0x14005e1d0 GetTempPathA
0x14005e1d8 K32GetModuleFileNameExA
0x14005e1e0 LockResource
0x14005e1e8 Process32Next
0x14005e1f8 FindResourceExW
0x14005e200 LoadResource
0x14005e208 FindResourceW
0x14005e210 K32EnumProcesses
0x14005e218 GetStartupInfoA
0x14005e220 CreateProcessW
0x14005e228 WideCharToMultiByte
0x14005e230 GetConsoleWindow
0x14005e238 lstrcmpiA
0x14005e240 CreateProcessA
0x14005e248 GetPrivateProfileIntA
0x14005e250 GetPrivateProfileStringA
0x14005e258 SetConsoleTitleW
0x14005e260 SetEvent
0x14005e270 LeaveCriticalSection
0x14005e278 EnterCriticalSection
0x14005e280 InitOnceBeginInitialize
0x14005e288 InitOnceComplete
0x14005e290 OutputDebugStringW
0x14005e2a0 SizeofResource
0x14005e2a8 GetSystemTimeAsFileTime
0x14005e2b0 GetProcessHeap
0x14005e2b8 InitializeSListHead
Library USER32.dll:
0x14005e548 GetMessageA
0x14005e550 DispatchMessageA
0x14005e558 GetWindowRect
0x14005e560 DestroyWindow
0x14005e568 SetWindowPos
0x14005e570 GetClassNameA
0x14005e578 ShowWindow
0x14005e580 GetAsyncKeyState
0x14005e588 GetWindowTextA
0x14005e590 MessageBoxA
0x14005e598 MoveWindow
0x14005e5a0 DefWindowProcA
0x14005e5b0 TranslateMessage
0x14005e5b8 LoadIconA
0x14005e5c0 PeekMessageA
0x14005e5c8 GetSystemMetrics
0x14005e5d0 SetWindowLongPtrA
0x14005e5d8 RegisterClassExA
0x14005e5e0 GetKeyState
0x14005e5e8 LoadCursorA
0x14005e5f0 ScreenToClient
0x14005e5f8 GetCapture
0x14005e600 ClientToScreen
0x14005e608 GetForegroundWindow
0x14005e610 SetCapture
0x14005e618 SetCursor
0x14005e620 GetClientRect
0x14005e628 ReleaseCapture
0x14005e630 SetCursorPos
0x14005e638 GetCursorPos
0x14005e640 OpenClipboard
0x14005e648 PostQuitMessage
0x14005e650 GetWindowThreadProcessId
0x14005e658 SetClipboardData
0x14005e660 GetClipboardData
0x14005e668 CloseClipboard
0x14005e670 EmptyClipboard
0x14005e678 EnumWindows
Library ADVAPI32.dll:
0x14005e000 RegCreateKeyW
0x14005e008 RegDeleteKeyW
0x14005e010 RegCloseKey
0x14005e018 RegSetKeyValueW
0x14005e020 RegOpenKeyW
Library MSVCP140.dll:
0x14005e310 _Xtime_get_ticks
0x14005e318 _Thrd_detach
0x14005e320 _Query_perf_counter
0x14005e368 _Query_perf_frequency
0x14005e388 _Thrd_sleep
0x14005e3a0 ??1_Lockit@std@@QEAA@XZ
0x14005e3a8 ??0_Lockit@std@@QEAA@H@Z
Library ntdll.dll:
0x14005ea90 RtlVirtualUnwind
0x14005ea98 RtlInitUnicodeString
0x14005eaa0 RtlCaptureContext
0x14005eaa8 RtlLookupFunctionEntry
0x14005eab0 NtQuerySystemInformation
Library WS2_32.dll:
0x14005e750 inet_addr
0x14005e758 gethostbyname
0x14005e760 recv
0x14005e768 connect
0x14005e770 socket
0x14005e778 send
0x14005e780 closesocket
0x14005e788 WSACleanup
0x14005e790 htons
0x14005e798 WSAStartup
Library VCRUNTIME140_1.dll:
0x14005e6f8 __CxxFrameHandler4
Library VCRUNTIME140.dll:
0x14005e688 memcmp
0x14005e690 memchr
0x14005e698 memcpy
0x14005e6a0 memmove
0x14005e6a8 memset
0x14005e6b0 _CxxThrowException
0x14005e6c0 __current_exception
0x14005e6c8 __C_specific_handler
0x14005e6d0 strstr
0x14005e6d8 __std_exception_copy
0x14005e6e0 __std_exception_destroy
0x14005e6e8 __std_terminate
Library api-ms-win-crt-runtime-l1-1-0.dll:
0x14005e8a0 _errno
0x14005e8b0 exit
0x14005e8b8 terminate
0x14005e8c0 abort
0x14005e8c8 _c_exit
0x14005e8d8 _beginthreadex
0x14005e8e0 _configure_narrow_argv
0x14005e8f0 _initialize_onexit_table
0x14005e900 _crt_atexit
0x14005e908 _cexit
0x14005e910 _seh_filter_exe
0x14005e918 _set_app_type
0x14005e920 __p___argv
0x14005e930 _initterm
0x14005e938 _initterm_e
0x14005e940 _exit
0x14005e948 __p___argc
Library api-ms-win-crt-stdio-l1-1-0.dll:
0x14005e958 fopen
0x14005e960 __acrt_iob_func
0x14005e968 fflush
0x14005e970 fclose
0x14005e980 __p__commode
0x14005e988 _fseeki64
0x14005e990 _set_fmode
0x14005e998 fseek
0x14005e9a0 fsetpos
0x14005e9a8 ungetc
0x14005e9b0 __stdio_common_vfprintf
0x14005e9b8 setvbuf
0x14005e9c0 fgetpos
0x14005e9c8 fgetc
0x14005e9d0 fwrite
0x14005e9d8 fputc
0x14005e9e0 __stdio_common_vsscanf
0x14005e9e8 fread
0x14005e9f0 __stdio_common_vsprintf
0x14005e9f8 _wfopen
0x14005ea00 ftell
Library api-ms-win-crt-string-l1-1-0.dll:
0x14005ea10 _stricmp
0x14005ea18 strncmp
0x14005ea20 isdigit
0x14005ea28 tolower
0x14005ea30 strcpy_s
0x14005ea38 isspace
0x14005ea40 strcmp
Library api-ms-win-crt-utility-l1-1-0.dll:
0x14005ea60 rand
0x14005ea68 srand
0x14005ea70 qsort
Library api-ms-win-crt-heap-l1-1-0.dll:
0x14005e7e8 realloc
0x14005e7f0 _callnewh
0x14005e7f8 free
0x14005e800 _set_new_mode
0x14005e808 malloc
Library api-ms-win-crt-convert-l1-1-0.dll:
0x14005e7a8 strtod
0x14005e7b0 atoi
0x14005e7b8 strtol
Library api-ms-win-crt-filesystem-l1-1-0.dll:
0x14005e7c8 _lock_file
0x14005e7d0 _unlock_file
0x14005e7d8 _wremove
Library api-ms-win-crt-time-l1-1-0.dll:
0x14005ea50 _time64
Library api-ms-win-crt-math-l1-1-0.dll:
0x14005e828 fmod
0x14005e830 sqrtf
0x14005e838 sinf
0x14005e840 sqrt
0x14005e848 pow
0x14005e850 _dclass
0x14005e858 floorf
0x14005e860 __setusermatherr
0x14005e868 ceilf
0x14005e870 cosf
0x14005e878 sin
0x14005e880 cos
0x14005e888 fmodf
Library api-ms-win-crt-locale-l1-1-0.dll:
0x14005e818 _configthreadlocale

Exports

Ordinal Address Name
1 0x140055d30 cJSON_AddArrayToObject
2 0x140055920 cJSON_AddBoolToObject
3 0x140055840 cJSON_AddFalseToObject
4 0x1400555b0 cJSON_AddItemReferenceToArray
5 0x140055630 cJSON_AddItemReferenceToObject
6 0x140055410 cJSON_AddItemToArray
7 0x140055570 cJSON_AddItemToObject
8 0x140055590 cJSON_AddItemToObjectCS
9 0x140055680 cJSON_AddNullToObject
10 0x140055a10 cJSON_AddNumberToObject
11 0x140055c50 cJSON_AddObjectToObject
12 0x140055b90 cJSON_AddRawToObject
13 0x140055ad0 cJSON_AddStringToObject
14 0x140055760 cJSON_AddTrueToObject
15 0x1400572c0 cJSON_Compare
16 0x140056970 cJSON_CreateArray
17 0x140056820 cJSON_CreateArrayReference
18 0x1400565a0 cJSON_CreateBool
19 0x140056c70 cJSON_CreateDoubleArray
20 0x140056560 cJSON_CreateFalse
21 0x140056b30 cJSON_CreateFloatArray
22 0x1400569f0 cJSON_CreateIntArray
23 0x1400564e0 cJSON_CreateNull
24 0x1400565e0 cJSON_CreateNumber
25 0x1400569b0 cJSON_CreateObject
26 0x1400567d0 cJSON_CreateObjectReference
27 0x140056870 cJSON_CreateRaw
28 0x140056680 cJSON_CreateString
29 0x140056da0 cJSON_CreateStringArray
30 0x140056780 cJSON_CreateStringReference
31 0x140056520 cJSON_CreateTrue
32 0x140053320 cJSON_Delete
33 0x140055f20 cJSON_DeleteItemFromArray
34 0x1400560c0 cJSON_DeleteItemFromObject
35 0x140056150 cJSON_DeleteItemFromObjectCaseSensitive
36 0x140055e80 cJSON_DetachItemFromArray
37 0x140055fb0 cJSON_DetachItemFromObject
38 0x140056030 cJSON_DetachItemFromObjectCaseSensitive
39 0x140055e10 cJSON_DetachItemViaPointer
40 0x140056ed0 cJSON_Duplicate
41 0x140055210 cJSON_GetArrayItem
42 0x1400551f0 cJSON_GetArraySize
43 0x1400531e0 cJSON_GetErrorPtr
44 0x140053210 cJSON_GetNumberValue
45 0x140055360 cJSON_GetObjectItem
46 0x140055370 cJSON_GetObjectItemCaseSensitive
47 0x1400531f0 cJSON_GetStringValue
48 0x140055380 cJSON_HasObjectItem
49 0x140053280 cJSON_InitHooks
50 0x1400561e0 cJSON_InsertItemInArray
51 0x140057290 cJSON_IsArray
52 0x140057240 cJSON_IsBool
53 0x140057220 cJSON_IsFalse
54 0x140057210 cJSON_IsInvalid
55 0x140057260 cJSON_IsNull
56 0x140057270 cJSON_IsNumber
57 0x1400572a0 cJSON_IsObject
58 0x1400572b0 cJSON_IsRaw
59 0x140057280 cJSON_IsString
60 0x140057230 cJSON_IsTrue
61 0x1400570d0 cJSON_Minify
62 0x1400541c0 cJSON_Parse
63 0x1400541f0 cJSON_ParseWithLength
64 0x140053f60 cJSON_ParseWithLengthOpts
65 0x140053f30 cJSON_ParseWithOpts
66 0x140054340 cJSON_Print
67 0x140054360 cJSON_PrintBuffered
68 0x140054420 cJSON_PrintPreallocated
69 0x140054350 cJSON_PrintUnformatted
70 0x1400563a0 cJSON_ReplaceItemInArray
71 0x1400564c0 cJSON_ReplaceItemInObject
72 0x1400564d0 cJSON_ReplaceItemInObjectCaseSensitive
73 0x140056290 cJSON_ReplaceItemViaPointer
74 0x1400533a0 cJSON_SetNumberHelper
75 0x1400533e0 cJSON_SetValuestring
76 0x140053230 cJSON_Version
77 0x1400575e0 cJSON_free
78 0x1400575d0 cJSON_malloc
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.rsrc
@.reloc
<}NBH3
El{gLE
rbDfoYZH
D3D$(H
D$0D9@
L$ SVWH
UVWAVAWH
pA_A^_^]
|$ AVH
L$ SUVWH
UVWATAUAVAWH
D8!t2f
D8't2f
@A_A^A]A\_^]
WAVAWH
0A_A^_
)t$pfH
@hIcP`
p UWATAUAWH
A_A]A\_]
E8McE`
UVWATAUAVAWH
A_A^A]A\_^]
WAVAWH
tiE8yztcA
tnD8x{uhIc
t$E8x{t
@A_A^_
@SVAVH
HhHcP`H
HhHcP`H
D8mzt[Lc
WATAUAVAWH
@8rzt>@8
t4@8rzt.@8
B$A96~AD
0A_A^A]A\_
UVWAVAWH
`A_A^_^]
/D$(v0
USWAUAVI
A^A]_[]
D$At6Hc
t$pD9u
l$Pt7A
HhHcP`H
D8t$At
D9t$Ht\A
D8t$@tvH
HhHcP`H
L$ UVWH
@UVAVH
|$`u;I
D8AxtJ
uIHcJP
\$ UVWH
(t$@Hc
@SUAUH
@VWAWH
l$HH9s
|$ ATAVAWH
0A_A^A\
s6D87t1E3
|$ AVH
|$ AVH
|$ AVAW
t$(A_A^
SUVWATAUAVAWH
;L$0}:A;
T$Hu$;
XA_A^A]A\_^][
SWATAVAWH
PA_A^A\_[
PA_A^A\_[
|$ AVH
l$ VWAVH
D$<9D$8}
D$<9D$8}
\$ UVWATAUAVAWH
A_A^A]A\_^]
|$ ATAUAVAWD
|$@A_A^A]A\
X UVWATAUAVAWH
D$PD9L$`
A_A^A]A\_^]
B(LcQ0Ik
C(IcS0Hk
@(HcQ0Hk
WAVAWH
PA_A^_
UVWATAUAVAWH
A_A^A]A\_^]
(D$`Ic
tNHcD$PHk
l$ VWATAVAWH
A_A^A\_^
t$hv&A
@SUWAVH
UVWATAUAVAWH
A_A^A]A\_^]
SVWAVH
8A^_^[
SVWAVAWH
0A_A^_^[
UAUAVH
vBMcV$M
f+D$PI
E$f+D$Xf
UVWAUI
u%HcBp
HcAp3
uvI9y upA
tfHcA`
t$ AWH
@UATAUAVAWH
GXHL;m
A_A^A]A\]
@UATAUAVAWH
A_A^A]A\]
WAVAWH
@A_A^_
t$ AVH
t$ AVH
t$ AVH
@SUVWH
t:HcO`Li
_dHcG`Hi
|$ UATAUAVAWH
D9ip}E
E9n`~^M
fD9*t$
D9h`~\M
l$`D9n`
HcL$xM
t$p;N`}6D
t$pA;D$`}
A;G0}+
A;|$P
E;l$@|
A_A^A]A\]
l$ VWAVH
9_P~8L
@SVHcYpL
|$ AVH
t$ WAVAWH
A_A^_
WAVAWH
t,A;F }
SWATAUAVH
gfffffffI+M(H
A^A]A\_[
@UVWAUH
|$XD9n
l$4D9n
T$8fff
T$8D;F
SVWAVH
XA^_^[
XA^_^[
USWAVAWH
@8t$1@
A_A^_[]
s UWATAVAWI
D8|$Bt
A_A^A\_]
UAVAWH
D$pHcH
D$pHcH
D$pHcH
@USWAVH
@USVAVAWH
A_A^^[]
H;\$0r`H
\$ UVAWH
H9;v[I
|$ UAVAWH
|$ AVH
@UAUAW
HcD$|H
|$ UATAUAVAWH
fF9<ru
A_A^A]A\]
@SUVWAVH
L90u"H
0A^_^][
|$ AVH
@UVAVH
0A^^]H
@SUVWATAVAWH
A_A^A\_^][
@SUWAVAWH
A_A^_][
A_A^_][
WATAUAVAWH
0A_A^A]A\_
t$ UWAVH
UVWAVAWH
pA_A^_^]
@USVWATAVAWH
pA_A^A\_^[]
@USVWATAVAWH
pA_A^A\_^[]
SVWATAUAVAWH
PA_A^A]A\_^[
@SVAVH
@SVATAVH
(A^A\^[
@SUVAWH
(A_^][
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
WATAUAVAWH
0A_A^A]A\_
UVWATAUAVAWH
pA_A^A]A\_^]
l$ VWATAVAWH
0A_A^A\_^
t$ UWAVH
VWATAVAWH
0A_A^A\_^
VWATAVAWH
0A_A^A\_^
gfffffffH
L$ SWH
L$ SVWH
t$ WATAUAVAWH
A_A^A]A\_
|$ ATAVAWH
A_A^A\
|$ UATAUAVAWH
A_A^A]A\]
l$ VWATAVAWH
HcD$0D
A_A^A\_^
|$ UATAUAVAWH
A_A^A]A\]
\$ UVWATAUAVAWH
A_A^A]A\_^]
@USVWATAVAWH
A_A^A\_^[]
UVWATAUAVAWH
A_A^A]A\_^]
D$TvT2
@SUVWAVH
t$0M9p
`A^_^][
WAVAWH
fD9<^u
0A_A^_
|$ UATAUAVAWH
A_A^A]A\]
UVWATAUAVAWH
A_A^A]A\_^]
WAVAWH
@A_A^_
WATAUAVAWH
@A_A^A]A\_
t$ UWAVH
t$ UWAVH
fB94@u
CL$ E3
UATAUAVAWH
\$(fff
A_A^A]A\]
WAVAWH
A_A^_
UATAUAVAWH
A_A^A]A\]
UAVAWH
` AUAVAWH
A_A^A]
|$ AVH
d$ AUAVAWH
CT$XE3
H;\$@u
A_A^A]
t$ WATAUAVAWH
@A_A^A]A\_
|$ ATAVAWH
A_A^A\
@UWAVH
UVWATAUAVAWH
PA_A^A]A\_^]
UVWATAUAVAWH
PA_A^A]A\_^]
@SVAVH
WAVAWH
A_A^_
@VWAVH
@SVATAUH
8A]A\^[
WATAUAVAWH
A_A^A]A\_
@SVATAVH
(A^A\^[
t$ WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
A_A^A]A\_^]
gfffffffH
@SVWATAUAVAWH
@A_A^A]A\_^[
@WATAUAWH
8A_A]A\_
@SVWATAUAVAWH
gfffffffI
fffffff
gfffffffH
PA_A^A]A\_^[
fffffff
ChMcC`
ChMcC`
ChMcC`
ChMcC`
L$ SVWH
t$ WAVAWH
A_A^_
WAVAWH
A_A^_
\$ UVWAVAWH
`A_A^_^]
H9l$(H
\$ UVWH
<-t6,0<
L97t8D9s$I
WAVAWH
A_A^_
|$ AVH
WAVAWH
A_A^_
A_A^_
WAVAWH
A_A^_
WAVAWH
A_A^_
WAVAWH
A_A^_
WAVAWH
A_A^_
WATAUAVAWH
A_A^A]A\_
<"t$<\u
|$ UATAUAVAWH
A_A^A]A\]
UWATAVAWH
A_A^A\_]
UWATAVAWH
A_A^A\_]
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
VWATAVAWH
AXHc8H
A_A^A\_^
UVWAVAWH
0A_A^_^]
UVWATAUAVAWH
pA_A^A]A\_^]
@SUAVH
SVWAVH
8A^_^[
WAVAWH
WAVAWH
0A_A^_
u0HcH<H
H3E H3E
;^Xu&H
@SUVWH
SleepConditionVariableCS
WakeAllConditionVariable
bad allocation
user32.dll
NtOpenCompositionSurfaceSectionInfo
win32u.dll
Unknown exception
bad array new length
map/set too long
Debug##Default
Window
#RESIZE
##Tooltip_%02d
(Popup)
##MainMenuBar
(Main menu bar)
(Untitled)
###NavWindowingList
%*s%.*s
Pos=%f,%f
Size=%f,%f
Collapsed=%d
[%s][%s]
Pos=%d,%d
Size=%d,%d
Collapsed=%d
..- -XXXXXXX- X - X -XXXXXXX - XXXXXXX- XX ..- -X.....X- X.X - X.X -X.....X - X.....X- X..X --- -XXX.XXX- X...X - X...X -X....X - X....X- X..X X - X.X - X.....X - X.....X -X...X - X...X- X..X XX - X.X -X.......X- X.......X -X..X.X - X.X..X- X..X X.X - X.X -XXXX.XXXX- XXXX.XXXX -X.X X.X - X.X X.X- X..XXX X..X - X.X - X.X - X.X -XX X.X - X.X XX- X..X..XXX X...X - X.X - X.X - XX X.X XX - X.X - X.X - X..X..X..XX X....X - X.X - X.X - X.X X.X X.X - X.X - X.X - X..X..X..X.X X.....X - X.X - X.X - X..X X.X X..X
!This program cannot be run in DOS mode.
h.rdata
H.data
.pdata
|$ uG3
D$L/vf
l$Ht$H
l$Ht&f
D$(tEH
Nal Windows Driver Unload: IoDeleteDevice NOT called: NULL DeviceObject
Nal Windows Driver Unload: Leaving...
Nal Windows Driver Unload: Starting
Nal Windows DriverAddDevice: done
Nal Windows DriverIoCreateSymbolicLink failed. Status = 0x%x
Nal Windows DriverIoCreateDevice failed. Status = 0x%0x
Nal Windows DriverAddDevice: entered
Nal Windows DriverCreate: Leaving
Nal Windows DriverCreate: Starting
Nal Windows DriverClose: Leaving
Nal Windows DriverClose: Starting
NalDeviceControl: InputBuffer was NULL
Nal Windows DriverDeviceControl: Invalid IOCTL code 0x%0x
NAL_ENABLE_DEBUG_PRINT_FUNCID: FunctionData is NULL
NAL_KKMEMCPY_FUNCID: One of the buffers was NULL
NAL_KUMEMCPY_FUNCID: One of the buffers was NULL
NAL_KMEMSET_FUNCID: One of the buffers was NULL
Kernel:
_NalWinGetUserAddress: Unable to allocate MDL
_NalWinGetUserAddress: Address To Free = 0x%p
_NalWinGetUserAddress: MmMapLockedPages failed. Freeing MDL
_NalWinGetUserAddress: KernelLevelAddress = 0x%p
PAGE_SIZE * (65535 - sizeof(MDL)) / sizeof(ULONG_PTR) = %d
_NalWinGetUserAddress: Using memory map table slot %d - Length %d
NalUnmapAddress: Unmapping non-usermode mapped address 0x%p, Length %d
NalUnmapAddressEx: Address not found in table - not unmapping 0x%p, Length %d
NalUnmapAddressEx: Global_WinMemoryMapTable[i].AddressToFree = %p
NalUnmapAddressEx: Unmapping OriginalMemoryMapped
NalUnmapAddressEx: Skipped MmUnmapLockedPages - AddressToFree or Mdl was NULL
NalUnmapAddressEx: Calling MmUnmapLockedPages
NalUnmapAddressEx: Slot %d matched
NalUnmapAddressEx: Global_WinMemoryMapTable[%d].MappedAddress = 0x%p == 0x%p
NalUnmapAddressEx: Looking to unmap 0x%p, Length %d, ProcessId %d
_NalAllocateMemoryNonPaged - MmAllocateContiguousMemory failed
_NalAllocateMemoryNonPaged - VirtualAddress = 0x%p
_NalAllocateMemoryNonPaged - MmMapLockedPages failed. Freeing MDL
_NalFreeMemoryNonPagedEx: Memory entry 0x%p is not entered into the table. Not freeing anything.
NalMmapAddressEx: *VirtualAddress = 0x%p (mapped to user)
NalMmapAddressEx: *VirtualAddress = 0x%p (not mapped to user)
NalMmapAddressEx: Vaddress = 0x%p
Translated
Looking for match for %d/%d/%d
_NalReadPciDeviceCount found %d devices (%d)
c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\windriverpci_i.c
FillKernelContext: VirtualAddress: %p
_NalHasInterruptOccurred returning %s
NalResolveOsSpecificIoctl: FuctionId = %d
NalResolveOsSpecificIoctl: NAL_WIN_IS_ADAPTER_IN_USE_FUNCID FunctionData is NULL
NalResolveOsSpecificIoctl: NAL_WIN_ADAPTER_IN_USE_FUNCID FunctionData is NULL
NalResolveOsSpecificIoctl: NAL_WIN_DRIVER_GET_REF_COUNT_FUNCID FunctionData is NULL
NalResolveOsSpecificIoctl: NAL_WIN_OS_DEVICE_FUNCID FunctionData is NULL
NalResolveOsSpecificIoctl: NAL_WIN_FREE_DEV_CONTEXT_FUNCID FunctionData is NULL
NalResolveOsSpecificIoctl: NAL_WIN_ALLOC_DEV_CONTEXT_FUNCID FunctionData is NULL
NalResolveOsSpecificIoctl: NAL_WIN_GET_SYMBOLIC_NAME_FUNCID FunctionData is NULL
NalResolveOsSpecificIoctl: NAL_WIN_GET_PDO_POINTER_FUNCID FunctionData is NULL
NalOsSpecificIoctl: FunctionId = %d
c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb
Nal Windows Driver DriverEntry: Completed
Nov 14 2013
Nal Windows Driver Loaded -- Compiled %s %s
07:22:40
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetPhysicalAddress
DbgPrint
strncpy
vsprintf
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmUnmapIoSpace
MmUnmapLockedPages
MmAllocateContiguousMemory
MmFreeContiguousMemory
MmMapIoSpace
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
ZwClose
RtlFreeAnsiString
strstr
RtlUnicodeStringToAnsiString
ZwEnumerateValueKey
ZwOpenKey
wcsncpy
IoGetDeviceObjectPointer
IoGetDeviceInterfaces
ObReferenceObjectByPointer
KeBugCheckEx
ntoskrnl.exe
KeStallExecutionProcessor
KeQueryPerformanceCounter
HAL.dll
Western Cape1
Durbanville1
Thawte1
Thawte Certification10
Thawte Timestamping CA0
121221000000Z
201230235959Z0^1
Symantec Corporation100.
'Symantec Time Stamping Services CA - G20
http://ocsp.thawte.com0
.http://crl.thawte.com/ThawteTimestampingCA.crl0
TimeStamp-2048-10
Symantec Corporation100.
'Symantec Time Stamping Services CA - G20
121018000000Z
201229235959Z0b1
Symantec Corporation1402
+Symantec Time Stamping Services Signer - G40
http://ts-ocsp.ws.symantec.com07
+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
TimeStamp-2048-20
VeriSign, Inc.10
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA0
120517000000Z
150530235959Z0
Oregon1
Hillsboro1
Intel Corporation1>0<
5Digital ID Class 3 - Microsoft Software Validation v21
LAN Access Division1
Intel Corporation0
/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
https://www.verisign.com/rpa0
http://ocsp.verisign.com0;
/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
Washington1
Redmond1
Microsoft Corporation1)0'
Microsoft Code Verification Root0
110222192517Z
210222193517Z0
VeriSign, Inc.10
VeriSign Trust Network1:08
1(c) 2006 VeriSign, Inc. - For authorized use only1E0C
<VeriSign Class 3 Public Primary Certification Authority - G50
Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
,N<jPl
3BH8Q:|8
VeriSign, Inc.10
VeriSign Trust Network1:08
1(c) 2006 VeriSign, Inc. - For authorized use only1E0C
<VeriSign Class 3 Public Primary Certification Authority - G50
100208000000Z
200207235959Z0
VeriSign, Inc.10
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA0
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
[0Y0W0U
image/gif0!00
#http://logo.verisign.com/vslogo.gif04
#http://crl.verisign.com/pca3-g5.crl04
http://ocsp.verisign.com0
VeriSignMPKI-2-80
VeriSign, Inc.10
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA
Symantec Corporation100.
'Symantec Time Stamping Services CA - G2
131114152322Z0#
Dt-^fW
!This program cannot be run in DOS mode.
`.rdata
@.data
wO;58oI
RPWWWj
t'9|$pt
t8j\hhpI
j\hhpI
j\hhpI
t@_^]3
D$,WPQR
L$<RPQ
D$XQRP
CreateToolhelp32Snapshot
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CloseHandle
WaitForSingleObject
CreateProcessA
GetStartupInfoA
WriteFile
CreateFileA
DeleteFileA
WritePrivateProfileStringA
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
KERNEL32.dll
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
USER32.dll
sprintf
strrchr
strchr
MSVCRT.dll
PathFileExistsA
SHLWAPI.dll
GDI32.dll
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetTickCount
ADVAPI32.dll
SHGetSpecialFolderPathA
SHELL32.dll
ole32.dll
WINMM.dll
_stricmp
WinPor.exe
taskkill /f /im WinPor.exe
Start.dll
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@_RDATA
@.rsrc
@.reloc
l$ VWATAVAWH
A_A^A\_^
;D$,uoD
|$ UATAUAVAWH
A_A^A]A\]
@SUVATAVH
A^A\^][
@SVAVH
@UWAUAWH
8A_A]_]
|$ AVH
H3E H3E
D8L$0uP
VWATAVAWH
A_A^A\_^
WATAUAVAWH
A_A^A]A\_
H;xXu5
fA;8unI
fA;(t(fA98t
WATAUAVAWH
A_A^A]A\_
AUAVAWH
u4I9}(
;I9}(tiH
0A_A^A]
AUAVAWH
u4I9}(
;I9}(tiH
0A_A^A]
UVWATAUAVAWH
`A_A^A]A\_^]
UVWATAUAVAWH
`A_A^A]A\_^]
@USVWATAUAVAWH
A_A^A]A\_^[]
@USVWATAUAVAWH
d$dD;d$ltY
A_A^A]A\_^[]
UVWATAUAVAWH
A_A^A]A\_^]
@USVWATAUAVAWH
A_A^A]A\_^[]
WAVAWH
@SVWATAUAVAWH
L!|$(L!
D$0HcH
pA_A^A]A\_^[
SVWATAUAWH
L!d$(L!d$@D
D$HL9gXt
A_A]A\_^[
B(I9A(u
SVWATAUAVAWH
0A_A^A]A\_^[
SVWATAUAVAWH
A_A^A]A\_^[
t$ WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
A_A^A]A\_^]
WATAUAVAWH
A_A^A]A\_
ffffff
fffffff
@USVWATAVAWH
A_A^A\_^[]
x AUAVAWH
0A_A^A]
D$@H;F
kL@8o(u
<htl<jt\<lt4<tt$<wt
|$ UATAUAVAWH
<Ct-<D
<St[@:
u<g~l<it[<ntP<ot,<pt
<utK@:
A_A^A]A\]
` UAVAWH
D$0@8{
p*W4H
p*W4H
p0R^G'
u3HcH<H
x ATAVAWH
A_A^A\
UVWAVAWH
0A_A^_^]
WAVAWH
A_A^_
WATAUAVAWH
gfffffffH
A_A^A]A\_
{ AUAVAWH
0A_A^A]
t$xt*3
WAVAWH
A_A^_
x ATAVAWH
A_A^A\
L$ VWAVH
fD94H}aD
fD9t$b
u$D8r(t
D81uUL9r
uED8r(t
vAD8s(t
u$D8r(t
fD91uTL9r
uED8r(t
v@D8s(t
UVWATAUAVAWH
PA_A^A]A\_^]
WATAUAVAWH
0A_A^A]A\_
H97u+A
@USVWATAUAVH
D8t$ht
D8t$ht
A^A]A\_^[]
f9)u4H9j
u%@8j(t
l$ VWATAVAWH
L$&8\$&t,8Y
A_A^A\_^
WATAUAVAWH
A_A^A]A\_
p0R^G'
\$ VWATAUAVH
D!l$xA
@A^A]A\_^
L$ VWAVH
x ATAVAWH
0A_A^A\
SUVWATAVAWH
A_A^A\_^][
@USVWATAVAWH
A_A^A\_^[]
WATAUAVAWH
0A_A^A]A\_
@UATAUAVAWH
e0A_A^A]A\]
ATAUAVH
L$ fff
L$ |+L;
A^A]A\
@UATAUAVAWH
H!T$0D
u,!T$(H!T$
A_A^A]A\]
WAVAWH
A_A^_
UVWATAUAVAWH
fB9<A}1L
A_A^A]A\_^]
VWATAVAW
A_A^A\_^
AUAVAWH
@A_A^A]
@USVWATAUAVAWH
H!D$ I
hA_A^A]A\_^[]
ffffff
fffffff
@SUVWATAVAWH
@A_A^A\_^][
ATAVAWH
A_A^A\
USVWAVH
A^_^[]
LcA<E3
u HcA<H
bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
(null)
CorExitProcess
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
AreFileApisANSI
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
1#QNAN
1#SNAN
UUUUUU
UUUUUU
=imb;D
/>58d%
VM>cQ6
>jtm}S
)>6{1n
+f)>0'
;H9>&X
*StO9>T
n03>Pu
K~Je#>!
bp(=>?g
BC?>6t9^
K&>.yC
.xJ>Hf
y\PD>!
|b=})>
c [1>H'
uzKs@>
3>N;kU
kE>fvw
V6E>`"(5
?UUUUUU
?7zQ6$
Unknown exception
bad array new length
c:\ESsystem.ini
Configure
48 8B CF CC CC CC CC CC 8B D8 85 C0 78 CC C6 CC CC CC CC CC 01 EB
44 CC CC CC CC 74 CC 44 CC CC CC CC 75 CC 48 CC CC CC CC 48
NtCreateThreadEx
ntdll.dll
vector too long
VirtualQueryEx failed at %p (Err=0x%X)
C:\Windows\Start.pdb
.text$mn
.text$mn$00
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCZ
.CRT$XIA
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.pdata
_RDATA
.rsrc$01
.rsrc$02
WriteProcessMemory
GetCurrentProcess
OutputDebugStringA
Thread32Next
Thread32First
SuspendThread
ResumeThread
GetModuleHandleA
CreateToolhelp32Snapshot
GetLastError
CloseHandle
WritePrivateProfileStringA
Module32FirstW
VirtualProtectEx
AddVectoredExceptionHandler
GetThreadContext
GetProcAddress
GetCurrentProcessId
Module32NextW
SetThreadContext
OpenThread
VirtualQueryEx
KERNEL32.dll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
CreateFileW
WriteConsoleW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVtype_info@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
</assembly>
Start.exe
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@_RDATA
@.vmp0
h.reloc
@.rsrc
@SWATH
@SUWAVAWH
A_A^_][
A_A^_][
H3E H3E
u0HcH<H
D8L$0uP
VWATAVAWH
A_A^A\_^
WATAUAVAWH
A_A^A]A\_
H;xXu5
fA;8unI
fA;(t(fA98t
WATAUAVAWH
A_A^A]A\_
AUAVAWH
u4I9}(
;I9}(tiH
0A_A^A]
AUAVAWH
u4I9}(
;I9}(tiH
0A_A^A]
UVWATAUAVAWH
`A_A^A]A\_^]
UVWATAUAVAWH
`A_A^A]A\_^]
@USVWATAUAVAWH
A_A^A]A\_^[]
@USVWATAUAVAWH
d$dD;d$ltY
A_A^A]A\_^[]
UVWATAUAVAWH
A_A^A]A\_^]
@USVWATAUAVAWH
A_A^A]A\_^[]
WAVAWH
@SVWATAUAVAWH
L!|$(L!
D$0HcH
pA_A^A]A\_^[
SVWATAUAWH
L!d$(L!d$@D
D$HL9gXt
A_A]A\_^[
B(I9A(u
SVWATAUAVAWH
0A_A^A]A\_^[
SVWATAUAVAWH
A_A^A]A\_^[
t$ WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
A_A^A]A\_^]
WATAUAVAWH
A_A^A]A\_
ffffff
fffffff
D$0@8{
p*W4H
p*W4H
x ATAVAWH
A_A^A\
UVWAVAWH
0A_A^_^]
p0R^G'
u3HcH<H
t$ WAVAWH
A_A^_
WAVAWH
A_A^_
WATAUAVAWH
A_A^A]A\_
p0R^G'
L$ VWAVH
fD9t$b
fD94H}aD
WATAUAVAWH
0A_A^A]A\_
x UAVAWH
t(LcuoH;
UVWATAUAVAWH
A_A^A]A\_^]
@USVWATAUAVAWH
xA_A^A]A\_^[]
u$D8r(t
D81uUL9r
uED8r(t
vAD8s(t
u$D8r(t
fD91uTL9r
uED8r(t
v@D8s(t
UVWATAUAVAWH
PA_A^A]A\_^]
WATAUAVAWH
0A_A^A]A\_
H97u+A
@USVWATAUAVH
D8t$ht
D8t$ht
A^A]A\_^[]
f9)u4H9j
u%@8j(t
l$ VWATAVAWH
L$&8\$&t,8Y
A_A^A\_^
UVWATAUAVAWH
tUH95i2
xWI96tRI
0A_A^A]A\_^]
@UATAUAVAWH
e0A_A^A]A\]
\$ VWATAUAVH
D!l$xA
@A^A]A\_^
WAVAWH
A_A^_
UVWATAUAVAWH
fB9<A}1L
A_A^A]A\_^]
VWATAVAW
A_A^A\_^
AUAVAWH
@A_A^A]
@USVWATAUAVAWH
H!D$ I
hA_A^A]A\_^[]
WATAUAVAWH
0A_A^A]A\_
UVWATAUAVAWH
L9#t!H
:u A8N
pA_A^A]A\_^]
t$ WATAUAVAWH
0A_A^A]A\_
UATAUAVAWH
D8l$pt
D8l$pt
D8l$pt
D8l$pt
D8l$pt
D8l$pt
D8l$ptGH
D8l$pt
D8l$pt
A_A^A]A\]
ATAUAVH
L$ fff
L$ |+L;
A^A]A\
@UATAUAVAWH
H!T$0D
u,!T$(H!T$
A_A^A]A\]
x UAVAWH
ffffff
fffffff
@SUVWATAVAWH
@A_A^A\_^][
@USVWATAUAVAWH
eHA_A^A]A\_^[]
USVWAVH
A^_^[]
LcA<E3
u HcA<H
bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
COMSPEC
cmd.exe
CorExitProcess
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
UUUUUU
UUUUUU
=imb;D
/>58d%
VM>cQ6
>jtm}S
)>6{1n
+f)>0'
;H9>&X
*StO9>T
n03>Pu
K~Je#>!
bp(=>?g
BC?>6t9^
K&>.yC
.xJ>Hf
y\PD>!
|b=})>
c [1>H'
uzKs@>
3>N;kU
kE>fvw
V6E>`"(5
?UUUUUU
?7zQ6$
Unknown exception
bad array new length
string too long
;ntdll.dll
LdrGetProcedureAddress
NtAllocateVirtualMemory
LdrLoadDll
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
LdrUnloadDll
NtFreeVirtualMemory
NtCreateThreadEx
c:\ESsystem.ini
Configure
c net start "Desktop Window Manager Session Manager"
c net stop "Desktop Window Manager Session Manager"
c sc config "UxSms" start= demand
sc config uxsms start= auto
net stop uxsms
net start uxsms
@USVWATAVH
A^A\_^[]
ReadFile
WriteProcessMemory
GetCurrentProcess
WaitForSingleObject
CreateFileW
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
CloseHandle
WritePrivateProfileStringA
HeapAlloc
GetProcAddress
VirtualAllocEx
GetFileSize
ReadProcessMemory
GetProcessHeap
VirtualFreeEx
KERNEL32.dll
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ADVAPI32.dll
ShellExecuteExW
SHELL32.dll
DwmIsCompositionEnabled
dwmapi.dll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetFileType
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
HeapSize
HeapReAlloc
WriteConsoleW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVtype_info@@
<\7fFOk
~%mHP^
M@$*52
l[4i~U
^.#A`J
BwK*hHL
To.-+1K
(85gE|
VRxfj$
_?BA]1
Em9|r?
ZOpf/z3f E
y_l]}s
\g6a;>P
<ZC}k~J
R\l&i;
a/4IQQ8;
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
WindowEx.ini
Unicode
!This program cannot be run in DOS mode.
WG`x(h-
]RP#E3
x@8`}<
iP(PA5'
xPL:A3
n[tl}0
A1J(G4
!G[#DZ
l$_a(
R_?<
rbAnn
p:#y#x3
d 8<WL_
tW9~tQ
U+xD5<
RUV@XW;
o;Du+$T%FI6
9oTtc:HQ;
xLtFpW3
WWri%pn
TD\a0y
?M3\`
|hHtS
[AD=+=
rA,*FP
phd@6P
gpgp[t_
VO.Xq
`!g0Wm
P`uo |
,_,\(`
t=048<
kAlj0VRPSQ
u 0:D6\
3WPAJM
C;e8^>
r$(,0=
8<@d62RDHJ
^ddddr
`7dhlpH
T.(,04J
228:<@.#/
DH=LNP6
@\"Al{
'#wWt(/T
Rie?_Tq
4_H]8W_F
,~th9^
X;sdLT
Vof|3D8
f;ca[@
`YrJTH
;xT@3]
i`%|py
CmYK4:
y!36@>
844fW`
N hlc=5p
{rHxhqm
C}:HVu
'~AtEM
&"ap;lg
ecnXHx
/%L:&&
FagIi0
^,V=uW
NP;pT}
g$xKCQ
='D-!u*^
X@@H3"
X ( {@
tj$DA8
sp 90t
JCbcdT
U!{ $+
SX-Lu7
bH[~xv
KA'KF@"
;ELdO@
^81,Pd
.CCHvD4
JNN@t;
w4X3S-
EbDV`L=.kt
R}Y'>~'[u
5h\UWSS
`QPW t
WWB^S%c
,=6W'_
t@:.jp
22r$<@"|'
,uzUU9
*W!&BD
'3k0QW
d%FNHZ
aL.$lH.
Q0CI89
[XSQ7d
fREh$J <
9H.G_D
eu Hk)r
mU^[2~
t&V0r!
_t(L/t"
hyLNP~
P\|X[IXYt-
hb@"v|0q%XU
@P%XpG
T\9@FHI
cw>.G0
j22ccE
,DvILX0Z
M\t!R5
I@"WAyt
m.Z>ugX
;=&puU
*C#Moj%
r$DSw,
zN<V)<x
=`]9^xu5ji
HtRI>l|
Vx$H%
h9n`u;
L=Q0<A
t[ nSfR
j&Q;AO
UY;fu";
$(o@ ,
+ixw~
.7{tO$Zs9
A_8u_\R,
|B3X@y
,V30r`
.|X&D4
dlGFix:
$C[OTS
vOBkC
VpCSEX'
@i &/*
kt!V)?
!{zRx)
4MskCKD
BO^fh
xNa='=*G
?jQDI/
Ric#*`
hVptbp
2@4j@)
x!W,t7
stg<0t2
jl5o_k
M#tF)x
/A34W`
Pn}Tut]!4
h`x!hx
?VdLz"
aa!_*j
SRR$XsC7
rug!W'r%W
W![XX
(,048@
L.SA;L
h9^8uX
;MXy0)
r!mqcD:
Sm>,Bh
chDA<
{tc@8o
+h qg*V
[NY8Yp2X38DV
D\H,0k
G@'^ov
w_Y,&9
uUPiGQ
|"P<?d
\FtAH$`
PR}G:n
kRLNKeBLp
x#\mSU1
P6>6Ok0
&B)d<4
P3+|LH
>.Ptm|.
/ WH55e
?0VUC+
`FLQ \K
&tP(tK$tF7777#tA!t<"t7Cu
L`)R=n
0]S%vhR
0g@3^s
@ul9~}f
kz=Q%*
%$E^N@
XP!=L^m
TtiLiH
QYHLQK
U,(/'$
i1 dC$I_R
[k)pS?
tmt}<
]X?g#u
ht1+\wdkI
`)4j!Y
29|3-H|
j,69m9s^
OJY/Na
t$PV;mZN
vC{VW_8
,1u&PY
Vj0^|^
e&1r$K,
)<R:Dy~
UiT220
(?<:9PVA
EcJAJj
1V*"AR
g$t-#
xnI*PT
7@|HWP
qhDck1
Qi6lL"U
rv;9`
*Wa/@@c9
"ev(~LDp
O/aS<t&
pIyH`0
j=~jU#.
NjWBjV
)j,^]Y
xit8Wh
EF$xYha
EZ`D#>
[Hr/!h
h{WudP
uSXR%P
e=4XF7
bLL\$h
346dC^;,
}DQW%dM
WKp3-$
q@/\B8
P^^|a^x
N<P9i6w
4 8>k/
k Vhkc
"6E(j$.!
"` z`PL
W=RZT:
[@\.iZ
>-D>D")
Kg~6O~
$cc@.(0
)X)l6D
XvT2R:dC
X;Ik$.jQ
_lRQ{
sAt$kn
b8`[a]!
FH(Jlv
0EVh*9
78_[Ho1
%4cNBo"
WZ A0"
:+|s\n
1yN}+`
]8[9Q]
'=pscat
YARGtD= BGR
>|h_UPG;
-=knilt
=rtnmto
u/QQz"
d'h O+B_
@uj^tu
=tcR/N
aHhkoW.
O8 n<B
2`pt8FO
TADIut
ETLPuFS
A.DNH3D
GKbG6,MRHc/r
KPCCi)
AEMI/@
C/k,\J
/ioQqu<\/
FEus3_
v\:UJw
AK ofkW
#J}&M_
:ww ?u
@16:d<V
`02D.6
[10^"q
RQP;"F
t&P{Lt
jt$Q DM
4CSGhP
"V0_V23X
FR `Ii
\XpQ~J
#@,:8)_
cWMo8ic_
a4pP_t*`@
iuS(|>;
'DW3 C
j-N !\C0y
GAfBj)
P,^w/,K
8FpSP,\t
|z;^uW
/Mb~D
SRO3]>
AlRoad@{@W
Zh$WQz
`<%P_T
P!x]B
#VjKy:
E&:*CmP
Ku:bR)
@g^+oBP#
ja_@4\
J@D]@D}O
t B$:]
tL9~HvG,C
lN$<*z
ET9~$u
b40F@
evkH`te
tkG_i j0^
< o5\0
*0&&he
8tfL@Hd/
& tLhP}
I @8t}
P}q,Xp
R^(T<
sKQU'h
eQC`hP
5phd0s
E3,WuA
L0b@Q ,
&]Na[p
c`^CwP
D}%}I2
-db}bur!@
NM(1"L
]!|~jW
DigDAu
pxMn^
JB3THe
@\oW\9
aji+j6
a|d[6!
yXY7_/(dL*Np
96`TAf
$]8tY0uT
nOS}fi
ZSCU#<B
2(=SP'
LTwRIa
[6mlwR/
t-T<%/
lTp%P%
aG$-@)
=X&SByIw
MNN5ih
u%:,<&
EC2E'C
NS4rqP#
;i7ml%
DEP<DJ
s$V9FnI
ue/bGKa
;IM$f"u
73 x!`
ip0xT8
g.M)l'
2?6R#S
K;Y#@8
5)Xe@t
^:]H!T0"{
K26Ep^4&
v;\T!e
&$A)&'A(
nh}8!<4
HtHHuzH
MVLONM:
R/#W^G
CtEWz/
mtae]cS
+I~/U,H
V9xPu4
PEc?IC
[D;LMHS
I;-!bu
_^V1db
B*ODpdV
^G.X'Z
fCHO0z(d
+l^W8p
o2l00%Z
E@]9B uX
|_Y(&V
tq,DiD(i#0aaS
h7Qln7
Nd\=AH
?N8/tF
uRK$DVQ;
DPVBXx
Vg^SaPT
w<>[-pK
P9Qp8HG
joRVl|
R?R/rq
7;0mshL
p({>97(
E,_m%BH
5&B9j(
*7C_ ,
4PUjSl
m @814
s1g~lm
4>\W8x
fh%F|Y
yImU<I
(46`eh
O-`{XRlf !
;w8rVJf
TB( {c
{@Mulv
$}$WmL<
^:_DTW<
p+"#y=
BP<*x+
P3V-,1
Vq ^\T
Pi:>WG
/l^q|,A
kAm^tj+
0K0=,o
X@tfmP
EY(VB'
xF(aFv+
~#'q94
l1PRZ
Io<C.8
pr5m;7
~*K.HF
ltfNpt5
Ct&f$-
;Rr}FA
&@j@$G
7U$qwe
oC8P1*4
{xx"&n
$vJtZ
x?tCDHP
4DoB8"
Jht^;M
p|"c%5
v$q}x_
TH"v:u
T+3x%A
BXO&N%AO
ZaQ,(1
4R#h0/H
<`4]h/_G
N2VG0%
6TZQjC
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.GameHack.4!c
Elastic malicious (high confidence)
ClamAV Win.Dropper.Tiggre-9845940-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Injector.vh
ALYac Gen:Variant.Lazy.534854
Cylance Unsafe
Zillya Tool.GameHack.Win64.2135
Sangfor Trojan.Win32.Save.BlackMoon
CrowdStrike win/malicious_confidence_90% (W)
Alibaba HackTool:Win64/Krypt.f32aa432
K7GW Trojan ( 0058ef5b1 )
K7AntiVirus Trojan ( 0058ef5b1 )
huorong Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win64/HackTool.GameHack.Q
APEX Clean
Avast Win32:Malware-gen
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Gen:Variant.Lazy.534854
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Lazy.534854
Tencent Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Gen:Variant.Lazy.534854
TrendMicro Clean
McAfeeD ti!538657E0E69A
Trapmine Clean
CTX exe.trojan.generic
Emsisoft Gen:Variant.Lazy.534854 (B)
Ikarus Trojan.Win64.Krypt
FireEye Generic.mg.3f766be1002f79ce
Jiangmin Clean
Webroot W32.Malware.Gen
Varist W64/GameHack.EW.gen!Eldorado
Avira Clean
Fortinet W64/GameHack.Q!tr
Antiy-AVL Trojan/Win32.Blamon.a
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Trojan.Win64.CoinMiner.sa
Xcitium Malware@#24lfgohzz5hbf
Arcabit Trojan.Lazy.D82946
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Clean
Google Detected
AhnLab-V3 Malware/Win.Generic.R663016
Acronis Clean
McAfee Artemis!3F766BE1002F
TACHYON Clean
VBA32 Clean
Malwarebytes Generic.Malware.AI.DDS
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0DEN24
Rising Malware.Undefined!8.C (TFE:5:QntIFX5CFiG)
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.121218.susgen
GData Gen:Variant.Lazy.534854
AVG Win32:Malware-gen
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.