!This program cannot be run in DOS mode.
h.rdata
H.data
.pdata
h.reloc
STeI<x
\G1e Y!\%
9oZh~g]
H!D$@E3
!V)G\@
4rFJ/_$
W*`^pK
l ED_x
a&mGW?tz'
>'_Nn4
,eQ711
fffffff
xxx????xxx????x
NtCreateThreadEx
NtProtectVirtualMemory
/T'H@~
c*69rS
$AtU (
dSO0t?
;},]Y!
wpf&vh
AD+1Xd
CE3L0J#f=
L8xsI|=
xV'kQ+'
QKxRf0L"
1!)D.O
K ^pBO
*E},}v
=Db)1>"
#5w_,"S
|sW;B:
Q-:<X$Z
d1\NCT
~K6<>$
C0~3>P
Hhu.BW
T)HaS4
^%XN^;FI
yy}hs*
Yk"Zfp
Cr&&k4
m!M`zcb
;vhLae
..8aso
|fy1#i
Gn'aeJ
j.hq h0
"YeD_8
iSw4TKEY
Y#H$Ak
,6tVo[
mr/QFC
s|fA!2
yzu7"*N,
(w>rfV
dke`0@
Eho%:d
=P+F`"
\FB."a!
Jg.xkND^m
w^#*a=
N.Q6LN`w
<A@!S
+4LF}Q
!vEUMM
eo^O8F
WTjvd=
4lZ]Y/
Eb|rBQ
|z*0o
00(@ j
?.NlF]
#K<6M@
ip87/WZ?8c
KU Ev*
\Ve0r6
7eT3?6
#qs_M;0
Yj~/p}
+G%"h`
hBel>,
pal t({
>\:"vG
)-R%Q.
@1!GpH1
?E'o#*%
XZb"\s
hmsGp;
\T3!&_U=:O
v(ebEV
HC/.Nm?
L)]48,
_^Lw!r
&& )Aa
u9Fg2i
;#Y!~Lx
$=M }w
j6QA#/1
U,[l][Z
j6QA#/1
j6QA#/1
z_Q6H!
fubywo]m
WG<v'a
%LhW M_
P_08xc
"Er=0#
<Qi*#}
[#AH6\
D(cah4
w3Zw0%
3bf)_a
n pqk(a
.V,Xib1
<EWHxD\M
{wu$iy
l+{6N1h
|t$e#k
&E>foA
L'rs#gl
bh,2>XY7)RXR
BNh4#5
=Z(#NdNR
:2HTKF
7]7p3~
*}LrF
C{g[=f
R'X'Eu
C'[ a-
(teAV1
K }7iq
_M_$)Hv
JFw}@Q
vOZCs~
Z#=/"jm}
-znBA*
Cn^uMh'
OWI|!|
xDC@^"
qx"bRT
zc^vf5
H{|5(Ol
xbjZ$5{
fT- #l
J{w*4f
c8F5Gm
gK%6$
O*K^;l`
v miOA
@/PU>hJ
`pV4D7
&AypGZ
XkFhB-
q~SQ>]\~
'~Ry,z
;pz/uM
n]jcht{
@+F,-{
M8J}bSg
at )7\
oghkN>z{
#AtiV+o
o+T7 :Q
GmI`o"1
<4~9wE
}O%KUc
{ tKg}
k;=,a"
p_[4'x
*WhQ%\
&Nlp9a
%gu#A2z
[+D {i
S6K)G)
pRg{nDy
f]4m>O
f5nJ-Y
2|d.zk
K.xHd&p
9n`!duK-
}x,B!u
!spAN/gW
1Wc2@7lC9BL
h"n>~E
yd9#/k;y32?
;gwPh~
'd|z:T
c;px+v
sS3w15
H(_c7 T.
PV!}`rO
~3ca<P
g"h{K
'C(P66
|=i~K ^
%E[.[x~
$SzIu
5[$CS}
:'J@>7
s?KN-8
+eC]D
[03VIv6=)}3
ck^Py!
j=RVp|
zFCKr
9!0A7g
e}UAU>{
~,& X}EZ
}Q9{`:b
r'B,iv
a>t^1u
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptDestroyKey
cng.sys
RtlInitUnicodeString
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmAllocatePagesForMdlEx
PsCreateSystemThread
ObReferenceObjectByHandle
ObReferenceObjectByHandleWithTag
ObCloseHandle
ObfDereferenceObject
ZwCreateFile
ZwReadFile
ZwWriteFile
ZwClose
MmIsAddressValid
IoCreateFileEx
MmFlushImageSection
ZwDeleteFile
IoFileObjectType
RtlGetVersion
ZwQueryInformationFile
MmGetVirtualForPhysical
KeBugCheckEx
ntoskrnl.exe
Hcy<fA
A^A]fD
CMqYfA
pA]A\_
6VWAVH
L+M0D:
D$ FILE
S;AVAWf
WATAU@:
H!D$@E+
Washington1
Redmond1
Microsoft Corporation1)0'
Microsoft Code Verification Root0
110222192517Z
210222193517Z0
VeriSign, Inc.1 0
VeriSign Trust Network1:08
1(c) 2006 VeriSign, Inc. - For authorized use only1E0C
<VeriSign Class 3 Public Primary Certification Authority - G50
Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
,N<jPl
3BH8Q:|8
VeriSign, Inc.1 0
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA0
120717000000Z
130717235959Z0
Beijing1
Beijing1A0?
8BEIJING XINDA HUANYU NETWORK SECURITY TECHNOLOGY CO.,LTD1>0<
5Digital ID Class 3 - Microsoft Software Validation v21A0?
8BEIJING XINDA HUANYU NETWORK SECURITY TECHNOLOGY CO.,LTD0
$2<5F~
/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
https://www.verisign.com/rpa0
http://ocsp.verisign.com0;
/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
VeriSign, Inc.1 0
VeriSign Trust Network1:08
1(c) 2006 VeriSign, Inc. - For authorized use only1E0C
<VeriSign Class 3 Public Primary Certification Authority - G50
100208000000Z
200207235959Z0
VeriSign, Inc.1 0
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA0
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
[0Y0W0U
image/gif0!0 0
#http://logo.verisign.com/vslogo.gif04
#http://crl.verisign.com/pca3-g5.crl04
http://ocsp.verisign.com0
VeriSignMPKI-2-80
VeriSign, Inc.1 0
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA
ZwQuerySystemInformation
RtlImageNtHeader
RtlImageDirectoryEntryToData
Microsoft Primitive Provider
ChainingModeECB
ChainingMode
\SystemRoot\System32\GSDrv.bin
\SystemRoot\System32\ntdll.dll
NtOpenFile