ScreenShot
| Created | 2021.06.24 23:53 | Machine | s1_win7_x6401 |
| Filename | Lady.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | c1e123df8403bf9087cce44956d6801c | ||
| sha256 | 43b3fa1a455eedfc3a6084046a958b6a41074b92d94ecb5a0262911eab570f86 | ||
| ssdeep | 12288:l9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h8gbgk:vZ1xuVVjfFoynPaVBUR8f+kN10EB1 | ||
| imphash | e5b4359a3773764a372173074ae9b6bd | ||
| impfuzzy | 192:oV3sCbuuoTSUvK9v+ovXE2co7dLtF9Rwuxm1ekHqdYtNBgIPOQgva9MU3i9++:43Jo49NtBcu41eklNBgIPOQr1I++ | ||
Network IP location
Signature (24cnts)
| Level | Description |
|---|---|
| danger | Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | Executed a process and injected code into it |
| warning | Generates some ICMP traffic |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates a windows hook that monitors keyboard input (keylogger) |
| watch | Creates known Fynloski/DarkComet files |
| watch | Creates known Jorik Trojan Files |
| watch | Deletes executed files from disk |
| watch | Installs itself for autorun at Windows startup |
| watch | Potential code injection by writing to the memory of another process |
| notice | A process attempted to delay the analysis task. |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Checks whether any human activity is being performed by constantly checking whether the foreground window changed |
| notice | Creates a suspicious process |
| notice | Drops an executable to the user AppData folder |
| notice | Terminates another process |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (8cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (download) |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (upload) |
PE API
IAT(Import Address Table) Library
oleaut32.dll
0x49dca4 SysFreeString
0x49dca8 SysReAllocStringLen
0x49dcac SysAllocStringLen
advapi32.dll
0x49dcb4 RegQueryValueExA
0x49dcb8 RegOpenKeyExA
0x49dcbc RegCloseKey
user32.dll
0x49dcc4 GetKeyboardType
0x49dcc8 DestroyWindow
0x49dccc LoadStringA
0x49dcd0 MessageBoxA
0x49dcd4 CharNextA
kernel32.dll
0x49dcdc GetACP
0x49dce0 Sleep
0x49dce4 VirtualFree
0x49dce8 VirtualAlloc
0x49dcec GetTickCount
0x49dcf0 QueryPerformanceCounter
0x49dcf4 GetCurrentThreadId
0x49dcf8 InterlockedDecrement
0x49dcfc InterlockedIncrement
0x49dd00 VirtualQuery
0x49dd04 WideCharToMultiByte
0x49dd08 MultiByteToWideChar
0x49dd0c lstrlenA
0x49dd10 lstrcpynA
0x49dd14 LoadLibraryExA
0x49dd18 GetThreadLocale
0x49dd1c GetStartupInfoA
0x49dd20 GetProcAddress
0x49dd24 GetModuleHandleA
0x49dd28 GetModuleFileNameA
0x49dd2c GetLocaleInfoA
0x49dd30 GetLastError
0x49dd34 GetCommandLineA
0x49dd38 FreeLibrary
0x49dd3c FindFirstFileA
0x49dd40 FindClose
0x49dd44 ExitProcess
0x49dd48 ExitThread
0x49dd4c CreateThread
0x49dd50 CompareStringA
0x49dd54 WriteFile
0x49dd58 UnhandledExceptionFilter
0x49dd5c SetFilePointer
0x49dd60 SetEndOfFile
0x49dd64 RtlUnwind
0x49dd68 ReadFile
0x49dd6c RaiseException
0x49dd70 GetStdHandle
0x49dd74 GetFileSize
0x49dd78 GetFileType
0x49dd7c CreateFileA
0x49dd80 CloseHandle
kernel32.dll
0x49dd88 TlsSetValue
0x49dd8c TlsGetValue
0x49dd90 LocalAlloc
0x49dd94 GetModuleHandleA
user32.dll
0x49dd9c CreateWindowExA
0x49dda0 mouse_event
0x49dda4 keybd_event
0x49dda8 WindowFromPoint
0x49ddac WaitMessage
0x49ddb0 VkKeyScanA
0x49ddb4 UpdateWindow
0x49ddb8 UnregisterClassA
0x49ddbc UnhookWindowsHookEx
0x49ddc0 TranslateMessage
0x49ddc4 TranslateMDISysAccel
0x49ddc8 TrackPopupMenu
0x49ddcc ToAscii
0x49ddd0 SystemParametersInfoA
0x49ddd4 ShowWindow
0x49ddd8 ShowScrollBar
0x49dddc ShowOwnedPopups
0x49dde0 SetWindowsHookExA
0x49dde4 SetWindowTextA
0x49dde8 SetWindowPos
0x49ddec SetWindowPlacement
0x49ddf0 SetWindowLongW
0x49ddf4 SetWindowLongA
0x49ddf8 SetTimer
0x49ddfc SetScrollRange
0x49de00 SetScrollPos
0x49de04 SetScrollInfo
0x49de08 SetRect
0x49de0c SetPropA
0x49de10 SetParent
0x49de14 SetMenuItemInfoA
0x49de18 SetMenu
0x49de1c SetForegroundWindow
0x49de20 SetFocus
0x49de24 SetCursorPos
0x49de28 SetCursor
0x49de2c SetClipboardData
0x49de30 SetClassLongA
0x49de34 SetCapture
0x49de38 SetActiveWindow
0x49de3c SendMessageW
0x49de40 SendMessageA
0x49de44 ScrollWindow
0x49de48 ScreenToClient
0x49de4c RemovePropA
0x49de50 RemoveMenu
0x49de54 ReleaseDC
0x49de58 ReleaseCapture
0x49de5c RegisterWindowMessageA
0x49de60 RegisterClipboardFormatA
0x49de64 RegisterClassA
0x49de68 RedrawWindow
0x49de6c PtInRect
0x49de70 PostQuitMessage
0x49de74 PostMessageA
0x49de78 PeekMessageW
0x49de7c PeekMessageA
0x49de80 OpenClipboard
0x49de84 OffsetRect
0x49de88 OemToCharA
0x49de8c MsgWaitForMultipleObjectsEx
0x49de90 MsgWaitForMultipleObjects
0x49de94 MessageBoxA
0x49de98 MapWindowPoints
0x49de9c MapVirtualKeyA
0x49dea0 LockWorkStation
0x49dea4 LoadStringA
0x49dea8 LoadKeyboardLayoutA
0x49deac LoadIconA
0x49deb0 LoadCursorA
0x49deb4 LoadBitmapA
0x49deb8 KillTimer
0x49debc IsZoomed
0x49dec0 IsWindowVisible
0x49dec4 IsWindowUnicode
0x49dec8 IsWindowEnabled
0x49decc IsWindow
0x49ded0 IsRectEmpty
0x49ded4 IsIconic
0x49ded8 IsDialogMessageW
0x49dedc IsDialogMessageA
0x49dee0 IsClipboardFormatAvailable
0x49dee4 IsChild
0x49dee8 InvalidateRect
0x49deec IntersectRect
0x49def0 InsertMenuItemA
0x49def4 InsertMenuA
0x49def8 InflateRect
0x49defc GetWindowThreadProcessId
0x49df00 GetWindowTextLengthA
0x49df04 GetWindowTextA
0x49df08 GetWindowRect
0x49df0c GetWindowPlacement
0x49df10 GetWindowLongW
0x49df14 GetWindowLongA
0x49df18 GetWindowDC
0x49df1c GetTopWindow
0x49df20 GetSystemMetrics
0x49df24 GetSystemMenu
0x49df28 GetSysColorBrush
0x49df2c GetSysColor
0x49df30 GetSubMenu
0x49df34 GetScrollRange
0x49df38 GetScrollPos
0x49df3c GetScrollInfo
0x49df40 GetPropA
0x49df44 GetParent
0x49df48 GetWindow
0x49df4c GetMessagePos
0x49df50 GetMessageA
0x49df54 GetMenuStringA
0x49df58 GetMenuState
0x49df5c GetMenuItemInfoA
0x49df60 GetMenuItemID
0x49df64 GetMenuItemCount
0x49df68 GetMenu
0x49df6c GetLastInputInfo
0x49df70 GetLastActivePopup
0x49df74 GetKeyboardState
0x49df78 GetKeyboardLayoutNameA
0x49df7c GetKeyboardLayoutList
0x49df80 GetKeyboardLayout
0x49df84 GetKeyState
0x49df88 GetKeyNameTextA
0x49df8c GetIconInfo
0x49df90 GetForegroundWindow
0x49df94 GetFocus
0x49df98 GetDesktopWindow
0x49df9c GetDCEx
0x49dfa0 GetDC
0x49dfa4 GetCursorPos
0x49dfa8 GetCursor
0x49dfac GetClipboardData
0x49dfb0 GetClientRect
0x49dfb4 GetClassNameA
0x49dfb8 GetClassLongA
0x49dfbc GetClassInfoA
0x49dfc0 GetCapture
0x49dfc4 GetActiveWindow
0x49dfc8 FrameRect
0x49dfcc FindWindowExA
0x49dfd0 FindWindowA
0x49dfd4 FillRect
0x49dfd8 ExitWindowsEx
0x49dfdc EqualRect
0x49dfe0 EnumWindows
0x49dfe4 EnumThreadWindows
0x49dfe8 EnumDisplayDevicesA
0x49dfec EnumClipboardFormats
0x49dff0 EnumChildWindows
0x49dff4 EndPaint
0x49dff8 EnableWindow
0x49dffc EnableScrollBar
0x49e000 EnableMenuItem
0x49e004 EmptyClipboard
0x49e008 DrawTextA
0x49e00c DrawMenuBar
0x49e010 DrawIconEx
0x49e014 DrawIcon
0x49e018 DrawFrameControl
0x49e01c DrawEdge
0x49e020 DispatchMessageW
0x49e024 DispatchMessageA
0x49e028 DestroyWindow
0x49e02c DestroyMenu
0x49e030 DestroyIcon
0x49e034 DestroyCursor
0x49e038 DeleteMenu
0x49e03c DefWindowProcA
0x49e040 DefMDIChildProcA
0x49e044 DefFrameProcA
0x49e048 CreatePopupMenu
0x49e04c CreateMenu
0x49e050 CreateIcon
0x49e054 CloseClipboard
0x49e058 ClientToScreen
0x49e05c CheckMenuItem
0x49e060 CallWindowProcA
0x49e064 CallNextHookEx
0x49e068 BeginPaint
0x49e06c CharNextA
0x49e070 CharLowerBuffA
0x49e074 CharLowerA
0x49e078 CharUpperBuffA
0x49e07c CharToOemA
0x49e080 AdjustWindowRectEx
0x49e084 ActivateKeyboardLayout
gdi32.dll
0x49e08c UnrealizeObject
0x49e090 StretchBlt
0x49e094 SetWindowOrgEx
0x49e098 SetWinMetaFileBits
0x49e09c SetViewportOrgEx
0x49e0a0 SetTextColor
0x49e0a4 SetStretchBltMode
0x49e0a8 SetROP2
0x49e0ac SetPixel
0x49e0b0 SetEnhMetaFileBits
0x49e0b4 SetDIBColorTable
0x49e0b8 SetBrushOrgEx
0x49e0bc SetBkMode
0x49e0c0 SetBkColor
0x49e0c4 SelectPalette
0x49e0c8 SelectObject
0x49e0cc SaveDC
0x49e0d0 RestoreDC
0x49e0d4 RectVisible
0x49e0d8 RealizePalette
0x49e0dc PlayEnhMetaFile
0x49e0e0 PatBlt
0x49e0e4 MoveToEx
0x49e0e8 MaskBlt
0x49e0ec LineTo
0x49e0f0 IntersectClipRect
0x49e0f4 GetWindowOrgEx
0x49e0f8 GetWinMetaFileBits
0x49e0fc GetTextMetricsA
0x49e100 GetTextExtentPoint32A
0x49e104 GetSystemPaletteEntries
0x49e108 GetStockObject
0x49e10c GetRgnBox
0x49e110 GetPixel
0x49e114 GetPaletteEntries
0x49e118 GetObjectA
0x49e11c GetEnhMetaFilePaletteEntries
0x49e120 GetEnhMetaFileHeader
0x49e124 GetEnhMetaFileBits
0x49e128 GetDeviceCaps
0x49e12c GetDIBits
0x49e130 GetDIBColorTable
0x49e134 GetDCOrgEx
0x49e138 GetCurrentPositionEx
0x49e13c GetClipBox
0x49e140 GetBrushOrgEx
0x49e144 GetBitmapBits
0x49e148 GdiFlush
0x49e14c ExtTextOutA
0x49e150 ExcludeClipRect
0x49e154 DeleteObject
0x49e158 DeleteEnhMetaFile
0x49e15c DeleteDC
0x49e160 CreateSolidBrush
0x49e164 CreatePenIndirect
0x49e168 CreatePalette
0x49e16c CreateHalftonePalette
0x49e170 CreateFontIndirectA
0x49e174 CreateDIBitmap
0x49e178 CreateDIBSection
0x49e17c CreateDCA
0x49e180 CreateCompatibleDC
0x49e184 CreateCompatibleBitmap
0x49e188 CreateBrushIndirect
0x49e18c CreateBitmap
0x49e190 CopyEnhMetaFileA
0x49e194 BitBlt
version.dll
0x49e19c VerQueryValueA
0x49e1a0 GetFileVersionInfoSizeA
0x49e1a4 GetFileVersionInfoA
kernel32.dll
0x49e1ac lstrcpyA
0x49e1b0 WriteProcessMemory
0x49e1b4 WriteFile
0x49e1b8 WinExec
0x49e1bc WaitForSingleObject
0x49e1c0 WaitForMultipleObjectsEx
0x49e1c4 VirtualQuery
0x49e1c8 VirtualProtectEx
0x49e1cc VirtualProtect
0x49e1d0 VirtualFreeEx
0x49e1d4 VirtualFree
0x49e1d8 VirtualAllocEx
0x49e1dc VirtualAlloc
0x49e1e0 VerLanguageNameA
0x49e1e4 UnmapViewOfFile
0x49e1e8 TerminateProcess
0x49e1ec Sleep
0x49e1f0 SizeofResource
0x49e1f4 SetThreadPriority
0x49e1f8 SetThreadLocale
0x49e1fc SetThreadContext
0x49e200 SetLastError
0x49e204 SetFileTime
0x49e208 SetFilePointer
0x49e20c SetFileAttributesA
0x49e210 SetEvent
0x49e214 SetErrorMode
0x49e218 SetEndOfFile
0x49e21c ResumeThread
0x49e220 ResetEvent
0x49e224 ReadProcessMemory
0x49e228 ReadFile
0x49e22c PeekNamedPipe
0x49e230 OpenProcess
0x49e234 MultiByteToWideChar
0x49e238 MulDiv
0x49e23c MoveFileA
0x49e240 MapViewOfFile
0x49e244 LockResource
0x49e248 LocalFileTimeToFileTime
0x49e24c LocalAlloc
0x49e250 LoadResource
0x49e254 LoadLibraryA
0x49e258 LeaveCriticalSection
0x49e25c IsBadReadPtr
0x49e260 InitializeCriticalSection
0x49e264 HeapFree
0x49e268 HeapAlloc
0x49e26c GlobalUnlock
0x49e270 GlobalMemoryStatus
0x49e274 GlobalLock
0x49e278 GlobalFree
0x49e27c GlobalFindAtomA
0x49e280 GlobalDeleteAtom
0x49e284 GlobalAlloc
0x49e288 GlobalAddAtomA
0x49e28c GetWindowsDirectoryA
0x49e290 GetVolumeInformationA
0x49e294 GetVersionExA
0x49e298 GetVersion
0x49e29c GetUserDefaultLangID
0x49e2a0 GetTickCount
0x49e2a4 GetThreadLocale
0x49e2a8 GetThreadContext
0x49e2ac GetTempPathA
0x49e2b0 GetSystemPowerStatus
0x49e2b4 GetSystemDirectoryA
0x49e2b8 GetStdHandle
0x49e2bc GetProcessHeap
0x49e2c0 GetProcAddress
0x49e2c4 GetModuleHandleA
0x49e2c8 GetModuleFileNameA
0x49e2cc GetLocaleInfoA
0x49e2d0 GetLocalTime
0x49e2d4 GetLastError
0x49e2d8 GetFullPathNameA
0x49e2dc GetFileTime
0x49e2e0 GetFileSize
0x49e2e4 GetFileAttributesA
0x49e2e8 GetExitCodeThread
0x49e2ec GetExitCodeProcess
0x49e2f0 GetEnvironmentVariableA
0x49e2f4 GetDriveTypeA
0x49e2f8 GetDiskFreeSpaceA
0x49e2fc GetDateFormatA
0x49e300 GetCurrentThreadId
0x49e304 GetCurrentThread
0x49e308 GetCurrentProcessId
0x49e30c GetCurrentProcess
0x49e310 GetComputerNameA
0x49e314 GetCPInfo
0x49e318 FreeResource
0x49e31c InterlockedIncrement
0x49e320 InterlockedExchange
0x49e324 InterlockedDecrement
0x49e328 FreeLibrary
0x49e32c FormatMessageA
0x49e330 FindResourceA
0x49e334 FindNextFileA
0x49e338 FindFirstFileA
0x49e33c FindClose
0x49e340 FileTimeToSystemTime
0x49e344 FileTimeToLocalFileTime
0x49e348 FileTimeToDosDateTime
0x49e34c ExitThread
0x49e350 ExitProcess
0x49e354 EnumResourceNamesA
0x49e358 EnumCalendarInfoA
0x49e35c EnterCriticalSection
0x49e360 DosDateTimeToFileTime
0x49e364 DeleteFileA
0x49e368 DeleteCriticalSection
0x49e36c CreateThread
0x49e370 CreateRemoteThread
0x49e374 CreateProcessA
0x49e378 CreatePipe
0x49e37c CreateMutexA
0x49e380 CreateFileMappingA
0x49e384 CreateFileA
0x49e388 CreateEventA
0x49e38c CreateDirectoryA
0x49e390 CopyFileA
0x49e394 CompareStringA
0x49e398 CloseHandle
0x49e39c Beep
advapi32.dll
0x49e3a4 RegSetValueExA
0x49e3a8 RegQueryValueExA
0x49e3ac RegQueryInfoKeyA
0x49e3b0 RegOpenKeyExA
0x49e3b4 RegOpenKeyA
0x49e3b8 RegFlushKey
0x49e3bc RegEnumValueA
0x49e3c0 RegEnumKeyExA
0x49e3c4 RegDeleteValueA
0x49e3c8 RegDeleteKeyA
0x49e3cc RegCreateKeyExA
0x49e3d0 RegCreateKeyA
0x49e3d4 RegCloseKey
0x49e3d8 OpenThreadToken
0x49e3dc OpenProcessToken
0x49e3e0 LookupPrivilegeValueA
0x49e3e4 LookupPrivilegeNameA
0x49e3e8 LookupPrivilegeDisplayNameA
0x49e3ec LookupAccountSidA
0x49e3f0 IsValidSid
0x49e3f4 GetUserNameA
0x49e3f8 GetTokenInformation
0x49e3fc GetSidSubAuthorityCount
0x49e400 GetSidSubAuthority
0x49e404 GetSidIdentifierAuthority
0x49e408 GetCurrentHwProfileA
0x49e40c AdjustTokenPrivileges
wsock32.dll
0x49e414 __WSAFDIsSet
0x49e418 WSACleanup
0x49e41c WSAStartup
0x49e420 WSAGetLastError
0x49e424 gethostname
0x49e428 getservbyname
0x49e42c gethostbyname
0x49e430 gethostbyaddr
0x49e434 socket
0x49e438 shutdown
0x49e43c sendto
0x49e440 send
0x49e444 select
0x49e448 recv
0x49e44c ntohs
0x49e450 listen
0x49e454 ioctlsocket
0x49e458 inet_ntoa
0x49e45c inet_addr
0x49e460 htons
0x49e464 getsockname
0x49e468 connect
0x49e46c closesocket
0x49e470 ind
0x49e474 accept
kernel32.dll
0x49e47c Sleep
ole32.dll
0x49e484 CoTaskMemFree
0x49e488 StringFromCLSID
shell32.dll
0x49e490 ShellExecuteExA
0x49e494 ShellExecuteA
0x49e498 SHGetFileInfoA
0x49e49c SHFileOperationA
0x49e4a0 DragQueryFileA
oleaut32.dll
0x49e4a8 GetErrorInfo
0x49e4ac GetActiveObject
0x49e4b0 SysFreeString
ole32.dll
0x49e4b8 CoTaskMemFree
0x49e4bc CLSIDFromProgID
0x49e4c0 ProgIDFromCLSID
0x49e4c4 StringFromCLSID
0x49e4c8 CoCreateInstance
0x49e4cc CoUninitialize
0x49e4d0 CoInitialize
0x49e4d4 IsEqualGUID
URLMON.DLL
0x49e4dc URLDownloadToFileA
oleaut32.dll
0x49e4e4 SafeArrayPtrOfIndex
0x49e4e8 SafeArrayGetUBound
0x49e4ec SafeArrayGetLBound
0x49e4f0 SafeArrayCreate
0x49e4f4 VariantChangeType
0x49e4f8 VariantCopy
0x49e4fc VariantClear
0x49e500 VariantInit
comctl32.dll
0x49e508 _TrackMouseEvent
0x49e50c ImageList_SetIconSize
0x49e510 ImageList_GetIconSize
0x49e514 ImageList_Write
0x49e518 ImageList_Read
0x49e51c ImageList_DragShowNolock
0x49e520 ImageList_DragMove
0x49e524 ImageList_DragLeave
0x49e528 ImageList_DragEnter
0x49e52c ImageList_EndDrag
0x49e530 ImageList_BeginDrag
0x49e534 ImageList_Remove
0x49e538 ImageList_DrawEx
0x49e53c ImageList_Draw
0x49e540 ImageList_GetBkColor
0x49e544 ImageList_SetBkColor
0x49e548 ImageList_Add
0x49e54c ImageList_GetImageCount
0x49e550 ImageList_Destroy
0x49e554 ImageList_Create
wininet.dll
0x49e55c InternetReadFile
0x49e560 InternetOpenUrlA
0x49e564 InternetOpenA
0x49e568 InternetConnectA
0x49e56c InternetCloseHandle
0x49e570 HttpQueryInfoA
0x49e574 FtpPutFileA
shell32.dll
0x49e57c SHGetSpecialFolderLocation
0x49e580 SHGetPathFromIDListA
winmm.dll
0x49e588 waveInUnprepareHeader
0x49e58c waveInStart
0x49e590 waveInReset
0x49e594 waveInPrepareHeader
0x49e598 waveInOpen
0x49e59c waveInClose
0x49e5a0 waveInAddBuffer
0x49e5a4 PlaySoundA
0x49e5a8 mciSendStringA
netapi32.dll
0x49e5b0 Netbios
gdiplus.dll
0x49e5b8 GdipGetImageEncoders
0x49e5bc GdipGetImageEncodersSize
0x49e5c0 GdipDrawImageRectI
0x49e5c4 GdipSetInterpolationMode
0x49e5c8 GdipDeleteGraphics
0x49e5cc GdipCreateBitmapFromHBITMAP
0x49e5d0 GdipCreateBitmapFromScan0
0x49e5d4 GdipGetImagePixelFormat
0x49e5d8 GdipGetImageGraphicsContext
0x49e5dc GdipSaveImageToStream
0x49e5e0 GdipDisposeImage
0x49e5e4 GdiplusShutdown
0x49e5e8 GdiplusStartup
0x49e5ec GdipFree
0x49e5f0 GdipAlloc
advapi32.dll
0x49e5f8 StartServiceA
0x49e5fc QueryServiceStatus
0x49e600 OpenServiceA
0x49e604 OpenSCManagerA
0x49e608 EnumServicesStatusA
0x49e60c DeleteService
0x49e610 CreateServiceA
0x49e614 ControlService
0x49e618 CloseServiceHandle
msacm32.dll
0x49e620 acmStreamUnprepareHeader
0x49e624 acmStreamPrepareHeader
0x49e628 acmStreamConvert
0x49e62c acmStreamReset
0x49e630 acmStreamSize
0x49e634 acmStreamClose
0x49e638 acmStreamOpen
ntdll.dll
0x49e640 NtQuerySystemInformation
netapi32.dll
0x49e648 NetApiBufferFree
0x49e64c NetShareGetInfo
0x49e650 NetShareEnum
WS2_32.DLL
0x49e658 WSAIoctl
SHFolder.dll
0x49e660 SHGetFolderPathA
ntdll
0x49e668 NtUnmapViewOfSection
user32.dll
0x49e670 EnumDisplayMonitors
0x49e674 GetMonitorInfoA
SHELL32.DLL
0x49e67c SHEmptyRecycleBinA
AVICAP32.DLL
0x49e684 capGetDriverDescriptionA
EAT(Export Address Table) is none
oleaut32.dll
0x49dca4 SysFreeString
0x49dca8 SysReAllocStringLen
0x49dcac SysAllocStringLen
advapi32.dll
0x49dcb4 RegQueryValueExA
0x49dcb8 RegOpenKeyExA
0x49dcbc RegCloseKey
user32.dll
0x49dcc4 GetKeyboardType
0x49dcc8 DestroyWindow
0x49dccc LoadStringA
0x49dcd0 MessageBoxA
0x49dcd4 CharNextA
kernel32.dll
0x49dcdc GetACP
0x49dce0 Sleep
0x49dce4 VirtualFree
0x49dce8 VirtualAlloc
0x49dcec GetTickCount
0x49dcf0 QueryPerformanceCounter
0x49dcf4 GetCurrentThreadId
0x49dcf8 InterlockedDecrement
0x49dcfc InterlockedIncrement
0x49dd00 VirtualQuery
0x49dd04 WideCharToMultiByte
0x49dd08 MultiByteToWideChar
0x49dd0c lstrlenA
0x49dd10 lstrcpynA
0x49dd14 LoadLibraryExA
0x49dd18 GetThreadLocale
0x49dd1c GetStartupInfoA
0x49dd20 GetProcAddress
0x49dd24 GetModuleHandleA
0x49dd28 GetModuleFileNameA
0x49dd2c GetLocaleInfoA
0x49dd30 GetLastError
0x49dd34 GetCommandLineA
0x49dd38 FreeLibrary
0x49dd3c FindFirstFileA
0x49dd40 FindClose
0x49dd44 ExitProcess
0x49dd48 ExitThread
0x49dd4c CreateThread
0x49dd50 CompareStringA
0x49dd54 WriteFile
0x49dd58 UnhandledExceptionFilter
0x49dd5c SetFilePointer
0x49dd60 SetEndOfFile
0x49dd64 RtlUnwind
0x49dd68 ReadFile
0x49dd6c RaiseException
0x49dd70 GetStdHandle
0x49dd74 GetFileSize
0x49dd78 GetFileType
0x49dd7c CreateFileA
0x49dd80 CloseHandle
kernel32.dll
0x49dd88 TlsSetValue
0x49dd8c TlsGetValue
0x49dd90 LocalAlloc
0x49dd94 GetModuleHandleA
user32.dll
0x49dd9c CreateWindowExA
0x49dda0 mouse_event
0x49dda4 keybd_event
0x49dda8 WindowFromPoint
0x49ddac WaitMessage
0x49ddb0 VkKeyScanA
0x49ddb4 UpdateWindow
0x49ddb8 UnregisterClassA
0x49ddbc UnhookWindowsHookEx
0x49ddc0 TranslateMessage
0x49ddc4 TranslateMDISysAccel
0x49ddc8 TrackPopupMenu
0x49ddcc ToAscii
0x49ddd0 SystemParametersInfoA
0x49ddd4 ShowWindow
0x49ddd8 ShowScrollBar
0x49dddc ShowOwnedPopups
0x49dde0 SetWindowsHookExA
0x49dde4 SetWindowTextA
0x49dde8 SetWindowPos
0x49ddec SetWindowPlacement
0x49ddf0 SetWindowLongW
0x49ddf4 SetWindowLongA
0x49ddf8 SetTimer
0x49ddfc SetScrollRange
0x49de00 SetScrollPos
0x49de04 SetScrollInfo
0x49de08 SetRect
0x49de0c SetPropA
0x49de10 SetParent
0x49de14 SetMenuItemInfoA
0x49de18 SetMenu
0x49de1c SetForegroundWindow
0x49de20 SetFocus
0x49de24 SetCursorPos
0x49de28 SetCursor
0x49de2c SetClipboardData
0x49de30 SetClassLongA
0x49de34 SetCapture
0x49de38 SetActiveWindow
0x49de3c SendMessageW
0x49de40 SendMessageA
0x49de44 ScrollWindow
0x49de48 ScreenToClient
0x49de4c RemovePropA
0x49de50 RemoveMenu
0x49de54 ReleaseDC
0x49de58 ReleaseCapture
0x49de5c RegisterWindowMessageA
0x49de60 RegisterClipboardFormatA
0x49de64 RegisterClassA
0x49de68 RedrawWindow
0x49de6c PtInRect
0x49de70 PostQuitMessage
0x49de74 PostMessageA
0x49de78 PeekMessageW
0x49de7c PeekMessageA
0x49de80 OpenClipboard
0x49de84 OffsetRect
0x49de88 OemToCharA
0x49de8c MsgWaitForMultipleObjectsEx
0x49de90 MsgWaitForMultipleObjects
0x49de94 MessageBoxA
0x49de98 MapWindowPoints
0x49de9c MapVirtualKeyA
0x49dea0 LockWorkStation
0x49dea4 LoadStringA
0x49dea8 LoadKeyboardLayoutA
0x49deac LoadIconA
0x49deb0 LoadCursorA
0x49deb4 LoadBitmapA
0x49deb8 KillTimer
0x49debc IsZoomed
0x49dec0 IsWindowVisible
0x49dec4 IsWindowUnicode
0x49dec8 IsWindowEnabled
0x49decc IsWindow
0x49ded0 IsRectEmpty
0x49ded4 IsIconic
0x49ded8 IsDialogMessageW
0x49dedc IsDialogMessageA
0x49dee0 IsClipboardFormatAvailable
0x49dee4 IsChild
0x49dee8 InvalidateRect
0x49deec IntersectRect
0x49def0 InsertMenuItemA
0x49def4 InsertMenuA
0x49def8 InflateRect
0x49defc GetWindowThreadProcessId
0x49df00 GetWindowTextLengthA
0x49df04 GetWindowTextA
0x49df08 GetWindowRect
0x49df0c GetWindowPlacement
0x49df10 GetWindowLongW
0x49df14 GetWindowLongA
0x49df18 GetWindowDC
0x49df1c GetTopWindow
0x49df20 GetSystemMetrics
0x49df24 GetSystemMenu
0x49df28 GetSysColorBrush
0x49df2c GetSysColor
0x49df30 GetSubMenu
0x49df34 GetScrollRange
0x49df38 GetScrollPos
0x49df3c GetScrollInfo
0x49df40 GetPropA
0x49df44 GetParent
0x49df48 GetWindow
0x49df4c GetMessagePos
0x49df50 GetMessageA
0x49df54 GetMenuStringA
0x49df58 GetMenuState
0x49df5c GetMenuItemInfoA
0x49df60 GetMenuItemID
0x49df64 GetMenuItemCount
0x49df68 GetMenu
0x49df6c GetLastInputInfo
0x49df70 GetLastActivePopup
0x49df74 GetKeyboardState
0x49df78 GetKeyboardLayoutNameA
0x49df7c GetKeyboardLayoutList
0x49df80 GetKeyboardLayout
0x49df84 GetKeyState
0x49df88 GetKeyNameTextA
0x49df8c GetIconInfo
0x49df90 GetForegroundWindow
0x49df94 GetFocus
0x49df98 GetDesktopWindow
0x49df9c GetDCEx
0x49dfa0 GetDC
0x49dfa4 GetCursorPos
0x49dfa8 GetCursor
0x49dfac GetClipboardData
0x49dfb0 GetClientRect
0x49dfb4 GetClassNameA
0x49dfb8 GetClassLongA
0x49dfbc GetClassInfoA
0x49dfc0 GetCapture
0x49dfc4 GetActiveWindow
0x49dfc8 FrameRect
0x49dfcc FindWindowExA
0x49dfd0 FindWindowA
0x49dfd4 FillRect
0x49dfd8 ExitWindowsEx
0x49dfdc EqualRect
0x49dfe0 EnumWindows
0x49dfe4 EnumThreadWindows
0x49dfe8 EnumDisplayDevicesA
0x49dfec EnumClipboardFormats
0x49dff0 EnumChildWindows
0x49dff4 EndPaint
0x49dff8 EnableWindow
0x49dffc EnableScrollBar
0x49e000 EnableMenuItem
0x49e004 EmptyClipboard
0x49e008 DrawTextA
0x49e00c DrawMenuBar
0x49e010 DrawIconEx
0x49e014 DrawIcon
0x49e018 DrawFrameControl
0x49e01c DrawEdge
0x49e020 DispatchMessageW
0x49e024 DispatchMessageA
0x49e028 DestroyWindow
0x49e02c DestroyMenu
0x49e030 DestroyIcon
0x49e034 DestroyCursor
0x49e038 DeleteMenu
0x49e03c DefWindowProcA
0x49e040 DefMDIChildProcA
0x49e044 DefFrameProcA
0x49e048 CreatePopupMenu
0x49e04c CreateMenu
0x49e050 CreateIcon
0x49e054 CloseClipboard
0x49e058 ClientToScreen
0x49e05c CheckMenuItem
0x49e060 CallWindowProcA
0x49e064 CallNextHookEx
0x49e068 BeginPaint
0x49e06c CharNextA
0x49e070 CharLowerBuffA
0x49e074 CharLowerA
0x49e078 CharUpperBuffA
0x49e07c CharToOemA
0x49e080 AdjustWindowRectEx
0x49e084 ActivateKeyboardLayout
gdi32.dll
0x49e08c UnrealizeObject
0x49e090 StretchBlt
0x49e094 SetWindowOrgEx
0x49e098 SetWinMetaFileBits
0x49e09c SetViewportOrgEx
0x49e0a0 SetTextColor
0x49e0a4 SetStretchBltMode
0x49e0a8 SetROP2
0x49e0ac SetPixel
0x49e0b0 SetEnhMetaFileBits
0x49e0b4 SetDIBColorTable
0x49e0b8 SetBrushOrgEx
0x49e0bc SetBkMode
0x49e0c0 SetBkColor
0x49e0c4 SelectPalette
0x49e0c8 SelectObject
0x49e0cc SaveDC
0x49e0d0 RestoreDC
0x49e0d4 RectVisible
0x49e0d8 RealizePalette
0x49e0dc PlayEnhMetaFile
0x49e0e0 PatBlt
0x49e0e4 MoveToEx
0x49e0e8 MaskBlt
0x49e0ec LineTo
0x49e0f0 IntersectClipRect
0x49e0f4 GetWindowOrgEx
0x49e0f8 GetWinMetaFileBits
0x49e0fc GetTextMetricsA
0x49e100 GetTextExtentPoint32A
0x49e104 GetSystemPaletteEntries
0x49e108 GetStockObject
0x49e10c GetRgnBox
0x49e110 GetPixel
0x49e114 GetPaletteEntries
0x49e118 GetObjectA
0x49e11c GetEnhMetaFilePaletteEntries
0x49e120 GetEnhMetaFileHeader
0x49e124 GetEnhMetaFileBits
0x49e128 GetDeviceCaps
0x49e12c GetDIBits
0x49e130 GetDIBColorTable
0x49e134 GetDCOrgEx
0x49e138 GetCurrentPositionEx
0x49e13c GetClipBox
0x49e140 GetBrushOrgEx
0x49e144 GetBitmapBits
0x49e148 GdiFlush
0x49e14c ExtTextOutA
0x49e150 ExcludeClipRect
0x49e154 DeleteObject
0x49e158 DeleteEnhMetaFile
0x49e15c DeleteDC
0x49e160 CreateSolidBrush
0x49e164 CreatePenIndirect
0x49e168 CreatePalette
0x49e16c CreateHalftonePalette
0x49e170 CreateFontIndirectA
0x49e174 CreateDIBitmap
0x49e178 CreateDIBSection
0x49e17c CreateDCA
0x49e180 CreateCompatibleDC
0x49e184 CreateCompatibleBitmap
0x49e188 CreateBrushIndirect
0x49e18c CreateBitmap
0x49e190 CopyEnhMetaFileA
0x49e194 BitBlt
version.dll
0x49e19c VerQueryValueA
0x49e1a0 GetFileVersionInfoSizeA
0x49e1a4 GetFileVersionInfoA
kernel32.dll
0x49e1ac lstrcpyA
0x49e1b0 WriteProcessMemory
0x49e1b4 WriteFile
0x49e1b8 WinExec
0x49e1bc WaitForSingleObject
0x49e1c0 WaitForMultipleObjectsEx
0x49e1c4 VirtualQuery
0x49e1c8 VirtualProtectEx
0x49e1cc VirtualProtect
0x49e1d0 VirtualFreeEx
0x49e1d4 VirtualFree
0x49e1d8 VirtualAllocEx
0x49e1dc VirtualAlloc
0x49e1e0 VerLanguageNameA
0x49e1e4 UnmapViewOfFile
0x49e1e8 TerminateProcess
0x49e1ec Sleep
0x49e1f0 SizeofResource
0x49e1f4 SetThreadPriority
0x49e1f8 SetThreadLocale
0x49e1fc SetThreadContext
0x49e200 SetLastError
0x49e204 SetFileTime
0x49e208 SetFilePointer
0x49e20c SetFileAttributesA
0x49e210 SetEvent
0x49e214 SetErrorMode
0x49e218 SetEndOfFile
0x49e21c ResumeThread
0x49e220 ResetEvent
0x49e224 ReadProcessMemory
0x49e228 ReadFile
0x49e22c PeekNamedPipe
0x49e230 OpenProcess
0x49e234 MultiByteToWideChar
0x49e238 MulDiv
0x49e23c MoveFileA
0x49e240 MapViewOfFile
0x49e244 LockResource
0x49e248 LocalFileTimeToFileTime
0x49e24c LocalAlloc
0x49e250 LoadResource
0x49e254 LoadLibraryA
0x49e258 LeaveCriticalSection
0x49e25c IsBadReadPtr
0x49e260 InitializeCriticalSection
0x49e264 HeapFree
0x49e268 HeapAlloc
0x49e26c GlobalUnlock
0x49e270 GlobalMemoryStatus
0x49e274 GlobalLock
0x49e278 GlobalFree
0x49e27c GlobalFindAtomA
0x49e280 GlobalDeleteAtom
0x49e284 GlobalAlloc
0x49e288 GlobalAddAtomA
0x49e28c GetWindowsDirectoryA
0x49e290 GetVolumeInformationA
0x49e294 GetVersionExA
0x49e298 GetVersion
0x49e29c GetUserDefaultLangID
0x49e2a0 GetTickCount
0x49e2a4 GetThreadLocale
0x49e2a8 GetThreadContext
0x49e2ac GetTempPathA
0x49e2b0 GetSystemPowerStatus
0x49e2b4 GetSystemDirectoryA
0x49e2b8 GetStdHandle
0x49e2bc GetProcessHeap
0x49e2c0 GetProcAddress
0x49e2c4 GetModuleHandleA
0x49e2c8 GetModuleFileNameA
0x49e2cc GetLocaleInfoA
0x49e2d0 GetLocalTime
0x49e2d4 GetLastError
0x49e2d8 GetFullPathNameA
0x49e2dc GetFileTime
0x49e2e0 GetFileSize
0x49e2e4 GetFileAttributesA
0x49e2e8 GetExitCodeThread
0x49e2ec GetExitCodeProcess
0x49e2f0 GetEnvironmentVariableA
0x49e2f4 GetDriveTypeA
0x49e2f8 GetDiskFreeSpaceA
0x49e2fc GetDateFormatA
0x49e300 GetCurrentThreadId
0x49e304 GetCurrentThread
0x49e308 GetCurrentProcessId
0x49e30c GetCurrentProcess
0x49e310 GetComputerNameA
0x49e314 GetCPInfo
0x49e318 FreeResource
0x49e31c InterlockedIncrement
0x49e320 InterlockedExchange
0x49e324 InterlockedDecrement
0x49e328 FreeLibrary
0x49e32c FormatMessageA
0x49e330 FindResourceA
0x49e334 FindNextFileA
0x49e338 FindFirstFileA
0x49e33c FindClose
0x49e340 FileTimeToSystemTime
0x49e344 FileTimeToLocalFileTime
0x49e348 FileTimeToDosDateTime
0x49e34c ExitThread
0x49e350 ExitProcess
0x49e354 EnumResourceNamesA
0x49e358 EnumCalendarInfoA
0x49e35c EnterCriticalSection
0x49e360 DosDateTimeToFileTime
0x49e364 DeleteFileA
0x49e368 DeleteCriticalSection
0x49e36c CreateThread
0x49e370 CreateRemoteThread
0x49e374 CreateProcessA
0x49e378 CreatePipe
0x49e37c CreateMutexA
0x49e380 CreateFileMappingA
0x49e384 CreateFileA
0x49e388 CreateEventA
0x49e38c CreateDirectoryA
0x49e390 CopyFileA
0x49e394 CompareStringA
0x49e398 CloseHandle
0x49e39c Beep
advapi32.dll
0x49e3a4 RegSetValueExA
0x49e3a8 RegQueryValueExA
0x49e3ac RegQueryInfoKeyA
0x49e3b0 RegOpenKeyExA
0x49e3b4 RegOpenKeyA
0x49e3b8 RegFlushKey
0x49e3bc RegEnumValueA
0x49e3c0 RegEnumKeyExA
0x49e3c4 RegDeleteValueA
0x49e3c8 RegDeleteKeyA
0x49e3cc RegCreateKeyExA
0x49e3d0 RegCreateKeyA
0x49e3d4 RegCloseKey
0x49e3d8 OpenThreadToken
0x49e3dc OpenProcessToken
0x49e3e0 LookupPrivilegeValueA
0x49e3e4 LookupPrivilegeNameA
0x49e3e8 LookupPrivilegeDisplayNameA
0x49e3ec LookupAccountSidA
0x49e3f0 IsValidSid
0x49e3f4 GetUserNameA
0x49e3f8 GetTokenInformation
0x49e3fc GetSidSubAuthorityCount
0x49e400 GetSidSubAuthority
0x49e404 GetSidIdentifierAuthority
0x49e408 GetCurrentHwProfileA
0x49e40c AdjustTokenPrivileges
wsock32.dll
0x49e414 __WSAFDIsSet
0x49e418 WSACleanup
0x49e41c WSAStartup
0x49e420 WSAGetLastError
0x49e424 gethostname
0x49e428 getservbyname
0x49e42c gethostbyname
0x49e430 gethostbyaddr
0x49e434 socket
0x49e438 shutdown
0x49e43c sendto
0x49e440 send
0x49e444 select
0x49e448 recv
0x49e44c ntohs
0x49e450 listen
0x49e454 ioctlsocket
0x49e458 inet_ntoa
0x49e45c inet_addr
0x49e460 htons
0x49e464 getsockname
0x49e468 connect
0x49e46c closesocket
0x49e470 ind
0x49e474 accept
kernel32.dll
0x49e47c Sleep
ole32.dll
0x49e484 CoTaskMemFree
0x49e488 StringFromCLSID
shell32.dll
0x49e490 ShellExecuteExA
0x49e494 ShellExecuteA
0x49e498 SHGetFileInfoA
0x49e49c SHFileOperationA
0x49e4a0 DragQueryFileA
oleaut32.dll
0x49e4a8 GetErrorInfo
0x49e4ac GetActiveObject
0x49e4b0 SysFreeString
ole32.dll
0x49e4b8 CoTaskMemFree
0x49e4bc CLSIDFromProgID
0x49e4c0 ProgIDFromCLSID
0x49e4c4 StringFromCLSID
0x49e4c8 CoCreateInstance
0x49e4cc CoUninitialize
0x49e4d0 CoInitialize
0x49e4d4 IsEqualGUID
URLMON.DLL
0x49e4dc URLDownloadToFileA
oleaut32.dll
0x49e4e4 SafeArrayPtrOfIndex
0x49e4e8 SafeArrayGetUBound
0x49e4ec SafeArrayGetLBound
0x49e4f0 SafeArrayCreate
0x49e4f4 VariantChangeType
0x49e4f8 VariantCopy
0x49e4fc VariantClear
0x49e500 VariantInit
comctl32.dll
0x49e508 _TrackMouseEvent
0x49e50c ImageList_SetIconSize
0x49e510 ImageList_GetIconSize
0x49e514 ImageList_Write
0x49e518 ImageList_Read
0x49e51c ImageList_DragShowNolock
0x49e520 ImageList_DragMove
0x49e524 ImageList_DragLeave
0x49e528 ImageList_DragEnter
0x49e52c ImageList_EndDrag
0x49e530 ImageList_BeginDrag
0x49e534 ImageList_Remove
0x49e538 ImageList_DrawEx
0x49e53c ImageList_Draw
0x49e540 ImageList_GetBkColor
0x49e544 ImageList_SetBkColor
0x49e548 ImageList_Add
0x49e54c ImageList_GetImageCount
0x49e550 ImageList_Destroy
0x49e554 ImageList_Create
wininet.dll
0x49e55c InternetReadFile
0x49e560 InternetOpenUrlA
0x49e564 InternetOpenA
0x49e568 InternetConnectA
0x49e56c InternetCloseHandle
0x49e570 HttpQueryInfoA
0x49e574 FtpPutFileA
shell32.dll
0x49e57c SHGetSpecialFolderLocation
0x49e580 SHGetPathFromIDListA
winmm.dll
0x49e588 waveInUnprepareHeader
0x49e58c waveInStart
0x49e590 waveInReset
0x49e594 waveInPrepareHeader
0x49e598 waveInOpen
0x49e59c waveInClose
0x49e5a0 waveInAddBuffer
0x49e5a4 PlaySoundA
0x49e5a8 mciSendStringA
netapi32.dll
0x49e5b0 Netbios
gdiplus.dll
0x49e5b8 GdipGetImageEncoders
0x49e5bc GdipGetImageEncodersSize
0x49e5c0 GdipDrawImageRectI
0x49e5c4 GdipSetInterpolationMode
0x49e5c8 GdipDeleteGraphics
0x49e5cc GdipCreateBitmapFromHBITMAP
0x49e5d0 GdipCreateBitmapFromScan0
0x49e5d4 GdipGetImagePixelFormat
0x49e5d8 GdipGetImageGraphicsContext
0x49e5dc GdipSaveImageToStream
0x49e5e0 GdipDisposeImage
0x49e5e4 GdiplusShutdown
0x49e5e8 GdiplusStartup
0x49e5ec GdipFree
0x49e5f0 GdipAlloc
advapi32.dll
0x49e5f8 StartServiceA
0x49e5fc QueryServiceStatus
0x49e600 OpenServiceA
0x49e604 OpenSCManagerA
0x49e608 EnumServicesStatusA
0x49e60c DeleteService
0x49e610 CreateServiceA
0x49e614 ControlService
0x49e618 CloseServiceHandle
msacm32.dll
0x49e620 acmStreamUnprepareHeader
0x49e624 acmStreamPrepareHeader
0x49e628 acmStreamConvert
0x49e62c acmStreamReset
0x49e630 acmStreamSize
0x49e634 acmStreamClose
0x49e638 acmStreamOpen
ntdll.dll
0x49e640 NtQuerySystemInformation
netapi32.dll
0x49e648 NetApiBufferFree
0x49e64c NetShareGetInfo
0x49e650 NetShareEnum
WS2_32.DLL
0x49e658 WSAIoctl
SHFolder.dll
0x49e660 SHGetFolderPathA
ntdll
0x49e668 NtUnmapViewOfSection
user32.dll
0x49e670 EnumDisplayMonitors
0x49e674 GetMonitorInfoA
SHELL32.DLL
0x49e67c SHEmptyRecycleBinA
AVICAP32.DLL
0x49e684 capGetDriverDescriptionA
EAT(Export Address Table) is none