Report - Game.exe

Generic Malware Malicious Library Malicious Packer ASPack UPX PE File PE32 OS Processor Check
ScreenShot
Created 2024.07.16 07:29 Machine s1_win7_x6401
Filename Game.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
1.0
ZERO API file : clean
VT API (file)
md5 e031d8266a5f1cbc0eb29455e25c31c2
sha256 19bd3b9f8706922c253fd78146edea0f1c3801d19be0539033bf298bde6bc613
ssdeep 49152:FjrrKXGmKrjk2ICJOpzkGc1r+aAzeALNDE+Hw6T3gQhAAAAAeAAAAAAesBVvBBIz:FwTKrjkVCJOpwV1r+aAzeALNDE+Hw6Tw
imphash 94f2f98673e7befac9a05e04a3dc0b9f
impfuzzy 192:1s0ki8JINpyXyCm6ADROvqnPsstQAcQhu9rssVhhDfy2Ahq60rIlUHu9R1Y6mBxo:1sWJICRpD8xicQc9rJVhZMrKrC
  Network IP location

Signature (3cnts)

Level Description
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (8cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch ASPack_Zero ASPack packed file binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.DLL
 0x5ea024 GetCurrentThreadId
 0x5ea028 QueryPerformanceCounter
 0x5ea02c GetStartupInfoA
 0x5ea030 GlobalFree
 0x5ea034 GlobalAlloc
 0x5ea038 SetLastError
 0x5ea03c HeapReAlloc
 0x5ea040 CopyFileA
 0x5ea044 DeviceIoControl
 0x5ea048 LocalAlloc
 0x5ea04c LocalFree
 0x5ea050 FreeLibrary
 0x5ea054 VirtualAlloc
 0x5ea058 HeapAlloc
 0x5ea05c GetProcessHeap
 0x5ea060 HeapFree
 0x5ea064 ReadFile
 0x5ea068 IsBadReadPtr
 0x5ea06c GetEnvironmentVariableA
 0x5ea070 CreateToolhelp32Snapshot
 0x5ea074 Module32First
 0x5ea078 Module32Next
 0x5ea07c SuspendThread
 0x5ea080 WriteProcessMemory
 0x5ea084 GetModuleHandleA
 0x5ea088 lstrcat
 0x5ea08c lstrlen
 0x5ea090 WinExec
 0x5ea094 lstrcpy
 0x5ea098 DeleteFileA
 0x5ea09c GetFileSize
 0x5ea0a0 GetPrivateProfileSectionA
 0x5ea0a4 MoveFileA
 0x5ea0a8 GetSystemDirectoryA
 0x5ea0ac CreateFileA
 0x5ea0b0 LeaveCriticalSection
 0x5ea0b4 EnterCriticalSection
 0x5ea0b8 InitializeCriticalSection
 0x5ea0bc CompareStringA
 0x5ea0c0 GetLocalTime
 0x5ea0c4 CreateDirectoryA
 0x5ea0c8 WideCharToMultiByte
 0x5ea0cc ResetEvent
 0x5ea0d0 LoadLibraryA
 0x5ea0d4 GetProcAddress
 0x5ea0d8 MultiByteToWideChar
 0x5ea0dc ResumeThread
 0x5ea0e0 GetExitCodeThread
 0x5ea0e4 Sleep
 0x5ea0e8 GetVersionExA
 0x5ea0ec CreateEventA
 0x5ea0f0 WaitForMultipleObjects
 0x5ea0f4 SetEvent
 0x5ea0f8 TerminateThread
 0x5ea0fc GlobalMemoryStatusEx
 0x5ea100 OutputDebugStringA
 0x5ea104 GetCurrentProcess
 0x5ea108 ExitProcess
 0x5ea10c GetFileAttributesA
 0x5ea110 SetFileAttributesA
 0x5ea114 WritePrivateProfileStringA
 0x5ea118 GetPrivateProfileStringA
 0x5ea11c CreateMutexA
 0x5ea120 GetLastError
 0x5ea124 WaitForSingleObject
 0x5ea128 GetExitCodeProcess
 0x5ea12c CloseHandle
 0x5ea130 GetPrivateProfileIntA
 0x5ea134 GetTickCount
 0x5ea138 GetModuleFileNameA
 0x5ea13c GetCurrentDirectoryA
 0x5ea140 CreateProcessA
 0x5ea144 TerminateProcess
 0x5ea148 GetCurrentProcessId
 0x5ea14c GetSystemTimeAsFileTime
advapi32.dll
 0x5ea000 RegCloseKey
 0x5ea004 RegOpenKeyExA
 0x5ea008 RegQueryValueA
dinput8.dll
 0x5ea010 DirectInput8Create
fmod.dll
 0x5ea738 _FSOUND_Close@0
 0x5ea73c _FSOUND_GetNumHWChannels@12
 0x5ea740 _FSOUND_GetMaxChannels@0
 0x5ea744 _FSOUND_GetError@0
 0x5ea748 _FSOUND_Init@12
 0x5ea74c _FSOUND_3D_SetRolloffFactor@4
 0x5ea750 _FSOUND_GetDriverName@4
 0x5ea754 _FSOUND_SetDriver@4
 0x5ea758 _FSOUND_GetNumDrivers@0
 0x5ea75c _FSOUND_GetOutput@0
 0x5ea760 _FSOUND_SetOutput@4
 0x5ea764 _FSOUND_GetVersion@0
 0x5ea768 _FSOUND_Sample_Free@4
 0x5ea76c _FSOUND_Stream_Close@4
 0x5ea770 _FSOUND_Sample_Load@20
 0x5ea774 _FSOUND_Stream_GetSample@4
 0x5ea778 _FSOUND_Stream_Open@16
 0x5ea77c _FSOUND_SetLoopMode@8
 0x5ea780 _FSOUND_SetPaused@8
 0x5ea784 _FSOUND_Stream_SetMode@8
 0x5ea788 _FSOUND_PlaySoundEx@16
 0x5ea78c _FSOUND_Stream_PlayEx@16
 0x5ea790 _FSOUND_StopSound@4
 0x5ea794 _FSOUND_SetVolume@8
 0x5ea798 _FSOUND_IsPlaying@4
 0x5ea79c _FSOUND_SetMute@8
imm32.dll
 0x5ea018 ImmAssociateContext
 0x5ea01c ImmGetContext
luaplus.dll
 0x5ea154 ??BLuaObject@LuaPlus@@QBEPAUlua_State@@XZ
 0x5ea158 ?GetByName@LuaObject@LuaPlus@@QAE?AV12@PBD@Z
 0x5ea15c ?IsNil@LuaObject@LuaPlus@@QBE_NXZ
 0x5ea160 ?PushInteger@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@H@Z
 0x5ea164 ?Register@LuaObject@LuaPlus@@QAEXPBDP6AHPAVLuaState@2@@ZH@Z
 0x5ea168 ?BoxPointer@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@PAX@Z
 0x5ea16c ?Create@LuaState@LuaPlus@@SAPAV12@_N0@Z
 0x5ea170 lua_setgcthreshold
 0x5ea174 lua_getgccount
 0x5ea178 lua_getgcthreshold
 0x5ea17c lua_dostring
 0x5ea180 ?Destroy@LuaState@LuaPlus@@SAXPAV12@@Z
 0x5ea184 ?PushString@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@PBD@Z
 0x5ea188 lua_insert
 0x5ea18c lua_settable
 0x5ea190 ?GetBoolean@LuaStackObject@LuaPlus@@QBE_NXZ
 0x5ea194 ?Register@LuaObject@LuaPlus@@QAEXPBDP6AHPAUlua_State@@@ZH@Z
 0x5ea198 lua_getstateuserdata
 0x5ea19c ??0LuaObject@LuaPlus@@QAE@XZ
 0x5ea1a0 ?GetGlobals@LuaState@LuaPlus@@QAE?AVLuaObject@2@XZ
 0x5ea1a4 ?CreateTable@LuaObject@LuaPlus@@QAE?AV12@PBDHH@Z
 0x5ea1a8 ??4LuaObject@LuaPlus@@QAEAAV01@ABV01@@Z
 0x5ea1ac ?SetObject@LuaObject@LuaPlus@@QAEAAV12@PBDAAV12@@Z
 0x5ea1b0 lua_pushvalue
 0x5ea1b4 lua_gettable
 0x5ea1b8 lua_isuserdata
 0x5ea1bc lua_gettop
 0x5ea1c0 lua_pushboolean
 0x5ea1c4 lua_tonumber
 0x5ea1c8 lua_type
 0x5ea1cc ??1LuaObject@LuaPlus@@QAE@XZ
 0x5ea1d0 ?PushStack@LuaObject@LuaPlus@@QAE?AVLuaStackObject@2@XZ
 0x5ea1d4 ?SetMetaTable@LuaObject@LuaPlus@@QAEXABV12@@Z
 0x5ea1d8 ??0LuaObject@LuaPlus@@QAE@ABVLuaStackObject@1@@Z
 0x5ea1dc lua_newuserdata
 0x5ea1e0 ?GetString@LuaStackObject@LuaPlus@@QBEPBDXZ
 0x5ea1e4 lua_isstring
 0x5ea1e8 lua_pushnumber
 0x5ea1ec lua_pushstring
 0x5ea1f0 lua_pushnil
 0x5ea1f4 lua_touserdata
 0x5ea1f8 luaL_argerror
 0x5ea1fc lua_settop
 0x5ea200 luaL_error
msvcp71.dll
 0x5ea208 ?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
 0x5ea20c ?_Getcat@facet@locale@std@@SAIPAPBV123@@Z
 0x5ea210 ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
 0x5ea214 ?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
 0x5ea218 ?capacity@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
 0x5ea21c ??1locale@std@@QAE@XZ
 0x5ea220 ?getloc@ios_base@std@@QBE?AVlocale@2@XZ
 0x5ea224 ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
 0x5ea228 ?to_char_type@?$char_traits@D@std@@SADABH@Z
 0x5ea22c ?is@?$ctype@D@std@@QBE_NFD@Z
 0x5ea230 ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
 0x5ea234 ??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
 0x5ea238 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
 0x5ea23c ?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
 0x5ea240 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
 0x5ea244 ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
 0x5ea248 ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
 0x5ea24c ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
 0x5ea250 ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
 0x5ea254 ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
 0x5ea258 ?_Myptr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
 0x5ea25c ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
 0x5ea260 ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
 0x5ea264 ?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
 0x5ea268 ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
 0x5ea26c ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
 0x5ea270 ?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
 0x5ea274 ?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
 0x5ea278 ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
 0x5ea27c ?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
 0x5ea280 ?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
 0x5ea284 ??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
 0x5ea288 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
 0x5ea28c ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
 0x5ea290 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
 0x5ea294 ??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
 0x5ea298 ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
 0x5ea29c ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBD@Z
 0x5ea2a0 ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
 0x5ea2a4 ?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@@Z
 0x5ea2a8 ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
 0x5ea2ac ?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
 0x5ea2b0 ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
 0x5ea2b4 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
 0x5ea2b8 ?width@ios_base@std@@QAEHH@Z
 0x5ea2bc ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
 0x5ea2c0 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
 0x5ea2c4 ??0_Lockit@std@@QAE@H@Z
 0x5ea2c8 ?id@?$ctype@D@std@@2V0locale@2@A
 0x5ea2cc ??Bid@locale@std@@QAEIXZ
 0x5ea2d0 ?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
 0x5ea2d4 ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
 0x5ea2d8 ?_Incref@facet@locale@std@@QAEXXZ
 0x5ea2dc ?_Register@facet@locale@std@@QAEXXZ
 0x5ea2e0 ??1_Lockit@std@@QAE@XZ
 0x5ea2e4 ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
 0x5ea2e8 ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
 0x5ea2ec ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
 0x5ea2f0 ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
 0x5ea2f4 ??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
 0x5ea2f8 ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
 0x5ea2fc ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
 0x5ea300 ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
 0x5ea304 ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
 0x5ea308 ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
 0x5ea30c ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
 0x5ea310 ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
 0x5ea314 ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
 0x5ea318 ?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
 0x5ea31c ?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
 0x5ea320 ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
 0x5ea324 ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
 0x5ea328 ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
 0x5ea32c ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
 0x5ea330 ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
 0x5ea334 ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
 0x5ea338 ??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
 0x5ea33c ??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
 0x5ea340 ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
 0x5ea344 ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
 0x5ea348 ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
 0x5ea34c ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
 0x5ea350 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
 0x5ea354 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
 0x5ea358 ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
 0x5ea35c ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
 0x5ea360 ?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
 0x5ea364 ?_Nomemory@std@@YAXXZ
msvcr71.dll
 0x5ea36c ??1exception@@UAE@XZ
 0x5ea370 ??0exception@@QAE@XZ
 0x5ea374 ??3@YAXPAX@Z
 0x5ea378 ??0exception@@QAE@ABV0@@Z
 0x5ea37c _CxxThrowException
 0x5ea380 sprintf
 0x5ea384 _snprintf
 0x5ea388 _purecall
 0x5ea38c _controlfp
 0x5ea390 __set_app_type
 0x5ea394 __p__fmode
 0x5ea398 __p__commode
 0x5ea39c _adjust_fdiv
 0x5ea3a0 __setusermatherr
 0x5ea3a4 _initterm
 0x5ea3a8 __getmainargs
 0x5ea3ac _amsg_exit
 0x5ea3b0 _acmdln
 0x5ea3b4 _cexit
 0x5ea3b8 _ismbblead
 0x5ea3bc _XcptFilter
 0x5ea3c0 _exit
 0x5ea3c4 _c_exit
 0x5ea3c8 _onexit
 0x5ea3cc __dllonexit
 0x5ea3d0 ?terminate@@YAXXZ
 0x5ea3d4 ??1type_info@@UAE@XZ
 0x5ea3d8 __security_error_handler
 0x5ea3dc _callnewh
 0x5ea3e0 localeconv
 0x5ea3e4 _CIpow
 0x5ea3e8 longjmp
 0x5ea3ec exit
 0x5ea3f0 _setjmp3
 0x5ea3f4 strcspn
 0x5ea3f8 strtod
 0x5ea3fc strtoul
 0x5ea400 strpbrk
 0x5ea404 memchr
 0x5ea408 islower
 0x5ea40c isalpha
 0x5ea410 iscntrl
 0x5ea414 ispunct
 0x5ea418 isspace
 0x5ea41c isupper
 0x5ea420 isalnum
 0x5ea424 isxdigit
 0x5ea428 toupper
 0x5ea42c _HUGE
 0x5ea430 floor
 0x5ea434 fputs
 0x5ea438 realloc
 0x5ea43c _iob
 0x5ea440 fgetc
 0x5ea444 ungetc
 0x5ea448 _errno
 0x5ea44c strerror
 0x5ea450 __CxxFrameHandler
 0x5ea454 fscanf
 0x5ea458 _vsnprintf
 0x5ea45c malloc
 0x5ea460 free
 0x5ea464 fseek
 0x5ea468 ftell
 0x5ea46c fread
 0x5ea470 isdigit
 0x5ea474 strrchr
 0x5ea478 tolower
 0x5ea47c ??0exception@@QAE@ABQBD@Z
 0x5ea480 _isnan
 0x5ea484 strftime
 0x5ea488 _strlwr
 0x5ea48c atof
 0x5ea490 strcoll
 0x5ea494 wcslen
 0x5ea498 fprintf
 0x5ea49c mktime
 0x5ea4a0 srand
 0x5ea4a4 _itoa
 0x5ea4a8 fgets
 0x5ea4ac fopen
 0x5ea4b0 fwrite
 0x5ea4b4 atoi
 0x5ea4b8 localtime
 0x5ea4bc strncat
 0x5ea4c0 fclose
 0x5ea4c4 ??_V@YAXPAX@Z
 0x5ea4c8 ?swprintf@@YAHPA_WIPB_WZZ
 0x5ea4cc _beginthreadex
 0x5ea4d0 strtok
 0x5ea4d4 _strcmpi
 0x5ea4d8 _mktime64
 0x5ea4dc ??0bad_cast@@QAE@PBD@Z
 0x5ea4e0 ??1bad_cast@@UAE@XZ
 0x5ea4e4 ??0bad_cast@@QAE@ABV0@@Z
 0x5ea4e8 _ui64toa
 0x5ea4ec mbstowcs
 0x5ea4f0 rand
 0x5ea4f4 _strnicmp
 0x5ea4f8 memmove
 0x5ea4fc _except_handler3
 0x5ea500 strstr
 0x5ea504 strncmp
 0x5ea508 _access
 0x5ea50c ceil
 0x5ea510 strchr
 0x5ea514 sscanf
 0x5ea518 strncpy
 0x5ea51c time
pathlib.dll
 0x5ea524 ?destroyPathData@PathLibRoot@PathLib@@QAEXPAVPathData@2@@Z
 0x5ea528 ?getPathFinder@PathLibRoot@PathLib@@QAEPAVPathFinder@2@XZ
 0x5ea52c ?getPathData@PathLibRoot@PathLib@@QAEPAVPathData@2@XZ
 0x5ea530 ?destroyBuildingCollision@PathLibRoot@PathLib@@QAEXPAVBuildingCollision@2@@Z
 0x5ea534 ?getBuildingCollsion@PathLibRoot@PathLib@@QAEPAVBuildingCollision@2@XZ
 0x5ea538 ?destroyPathData@PathLibRoot@PathLib@@QAEXPAVPathData@2@@Z
rpcrt4.dll
 0x5ea540 UuidCreate
rssparser.dll
 0x5ea548 RSS_GotoURL
 0x5ea54c RSS_GetParserManager
shlwapi.dll
 0x5ea554 PathFindExtensionA
 0x5ea558 PathFileExistsA
 0x5ea55c SHSetValueA
 0x5ea560 SHGetValueA
 0x5ea564 PathRemoveFileSpecA
 0x5ea568 PathAppendA
 0x5ea56c PathRenameExtensionA
tengine.dll
 0x5ea7a4 ??0tSoundSystem@@QAE@XZ
 0x5ea7a8 ?m_classtSoundSystem@tSoundSystem@@2UtClass@@A
 0x5ea7ac ?TDU_MD5String@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
 0x5ea7b0 ?Tick@tNode@@UAEXXZ
 0x5ea7b4 ??1tActionSystem@@UAE@XZ
 0x5ea7b8 ??0tDataBaseSystem@@QAE@XZ
 0x5ea7bc ?m_classtDataBaseSystem@tDataBaseSystem@@2UtClass@@A
 0x5ea7c0 ?CalSubTime@tTimeSystem@@QAEIII@Z
 0x5ea7c4 ?TDU_GetDist@@YAMABUfVector3@@0@Z
 0x5ea7c8 ?normalise@fVector3@@QAEMM@Z
 0x5ea7cc ??0tKernel@@QAE@XZ
 0x5ea7d0 ??1tKernel@@UAE@XZ
 0x5ea7d4 ??1tActionSystem@@UAE@XZ
 0x5ea7d8 ??4fVector3@@QAEAAU0@ABU0@@Z
 0x5ea7dc ?m_classtObjectSystem@tObjectSystem@@2UtClass@@A
 0x5ea7e0 ?m_classtFakeObjSystem@tFakeObjSystem@@2UtClass@@A
 0x5ea7e4 ??0tObjectSystem@@QAE@XZ
 0x5ea7e8 ??0tDataPool@@QAE@XZ
 0x5ea7ec ?m_classtDataPool@tDataPool@@2UtClass@@A
 0x5ea7f0 ??1tActionSystem@@UAE@XZ
 0x5ea7f4 ??0tTransferItemSystem@@QAE@XZ
 0x5ea7f8 ?m_classtTransferItemSystem@tTransferItemSystem@@2UtClass@@A
 0x5ea7fc ??0tObject@@QAE@XZ
 0x5ea800 ??1tActionSystem@@UAE@XZ
 0x5ea804 ?m_classtObject@tObject@@2UtClass@@A
 0x5ea808 ?TD_SetWindowTextW@@YAHPAUHWND__@@PB_W@Z
 0x5ea80c ??1tActionSystem@@UAE@XZ
 0x5ea810 ?TDU_GetDist@@YAMABUfVector2@@0@Z
 0x5ea814 ?TDU_GetDistSq@@YAMABUfVector3@@0@Z
 0x5ea818 ?m_classtItemSystem@tItemSystem@@2UtClass@@A
 0x5ea81c ??0tItemSystem@@QAE@XZ
 0x5ea820 ??1tActionSystem@@UAE@XZ
 0x5ea824 ?tProcessException@@YAXPAU_EXCEPTION_POINTERS@@_NPBD@Z
 0x5ea828 ?tSetCPPException@@YAXPBD@Z
 0x5ea82c ?TD_MessageBoxW@@YAHPAUHWND__@@PB_W1I@Z
 0x5ea830 ??0fVector3@@QAE@XZ
 0x5ea834 ?m_classtHelperSystem@tHelperSystem@@2UtClass@@A
 0x5ea838 ??0tHelperSystem@@QAE@XZ
 0x5ea83c ??1tActionSystem@@UAE@XZ
 0x5ea840 ?TDU_ConvertStringToVector@@YAHPBDAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@0HH@Z
 0x5ea844 ?TDU_GetYAngle@@YAMABUfVector2@@0@Z
 0x5ea848 ?Release@tNode@@UAEXXZ
 0x5ea84c ?m_classtWorldSystem@tWorldSystem@@2UtClass@@A
 0x5ea850 ?IsKindOf@tKernel@@QBEHPBUtClass@@0@Z
 0x5ea854 ??0tWorldSystem@@QAE@XZ
 0x5ea858 ??1tActionSystem@@UAE@XZ
 0x5ea85c ?GetChildNum@tNode@@UBEHXZ
 0x5ea860 ?GetNodeName@tNode@@UBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
 0x5ea864 ?GetParent@tNode@@UAEPAV1@XZ
 0x5ea868 ?GetMemory@tNode@@UAEHXZ
 0x5ea86c ?GetCurrentStation@tNode@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
 0x5ea870 ??1tNode@@UAE@XZ
 0x5ea874 ??0tNode@@QAE@XZ
 0x5ea878 ?LookUpChild@tNode@@UAEPAV1@PBD@Z
 0x5ea87c ?AddChild@tNode@@UAEXPAV1@@Z
 0x5ea880 ?EraseChild@tNode@@UAEHPAV1@@Z
 0x5ea884 ?EraseAllChild@tNode@@UAEXXZ
 0x5ea888 ?tThrowAssertException@@YAXPBDH0@Z
 0x5ea88c ?normalise@fVector2@@QAEMM@Z
 0x5ea890 ?TDU_GetDistSq@@YAMABUfVector2@@0@Z
 0x5ea894 ?TDU_Log@@YAXPBDZZ
 0x5ea898 ?tThrowStringException@@YAXPBDZZ
 0x5ea89c ?ReisgerClass@tKernel@@QAEXPAUtClass@@@Z
 0x5ea8a0 ??1tActionSystem@@UAE@XZ
 0x5ea8a4 ??0tDataPool_@@QAE@XZ
 0x5ea8a8 ?m_classtDataPool_@tDataPool_@@2UtClass@@A
 0x5ea8ac ?TDU_StringSafeConvertToVector@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@D@Z
 0x5ea8b0 ?TDU_GetLineFromMemory@@YAPBDPADHPBD1@Z
 0x5ea8b4 ??1tActionSystem@@UAE@XZ
 0x5ea8b8 ??0tScriptSystem@@QAE@XZ
 0x5ea8bc ?m_classtScriptSystem@tScriptSystem@@2UtClass@@A
 0x5ea8c0 ?TDU_GetReflect@@YA?AUfVector2@@ABU1@00@Z
 0x5ea8c4 ??1tActionSystem@@UAE@XZ
 0x5ea8c8 ??0tEventSystem@@QAE@XZ
 0x5ea8cc ?m_classtEventSystem@tEventSystem@@2UtClass@@A
 0x5ea8d0 ??1tActionSystem@@UAE@XZ
 0x5ea8d4 ??0tVariableSystem@@QAE@XZ
 0x5ea8d8 ?m_classtVariableSystem@tVariableSystem@@2UtClass@@A
 0x5ea8dc ??1tActionSystem@@UAE@XZ
 0x5ea8e0 ?TDU_LogMemory@@YAXPBDH@Z
 0x5ea8e4 ?tProcessInnerException@@YAHPAU_EXCEPTION_POINTERS@@PAUHWND__@@PBD2@Z
 0x5ea8e8 ?m_classtNode@tNode@@2UtClass@@A
 0x5ea8ec ??1tActionSystem@@UAE@XZ
 0x5ea8f0 ?NewNode@tKernel@@UAEPAVtNode@@PBDPAV2@0@Z
 0x5ea8f4 ?m_classtGameInterfaceBase@tGameInterfaceBase@@2UtClass@@A
 0x5ea8f8 ??1tActionSystem@@UAE@XZ
 0x5ea8fc ??0tGameInterfaceBase@@QAE@XZ
 0x5ea900 ?m_classtInputSystem@tInputSystem@@2UtClass@@A
 0x5ea904 ??0tInputSystem@@QAE@XZ
 0x5ea908 ??1tActionSystem@@UAE@XZ
 0x5ea90c ?m_classtCursorSystem@tCursorSystem@@2UtClass@@A
 0x5ea910 ??1tActionSystem@@UAE@XZ
 0x5ea914 ??0tCursorSystem@@QAE@XZ
 0x5ea918 ?m_classtActionSystem@tActionSystem@@2UtClass@@A
 0x5ea91c ??0tActionSystem@@QAE@XZ
 0x5ea920 ??1tActionSystem@@UAE@XZ
 0x5ea924 ??0tFakeObjSystem@@QAE@XZ
 0x5ea928 ?NewNode@tKernel@@UAEPAVtNode@@PBD00@Z
 0x5ea92c ?ShutDown@tKernel@@QAEXXZ
 0x5ea930 ?LoadPlugin@tKernel@@QAEHPBDPAX@Z
 0x5ea934 ?m_classtTimeSystem@tTimeSystem@@2UtClass@@A
user32.dll
 0x5ea574 GetCursorPos
 0x5ea578 ClientToScreen
 0x5ea57c GetDoubleClickTime
 0x5ea580 wsprintfA
 0x5ea584 IsCharAlphaNumericA
 0x5ea588 GetActiveWindow
 0x5ea58c WindowFromPoint
 0x5ea590 ScreenToClient
 0x5ea594 SystemParametersInfoA
 0x5ea598 SetCursorPos
 0x5ea59c ShowCursor
 0x5ea5a0 SetCursor
 0x5ea5a4 GetAsyncKeyState
 0x5ea5a8 UnregisterHotKey
 0x5ea5ac RegisterHotKey
 0x5ea5b0 SetTimer
 0x5ea5b4 KillTimer
 0x5ea5b8 IsWindow
 0x5ea5bc IsClipboardFormatAvailable
 0x5ea5c0 OpenClipboard
 0x5ea5c4 GetClipboardData
 0x5ea5c8 CloseClipboard
 0x5ea5cc GetForegroundWindow
 0x5ea5d0 GetWindowThreadProcessId
 0x5ea5d4 AttachThreadInput
 0x5ea5d8 SetForegroundWindow
 0x5ea5dc SetWindowPos
 0x5ea5e0 IsIconic
 0x5ea5e4 LoadIconA
 0x5ea5e8 LoadCursorA
 0x5ea5ec RegisterClassExA
 0x5ea5f0 CreateWindowExA
 0x5ea5f4 UpdateWindow
 0x5ea5f8 OffsetRect
 0x5ea5fc CopyRect
 0x5ea600 EqualRect
 0x5ea604 BeginPaint
 0x5ea608 EndPaint
 0x5ea60c PostQuitMessage
 0x5ea610 DispatchMessageA
 0x5ea614 PeekMessageA
 0x5ea618 TranslateMessage
 0x5ea61c MsgWaitForMultipleObjects
 0x5ea620 DefWindowProcA
 0x5ea624 UnregisterClassA
 0x5ea628 InvalidateRect
 0x5ea62c SetRect
 0x5ea630 AdjustWindowRect
 0x5ea634 PtInRect
 0x5ea638 DialogBoxParamA
 0x5ea63c IsDlgButtonChecked
 0x5ea640 GetDlgItem
 0x5ea644 EnableWindow
 0x5ea648 GetDlgItemTextA
 0x5ea64c SendDlgItemMessageA
 0x5ea650 EndDialog
 0x5ea654 GetWindowRect
 0x5ea658 GetSystemMetrics
 0x5ea65c MoveWindow
 0x5ea660 SetDlgItemTextA
 0x5ea664 CheckDlgButton
 0x5ea668 DestroyWindow
 0x5ea66c GetDesktopWindow
 0x5ea670 MessageBoxA
 0x5ea674 FindWindowA
 0x5ea678 SendMessageA
 0x5ea67c GetClientRect
 0x5ea680 GetCapture
 0x5ea684 GetKeyState
 0x5ea688 SetCapture
 0x5ea68c ReleaseCapture
 0x5ea690 GetWindowLongA
 0x5ea694 SetWindowLongA
 0x5ea698 PostMessageA
 0x5ea69c ShowWindow
wininet.dll
 0x5ea6a4 InternetOpenA
 0x5ea6a8 InternetConnectA
 0x5ea6ac InternetAttemptConnect
 0x5ea6b0 HttpSendRequestExA
 0x5ea6b4 HttpEndRequestA
 0x5ea6b8 HttpOpenRequestA
 0x5ea6bc HttpAddRequestHeadersA
 0x5ea6c0 InternetSetCookieA
 0x5ea6c4 HttpSendRequestA
 0x5ea6c8 InternetWriteFile
 0x5ea6cc InternetReadFile
 0x5ea6d0 InternetCloseHandle
winmm.dll
 0x5ea6d8 timeGetTime
 0x5ea6dc timeSetEvent
 0x5ea6e0 timeKillEvent
ws2_32.dll
 0x5ea6e8 WSAStartup
 0x5ea6ec __WSAFDIsSet
 0x5ea6f0 select
 0x5ea6f4 WSAGetLastError
 0x5ea6f8 sendto
 0x5ea6fc recvfrom
 0x5ea700 closesocket
 0x5ea704 gethostbyname
 0x5ea708 socket
 0x5ea70c htons
 0x5ea710 inet_addr
 0x5ea714 connect
 0x5ea718 getsockopt
 0x5ea71c setsockopt
 0x5ea720 send
 0x5ea724 recv
 0x5ea728 ioctlsocket
 0x5ea72c htonl
 0x5ea730 WSACleanup

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure