GuLoader Delivering AZORult | Files
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Exploit
Dropper
Downloader
...
Threat Names:
AZORult v3
GuLoader
Exploit.RTF-ObfsObjDat.Gen
...

API .doc.rtf

RTF Document

Created at 2020-11-10T00:49:00

...

Remarks

(0x0200000C): The maximum memory dump size was exceeded. Some dumps may be missing in the report.

Filters:
Filename Category Type Severity Actions
C:\Users\aETAdzjz\Desktop\API .doc.rtf Sample File RTF
Malicious
...
»
Mime Type text/rtf
File Size 831.30 KB
MD5 1cc146d47918d23cee86a97c77f87918 Copy to Clipboard
SHA1 3d07f8db1010627f1481b5fde714185215971935 Copy to Clipboard
SHA256 5ff8a87fd7626d4beab7a5be7f285f1d1d64478509f27aca6fd9deb3f69155e7 Copy to Clipboard
SSDeep 12288:lUykCSZQeSdPLHNHgdvb0INuK8afD7Gj7qqtisK1yty+79mmUE7evpp:hsQeS9Hpg7ear7GXZgTvmUwup Copy to Clipboard
ImpHash -
Parser Error Remark Static engine was unable to completely parse the analyzed file
Office Information
»
Controls (1)
»
CLSID Control Name Associated Vulnerability
{00021700-0000-0000-C000-000000000046} Equation3 CVE-2017-11882
Document Content
»
41335395
Local AV Matches (1)
»
Threat Name Severity
Exploit.RTF-ObfsObjDat.Gen
Malicious
C:\Users\aETAdzjz\AppData\Roaming\fghvhghvgfdgfhchfg.exe Downloaded File Binary
Malicious
...
»
Also Known As C:\Users\aETAdzjz\AppData\Roaming\fghvhghvgfdgfhchfg.exe (Downloaded File)
fghvhghvgfdgfhchfg.exe (Downloaded File)
Parent File analysis.pcap
Mime Type application/vnd.microsoft.portable-executable
File Size 80.00 KB
MD5 60b900594c282fd33198488327e5fa32 Copy to Clipboard
SHA1 3814214b06d827b877a6a23944f53720d3682ecd Copy to Clipboard
SHA256 e000b0cae7df0753ea12d97175e393bacf905613eef1a59d7e1784a913993f58 Copy to Clipboard
SSDeep 768:Ak9YyFYxwLT2qDk/BRB6FRutiSiHQ6orjcvYGfQjq89Zh116RS2CuD9CbVJsgY6L:j5hf2qgB67uUS+Q6XajRhr6Rs8oyDT+ Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Blacklisted
Names Mal/Generic-S
Local AV Matches (1)
»
Threat Name Severity
Trojan.GenericKD.44426822
Malicious
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-console-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 502263c56f931df8440d7fd2fa7b7c00 Copy to Clipboard
SHA1 523a3d7c3f4491e67fc710575d8e23314db2c1a2 Copy to Clipboard
SHA256 94a5df1227818edbfd0d5091c6a48f86b4117c38550343f780c604eee1cd6231 Copy to Clipboard
SSDeep 192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2061-07-07 10:18:41+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x42b 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.84
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (14)
»
Api name EAT Address Ordinal
AllocConsole 0x11e4 0x1
GetConsoleCP 0x1207 0x2
GetConsoleMode 0x122c 0x3
GetConsoleOutputCP 0x1257 0x4
GetNumberOfConsoleInputEvents 0x1291 0x5
PeekConsoleInputA 0x12ca 0x6
ReadConsoleA 0x12f2 0x7
ReadConsoleInputA 0x131a 0x8
ReadConsoleInputW 0x1347 0x9
ReadConsoleW 0x136f 0xa
SetConsoleCtrlHandler 0x139b 0xb
SetConsoleMode 0x13c9 0xc
WriteConsoleA 0x13ef 0xd
WriteConsoleW 0x1414 0xe
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-datetime-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 cb978304b79ef53962408c611dfb20f5 Copy to Clipboard
SHA1 eca42f7754fb0017e86d50d507674981f80bc0b9 Copy to Clipboard
SHA256 90fae0e7c3644a6754833c42b0ac39b6f23859f9a7cf4b6c8624820f59b9dad3 Copy to Clipboard
SSDeep 192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2104-07-08 06:18:41+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x210 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 2.76
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (4)
»
Api name EAT Address Ordinal
GetDateFormatA 0x1183 0x1
GetDateFormatW 0x11aa 0x2
GetTimeFormatA 0x11d1 0x3
GetTimeFormatW 0x11f8 0x4
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-debug-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 88ff191fd8648099592ed28ee6c442a5 Copy to Clipboard
SHA1 6a4f818b53606a5602c609ec343974c2103bc9cc Copy to Clipboard
SHA256 c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d Copy to Clipboard
SSDeep 384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1980-01-30 01:26:33+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x21b 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 2.89
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (4)
»
Api name EAT Address Ordinal
DebugBreak 0x117c 0x1
IsDebuggerPresent 0x11a2 0x2
OutputDebugStringA 0x11d0 0x3
OutputDebugStringW 0x11ff 0x4
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-errorhandling-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 6d778e83f74a4c7fe4c077dc279f6867 Copy to Clipboard
SHA1 f5d9cf848f79a57f690da9841c209b4837c2e6c3 Copy to Clipboard
SHA256 a97dcca76cdb12e985dff71040815f28508c655ab2b073512e386dd63f4da325 Copy to Clipboard
SSDeep 192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2093-08-14 04:06:52+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x2c6 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.71
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (7)
»
Api name EAT Address Ordinal
GetErrorMode 0x11a4 0x1
GetLastError 0x11c7 0x2
RaiseException 0x11ec 0x3
SetErrorMode 0x1211 0x4
SetLastError 0x1234 0x5
SetUnhandledExceptionFilter 0x1266 0x6
UnhandledExceptionFilter 0x12a4 0x7
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 21.30 KB
MD5 94ae25c7a5497ca0be6882a00644ca64 Copy to Clipboard
SHA1 f7ac28bbc47e46485025a51eeb6c304b70cee215 Copy to Clipboard
SHA256 7ea06b7050f9ea2bcc12af34374bdf1173646d4e5ebf66ad690b37f4df5f3d4e Copy to Clipboard
SSDeep 384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x1200
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1980-11-26 19:37:56+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x10f7 0x1200 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.05
.rsrc 0x10003000 0x3f0 0x400 0x1400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (75)
»
Api name EAT Address Ordinal
CompareFileTime 0x1436 0x1
CreateDirectoryA 0x1460 0x2
CreateDirectoryW 0x148b 0x3
CreateFileA 0x14b1 0x4
CreateFileW 0x14d2 0x5
DefineDosDeviceW 0x14f8 0x6
DeleteFileA 0x151e 0x7
DeleteFileW 0x153f 0x8
DeleteVolumeMountPointW 0x156c 0x9
FileTimeToLocalFileTime 0x15a5 0xa
FindClose 0x15d0 0xb
FindCloseChangeNotification 0x15ff 0xc
FindFirstChangeNotificationA 0x1641 0xd
FindFirstChangeNotificationW 0x1684 0xe
FindFirstFileA 0x16b9 0xf
FindFirstFileExA 0x16e2 0x10
FindFirstFileExW 0x170d 0x11
FindFirstFileW 0x1736 0x12
FindFirstVolumeW 0x175f 0x13
FindNextChangeNotification 0x1794 0x14
FindNextFileA 0x17c6 0x15
FindNextFileW 0x17eb 0x16
FindNextVolumeW 0x1812 0x17
FindVolumeClose 0x183b 0x18
FlushFileBuffers 0x1865 0x19
GetDiskFreeSpaceA 0x1891 0x1a
GetDiskFreeSpaceExA 0x18c0 0x1b
GetDiskFreeSpaceExW 0x18f1 0x1c
GetDiskFreeSpaceW 0x1920 0x1d
GetDriveTypeA 0x1949 0x1e
GetDriveTypeW 0x196e 0x1f
GetFileAttributesA 0x1998 0x20
GetFileAttributesExA 0x19c9 0x21
GetFileAttributesExW 0x19fc 0x22
GetFileAttributesW 0x1a2d 0x23
GetFileInformationByHandle 0x1a64 0x24
GetFileSize 0x1a94 0x25
GetFileSizeEx 0x1ab7 0x26
GetFileTime 0x1ada 0x27
GetFileType 0x1afb 0x28
GetFinalPathNameByHandleA 0x1b2a 0x29
GetFinalPathNameByHandleW 0x1b67 0x2a
GetFullPathNameA 0x1b9b 0x2b
GetFullPathNameW 0x1bc6 0x2c
GetLogicalDriveStringsW 0x1bf8 0x2d
GetLogicalDrives 0x1c2a 0x2e
GetLongPathNameA 0x1c55 0x2f
GetLongPathNameW 0x1c80 0x30
GetShortPathNameW 0x1cac 0x31
GetTempFileNameW 0x1cd8 0x32
GetVolumeInformationByHandleW 0x1d10 0x33
GetVolumeInformationW 0x1d4d 0x34
GetVolumePathNameW 0x1d7f 0x35
LocalFileTimeToFileTime 0x1db3 0x36
LockFile 0x1ddd 0x37
LockFileEx 0x1dfa 0x38
QueryDosDeviceW 0x1e1e 0x39
ReadFile 0x1e40 0x3a
ReadFileEx 0x1e5d 0x3b
ReadFileScatter 0x1e81 0x3c
RemoveDirectoryA 0x1eab 0x3d
RemoveDirectoryW 0x1ed6 0x3e
SetEndOfFile 0x1efd 0x3f
SetFileAttributesA 0x1f26 0x40
SetFileAttributesW 0x1f55 0x41
SetFileInformationByHandle 0x1f8c 0x42
SetFilePointer 0x1fbf 0x43
SetFilePointerEx 0x1fe8 0x44
SetFileTime 0x200e 0x45
SetFileValidData 0x2034 0x46
UnlockFile 0x2059 0x47
UnlockFileEx 0x207a 0x48
WriteFile 0x209a 0x49
WriteFileEx 0x20b9 0x4a
WriteFileGather 0x20de 0x4b
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l1-2-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 e2f648ae40d234a3892e1455b4dbbe05 Copy to Clipboard
SHA1 d9d750e828b629cfb7b402a3442947545d8d781b Copy to Clipboard
SHA256 c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03 Copy to Clipboard
SSDeep 192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2010-09-03 20:48:21+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x23c 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.19
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (4)
»
Api name EAT Address Ordinal
CreateFile2 0x116c 0x1
GetTempPathW 0x118e 0x2
GetVolumeNameForVolumeMountPointW 0x11c6 0x3
GetVolumePathNamesForVolumeNameW 0x1212 0x4
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l2-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 e479444bdd4ae4577fd32314a68f5d28 Copy to Clipboard
SHA1 77edf9509a252e886d4da388bf9c9294d95498eb Copy to Clipboard
SHA256 c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719 Copy to Clipboard
SSDeep 192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2036-05-22 06:29:08+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x37d 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.64
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (11)
»
Api name EAT Address Ordinal
CopyFile2 0x11b0 0x1
CopyFileExW 0x11cf 0x2
CreateDirectoryExW 0x11f7 0x3
CreateHardLinkW 0x1223 0x4
CreateSymbolicLinkW 0x1250 0x5
GetFileInformationByHandleEx 0x128a 0x6
MoveFileExW 0x12bc 0x7
MoveFileWithProgressW 0x12e7 0x8
ReOpenFile 0x1311 0x9
ReadDirectoryChangesW 0x133b 0xa
ReplaceFileW 0x1367 0xb
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-handle-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 6db54065b33861967b491dd1c8fd8595 Copy to Clipboard
SHA1 ed0938bbc0e2a863859aad64606b8fc4c69b810a Copy to Clipboard
SHA256 945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5 Copy to Clipboard
SSDeep 384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2008-02-02 03:17:29+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x25f 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.24
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (5)
»
Api name EAT Address Ordinal
CloseHandle 0x1188 0x1
CompareObjectHandles 0x11b2 0x2
DuplicateHandle 0x11e0 0x3
GetHandleInformation 0x120e 0x4
SetHandleInformation 0x1241 0x5
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-heap-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 2ea3901d7b50bf6071ec8732371b821c Copy to Clipboard
SHA1 e7be926f0f7d842271f7edc7a4989544f4477da7 Copy to Clipboard
SHA256 44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a Copy to Clipboard
SSDeep 192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2071-09-01 04:16:53+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x3f8 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.93
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (16)
»
Api name EAT Address Ordinal
GetProcessHeap 0x11e7 0x1
GetProcessHeaps 0x120f 0x2
HeapAlloc 0x1232 0x3
HeapCompact 0x1251 0x4
HeapCreate 0x1271 0x5
HeapDestroy 0x1291 0x6
HeapFree 0x12af 0x7
HeapLock 0x12ca 0x8
HeapQueryInformation 0x12f1 0x9
HeapReAlloc 0x131b 0xa
HeapSetInformation 0x1343 0xb
HeapSize 0x1368 0xc
HeapSummary 0x1386 0xd
HeapUnlock 0x13a6 0xe
HeapValidate 0x13c7 0xf
HeapWalk 0x13e6 0x10
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-interlocked-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.44 KB
MD5 d97a1cb141c6806f0101a5ed2673a63d Copy to Clipboard
SHA1 d31a84c1499a9128a8f0efea4230fcfa6c9579be Copy to Clipboard
SHA256 deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c Copy to Clipboard
SSDeep 192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2052-12-12 20:31:39+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x414 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.88
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (11)
»
Api name EAT Address Ordinal
InitializeSListHead 0x11d1 0x1
InterlockedCompareExchange 0x124c 0x3
InterlockedCompareExchange64 0x120b 0x2
InterlockedDecrement 0x1285 0x4
InterlockedExchange 0x12b7 0x5
InterlockedExchangeAdd 0x12eb 0x6
InterlockedFlushSList 0x1321 0x7
InterlockedIncrement 0x1355 0x8
InterlockedPopEntrySList 0x138c 0x9
InterlockedPushEntrySList 0x13c8 0xa
QueryDepthSList 0x13fb 0xb
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-libraryloader-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 d0873e21721d04e20b6ffb038accf2f1 Copy to Clipboard
SHA1 9e39e505d80d67b347b19a349a1532746c1f7f88 Copy to Clipboard
SHA256 bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce Copy to Clipboard
SSDeep 384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2027-07-04 17:26:46+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x50b 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.54
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (18)
»
Api name EAT Address Ordinal
DisableThreadLibraryCalls 0x121f 0x1
FindResourceExW 0x1252 0x2
FindStringOrdinal 0x127d 0x3
FreeLibrary 0x12a4 0x4
FreeLibraryAndExitThread 0x12d2 0x5
FreeResource 0x1301 0x6
GetModuleFileNameA 0x132a 0x7
GetModuleFileNameW 0x1359 0x8
GetModuleHandleA 0x1386 0x9
GetModuleHandleExA 0x13b3 0xa
GetModuleHandleExW 0x13e2 0xb
GetModuleHandleW 0x140f 0xc
GetProcAddress 0x1438 0xd
LoadLibraryExA 0x145f 0xe
LoadLibraryExW 0x1486 0xf
LoadResource 0x14ab 0x10
LockResource 0x14ce 0x11
SizeofResource 0x14f3 0x12
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-localization-l1-2-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 20.30 KB
MD5 eff11130bfe0d9c90c0026bf2fb219ae Copy to Clipboard
SHA1 cf4c89a6e46090d3d8feeb9eb697aea8a26e4088 Copy to Clipboard
SHA256 03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97 Copy to Clipboard
SSDeep 384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0xe00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2099-12-20 04:00:19+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xdc7 0xe00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.23
.rsrc 0x10002000 0x3f0 0x400 0x1000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (59)
»
Api name EAT Address Ordinal
ConvertDefaultLocale 0x13b3 0x1
EnumSystemGeoID 0x13e1 0x2
EnumSystemLocalesA 0x140d 0x3
EnumSystemLocalesW 0x143c 0x4
FindNLSString 0x1466 0x5
FindNLSStringEx 0x148d 0x6
FormatMessageA 0x14b5 0x7
FormatMessageW 0x14dc 0x8
GetACP 0x14fb 0x9
GetCPInfo 0x1515 0xa
GetCPInfoExW 0x1535 0xb
GetCalendarInfoEx 0x155d 0xc
GetCalendarInfoW 0x1589 0xd
GetFileMUIInfo 0x15b2 0xe
GetFileMUIPath 0x15d9 0xf
GetGeoInfoW 0x15fd 0x10
GetLocaleInfoA 0x1621 0x11
GetLocaleInfoEx 0x1649 0x12
GetLocaleInfoW 0x1671 0x13
GetNLSVersion 0x1697 0x14
GetNLSVersionEx 0x16be 0x15
GetOEMCP 0x16e0 0x16
GetProcessPreferredUILanguages 0x1711 0x17
GetSystemDefaultLCID 0x174e 0x18
GetSystemDefaultLangID 0x1783 0x19
GetSystemPreferredUILanguages 0x17c1 0x1a
GetThreadLocale 0x17f8 0x1b
GetThreadPreferredUILanguages 0x182f 0x1c
GetThreadUILanguage 0x186a 0x1d
GetUILanguageInfo 0x1899 0x1e
GetUserDefaultLCID 0x18c7 0x1f
GetUserDefaultLangID 0x18f8 0x20
GetUserDefaultLocaleName 0x192f 0x21
GetUserGeoID 0x195e 0x22
GetUserPreferredUILanguages 0x1990 0x23
IdnToAscii 0x19c0 0x24
IdnToUnicode 0x19e1 0x25
IsDBCSLeadByte 0x1a06 0x26
IsDBCSLeadByteEx 0x1a2f 0x27
IsNLSDefinedString 0x1a5c 0x28
IsValidCodePage 0x1a88 0x29
IsValidLanguageGroup 0x1ab6 0x2a
IsValidLocale 0x1ae2 0x2b
IsValidLocaleName 0x1b0b 0x2c
IsValidNLSVersion 0x1b38 0x2d
LCMapStringA 0x1b60 0x2e
LCMapStringEx 0x1b84 0x2f
LCMapStringW 0x1ba8 0x30
LocaleNameToLCID 0x1bcf 0x31
ResolveLocaleName 0x1bfb 0x32
SetCalendarInfoW 0x1c27 0x33
SetLocaleInfoW 0x1c50 0x34
SetProcessPreferredUILanguages 0x1c87 0x35
SetThreadLocale 0x1cbf 0x36
SetThreadPreferredUILanguages 0x1cf6 0x37
SetThreadUILanguage 0x1d31 0x38
SetUserGeoID 0x1d5b 0x39
VerLanguageNameA 0x1d82 0x3a
VerLanguageNameW 0x1dad 0x3b
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-memory-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 d500d9e24f33933956df0e26f087fd91 Copy to Clipboard
SHA1 6c537678ab6cfd6f3ea0dc0f5abefd1c4924f0c0 Copy to Clipboard
SHA256 bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca Copy to Clipboard
SSDeep 384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1991-05-07 00:38:52+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x46c 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.11
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (16)
»
Api name EAT Address Ordinal
CreateFileMappingW 0x11fd 0x1
FlushViewOfFile 0x1229 0x2
MapViewOfFile 0x1250 0x3
MapViewOfFileEx 0x1277 0x4
OpenFileMappingW 0x12a1 0x5
ReadProcessMemory 0x12cd 0x6
UnmapViewOfFile 0x12f8 0x7
VirtualAlloc 0x131e 0x8
VirtualAllocEx 0x1343 0x9
VirtualFree 0x1367 0xa
VirtualFreeEx 0x138a 0xb
VirtualProtect 0x13b0 0xc
VirtualProtectEx 0x13d9 0xd
VirtualQuery 0x1400 0xe
VirtualQueryEx 0x1425 0xf
WriteProcessMemory 0x1450 0x10
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-namedpipe-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 6f6796d1278670cce6e2d85199623e27 Copy to Clipboard
SHA1 8aa2155c3d3d5aa23f56cd0bc507255fc953ccc3 Copy to Clipboard
SHA256 c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507 Copy to Clipboard
SSDeep 192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2094-02-27 02:21:20+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x391 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.48
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (10)
»
Api name EAT Address Ordinal
ConnectNamedPipe 0x11c2 0x1
CreateNamedPipeW 0x11ed 0x2
CreatePipe 0x1212 0x3
DisconnectNamedPipe 0x123a 0x4
GetNamedPipeClientComputerNameW 0x1277 0x5
ImpersonateNamedPipeClient 0x12bb 0x6
PeekNamedPipe 0x12ed 0x7
SetNamedPipeHandleState 0x131c 0x8
TransactNamedPipe 0x134f 0x9
WaitNamedPipeW 0x1379 0xa
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processenvironment-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 5f73a814936c8e7e4a2dfd68876143c8 Copy to Clipboard
SHA1 d960016c4f553e461afb5b06b039a15d2e76135e Copy to Clipboard
SHA256 96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e Copy to Clipboard
SSDeep 192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2050-07-08 10:36:25+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x647 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.33
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (21)
»
Api name EAT Address Ordinal
ExpandEnvironmentStringsA 0x1242 0x1
ExpandEnvironmentStringsW 0x127f 0x2
FreeEnvironmentStringsA 0x12ba 0x3
FreeEnvironmentStringsW 0x12f3 0x4
GetCommandLineA 0x1324 0x5
GetCommandLineW 0x134d 0x6
GetCurrentDirectoryA 0x137b 0x7
GetCurrentDirectoryW 0x13ae 0x8
GetEnvironmentStrings 0x13e2 0x9
GetEnvironmentStringsW 0x1418 0xa
GetEnvironmentVariableA 0x1450 0xb
GetEnvironmentVariableW 0x1489 0xc
GetStdHandle 0x14b7 0xd
SearchPathW 0x14d9 0xe
SetCurrentDirectoryA 0x1503 0xf
SetCurrentDirectoryW 0x1536 0x10
SetEnvironmentStringsW 0x156b 0x11
SetEnvironmentVariableA 0x15a3 0x12
SetEnvironmentVariableW 0x15dc 0x13
SetStdHandle 0x160a 0x14
SetStdHandleEx 0x162f 0x15
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processthreads-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.94 KB
MD5 a2d7d7711f9c0e3e065b2929ff342666 Copy to Clipboard
SHA1 a17b1f36e73b82ef9bfb831058f187535a550eb8 Copy to Clipboard
SHA256 9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d Copy to Clipboard
SSDeep 384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0xc00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2066-01-02 15:06:27+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xbe3 0xc00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.08
.rsrc 0x10002000 0x3f0 0x400 0xe00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (49)
»
Api name EAT Address Ordinal
CreateProcessA 0x134b 0x1
CreateProcessAsUserW 0x1378 0x2
CreateProcessW 0x13a5 0x3
CreateRemoteThread 0x13d0 0x4
CreateRemoteThreadEx 0x1401 0x5
CreateThread 0x142c 0x6
DeleteProcThreadAttributeList 0x1460 0x7
ExitProcess 0x1493 0x8
ExitThread 0x14b3 0x9
FlushProcessWriteBuffers 0x14e0 0xa
GetCurrentProcess 0x1514 0xb
GetCurrentProcessId 0x1543 0xc
GetCurrentThread 0x1571 0xd
GetCurrentThreadId 0x159e 0xe
GetExitCodeProcess 0x15cd 0xf
GetExitCodeThread 0x15fb 0x10
GetPriorityClass 0x1627 0x11
GetProcessId 0x164e 0x12
GetProcessIdOfThread 0x1679 0x13
GetProcessTimes 0x16a7 0x14
GetProcessVersion 0x16d2 0x15
GetStartupInfoW 0x16fd 0x16
GetThreadId 0x1722 0x17
GetThreadPriority 0x1749 0x18
GetThreadPriorityBoost 0x177b 0x19
InitializeProcThreadAttributeList 0x17bd 0x1a
OpenProcessToken 0x17f9 0x1b
OpenThread 0x181e 0x1c
OpenThreadToken 0x1842 0x1d
ProcessIdToSessionId 0x1870 0x1e
QueryProcessAffinityUpdateMode 0x18ad 0x1f
QueueUserAPC 0x18e2 0x20
ResumeThread 0x1905 0x21
SetPriorityClass 0x192c 0x22
SetProcessAffinityUpdateMode 0x1963 0x23
SetProcessShutdownParameters 0x19a6 0x24
SetThreadPriority 0x19de 0x25
SetThreadPriorityBoost 0x1a10 0x26
SetThreadStackGuarantee 0x1a48 0x27
SetThreadToken 0x1a78 0x28
SuspendThread 0x1a9e 0x29
SwitchToThread 0x1ac4 0x2a
TerminateProcess 0x1aed 0x2b
TerminateThread 0x1b17 0x2c
TlsAlloc 0x1b39 0x2d
TlsFree 0x1b53 0x2e
TlsGetValue 0x1b70 0x2f
TlsSetValue 0x1b91 0x30
UpdateProcThreadAttribute 0x1bc0 0x31
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processthreads-l1-1-1.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 d0289835d97d103bad0dd7b9637538a1 Copy to Clipboard
SHA1 8ceebe1e9abb0044808122557de8aab28ad14575 Copy to Clipboard
SHA256 91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a Copy to Clipboard
SSDeep 384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2084-10-18 13:20:17+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x4da 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.39
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (14)
»
Api name EAT Address Ordinal
FlushInstructionCache 0x11f4 0x1
GetCurrentProcessorNumber 0x122d 0x2
GetCurrentProcessorNumberEx 0x126c 0x3
GetCurrentThreadStackLimits 0x12ad 0x4
GetProcessHandleCount 0x12e8 0x5
GetProcessMitigationPolicy 0x1322 0x6
GetThreadContext 0x1357 0x7
GetThreadIdealProcessorEx 0x138b 0x8
GetThreadTimes 0x13bd 0x9
IsProcessorFeaturePresent 0x13ef 0xa
OpenProcess 0x141e 0xb
SetProcessMitigationPolicy 0x144e 0xc
SetThreadContext 0x1483 0xd
SetThreadIdealProcessorEx 0x14b7 0xe
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-profile-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.30 KB
MD5 fee0926aa1bf00f2bec9da5db7b2de56 Copy to Clipboard
SHA1 f5a4eb3d8ac8fb68af716857629a43cd6be63473 Copy to Clipboard
SHA256 8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c Copy to Clipboard
SSDeep 192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x200
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2087-01-16 03:30:42+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1d5 0x200 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.25
.rsrc 0x10002000 0x3f0 0x400 0x400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (2)
»
Api name EAT Address Ordinal
QueryPerformanceCounter 0x1177 0x1
QueryPerformanceFrequency 0x11b2 0x2
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-rtlsupport-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.30 KB
MD5 fdba0db0a1652d86cd471eaa509e56ea Copy to Clipboard
SHA1 3197cb45787d47bac80223e3e98851e48a122efa Copy to Clipboard
SHA256 2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57 Copy to Clipboard
SSDeep 384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x200
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1991-09-02 22:58:18+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1e8 0x200 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.36
.rsrc 0x10002000 0x3f0 0x400 0x400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (3)
»
Api name EAT Address Ordinal
RtlCaptureContext 0x117e 0x1
RtlCaptureStackBackTrace 0x11af 0x2
RtlUnwind 0x11d8 0x3
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-string-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 12cc7d8017023ef04ebdd28ef9558305 Copy to Clipboard
SHA1 f859a66009d1caae88bf36b569b63e1fbdae9493 Copy to Clipboard
SHA256 7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311 Copy to Clipboard
SSDeep 384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1982-05-26 10:44:09+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x2f2 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.96
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (8)
»
Api name EAT Address Ordinal
CompareStringEx 0x11aa 0x1
CompareStringOrdinal 0x11d8 0x2
CompareStringW 0x1205 0x3
FoldStringW 0x1229 0x4
GetStringTypeExW 0x124f 0x5
GetStringTypeW 0x1278 0x6
MultiByteToWideChar 0x12a4 0x7
WideCharToMultiByte 0x12d5 0x8
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-synch-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 19.80 KB
MD5 71af7ed2a72267aaad8564524903cff6 Copy to Clipboard
SHA1 8a8437123de5a22ab843adc24a01ac06f48db0d3 Copy to Clipboard
SHA256 5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f Copy to Clipboard
SSDeep 384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0xc00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1996-08-13 19:03:36+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xa56 0xc00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.71
.rsrc 0x10002000 0x3f0 0x400 0xe00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (41)
»
Api name EAT Address Ordinal
AcquireSRWLockExclusive 0x12fb 0x1
AcquireSRWLockShared 0x1331 0x2
CancelWaitableTimer 0x1363 0x3
CreateEventA 0x138d 0x4
CreateEventExA 0x13b2 0x5
CreateEventExW 0x13d9 0x6
CreateEventW 0x13fe 0x7
CreateMutexA 0x1421 0x8
CreateMutexExA 0x1446 0x9
CreateMutexExW 0x146d 0xa
CreateMutexW 0x1492 0xb
CreateSemaphoreExW 0x14bb 0xc
CreateWaitableTimerExW 0x14ee 0xd
DeleteCriticalSection 0x1524 0xe
EnterCriticalSection 0x1558 0xf
InitializeCriticalSection 0x1590 0x10
InitializeCriticalSectionAndSpinCount 0x15d9 0x11
InitializeCriticalSectionEx 0x1624 0x12
InitializeSRWLock 0x165b 0x13
LeaveCriticalSection 0x168b 0x14
OpenEventA 0x16b4 0x15
OpenEventW 0x16d3 0x16
OpenMutexW 0x16f2 0x17
OpenSemaphoreW 0x1715 0x18
OpenWaitableTimerW 0x1740 0x19
ReleaseMutex 0x1769 0x1a
ReleaseSRWLockExclusive 0x1797 0x1b
ReleaseSRWLockShared 0x17cd 0x1c
ReleaseSemaphore 0x17fc 0x1d
ResetEvent 0x1821 0x1e
SetCriticalSectionSpinCount 0x1851 0x1f
SetEvent 0x187f 0x20
SetWaitableTimer 0x18a2 0x21
SetWaitableTimerEx 0x18cf 0x22
SleepEx 0x18f3 0x23
TryAcquireSRWLockExclusive 0x191f 0x24
TryAcquireSRWLockShared 0x195b 0x25
TryEnterCriticalSection 0x1994 0x26
WaitForMultipleObjectsEx 0x19ce 0x27
WaitForSingleObject 0x1a04 0x28
WaitForSingleObjectEx 0x1a37 0x29
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-synch-l1-2-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 0d1aa99ed8069ba73cfd74b0fddc7b3a Copy to Clipboard
SHA1 ba1f5384072df8af5743f81fd02c98773b5ed147 Copy to Clipboard
SHA256 30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1 Copy to Clipboard
SSDeep 384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2017-07-23 22:59:36+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x576 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.7
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (17)
»
Api name EAT Address Ordinal
DeleteSynchronizationBarrier 0x1210 0x1
EnterSynchronizationBarrier 0x1252 0x2
InitOnceBeginInitialize 0x128f 0x3
InitOnceComplete 0x12c1 0x4
InitOnceExecuteOnce 0x12ef 0x5
InitOnceInitialize 0x131f 0x6
InitializeConditionVariable 0x1357 0x7
InitializeSynchronizationBarrier 0x139d 0x8
SignalObjectAndWait 0x13db 0x9
Sleep 0x13fe 0xa
SleepConditionVariableCS 0x1426 0xb
SleepConditionVariableSRW 0x1462 0xc
WaitOnAddress 0x1493 0xd
WakeAllConditionVariable 0x14c3 0xe
WakeByAddressAll 0x14f6 0xf
WakeByAddressSingle 0x1524 0x10
WakeConditionVariable 0x1557 0x11
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-sysinfo-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 19a40af040bd7add901aa967600259d9 Copy to Clipboard
SHA1 05b6322979b0b67526ae5cd6e820596cbe7393e4 Copy to Clipboard
SHA256 4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92 Copy to Clipboard
SSDeep 384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2002-07-28 05:58:26+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x645 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.39
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (22)
»
Api name EAT Address Ordinal
GetComputerNameExA 0x123a 0x1
GetComputerNameExW 0x1269 0x2
GetLocalTime 0x1292 0x3
GetLogicalProcessorInformation 0x12c7 0x4
GetLogicalProcessorInformationEx 0x1310 0x5
GetSystemDirectoryA 0x134e 0x6
GetSystemDirectoryW 0x137f 0x7
GetSystemInfo 0x13aa 0x8
GetSystemTime 0x13cf 0x9
GetSystemTimeAdjustment 0x13fe 0xa
GetSystemTimeAsFileTime 0x1437 0xb
GetSystemWindowsDirectoryA 0x1473 0xc
GetSystemWindowsDirectoryW 0x14b2 0xd
GetTickCount 0x150a 0xf
GetTickCount64 0x14e5 0xe
GetVersion 0x152b 0x10
GetVersionExA 0x154d 0x11
GetVersionExW 0x1572 0x12
GetWindowsDirectoryA 0x159e 0x13
GetWindowsDirectoryW 0x15d1 0x14
GlobalMemoryStatusEx 0x1604 0x15
SetLocalTime 0x162f 0x16
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-timezone-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 babf80608fd68a09656871ec8597296c Copy to Clipboard
SHA1 33952578924b0376ca4ae6a10b8d4ed749d10688 Copy to Clipboard
SHA256 24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca Copy to Clipboard
SSDeep 384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2034-03-22 16:36:28+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x3db 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.73
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (9)
»
Api name EAT Address Ordinal
FileTimeToSystemTime 0x11bb 0x1
GetDynamicTimeZoneInformation 0x11f7 0x2
GetTimeZoneInformation 0x1235 0x3
GetTimeZoneInformationForYear 0x1273 0x4
SetDynamicTimeZoneInformation 0x12b8 0x5
SetTimeZoneInformation 0x12f6 0x6
SystemTimeToFileTime 0x132b 0x7
SystemTimeToTzSpecificLocalTime 0x1369 0x8
TzSpecificLocalTimeToSystemTime 0x13b2 0x9
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-util-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 0f079489abd2b16751ceb7447512a70d Copy to Clipboard
SHA1 679dd712ed1c46fbd9bc8615598da585d94d5d87 Copy to Clipboard
SHA256 f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86 Copy to Clipboard
SSDeep 192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2061-02-14 06:53:13+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x229 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.0
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (5)
»
Api name EAT Address Ordinal
Beep 0x116f 0x1
DecodePointer 0x118b 0x2
DecodeSystemPointer 0x11b6 0x3
EncodePointer 0x11e1 0x4
EncodeSystemPointer 0x120c 0x5
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-conio-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 6ea692f862bdeb446e649e4b2893e36f Copy to Clipboard
SHA1 84fceae03d28ff1907048acee7eae7e45baaf2bd Copy to Clipboard
SHA256 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2 Copy to Clipboard
SSDeep 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2059-10-13 02:38:07+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x6f0 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.46
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (30)
»
Api name EAT Address Ordinal
__conio_common_vcprintf 0x128c 0x1
__conio_common_vcprintf_p 0x12c7 0x2
__conio_common_vcprintf_s 0x1304 0x3
__conio_common_vcscanf 0x133e 0x4
__conio_common_vcwprintf 0x1377 0x5
__conio_common_vcwprintf_p 0x13b4 0x6
__conio_common_vcwprintf_s 0x13f3 0x7
__conio_common_vcwscanf 0x142f 0x8
_cgets 0x1457 0x9
_cgets_s 0x1470 0xa
_cgetws 0x148a 0xb
_cgetws_s 0x14a5 0xc
_cputs 0x14bf 0xd
_cputws 0x14d7 0xe
_getch 0x14ef 0xf
_getch_nolock 0x150d 0x10
_getche 0x152c 0x11
_getche_nolock 0x154c 0x12
_getwch 0x156c 0x13
_getwch_nolock 0x158c 0x14
_getwche 0x15ad 0x15
_getwche_nolock 0x15cf 0x16
_putch 0x15ef 0x17
_putch_nolock 0x160d 0x18
_putwch 0x162c 0x19
_putwch_nolock 0x164c 0x1a
_ungetch 0x166d 0x1b
_ungetch_nolock 0x168f 0x1c
_ungetwch 0x16b2 0x1d
_ungetwch_nolock 0x16d6 0x1e
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-convert-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 21.80 KB
MD5 72e28c902cd947f9a3425b19ac5a64bd Copy to Clipboard
SHA1 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7 Copy to Clipboard
SHA256 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1 Copy to Clipboard
SSDeep 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x1400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2073-04-13 15:13:55+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x12fe 0x1400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.7
.rsrc 0x10003000 0x3f0 0x400 0x1600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (122)
»
Api name EAT Address Ordinal
__toascii 0x1628 0x1
_atodbl 0x1643 0x2
_atodbl_l 0x165e 0x3
_atof_l 0x1679 0x4
_atoflt 0x1692 0x5
_atoflt_l 0x16ad 0x6
_atoi64 0x16c8 0x7
_atoi64_l 0x16e3 0x8
_atoi_l 0x16fe 0x9
_atol_l 0x1717 0xa
_atoldbl 0x1731 0xb
_atoldbl_l 0x174e 0xc
_atoll_l 0x176b 0xd
_ecvt 0x1783 0xe
_ecvt_s 0x179a 0xf
_fcvt 0x17b1 0x10
_fcvt_s 0x17c8 0x11
_gcvt 0x17df 0x12
_gcvt_s 0x17f6 0x13
_i64toa 0x180f 0x14
_i64toa_s 0x182a 0x15
_i64tow 0x1845 0x16
_i64tow_s 0x1860 0x17
_itoa 0x1879 0x18
_itoa_s 0x1890 0x19
_itow 0x18a7 0x1a
_itow_s 0x18be 0x1b
_ltoa 0x18d5 0x1c
_ltoa_s 0x18ec 0x1d
_ltow 0x1903 0x1e
_ltow_s 0x191a 0x1f
_strtod_l 0x1935 0x20
_strtof_l 0x1952 0x21
_strtoi64 0x196f 0x22
_strtoi64_l 0x198e 0x23
_strtoimax_l 0x19b0 0x24
_strtol_l 0x19d0 0x25
_strtold_l 0x19ee 0x26
_strtoll_l 0x1a0d 0x27
_strtoui64 0x1a2c 0x28
_strtoui64_l 0x1a4d 0x29
_strtoul_l 0x1a6e 0x2a
_strtoull_l 0x1a8e 0x2b
_strtoumax_l 0x1ab0 0x2c
_ui64toa 0x1acf 0x2d
_ui64toa_s 0x1aec 0x2e
_ui64tow 0x1b09 0x2f
_ui64tow_s 0x1b26 0x30
_ultoa 0x1b41 0x31
_ultoa_s 0x1b5a 0x32
_ultow 0x1b73 0x33
_ultow_s 0x1b8c 0x34
_wcstod_l 0x1ba8 0x35
_wcstof_l 0x1bc5 0x36
_wcstoi64 0x1be2 0x37
_wcstoi64_l 0x1c01 0x38
_wcstoimax_l 0x1c23 0x39
_wcstol_l 0x1c43 0x3a
_wcstold_l 0x1c61 0x3b
_wcstoll_l 0x1c80 0x3c
_wcstombs_l 0x1ca0 0x3d
_wcstombs_s_l 0x1cc3 0x3e
_wcstoui64 0x1ce5 0x3f
_wcstoui64_l 0x1d06 0x40
_wcstoul_l 0x1d27 0x41
_wcstoull_l 0x1d47 0x42
_wcstoumax_l 0x1d69 0x43
_wctomb_l 0x1d89 0x44
_wctomb_s_l 0x1da8 0x45
_wtof 0x1dc3 0x46
_wtof_l 0x1dda 0x47
_wtoi 0x1df1 0x48
_wtoi64 0x1e08 0x49
_wtoi64_l 0x1e23 0x4a
_wtoi_l 0x1e3e 0x4b
_wtol 0x1e55 0x4c
_wtol_l 0x1e6c 0x4d
_wtoll 0x1e84 0x4e
_wtoll_l 0x1e9d 0x4f
atof 0x1eb4 0x50
atoi 0x1ec7 0x51
atol 0x1eda 0x52
atoll 0x1eee 0x53
btowc 0x1f03 0x54
c16rtomb 0x1f1b 0x55
c32rtomb 0x1f36 0x56
mbrtoc16 0x1f51 0x57
mbrtoc32 0x1f6c 0x58
mbrtowc 0x1f86 0x59
mbsrtowcs 0x1fa1 0x5a
mbsrtowcs_s 0x1fc0 0x5b
mbstowcs 0x1fde 0x5c
mbstowcs_s 0x1ffb 0x5d
mbtowc 0x2016 0x5e
strtod 0x202d 0x5f
strtof 0x2044 0x60
strtoimax 0x205e 0x61
strtol 0x2078 0x62
strtold 0x2090 0x63
strtoll 0x20a9 0x64
strtoul 0x20c2 0x65
strtoull 0x20dc 0x66
strtoumax 0x20f8 0x67
wcrtomb 0x2113 0x68
wcrtomb_s 0x212e 0x69
wcsrtombs 0x214b 0x6a
wcsrtombs_s 0x216a 0x6b
wcstod 0x2186 0x6c
wcstof 0x219d 0x6d
wcstoimax 0x21b7 0x6e
wcstol 0x21d1 0x6f
wcstold 0x21e9 0x70
wcstoll 0x2202 0x71
wcstombs 0x221c 0x72
wcstombs_s 0x2239 0x73
wcstoul 0x2255 0x74
wcstoull 0x226f 0x75
wcstoumax 0x228b 0x76
wctob 0x22a4 0x77
wctomb 0x22ba 0x78
wctomb_s 0x22d3 0x79
wctrans 0x22ed 0x7a
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-environment-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 ac290dad7cb4ca2d93516580452eda1c Copy to Clipboard
SHA1 fa949453557d0049d723f9615e4f390010520eda Copy to Clipboard
SHA256 c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382 Copy to Clipboard
SSDeep 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1972-04-21 12:19:18+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x432 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.67
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (18)
»
Api name EAT Address Ordinal
__p__environ 0x121f 0x1
__p__wenviron 0x1243 0x2
_dupenv_s 0x1264 0x3
_putenv 0x127f 0x4
_putenv_s 0x129a 0x5
_searchenv 0x12b8 0x6
_searchenv_s 0x12d9 0x7
_wdupenv_s 0x12fa 0x8
_wgetcwd 0x1317 0x9
_wgetdcwd 0x1333 0xa
_wgetenv 0x134f 0xb
_wgetenv_s 0x136c 0xc
_wputenv 0x1389 0xd
_wputenv_s 0x13a6 0xe
_wsearchenv 0x13c6 0xf
_wsearchenv_s 0x13e9 0x10
getenv 0x1407 0x11
getenv_s 0x1420 0x12
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-filesystem-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 19.80 KB
MD5 aec2268601470050e62cb8066dd41a59 Copy to Clipboard
SHA1 363ed259905442c4e3b89901bfd8a43b96bf25e4 Copy to Clipboard
SHA256 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2 Copy to Clipboard
SSDeep 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/ Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0xc00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2025-08-26 11:12:21+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xbc0 0xc00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.99
.rsrc 0x10002000 0x3f0 0x400 0xe00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (65)
»
Api name EAT Address Ordinal
_access 0x13ef 0x1
_access_s 0x140a 0x2
_chdir 0x1424 0x3
_chdrive 0x143d 0x4
_chmod 0x1456 0x5
_findclose 0x1471 0x6
_findfirst32 0x1492 0x7
_findfirst32i64 0x14b8 0x8
_findfirst64 0x14de 0x9
_findfirst64i32 0x1504 0xa
_findnext32 0x1529 0xb
_findnext32i64 0x154d 0xc
_findnext64 0x1571 0xd
_findnext64i32 0x1595 0xe
_fstat32 0x15b6 0xf
_fstat32i64 0x15d4 0x10
_fstat64 0x15f2 0x11
_fstat64i32 0x1610 0x12
_fullpath 0x162f 0x13
_getdiskfree 0x164f 0x14
_getdrive 0x166f 0x15
_getdrives 0x168d 0x16
_lock_file 0x16ac 0x17
_makepath 0x16ca 0x18
_makepath_s 0x16e9 0x19
_mkdir 0x1705 0x1a
_rmdir 0x171c 0x1b
_splitpath 0x1737 0x1c
_splitpath_s 0x1758 0x1d
_stat32 0x1776 0x1e
_stat32i64 0x1792 0x1f
_stat64 0x17ae 0x20
_stat64i32 0x17ca 0x21
_umask 0x17e5 0x22
_umask_s 0x17fe 0x23
_unlink 0x1818 0x24
_unlock_file 0x1836 0x25
_waccess 0x1855 0x26
_waccess_s 0x1872 0x27
_wchdir 0x188e 0x28
_wchmod 0x18a7 0x29
_wfindfirst32 0x18c6 0x2a
_wfindfirst32i64 0x18ee 0x2b
_wfindfirst64 0x1916 0x2c
_wfindfirst64i32 0x193e 0x2d
_wfindnext32 0x1965 0x2e
_wfindnext32i64 0x198b 0x2f
_wfindnext64 0x19b1 0x30
_wfindnext64i32 0x19d7 0x31
_wfullpath 0x19fb 0x32
_wmakepath 0x1a1a 0x33
_wmakepath_s 0x1a3b 0x34
_wmkdir 0x1a59 0x35
_wremove 0x1a73 0x36
_wrename 0x1a8e 0x37
_wrmdir 0x1aa8 0x38
_wsplitpath 0x1ac5 0x39
_wsplitpath_s 0x1ae8 0x3a
_wstat32 0x1b08 0x3b
_wstat32i64 0x1b26 0x3c
_wstat64 0x1b44 0x3d
_wstat64i32 0x1b62 0x3e
_wunlink 0x1b80 0x3f
remove 0x1b99 0x40
rename 0x1bb0 0x41
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-heap-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 93d3da06bf894f4fa21007bee06b5e7d Copy to Clipboard
SHA1 1e47230a7ebcfaf643087a1929a385e0d554ad15 Copy to Clipboard
SHA256 f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d Copy to Clipboard
SSDeep 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1987-03-31 17:26:34+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x616 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.05
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (27)
»
Api name EAT Address Ordinal
_aligned_free 0x1263 0x1
_aligned_malloc 0x128a 0x2
_aligned_msize 0x12b2 0x3
_aligned_offset_malloc 0x12e1 0x4
_aligned_offset_realloc 0x1319 0x5
_aligned_offset_recalloc 0x1353 0x6
_aligned_realloc 0x1386 0x7
_aligned_recalloc 0x13b2 0x8
_callnewh 0x13d7 0x9
_calloc_base 0x13f7 0xa
_expand 0x1415 0xb
_free_base 0x1431 0xc
_get_heap_handle 0x1456 0xd
_heapchk 0x1479 0xe
_heapmin 0x1494 0xf
_heapwalk 0x14b0 0x10
_malloc_base 0x14d0 0x11
_msize 0x14ed 0x12
_query_new_handler 0x1510 0x13
_query_new_mode 0x153c 0x14
_realloc_base 0x1563 0x15
_recalloc 0x1584 0x16
_set_new_mode 0x15a5 0x17
calloc 0x15c3 0x18
free 0x15d8 0x19
malloc 0x15ed 0x1a
realloc 0x1605 0x1b
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-locale-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 a2f2258c32e3ba9abf9e9e38ef7da8c9 Copy to Clipboard
SHA1 116846ca871114b7c54148ab2d968f364da6142f Copy to Clipboard
SHA256 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33 Copy to Clipboard
SSDeep 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2012-06-17 17:10:20+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x575 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.47
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (20)
»
Api name EAT Address Ordinal
___lc_codepage_func 0x1235 0x1
___lc_collate_cp_func 0x1268 0x2
___lc_locale_name_func 0x129e 0x3
___mb_cur_max_func 0x12d1 0x4
___mb_cur_max_l_func 0x1302 0x5
__initialize_lconv_for_unsigned_char 0x1345 0x6
__pctype_func 0x1381 0x7
__pwctype_func 0x13a7 0x8
_configthreadlocale 0x13d3 0x9
_create_locale 0x13ff 0xa
_free_locale 0x1424 0xb
_get_current_locale 0x144e 0xc
_getmbcp 0x1474 0xd
_lock_locales 0x1494 0xe
_setmbcp 0x14b4 0xf
_unlock_locales 0x14d6 0x10
_wcreate_locale 0x14ff 0x11
_wsetlocale 0x1524 0x12
localeconv 0x1544 0x13
setlocale 0x1562 0x14
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-math-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 28.30 KB
MD5 8b0ba750e7b15300482ce6c961a932f0 Copy to Clipboard
SHA1 71a2f5d76d23e48cef8f258eaad63e586cfc0e19 Copy to Clipboard
SHA256 bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed Copy to Clipboard
SSDeep 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x2e00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1982-09-29 08:09:06+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x2cd7 0x2e00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.07
.rsrc 0x10004000 0x3f0 0x400 0x3000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (314)
»
Api name EAT Address Ordinal
_CIacos 0x1d93 0x1
_CIasin 0x1dac 0x2
_CIatan 0x1dc5 0x3
_CIatan2 0x1ddf 0x4
_CIcos 0x1df8 0x5
_CIcosh 0x1e10 0x6
_CIexp 0x1e28 0x7
_CIfmod 0x1e40 0x8
_CIlog 0x1e58 0x9
_CIlog10 0x1e71 0xa
_CIpow 0x1e8a 0xb
_CIsin 0x1ea1 0xc
_CIsinh 0x1eb9 0xd
_CIsqrt 0x1ed2 0xe
_CItan 0x1eea 0xf
_CItanh 0x1f02 0x10
_Cbuild 0x1f1b 0x11
_Cmulcc 0x1f34 0x12
_Cmulcr 0x1f4d 0x13
_FCbuild 0x1f67 0x14
_FCmulcc 0x1f82 0x15
_FCmulcr 0x1f9d 0x16
_LCbuild 0x1fb8 0x17
_LCmulcc 0x1fd3 0x18
_LCmulcr 0x1fee 0x19
__libm_sse2_acos 0x2011 0x1a
__libm_sse2_acosf 0x203d 0x1b
__libm_sse2_asin 0x2069 0x1c
__libm_sse2_asinf 0x2095 0x1d
__libm_sse2_atan 0x20c1 0x1e
__libm_sse2_atan2 0x20ed 0x1f
__libm_sse2_atanf 0x211a 0x20
__libm_sse2_cos 0x2145 0x21
__libm_sse2_cosf 0x216f 0x22
__libm_sse2_exp 0x2199 0x23
__libm_sse2_expf 0x21c3 0x24
__libm_sse2_log 0x21ed 0x25
__libm_sse2_log10 0x2218 0x26
__libm_sse2_log10f 0x2246 0x27
__libm_sse2_logf 0x2273 0x28
__libm_sse2_pow 0x229d 0x29
__libm_sse2_powf 0x22c7 0x2a
__libm_sse2_sin 0x22f1 0x2b
__libm_sse2_sinf 0x231b 0x2c
__libm_sse2_tan 0x2345 0x2d
__libm_sse2_tanf 0x236f 0x2e
__setusermatherr 0x239a 0x2f
_cabs 0x23ba 0x30
_chgsign 0x23d2 0x31
_chgsignf 0x23ee 0x32
_copysign 0x240b 0x33
_copysignf 0x2429 0x34
_d_int 0x2444 0x35
_dclass 0x245c 0x36
_dexp 0x2473 0x37
_dlog 0x2488 0x38
_dnorm 0x249e 0x39
_dpcomp 0x24b6 0x3a
_dpoly 0x24ce 0x3b
_dscale 0x24e6 0x3c
_dsign 0x24fe 0x3d
_dsin 0x2514 0x3e
_dtest 0x252a 0x3f
_dunscale 0x2544 0x40
_except1 0x2560 0x41
_fd_int 0x257a 0x42
_fdclass 0x2594 0x43
_fdexp 0x25ad 0x44
_fdlog 0x25c4 0x45
_fdnorm 0x25dc 0x46
_fdopen 0x25f5 0x47
_fdpcomp 0x260f 0x48
_fdpoly 0x2629 0x49
_fdscale 0x2643 0x4a
_fdsign 0x265d 0x4b
_fdsin 0x2675 0x4c
_fdtest 0x268d 0x4d
_fdunscale 0x26a9 0x4e
_finite 0x26c5 0x4f
_fpclass 0x26df 0x50
_ftol 0x26f7 0x51
_hypot 0x270d 0x52
_hypotf 0x2725 0x53
_isnan 0x273d 0x54
_j0 0x2751 0x55
_j1 0x2762 0x56
_jn 0x2773 0x57
_ld_int 0x2788 0x58
_ldclass 0x27a2 0x59
_ldexp 0x27bb 0x5a
_ldlog 0x27d2 0x5b
_ldpcomp 0x27eb 0x5c
_ldpoly 0x2805 0x5d
_ldscale 0x281f 0x5e
_ldsign 0x2839 0x5f
_ldsin 0x2851 0x60
_ldtest 0x2869 0x61
_ldunscale 0x2885 0x62
_libm_sse2_acos_precise 0x28b1 0x63
_libm_sse2_asin_precise 0x28ea 0x64
_libm_sse2_atan_precise 0x2923 0x65
_libm_sse2_cos_precise 0x295b 0x66
_libm_sse2_exp_precise 0x2992 0x67
_libm_sse2_log10_precise 0x29cb 0x68
_libm_sse2_log_precise 0x2a04 0x69
_libm_sse2_pow_precise 0x2a3b 0x6a
_libm_sse2_sin_precise 0x2a72 0x6b
_libm_sse2_sqrt_precise 0x2aaa 0x6c
_libm_sse2_tan_precise 0x2ae2 0x6d
_logb 0x2b08 0x6e
_nextafter 0x2b22 0x6f
_scalb 0x2b3d 0x70
_set_SSE2_enable 0x2b5e 0x71
_y0 0x2b7c 0x72
_y1 0x2b8d 0x73
_yn 0x2b9e 0x74
acos 0x2bb0 0x75
acosh 0x2bc4 0x76
acoshf 0x2bda 0x77
acoshl 0x2bf1 0x78
asin 0x2c06 0x79
asinh 0x2c1a 0x7a
asinhf 0x2c30 0x7b
asinhl 0x2c47 0x7c
atan 0x2c5c 0x7d
atan2 0x2c70 0x7e
atanh 0x2c85 0x7f
atanhf 0x2c9b 0x80
atanhl 0x2cb2 0x81
cabs 0x2cc7 0x82
cabsf 0x2cdb 0x83
cabsl 0x2cf0 0x84
cacos 0x2d05 0x85
cacosf 0x2d1b 0x86
cacosh 0x2d32 0x87
cacoshf 0x2d4a 0x88
cacoshl 0x2d63 0x89
cacosl 0x2d7b 0x8a
carg 0x2d90 0x8b
cargf 0x2da4 0x8c
cargl 0x2db9 0x8d
casin 0x2dce 0x8e
casinf 0x2de4 0x8f
casinh 0x2dfb 0x90
casinhf 0x2e13 0x91
casinhl 0x2e2c 0x92
casinl 0x2e44 0x93
catan 0x2e5a 0x94
catanf 0x2e70 0x95
catanh 0x2e87 0x96
catanhf 0x2e9f 0x97
catanhl 0x2eb8 0x98
catanl 0x2ed0 0x99
cbrt 0x2ee5 0x9a
cbrtf 0x2ef9 0x9b
cbrtl 0x2f0e 0x9c
ccos 0x2f22 0x9d
ccosf 0x2f36 0x9e
ccosh 0x2f4b 0x9f
ccoshf 0x2f61 0xa0
ccoshl 0x2f78 0xa1
ccosl 0x2f8e 0xa2
ceil 0x2fa2 0xa3
cexp 0x2fb5 0xa4
cexpf 0x2fc9 0xa5
cexpl 0x2fde 0xa6
cimag 0x2ff3 0xa7
cimagf 0x3009 0xa8
cimagl 0x3020 0xa9
clog 0x3035 0xaa
clog10 0x304a 0xab
clog10f 0x3062 0xac
clog10l 0x307b 0xad
clogf 0x3092 0xae
clogl 0x30a7 0xaf
conj 0x30bb 0xb0
conjf 0x30cf 0xb1
conjl 0x30e4 0xb2
copysign 0x30fc 0xb3
copysignf 0x3118 0xb4
copysignl 0x3135 0xb5
cos 0x314c 0xb6
cosh 0x315e 0xb7
cpow 0x3171 0xb8
cpowf 0x3185 0xb9
cpowl 0x319a 0xba
cproj 0x31af 0xbb
cprojf 0x31c5 0xbc
cprojl 0x31dc 0xbd
creal 0x31f2 0xbe
crealf 0x3208 0xbf
creall 0x321f 0xc0
csin 0x3234 0xc1
csinf 0x3248 0xc2
csinh 0x325d 0xc3
csinhf 0x3273 0xc4
csinhl 0x328a 0xc5
csinl 0x32a0 0xc6
csqrt 0x32b5 0xc7
csqrtf 0x32cb 0xc8
csqrtl 0x32e2 0xc9
ctan 0x32f7 0xca
ctanf 0x330b 0xcb
ctanh 0x3320 0xcc
ctanhf 0x3336 0xcd
ctanhl 0x334d 0xce
ctanl 0x3363 0xcf
erf 0x3376 0xd0
erfc 0x3388 0xd1
erfcf 0x339c 0xd2
erfcl 0x33b1 0xd3
erff 0x33c5 0xd4
erfl 0x33d8 0xd5
exp 0x33ea 0xd6
exp2 0x33fc 0xd7
exp2f 0x3410 0xd8
exp2l 0x3425 0xd9
expm1 0x343a 0xda
expm1f 0x3450 0xdb
expm1l 0x3467 0xdc
fabs 0x347c 0xdd
fdim 0x348f 0xde
fdimf 0x34a3 0xdf
fdiml 0x34b8 0xe0
floor 0x34cd 0xe1
fma 0x34e0 0xe2
fmaf 0x34f2 0xe3
fmal 0x3505 0xe4
fmax 0x3518 0xe5
fmaxf 0x352c 0xe6
fmaxl 0x3541 0xe7
fmin 0x3555 0xe8
fminf 0x3569 0xe9
fminl 0x357e 0xea
fmod 0x3592 0xeb
frexp 0x35a6 0xec
hypot 0x35bb 0xed
ilogb 0x35d0 0xee
ilogbf 0x35e6 0xef
ilogbl 0x35fd 0xf0
ldexp 0x3613 0xf1
lgamma 0x3629 0xf2
lgammaf 0x3641 0xf3
lgammal 0x365a 0xf4
llrint 0x3672 0xf5
llrintf 0x368a 0xf6
llrintl 0x36a3 0xf7
llround 0x36bc 0xf8
llroundf 0x36d6 0xf9
llroundl 0x36f1 0xfa
log 0x3707 0xfb
log10 0x371a 0xfc
log1p 0x372f 0xfd
log1pf 0x3745 0xfe
log1pl 0x375c 0xff
log2 0x3771 0x100
log2f 0x3785 0x101
log2l 0x379a 0x102
logb 0x37ae 0x103
logbf 0x37c2 0x104
logbl 0x37d7 0x105
lrint 0x37ec 0x106
lrintf 0x3802 0x107
lrintl 0x3819 0x108
lround 0x3830 0x109
lroundf 0x3848 0x10a
lroundl 0x3861 0x10b
modf 0x3877 0x10c
nan 0x3889 0x10d
nanf 0x389b 0x10e
nanl 0x38ae 0x10f
nearbyint 0x38c6 0x110
nearbyintf 0x38e4 0x111
nearbyintl 0x3903 0x112
nextafter 0x3921 0x113
nextafterf 0x393f 0x114
nextafterl 0x395e 0x115
nexttoward 0x397d 0x116
nexttowardf 0x399d 0x117
nexttowardl 0x39be 0x118
norm 0x39d8 0x119
normf 0x39ec 0x11a
norml 0x3a01 0x11b
pow 0x3a14 0x11c
powf 0x3a26 0x11d
remainder 0x3a3e 0x11e
remainderf 0x3a5c 0x11f
remainderl 0x3a7b 0x120
remquo 0x3a96 0x121
remquof 0x3aae 0x122
remquol 0x3ac7 0x123
rint 0x3add 0x124
rintf 0x3af1 0x125
rintl 0x3b06 0x126
round 0x3b1b 0x127
roundf 0x3b31 0x128
roundl 0x3b48 0x129
scalbln 0x3b60 0x12a
scalblnf 0x3b7a 0x12b
scalblnl 0x3b95 0x12c
scalbn 0x3bae 0x12d
scalbnf 0x3bc6 0x12e
scalbnl 0x3bdf 0x12f
sin 0x3bf4 0x130
sinh 0x3c06 0x131
sqrt 0x3c19 0x132
tan 0x3c2b 0x133
tanh 0x3c3d 0x134
tgamma 0x3c52 0x135
tgammaf 0x3c6a 0x136
tgammal 0x3c83 0x137
trunc 0x3c9a 0x138
truncf 0x3cb0 0x139
truncl 0x3cc7 0x13a
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-multibyte-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 25.80 KB
MD5 35fc66bd813d0f126883e695664e7b83 Copy to Clipboard
SHA1 2fd63c18cc5dc4defc7ea82f421050e668f68548 Copy to Clipboard
SHA256 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735 Copy to Clipboard
SSDeep 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x2400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2054-08-12 16:00:10+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x2204 0x2400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.68
.rsrc 0x10004000 0x3f0 0x400 0x2600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (200)
»
Api name EAT Address Ordinal
__p__mbcasemap 0x193b 0x1
__p__mbctype 0x1960 0x2
_ismbbalnum 0x1982 0x3
_ismbbalnum_l 0x19a5 0x4
_ismbbalpha 0x19c8 0x5
_ismbbalpha_l 0x19eb 0x6
_ismbbblank 0x1a0e 0x7
_ismbbblank_l 0x1a31 0x8
_ismbbgraph 0x1a54 0x9
_ismbbgraph_l 0x1a77 0xa
_ismbbkalnum 0x1a9b 0xb
_ismbbkalnum_l 0x1ac0 0xc
_ismbbkana 0x1ae3 0xd
_ismbbkana_l 0x1b04 0xe
_ismbbkprint 0x1b27 0xf
_ismbbkprint_l 0x1b4c 0x10
_ismbbkpunct 0x1b71 0x11
_ismbbkpunct_l 0x1b96 0x12
_ismbblead 0x1bb9 0x13
_ismbblead_l 0x1bda 0x14
_ismbbprint 0x1bfc 0x15
_ismbbprint_l 0x1c1f 0x16
_ismbbpunct 0x1c42 0x17
_ismbbpunct_l 0x1c65 0x18
_ismbbtrail 0x1c88 0x19
_ismbbtrail_l 0x1cab 0x1a
_ismbcalnum 0x1cce 0x1b
_ismbcalnum_l 0x1cf1 0x1c
_ismbcalpha 0x1d14 0x1d
_ismbcalpha_l 0x1d37 0x1e
_ismbcblank 0x1d5a 0x1f
_ismbcblank_l 0x1d7d 0x20
_ismbcdigit 0x1da0 0x21
_ismbcdigit_l 0x1dc3 0x22
_ismbcgraph 0x1de6 0x23
_ismbcgraph_l 0x1e09 0x24
_ismbchira 0x1e2b 0x25
_ismbchira_l 0x1e4c 0x26
_ismbckata 0x1e6d 0x27
_ismbckata_l 0x1e8e 0x28
_ismbcl0 0x1ead 0x29
_ismbcl0_l 0x1eca 0x2a
_ismbcl1 0x1ee7 0x2b
_ismbcl1_l 0x1f04 0x2c
_ismbcl2 0x1f21 0x2d
_ismbcl2_l 0x1f3e 0x2e
_ismbclegal 0x1f5e 0x2f
_ismbclegal_l 0x1f81 0x30
_ismbclower 0x1fa4 0x31
_ismbclower_l 0x1fc7 0x32
_ismbcprint 0x1fea 0x33
_ismbcprint_l 0x200d 0x34
_ismbcpunct 0x2030 0x35
_ismbcpunct_l 0x2053 0x36
_ismbcspace 0x2076 0x37
_ismbcspace_l 0x2099 0x38
_ismbcsymbol 0x20bd 0x39
_ismbcsymbol_l 0x20e2 0x3a
_ismbcupper 0x2106 0x3b
_ismbcupper_l 0x2129 0x3c
_ismbslead 0x214b 0x3d
_ismbslead_l 0x216c 0x3e
_ismbstrail 0x218e 0x3f
_ismbstrail_l 0x21b1 0x40
_mbbtombc 0x21d2 0x41
_mbbtombc_l 0x21f1 0x42
_mbbtype 0x220f 0x43
_mbbtype_l 0x222c 0x44
_mbcasemap 0x224b 0x45
_mbccpy 0x2267 0x46
_mbccpy_l 0x2282 0x47
_mbccpy_s 0x229f 0x48
_mbccpy_s_l 0x22be 0x49
_mbcjistojms 0x22e0 0x4a
_mbcjistojms_l 0x2305 0x4b
_mbcjmstojis 0x232a 0x4c
_mbcjmstojis_l 0x234f 0x4d
_mbclen 0x236f 0x4e
_mbclen_l 0x238a 0x4f
_mbctohira 0x23a8 0x50
_mbctohira_l 0x23c9 0x51
_mbctokata 0x23ea 0x52
_mbctokata_l 0x240b 0x53
_mbctolower 0x242d 0x54
_mbctolower_l 0x2450 0x55
_mbctombb 0x2471 0x56
_mbctombb_l 0x2490 0x57
_mbctoupper 0x24b1 0x58
_mbctoupper_l 0x24d4 0x59
_mblen_l 0x24f4 0x5a
_mbsbtype 0x2510 0x5b
_mbsbtype_l 0x252f 0x5c
_mbscat_s 0x254e 0x5d
_mbscat_s_l 0x256d 0x5e
_mbschr 0x258a 0x5f
_mbschr_l 0x25a5 0x60
_mbscmp 0x25c0 0x61
_mbscmp_l 0x25db 0x62
_mbscoll 0x25f7 0x63
_mbscoll_l 0x2614 0x64
_mbscpy_s 0x2632 0x65
_mbscpy_s_l 0x2651 0x66
_mbscspn 0x266f 0x67
_mbscspn_l 0x268c 0x68
_mbsdec 0x26a8 0x69
_mbsdec_l 0x26c3 0x6a
_mbsdup 0x26de 0x6b
_mbsicmp 0x26f8 0x6c
_mbsicmp_l 0x2715 0x6d
_mbsicoll 0x2733 0x6e
_mbsicoll_l 0x2752 0x6f
_mbsinc 0x276f 0x70
_mbsinc_l 0x278a 0x71
_mbslen 0x27a5 0x72
_mbslen_l 0x27c0 0x73
_mbslwr 0x27db 0x74
_mbslwr_l 0x27f6 0x75
_mbslwr_s 0x2813 0x76
_mbslwr_s_l 0x2832 0x77
_mbsnbcat 0x2851 0x78
_mbsnbcat_l 0x2870 0x79
_mbsnbcat_s 0x2891 0x7a
_mbsnbcat_s_l 0x28b4 0x7b
_mbsnbcmp 0x28d5 0x7c
_mbsnbcmp_l 0x28f4 0x7d
_mbsnbcnt 0x2913 0x7e
_mbsnbcnt_l 0x2932 0x7f
_mbsnbcoll 0x2952 0x80
_mbsnbcoll_l 0x2973 0x81
_mbsnbcpy 0x2993 0x82
_mbsnbcpy_l 0x29b2 0x83
_mbsnbcpy_s 0x29d3 0x84
_mbsnbcpy_s_l 0x29f6 0x85
_mbsnbicmp 0x2a18 0x86
_mbsnbicmp_l 0x2a39 0x87
_mbsnbicoll 0x2a5b 0x88
_mbsnbicoll_l 0x2a7e 0x89
_mbsnbset 0x2a9f 0x8a
_mbsnbset_l 0x2abe 0x8b
_mbsnbset_s 0x2adf 0x8c
_mbsnbset_s_l 0x2b02 0x8d
_mbsncat 0x2b22 0x8e
_mbsncat_l 0x2b3f 0x8f
_mbsncat_s 0x2b5e 0x90
_mbsncat_s_l 0x2b7f 0x91
_mbsnccnt 0x2b9f 0x92
_mbsnccnt_l 0x2bbe 0x93
_mbsncmp 0x2bdc 0x94
_mbsncmp_l 0x2bf9 0x95
_mbsncoll 0x2c17 0x96
_mbsncoll_l 0x2c36 0x97
_mbsncpy 0x2c54 0x98
_mbsncpy_l 0x2c71 0x99
_mbsncpy_s 0x2c90 0x9a
_mbsncpy_s_l 0x2cb1 0x9b
_mbsnextc 0x2cd1 0x9c
_mbsnextc_l 0x2cf0 0x9d
_mbsnicmp 0x2d0f 0x9e
_mbsnicmp_l 0x2d2e 0x9f
_mbsnicoll 0x2d4e 0xa0
_mbsnicoll_l 0x2d6f 0xa1
_mbsninc 0x2d8e 0xa2
_mbsninc_l 0x2dab 0xa3
_mbsnlen 0x2dc8 0xa4
_mbsnlen_l 0x2de5 0xa5
_mbsnset 0x2e02 0xa6
_mbsnset_l 0x2e1f 0xa7
_mbsnset_s 0x2e3e 0xa8
_mbsnset_s_l 0x2e5f 0xa9
_mbspbrk 0x2e7e 0xaa
_mbspbrk_l 0x2e9b 0xab
_mbsrchr 0x2eb8 0xac
_mbsrchr_l 0x2ed5 0xad
_mbsrev 0x2ef1 0xae
_mbsrev_l 0x2f0c 0xaf
_mbsset 0x2f27 0xb0
_mbsset_l 0x2f42 0xb1
_mbsset_s 0x2f5f 0xb2
_mbsset_s_l 0x2f7e 0xb3
_mbsspn 0x2f9b 0xb4
_mbsspn_l 0x2fb6 0xb5
_mbsspnp 0x2fd2 0xb6
_mbsspnp_l 0x2fef 0xb7
_mbsstr 0x300b 0xb8
_mbsstr_l 0x3026 0xb9
_mbstok 0x3041 0xba
_mbstok_l 0x305c 0xbb
_mbstok_s 0x3079 0xbc
_mbstok_s_l 0x3098 0xbd
_mbstowcs_l 0x30b9 0xbe
_mbstowcs_s_l 0x30dc 0xbf
_mbstrlen 0x30fd 0xc0
_mbstrlen_l 0x311c 0xc1
_mbstrnlen 0x313c 0xc2
_mbstrnlen_l 0x315d 0xc3
_mbsupr 0x317b 0xc4
_mbsupr_l 0x3196 0xc5
_mbsupr_s 0x31b3 0xc6
_mbsupr_s_l 0x31d2 0xc7
_mbtowc_l 0x31f1 0xc8
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-private-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 71.30 KB
MD5 9910a1bfdc41c5b39f6af37f0a22aacd Copy to Clipboard
SHA1 47fa76778556f34a5e7910c816c78835109e4050 Copy to Clipboard
SHA256 65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9 Copy to Clipboard
SSDeep 1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0xda00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1996-03-31 17:57:49+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xd8ba 0xda00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.05
.rsrc 0x1000f000 0x3f0 0x400 0xdc00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (1164)
»
Api name EAT Address Ordinal
_CreateFrameInfo 0x3ee3 0x1
_CxxThrowException 0x3f10 0x2
_EH_prolog 0x3f37 0x3
_FindAndUnlinkFrame 0x3f5f 0x4
_IsExceptionObjectToBeDestroyed 0x3f9c 0x5
_NLG_Dispatch2 0x3fd4 0x6
_NLG_Return 0x3ff8 0x7
_NLG_Return2 0x401a 0x8
_SetWinRTOutOfMemoryExceptionCallback 0x4056 0x9
__AdjustPointer 0x4095 0xa
__BuildCatchObject 0x40c1 0xb
__BuildCatchObjectHelper 0x40f6 0xc
__CxxDetectRethrow 0x412b 0xd
__CxxExceptionFilter 0x415c 0xe
__CxxFrameHandler 0x418c 0xf
__CxxFrameHandler2 0x41ba 0x10
__CxxFrameHandler3 0x41e9 0x11
__CxxLongjmpUnwind 0x4218 0x12
__CxxQueryExceptionSize 0x424c 0x13
__CxxRegisterExceptionObject 0x428a 0x14
__CxxUnregisterExceptionObject 0x42cf 0x15
__DestructExceptionObject 0x4311 0x16
__FrameUnwindFilter 0x4348 0x17
__GetPlatformExceptionInfo 0x4380 0x18
__RTCastToVoid 0x43b3 0x19
__RTDynamicCast 0x43db 0x1a
__RTtypeid 0x43ff 0x1b
__TypeMatch 0x441f 0x1c
__current_exception 0x4448 0x1d
__current_exception_context 0x4481 0x1e
__dcrt_get_wide_environment_from_os 0x44ca 0x1f
__dcrt_initial_narrow_environment 0x4519 0x20
__intrinsic_abnormal_termination 0x4565 0x21
__intrinsic_setjmp 0x45a2 0x22
__processing_throw 0x45d1 0x23
__report_gsfailure 0x4600 0x24
__std_exception_copy 0x4631 0x25
__std_exception_destroy 0x4667 0x26
__std_terminate 0x4698 0x27
__std_type_info_compare 0x46c9 0x28
__std_type_info_destroy_list 0x4707 0x29
__std_type_info_hash 0x4742 0x2a
__std_type_info_name 0x4775 0x2b
__unDName 0x479d 0x2c
__unDNameEx 0x47bc 0x2d
__uncaught_exception 0x47e6 0x2e
__uncaught_exceptions 0x481a 0x2f
_chkesp 0x4841 0x30
_except_handler2 0x4863 0x31
_except_handler3 0x488e 0x32
_except_handler4_common 0x48c0 0x33
_get_purecall_handler 0x48f7 0x34
_get_unexpected 0x4926 0x35
_global_unwind2 0x494f 0x36
_is_exception_typeof 0x497d 0x37
_local_unwind2 0x49aa 0x38
_local_unwind4 0x49d1 0x39
_longjmpex 0x49f4 0x3a
_o__CIacos 0x4a13 0x3b
_o__CIasin 0x4a32 0x3c
_o__CIatan 0x4a51 0x3d
_o__CIatan2 0x4a71 0x3e
_o__CIcos 0x4a90 0x3f
_o__CIcosh 0x4aae 0x40
_o__CIexp 0x4acc 0x41
_o__CIfmod 0x4aea 0x42
_o__CIlog 0x4b08 0x43
_o__CIlog10 0x4b27 0x44
_o__CIpow 0x4b46 0x45
_o__CIsin 0x4b63 0x46
_o__CIsinh 0x4b81 0x47
_o__CIsqrt 0x4ba0 0x48
_o__CItan 0x4bbe 0x49
_o__CItanh 0x4bdc 0x4a
_o__Getdays 0x4bfc 0x4b
_o__Getmonths 0x4c1f 0x4c
_o__Gettnames 0x4c44 0x4d
_o__Strftime 0x4c68 0x4e
_o__W_Getdays 0x4c8c 0x4f
_o__W_Getmonths 0x4cb3 0x50
_o__W_Gettnames 0x4cdc 0x51
_o__Wcsftime 0x4d02 0x52
_o____lc_codepage_func 0x4d2f 0x53
_o____lc_collate_cp_func 0x4d68 0x54
_o____lc_locale_name_func 0x4da4 0x55
_o____mb_cur_max_func 0x4ddd 0x56
_o___acrt_iob_func 0x4e0f 0x57
_o___conio_common_vcprintf 0x4e46 0x58
_o___conio_common_vcprintf_p 0x4e87 0x59
_o___conio_common_vcprintf_s 0x4eca 0x5a
_o___conio_common_vcscanf 0x4f0a 0x5b
_o___conio_common_vcwprintf 0x4f49 0x5c
_o___conio_common_vcwprintf_p 0x4f8c 0x5d
_o___conio_common_vcwprintf_s 0x4fd1 0x5e
_o___conio_common_vcwscanf 0x5013 0x5f
_o___daylight 0x5045 0x60
_o___dstbias 0x5069 0x61
_o___fpe_flt_rounds 0x5093 0x62
_o___libm_sse2_acos 0x50c4 0x63
_o___libm_sse2_acosf 0x50f6 0x64
_o___libm_sse2_asin 0x5128 0x65
_o___libm_sse2_asinf 0x515a 0x66
_o___libm_sse2_atan 0x518c 0x67
_o___libm_sse2_atan2 0x51be 0x68
_o___libm_sse2_atanf 0x51f1 0x69
_o___libm_sse2_cos 0x5222 0x6a
_o___libm_sse2_cosf 0x5252 0x6b
_o___libm_sse2_exp 0x5282 0x6c
_o___libm_sse2_expf 0x52b2 0x6d
_o___libm_sse2_log 0x52e2 0x6e
_o___libm_sse2_log10 0x5313 0x6f
_o___libm_sse2_log10f 0x5347 0x70
_o___libm_sse2_logf 0x537a 0x71
_o___libm_sse2_pow 0x53aa 0x72
_o___libm_sse2_powf 0x53da 0x73
_o___libm_sse2_sin 0x540a 0x74
_o___libm_sse2_sinf 0x543a 0x75
_o___libm_sse2_tan 0x546a 0x76
_o___libm_sse2_tanf 0x549a 0x77
_o___p___argc 0x54c5 0x78
_o___p___argv 0x54ea 0x79
_o___p___wargv 0x5510 0x7a
_o___p__acmdln 0x5537 0x7b
_o___p__commode 0x555f 0x7c
_o___p__environ 0x5588 0x7d
_o___p__fmode 0x55af 0x7e
_o___p__mbcasemap 0x55d8 0x7f
_o___p__mbctype 0x5603 0x80
_o___p__pgmptr 0x562b 0x81
_o___p__wcmdln 0x5652 0x82
_o___p__wenviron 0x567b 0x83
_o___p__wpgmptr 0x56a5 0x84
_o___pctype_func 0x56cf 0x85
_o___pwctype_func 0x56fb 0x86
_o___std_exception_copy 0x572e 0x87
_o___std_exception_destroy 0x576a 0x88
_o___std_type_info_destroy_list 0x57ae 0x89
_o___std_type_info_name 0x57ef 0x8a
_o___stdio_common_vfprintf 0x582b 0x8b
_o___stdio_common_vfprintf_p 0x586c 0x8c
_o___stdio_common_vfprintf_s 0x58af 0x8d
_o___stdio_common_vfscanf 0x58ef 0x8e
_o___stdio_common_vfwprintf 0x592e 0x8f
_o___stdio_common_vfwprintf_p 0x5971 0x90
_o___stdio_common_vfwprintf_s 0x59b6 0x91
_o___stdio_common_vfwscanf 0x59f8 0x92
_o___stdio_common_vsnprintf_s 0x5a3a 0x93
_o___stdio_common_vsnwprintf_s 0x5a80 0x94
_o___stdio_common_vsprintf 0x5ac3 0x95
_o___stdio_common_vsprintf_p 0x5b04 0x96
_o___stdio_common_vsprintf_s 0x5b47 0x97
_o___stdio_common_vsscanf 0x5b87 0x98
_o___stdio_common_vswprintf 0x5bc6 0x99
_o___stdio_common_vswprintf_p 0x5c09 0x9a
_o___stdio_common_vswprintf_s 0x5c4e 0x9b
_o___stdio_common_vswscanf 0x5c90 0x9c
_o___timezone 0x5cc2 0x9d
_o___tzname 0x5ce5 0x9e
_o___wcserror 0x5d08 0x9f
_o__access 0x5d2a 0xa0
_o__access_s 0x5d4b 0xa1
_o__aligned_free 0x5d72 0xa2
_o__aligned_malloc 0x5d9f 0xa3
_o__aligned_msize 0x5dcd 0xa4
_o__aligned_offset_malloc 0x5e02 0xa5
_o__aligned_offset_realloc 0x5e40 0xa6
_o__aligned_offset_recalloc 0x5e80 0xa7
_o__aligned_realloc 0x5eb9 0xa8
_o__aligned_recalloc 0x5eeb 0xa9
_o__atodbl 0x5f14 0xaa
_o__atodbl_l 0x5f35 0xab
_o__atof_l 0x5f56 0xac
_o__atoflt 0x5f75 0xad
_o__atoflt_l 0x5f96 0xae
_o__atoi64 0x5fb7 0xaf
_o__atoi64_l 0x5fd8 0xb0
_o__atoi_l 0x5ff9 0xb1
_o__atol_l 0x6018 0xb2
_o__atoldbl 0x6038 0xb3
_o__atoldbl_l 0x605b 0xb4
_o__atoll_l 0x607e 0xb5
_o__beep 0x609c 0xb6
_o__beginthread 0x60be 0xb7
_o__beginthreadex 0x60e9 0xb8
_o__cabs 0x610d 0xb9
_o__callnewh 0x612c 0xba
_o__calloc_base 0x6152 0xbb
_o__cexit 0x6175 0xbc
_o__cgets 0x6192 0xbd
_o__cgets_s 0x61b1 0xbe
_o__cgetws 0x61d1 0xbf
_o__cgetws_s 0x61f2 0xc0
_o__chdir 0x6212 0xc1
_o__chdrive 0x6231 0xc2
_o__chmod 0x6250 0xc3
_o__chsize 0x626e 0xc4
_o__chsize_s 0x628f 0xc5
_o__close 0x62af 0xc6
_o__commit 0x62cd 0xc7
_o__configthreadlocale 0x62f8 0xc8
_o__configure_narrow_argv 0x6332 0xc9
_o__configure_wide_argv 0x636d 0xca
_o__controlfp_s 0x639e 0xcb
_o__cputs 0x63c1 0xcc
_o__cputws 0x63df 0xcd
_o__creat 0x63fd 0xce
_o__create_locale 0x6422 0xcf
_o__crt_atexit 0x644c 0xd0
_o__ctime32_s 0x6472 0xd1
_o__ctime64_s 0x6497 0xd2
_o__cwait 0x64b8 0xd3
_o__d_int 0x64d5 0xd4
_o__dclass 0x64f3 0xd5
_o__difftime32 0x6516 0xd6
_o__difftime64 0x653d 0xd7
_o__dlog 0x655e 0xd8
_o__dnorm 0x657a 0xd9
_o__dpcomp 0x6598 0xda
_o__dpoly 0x65b6 0xdb
_o__dscale 0x65d4 0xdc
_o__dsign 0x65f2 0xdd
_o__dsin 0x660e 0xde
_o__dtest 0x662a 0xdf
_o__dunscale 0x664a 0xe0
_o__dup 0x6668 0xe1
_o__dup2 0x6682 0xe2
_o__dupenv_s 0x66a1 0xe3
_o__ecvt 0x66c0 0xe4
_o__ecvt_s 0x66dd 0xe5
_o__endthread 0x66ff 0xe6
_o__endthreadex 0x6726 0xe7
_o__eof 0x6747 0xe8
_o__errno 0x6762 0xe9
_o__except1 0x6781 0xea
_o__execute_onexit_table 0x67af 0xeb
_o__execv 0x67db 0xec
_o__execve 0x67f9 0xed
_o__execvp 0x6818 0xee
_o__execvpe 0x6838 0xef
_o__exit 0x6856 0xf0
_o__expand 0x6873 0xf1
_o__fclose_nolock 0x6899 0xf2
_o__fcloseall 0x68c2 0xf3
_o__fcvt 0x68e2 0xf4
_o__fcvt_s 0x68ff 0xf5
_o__fd_int 0x691e 0xf6
_o__fdclass 0x693e 0xf7
_o__fdexp 0x695d 0xf8
_o__fdlog 0x697a 0xf9
_o__fdopen 0x6998 0xfa
_o__fdpcomp 0x69b8 0xfb
_o__fdpoly 0x69d8 0xfc
_o__fdscale 0x69f8 0xfd
_o__fdsign 0x6a18 0xfe
_o__fdsin 0x6a36 0xff
_o__fflush_nolock 0x6a5b 0x100
_o__fgetc_nolock 0x6a87 0x101
_o__fgetchar 0x6aae 0x102
_o__fgetwc_nolock 0x6ad6 0x103
_o__fgetwchar 0x6aff 0x104
_o__filelength 0x6b25 0x105
_o__filelengthi64 0x6b4f 0x106
_o__fileno 0x6b75 0x107
_o__findclose 0x6b97 0x108
_o__findfirst32 0x6bbe 0x109
_o__findfirst32i64 0x6bea 0x10a
_o__findfirst64 0x6c16 0x10b
_o__findfirst64i32 0x6c42 0x10c
_o__findnext32 0x6c6d 0x10d
_o__findnext32i64 0x6c97 0x10e
_o__findnext64 0x6cc1 0x10f
_o__findnext64i32 0x6ceb 0x110
_o__flushall 0x6d13 0x111
_o__fpclass 0x6d35 0x112
_o__fputc_nolock 0x6d5b 0x113
_o__fputchar 0x6d82 0x114
_o__fputwc_nolock 0x6daa 0x115
_o__fputwchar 0x6dd3 0x116
_o__fread_nolock 0x6dfb 0x117
_o__fread_nolock_s 0x6e28 0x118
_o__free_base 0x6e52 0x119
_o__free_locale 0x6e79 0x11a
_o__fseek_nolock 0x6ea3 0x11b
_o__fseeki64 0x6eca 0x11c
_o__fseeki64_nolock 0x6ef4 0x11d
_o__fsopen 0x6f1c 0x11e
_o__fstat32 0x6f3c 0x11f
_o__fstat32i64 0x6f60 0x120
_o__fstat64 0x6f84 0x121
_o__fstat64i32 0x6fa8 0x122
_o__ftell_nolock 0x6fd1 0x123
_o__ftelli64 0x6ff8 0x124
_o__ftelli64_nolock 0x7022 0x125
_o__ftime32 0x704b 0x126
_o__ftime32_s 0x706e 0x127
_o__ftime64 0x7091 0x128
_o__ftime64_s 0x70b4 0x129
_o__fullpath 0x70d8 0x12a
_o__futime32 0x70fb 0x12b
_o__futime64 0x711e 0x12c
_o__fwrite_nolock 0x7146 0x12d
_o__gcvt 0x716a 0x12e
_o__gcvt_s 0x7187 0x12f
_o__get_daylight 0x71ac 0x130
_o__get_doserrno 0x71d7 0x131
_o__get_dstbias 0x7201 0x132
_o__get_errno 0x7228 0x133
_o__get_fmode 0x724d 0x134
_o__get_heap_handle 0x7278 0x135
_o__get_initial_narrow_environment 0x72b8 0x136
_o__get_initial_wide_environment 0x7305 0x137
_o__get_invalid_parameter_handler 0x7351 0x138
_o__get_narrow_winmain_command_line 0x73a0 0x139
_o__get_osfhandle 0x73df 0x13a
_o__get_pgmptr 0x7409 0x13b
_o__get_stream_buffer_pointers 0x7440 0x13c
_o__get_terminate 0x747a 0x13d
_o__get_thread_local_invalid_parameter_handler 0x74c4 0x13e
_o__get_timezone 0x750d 0x13f
_o__get_tzname 0x7536 0x140
_o__get_wide_winmain_command_line 0x7570 0x141
_o__get_wpgmptr 0x75ab 0x142
_o__getc_nolock 0x75d4 0x143
_o__getch 0x75f7 0x144
_o__getch_nolock 0x761b 0x145
_o__getche 0x7640 0x146
_o__getche_nolock 0x7666 0x147
_o__getcwd 0x768c 0x148
_o__getdcwd 0x76ac 0x149
_o__getdiskfree 0x76d1 0x14a
_o__getdllprocaddr 0x76fd 0x14b
_o__getdrive 0x7726 0x14c
_o__getdrives 0x774a 0x14d
_o__getmbcp 0x776d 0x14e
_o__getsystime 0x7791 0x14f
_o__getw 0x77b2 0x150
_o__getwc_nolock 0x77d5 0x151
_o__getwch 0x77fa 0x152
_o__getwch_nolock 0x7820 0x153
_o__getwche 0x7847 0x154
_o__getwche_nolock 0x786f 0x155
_o__getws 0x7895 0x156
_o__getws_s 0x78b4 0x157
_o__gmtime32 0x78d6 0x158
_o__gmtime32_s 0x78fb 0x159
_o__gmtime64 0x7920 0x15a
_o__gmtime64_s 0x7945 0x15b
_o__heapchk 0x7969 0x15c
_o__heapmin 0x798a 0x15d
_o__hypot 0x79a9 0x15e
_o__hypotf 0x79c7 0x15f
_o__i64toa 0x79e6 0x160
_o__i64toa_s 0x7a07 0x161
_o__i64tow 0x7a28 0x162
_o__i64tow_s 0x7a49 0x163
_o__initialize_narrow_environment 0x7a81 0x164
_o__initialize_onexit_table 0x7ac8 0x165
_o__initialize_wide_environment 0x7b0d 0x166
_o__invalid_parameter_noinfo 0x7b53 0x167
_o__invalid_parameter_noinfo_noreturn 0x7b9f 0x168
_o__isatty 0x7bd9 0x169
_o__isctype 0x7bf9 0x16a
_o__isctype_l 0x7c1c 0x16b
_o__isleadbyte_l 0x7c44 0x16c
_o__ismbbalnum 0x7c6d 0x16d
_o__ismbbalnum_l 0x7c96 0x16e
_o__ismbbalpha 0x7cbf 0x16f
_o__ismbbalpha_l 0x7ce8 0x170
_o__ismbbblank 0x7d11 0x171
_o__ismbbblank_l 0x7d3a 0x172
_o__ismbbgraph 0x7d63 0x173
_o__ismbbgraph_l 0x7d8c 0x174
_o__ismbbkalnum 0x7db6 0x175
_o__ismbbkalnum_l 0x7de1 0x176
_o__ismbbkana 0x7e0a 0x177
_o__ismbbkana_l 0x7e31 0x178
_o__ismbbkprint 0x7e5a 0x179
_o__ismbbkprint_l 0x7e85 0x17a
_o__ismbbkpunct 0x7eb0 0x17b
_o__ismbbkpunct_l 0x7edb 0x17c
_o__ismbblead 0x7f04 0x17d
_o__ismbblead_l 0x7f2b 0x17e
_o__ismbbprint 0x7f53 0x17f
_o__ismbbprint_l 0x7f7c 0x180
_o__ismbbpunct 0x7fa5 0x181
_o__ismbbpunct_l 0x7fce 0x182
_o__ismbbtrail 0x7ff7 0x183
_o__ismbbtrail_l 0x8020 0x184
_o__ismbcalnum 0x8049 0x185
_o__ismbcalnum_l 0x8072 0x186
_o__ismbcalpha 0x809b 0x187
_o__ismbcalpha_l 0x80c4 0x188
_o__ismbcblank 0x80ed 0x189
_o__ismbcblank_l 0x8116 0x18a
_o__ismbcdigit 0x813f 0x18b
_o__ismbcdigit_l 0x8168 0x18c
_o__ismbcgraph 0x8191 0x18d
_o__ismbcgraph_l 0x81ba 0x18e
_o__ismbchira 0x81e2 0x18f
_o__ismbchira_l 0x8209 0x190
_o__ismbckata 0x8230 0x191
_o__ismbckata_l 0x8257 0x192
_o__ismbcl0 0x827c 0x193
_o__ismbcl0_l 0x829f 0x194
_o__ismbcl1 0x82c2 0x195
_o__ismbcl1_l 0x82e5 0x196
_o__ismbcl2 0x8308 0x197
_o__ismbcl2_l 0x832b 0x198
_o__ismbclegal 0x8351 0x199
_o__ismbclegal_l 0x837a 0x19a
_o__ismbclower 0x83a3 0x19b
_o__ismbclower_l 0x83cc 0x19c
_o__ismbcprint 0x83f5 0x19d
_o__ismbcprint_l 0x841e 0x19e
_o__ismbcpunct 0x8447 0x19f
_o__ismbcpunct_l 0x8470 0x1a0
_o__ismbcspace 0x8499 0x1a1
_o__ismbcspace_l 0x84c2 0x1a2
_o__ismbcsymbol 0x84ec 0x1a3
_o__ismbcsymbol_l 0x8517 0x1a4
_o__ismbcupper 0x8541 0x1a5
_o__ismbcupper_l 0x856a 0x1a6
_o__ismbslead 0x8592 0x1a7
_o__ismbslead_l 0x85b9 0x1a8
_o__ismbstrail 0x85e1 0x1a9
_o__ismbstrail_l 0x860a 0x1aa
_o__iswctype_l 0x8633 0x1ab
_o__itoa 0x8654 0x1ac
_o__itoa_s 0x8671 0x1ad
_o__itow 0x868e 0x1ae
_o__itow_s 0x86ab 0x1af
_o__j0 0x86c6 0x1b0
_o__j1 0x86dd 0x1b1
_o__jn 0x86f4 0x1b2
_o__kbhit 0x870e 0x1b3
_o__ld_int 0x872c 0x1b4
_o__ldclass 0x874c 0x1b5
_o__ldexp 0x876b 0x1b6
_o__ldlog 0x8788 0x1b7
_o__ldpcomp 0x87a7 0x1b8
_o__ldpoly 0x87c7 0x1b9
_o__ldscale 0x87e7 0x1ba
_o__ldsign 0x8807 0x1bb
_o__ldsin 0x8825 0x1bc
_o__ldtest 0x8843 0x1bd
_o__ldunscale 0x8865 0x1be
_o__lfind 0x8886 0x1bf
_o__lfind_s 0x88a5 0x1c0
_o__libm_sse2_acos_precise 0x88d5 0x1c1
_o__libm_sse2_asin_precise 0x8914 0x1c2
_o__libm_sse2_atan_precise 0x8953 0x1c3
_o__libm_sse2_cos_precise 0x8991 0x1c4
_o__libm_sse2_exp_precise 0x89ce 0x1c5
_o__libm_sse2_log10_precise 0x8a0d 0x1c6
_o__libm_sse2_log_precise 0x8a4c 0x1c7
_o__libm_sse2_pow_precise 0x8a89 0x1c8
_o__libm_sse2_sin_precise 0x8ac6 0x1c9
_o__libm_sse2_sqrt_precise 0x8b04 0x1ca
_o__libm_sse2_tan_precise 0x8b42 0x1cb
_o__loaddll 0x8b71 0x1cc
_o__localtime32 0x8b96 0x1cd
_o__localtime32_s 0x8bc1 0x1ce
_o__localtime64 0x8bec 0x1cf
_o__localtime64_s 0x8c17 0x1d0
_o__lock_file 0x8c40 0x1d1
_o__locking 0x8c63 0x1d2
_o__logb 0x8c81 0x1d3
_o__lsearch 0x8c9f 0x1d4
_o__lsearch_s 0x8cc2 0x1d5
_o__lseek 0x8ce3 0x1d6
_o__lseeki64 0x8d03 0x1d7
_o__ltoa 0x8d22 0x1d8
_o__ltoa_s 0x8d3f 0x1d9
_o__ltow 0x8d5c 0x1da
_o__ltow_s 0x8d79 0x1db
_o__makepath 0x8d9a 0x1dc
_o__makepath_s 0x8dbf 0x1dd
_o__malloc_base 0x8de7 0x1de
_o__mbbtombc 0x8e0d 0x1df
_o__mbbtombc_l 0x8e32 0x1e0
_o__mbbtype 0x8e56 0x1e1
_o__mbbtype_l 0x8e79 0x1e2
_o__mbccpy 0x8e9b 0x1e3
_o__mbccpy_l 0x8ebc 0x1e4
_o__mbccpy_s 0x8edf 0x1e5
_o__mbccpy_s_l 0x8f04 0x1e6
_o__mbcjistojms 0x8f2c 0x1e7
_o__mbcjistojms_l 0x8f57 0x1e8
_o__mbcjmstojis 0x8f82 0x1e9
_o__mbcjmstojis_l 0x8fad 0x1ea
_o__mbclen 0x8fd3 0x1eb
_o__mbclen_l 0x8ff4 0x1ec
_o__mbctohira 0x9018 0x1ed
_o__mbctohira_l 0x903f 0x1ee
_o__mbctokata 0x9066 0x1ef
_o__mbctokata_l 0x908d 0x1f0
_o__mbctolower 0x90b5 0x1f1
_o__mbctolower_l 0x90de 0x1f2
_o__mbctombb 0x9105 0x1f3
_o__mbctombb_l 0x912a 0x1f4
_o__mbctoupper 0x9151 0x1f5
_o__mbctoupper_l 0x917a 0x1f6
_o__mblen_l 0x91a0 0x1f7
_o__mbsbtype 0x91c2 0x1f8
_o__mbsbtype_l 0x91e7 0x1f9
_o__mbscat_s 0x920c 0x1fa
_o__mbscat_s_l 0x9231 0x1fb
_o__mbschr 0x9254 0x1fc
_o__mbschr_l 0x9275 0x1fd
_o__mbscmp 0x9296 0x1fe
_o__mbscmp_l 0x92b7 0x1ff
_o__mbscoll 0x92d9 0x200
_o__mbscoll_l 0x92fc 0x201
_o__mbscpy_s 0x9320 0x202
_o__mbscpy_s_l 0x9345 0x203
_o__mbscspn 0x9369 0x204
_o__mbscspn_l 0x938c 0x205
_o__mbsdec 0x93ae 0x206
_o__mbsdec_l 0x93cf 0x207
_o__mbsicmp 0x93f1 0x208
_o__mbsicmp_l 0x9414 0x209
_o__mbsicoll 0x9438 0x20a
_o__mbsicoll_l 0x945d 0x20b
_o__mbsinc 0x9480 0x20c
_o__mbsinc_l 0x94a1 0x20d
_o__mbslen 0x94c2 0x20e
_o__mbslen_l 0x94e3 0x20f
_o__mbslwr 0x9504 0x210
_o__mbslwr_l 0x9525 0x211
_o__mbslwr_s 0x9548 0x212
_o__mbslwr_s_l 0x956d 0x213
_o__mbsnbcat 0x9592 0x214
_o__mbsnbcat_l 0x95b7 0x215
_o__mbsnbcat_s 0x95de 0x216
_o__mbsnbcat_s_l 0x9607 0x217
_o__mbsnbcmp 0x962e 0x218
_o__mbsnbcmp_l 0x9653 0x219
_o__mbsnbcnt 0x9678 0x21a
_o__mbsnbcnt_l 0x969d 0x21b
_o__mbsnbcoll 0x96c3 0x21c
_o__mbsnbcoll_l 0x96ea 0x21d
_o__mbsnbcpy 0x9710 0x21e
_o__mbsnbcpy_l 0x9735 0x21f
_o__mbsnbcpy_s 0x975c 0x220
_o__mbsnbcpy_s_l 0x9785 0x221
_o__mbsnbicmp 0x97ad 0x222
_o__mbsnbicmp_l 0x97d4 0x223
_o__mbsnbicoll 0x97fc 0x224
_o__mbsnbicoll_l 0x9825 0x225
_o__mbsnbset 0x984c 0x226
_o__mbsnbset_l 0x9871 0x227
_o__mbsnbset_s 0x9898 0x228
_o__mbsnbset_s_l 0x98c1 0x229
_o__mbsncat 0x98e7 0x22a
_o__mbsncat_l 0x990a 0x22b
_o__mbsncat_s 0x992f 0x22c
_o__mbsncat_s_l 0x9956 0x22d
_o__mbsnccnt 0x997c 0x22e
_o__mbsnccnt_l 0x99a1 0x22f
_o__mbsncmp 0x99c5 0x230
_o__mbsncmp_l 0x99e8 0x231
_o__mbsncoll 0x9a0c 0x232
_o__mbsncoll_l 0x9a31 0x233
_o__mbsncpy 0x9a55 0x234
_o__mbsncpy_l 0x9a78 0x235
_o__mbsncpy_s 0x9a9d 0x236
_o__mbsncpy_s_l 0x9ac4 0x237
_o__mbsnextc 0x9aea 0x238
_o__mbsnextc_l 0x9b0f 0x239
_o__mbsnicmp 0x9b34 0x23a
_o__mbsnicmp_l 0x9b59 0x23b
_o__mbsnicoll 0x9b7f 0x23c
_o__mbsnicoll_l 0x9ba6 0x23d
_o__mbsninc 0x9bcb 0x23e
_o__mbsninc_l 0x9bee 0x23f
_o__mbsnlen 0x9c11 0x240
_o__mbsnlen_l 0x9c34 0x241
_o__mbsnset 0x9c57 0x242
_o__mbsnset_l 0x9c7a 0x243
_o__mbsnset_s 0x9c9f 0x244
_o__mbsnset_s_l 0x9cc6 0x245
_o__mbspbrk 0x9ceb 0x246
_o__mbspbrk_l 0x9d0e 0x247
_o__mbsrchr 0x9d31 0x248
_o__mbsrchr_l 0x9d54 0x249
_o__mbsrev 0x9d76 0x24a
_o__mbsrev_l 0x9d97 0x24b
_o__mbsset 0x9db8 0x24c
_o__mbsset_l 0x9dd9 0x24d
_o__mbsset_s 0x9dfc 0x24e
_o__mbsset_s_l 0x9e21 0x24f
_o__mbsspn 0x9e44 0x250
_o__mbsspn_l 0x9e65 0x251
_o__mbsspnp 0x9e87 0x252
_o__mbsspnp_l 0x9eaa 0x253
_o__mbsstr 0x9ecc 0x254
_o__mbsstr_l 0x9eed 0x255
_o__mbstok 0x9f0e 0x256
_o__mbstok_l 0x9f2f 0x257
_o__mbstok_s 0x9f52 0x258
_o__mbstok_s_l 0x9f77 0x259
_o__mbstowcs_l 0x9f9e 0x25a
_o__mbstowcs_s_l 0x9fc7 0x25b
_o__mbstrlen 0x9fee 0x25c
_o__mbstrlen_l 0xa013 0x25d
_o__mbstrnlen 0xa039 0x25e
_o__mbstrnlen_l 0xa060 0x25f
_o__mbsupr 0xa084 0x260
_o__mbsupr_l 0xa0a5 0x261
_o__mbsupr_s 0xa0c8 0x262
_o__mbsupr_s_l 0xa0ed 0x263
_o__mbtowc_l 0xa112 0x264
_o__memicmp 0xa134 0x265
_o__memicmp_l 0xa157 0x266
_o__mkdir 0xa178 0x267
_o__mkgmtime32 0xa19a 0x268
_o__mkgmtime64 0xa1c1 0x269
_o__mktemp 0xa1e4 0x26a
_o__mktemp_s 0xa205 0x26b
_o__mktime32 0xa228 0x26c
_o__mktime64 0xa24b 0x26d
_o__msize 0xa26b 0x26e
_o__nextafter 0xa28c 0x26f
_o__open_osfhandle 0xa2b6 0x270
_o__pclose 0xa2dd 0x271
_o__pipe 0xa2fa 0x272
_o__popen 0xa316 0x273
_o__purecall 0xa336 0x274
_o__putc_nolock 0xa35c 0x275
_o__putch 0xa37f 0x276
_o__putch_nolock 0xa3a3 0x277
_o__putenv 0xa3c8 0x278
_o__putenv_s 0xa3e9 0x279
_o__putw 0xa408 0x27a
_o__putwc_nolock 0xa42b 0x27b
_o__putwch 0xa450 0x27c
_o__putwch_nolock 0xa476 0x27d
_o__putws 0xa49b 0x27e
_o__read 0xa4b7 0x27f
_o__realloc_base 0xa4da 0x280
_o__recalloc 0xa501 0x281
_o__register_onexit_function 0xa534 0x282
_o__resetstkoflw 0xa56b 0x283
_o__rmdir 0xa58f 0x284
_o__rmtmp 0xa5ac 0x285
_o__scalb 0xa5c9 0x286
_o__searchenv 0xa5ea 0x287
_o__searchenv_s 0xa611 0x288
_o__seh_filter_dll 0xa63d 0x289
_o__seh_filter_exe 0xa66c 0x28a
_o__set_abort_behavior 0xa69f 0x28b
_o__set_app_type 0xa6d0 0x28c
_o__set_doserrno 0xa6fb 0x28d
_o__set_errno 0xa723 0x28e
_o__set_fmode 0xa748 0x28f
_o__set_invalid_parameter_handler 0xa781 0x290
_o__set_new_handler 0xa7c0 0x291
_o__set_new_mode 0xa7ee 0x292
_o__set_thread_local_invalid_parameter_handler 0xa837 0x293
_o__seterrormode 0xa880 0x294
_o__setmbcp 0xa8a6 0x295
_o__setmode 0xa8c7 0x296
_o__setsystime 0xa8eb 0x297
_o__sleep 0xa90d 0x298
_o__sopen 0xa92a 0x299
_o__sopen_dispatch 0xa950 0x29a
_o__sopen_s 0xa978 0x29b
_o__spawnv 0xa998 0x29c
_o__spawnve 0xa9b8 0x29d
_o__spawnvp 0xa9d9 0x29e
_o__spawnvpe 0xa9fb 0x29f
_o__splitpath 0xaa1f 0x2a0
_o__splitpath_s 0xaa46 0x2a1
_o__stat32 0xaa6a 0x2a2
_o__stat32i64 0xaa8c 0x2a3
_o__stat64 0xaaae 0x2a4
_o__stat64i32 0xaad0 0x2a5
_o__strcoll_l 0xaaf5 0x2a6
_o__strdate 0xab18 0x2a7
_o__strdate_s 0xab3b 0x2a8
_o__strdup 0xab5d 0x2a9
_o__strerror 0xab7e 0x2aa
_o__strerror_s 0xaba3 0x2ab
_o__strftime_l 0xabca 0x2ac
_o__stricmp 0xabee 0x2ad
_o__stricmp_l 0xac11 0x2ae
_o__stricoll 0xac35 0x2af
_o__stricoll_l 0xac5a 0x2b0
_o__strlwr 0xac7d 0x2b1
_o__strlwr_l 0xac9e 0x2b2
_o__strlwr_s 0xacc1 0x2b3
_o__strlwr_s_l 0xace6 0x2b4
_o__strncoll 0xad0b 0x2b5
_o__strncoll_l 0xad30 0x2b6
_o__strnicmp 0xad55 0x2b7
_o__strnicmp_l 0xad7a 0x2b8
_o__strnicoll 0xada0 0x2b9
_o__strnicoll_l 0xadc7 0x2ba
_o__strnset_s 0xadee 0x2bb
_o__strset_s 0xae12 0x2bc
_o__strtime 0xae34 0x2bd
_o__strtime_s 0xae57 0x2be
_o__strtod_l 0xae7b 0x2bf
_o__strtof_l 0xae9e 0x2c0
_o__strtoi64 0xaec1 0x2c1
_o__strtoi64_l 0xaee6 0x2c2
_o__strtol_l 0xaf0b 0x2c3
_o__strtold_l 0xaf2f 0x2c4
_o__strtoll_l 0xaf54 0x2c5
_o__strtoui64 0xaf79 0x2c6
_o__strtoui64_l 0xafa0 0x2c7
_o__strtoul_l 0xafc7 0x2c8
_o__strtoull_l 0xafed 0x2c9
_o__strupr 0xb010 0x2ca
_o__strupr_l 0xb031 0x2cb
_o__strupr_s 0xb054 0x2cc
_o__strupr_s_l 0xb079 0x2cd
_o__strxfrm_l 0xb09f 0x2ce
_o__swab 0xb0bf 0x2cf
_o__tell 0xb0da 0x2d0
_o__telli64 0xb0f8 0x2d1
_o__timespec32_get 0xb120 0x2d2
_o__timespec64_get 0xb14f 0x2d3
_o__tolower 0xb177 0x2d4
_o__tolower_l 0xb19a 0x2d5
_o__toupper 0xb1bd 0x2d6
_o__toupper_l 0xb1e0 0x2d7
_o__towlower_l 0xb206 0x2d8
_o__towupper_l 0xb22d 0x2d9
_o__tzset 0xb24f 0x2da
_o__ui64toa 0xb26e 0x2db
_o__ui64toa_s 0xb291 0x2dc
_o__ui64tow 0xb2b4 0x2dd
_o__ui64tow_s 0xb2d7 0x2de
_o__ultoa 0xb2f8 0x2df
_o__ultoa_s 0xb317 0x2e0
_o__ultow 0xb336 0x2e1
_o__ultow_s 0xb355 0x2e2
_o__umask 0xb374 0x2e3
_o__umask_s 0xb393 0x2e4
_o__ungetc_nolock 0xb3ba 0x2e5
_o__ungetch 0xb3e1 0x2e6
_o__ungetch_nolock 0xb409 0x2e7
_o__ungetwc_nolock 0xb438 0x2e8
_o__ungetwch 0xb461 0x2e9
_o__ungetwch_nolock 0xb48b 0x2ea
_o__unlink 0xb4b3 0x2eb
_o__unloaddll 0xb4d5 0x2ec
_o__unlock_file 0xb4fc 0x2ed
_o__utime32 0xb521 0x2ee
_o__utime64 0xb542 0x2ef
_o__waccess 0xb563 0x2f0
_o__waccess_s 0xb586 0x2f1
_o__wasctime 0xb5aa 0x2f2
_o__wasctime_s 0xb5cf 0x2f3
_o__wchdir 0xb5f2 0x2f4
_o__wchmod 0xb611 0x2f5
_o__wcreat 0xb630 0x2f6
_o__wcreate_locale 0xb657 0x2f7
_o__wcscoll_l 0xb681 0x2f8
_o__wcsdup 0xb6a3 0x2f9
_o__wcserror 0xb6c4 0x2fa
_o__wcserror_s 0xb6e9 0x2fb
_o__wcsftime_l 0xb710 0x2fc
_o__wcsicmp 0xb734 0x2fd
_o__wcsicmp_l 0xb757 0x2fe
_o__wcsicoll 0xb77b 0x2ff
_o__wcsicoll_l 0xb7a0 0x300
_o__wcslwr 0xb7c3 0x301
_o__wcslwr_l 0xb7e4 0x302
_o__wcslwr_s 0xb807 0x303
_o__wcslwr_s_l 0xb82c 0x304
_o__wcsncoll 0xb851 0x305
_o__wcsncoll_l 0xb876 0x306
_o__wcsnicmp 0xb89b 0x307
_o__wcsnicmp_l 0xb8c0 0x308
_o__wcsnicoll 0xb8e6 0x309
_o__wcsnicoll_l 0xb90d 0x30a
_o__wcsnset 0xb932 0x30b
_o__wcsnset_s 0xb955 0x30c
_o__wcsset 0xb977 0x30d
_o__wcsset_s 0xb998 0x30e
_o__wcstod_l 0xb9bb 0x30f
_o__wcstof_l 0xb9de 0x310
_o__wcstoi64 0xba01 0x311
_o__wcstoi64_l 0xba26 0x312
_o__wcstol_l 0xba4b 0x313
_o__wcstold_l 0xba6f 0x314
_o__wcstoll_l 0xba94 0x315
_o__wcstombs_l 0xbaba 0x316
_o__wcstombs_s_l 0xbae3 0x317
_o__wcstoui64 0xbb0b 0x318
_o__wcstoui64_l 0xbb32 0x319
_o__wcstoul_l 0xbb59 0x31a
_o__wcstoull_l 0xbb7f 0x31b
_o__wcsupr 0xbba2 0x31c
_o__wcsupr_l 0xbbc3 0x31d
_o__wcsupr_s 0xbbe6 0x31e
_o__wcsupr_s_l 0xbc0b 0x31f
_o__wcsxfrm_l 0xbc31 0x320
_o__wctime32 0xbc55 0x321
_o__wctime32_s 0xbc7a 0x322
_o__wctime64 0xbc9f 0x323
_o__wctime64_s 0xbcc4 0x324
_o__wctomb_l 0xbce9 0x325
_o__wctomb_s_l 0xbd0e 0x326
_o__wdupenv_s 0xbd34 0x327
_o__wexecv 0xbd56 0x328
_o__wexecve 0xbd76 0x329
_o__wexecvp 0xbd97 0x32a
_o__wexecvpe 0xbdb9 0x32b
_o__wfdopen 0xbddb 0x32c
_o__wfindfirst32 0xbe01 0x32d
_o__wfindfirst32i64 0xbe2f 0x32e
_o__wfindfirst64 0xbe5d 0x32f
_o__wfindfirst64i32 0xbe8b 0x330
_o__wfindnext32 0xbeb8 0x331
_o__wfindnext32i64 0xbee4 0x332
_o__wfindnext64 0xbf10 0x333
_o__wfindnext64i32 0xbf3c 0x334
_o__wfopen 0xbf63 0x335
_o__wfopen_s 0xbf84 0x336
_o__wfreopen 0xbfa7 0x337
_o__wfreopen_s 0xbfcc 0x338
_o__wfsopen 0xbff0 0x339
_o__wfullpath 0xc013 0x33a
_o__wgetcwd 0xc036 0x33b
_o__wgetdcwd 0xc058 0x33c
_o__wgetenv 0xc07a 0x33d
_o__wgetenv_s 0xc09d 0x33e
_o__wmakepath 0xc0c2 0x33f
_o__wmakepath_s 0xc0e9 0x340
_o__wmkdir 0xc10d 0x341
_o__wmktemp 0xc12d 0x342
_o__wmktemp_s 0xc150 0x343
_o__wperror 0xc173 0x344
_o__wpopen 0xc193 0x345
_o__wputenv 0xc1b3 0x346
_o__wputenv_s 0xc1d6 0x347
_o__wremove 0xc1f9 0x348
_o__wrename 0xc21a 0x349
_o__write 0xc239 0x34a
_o__wrmdir 0xc257 0x34b
_o__wsearchenv 0xc27a 0x34c
_o__wsearchenv_s 0xc2a3 0x34d
_o__wsetlocale 0xc2cc 0x34e
_o__wsopen_dispatch 0xc2f8 0x34f
_o__wsopen_s 0xc322 0x350
_o__wspawnv 0xc344 0x351
_o__wspawnve 0xc366 0x352
_o__wspawnvp 0xc389 0x353
_o__wspawnvpe 0xc3ad 0x354
_o__wsplitpath 0xc3d3 0x355
_o__wsplitpath_s 0xc3fc 0x356
_o__wstat32 0xc422 0x357
_o__wstat32i64 0xc446 0x358
_o__wstat64 0xc46a 0x359
_o__wstat64i32 0xc48e 0x35a
_o__wstrdate 0xc4b3 0x35b
_o__wstrdate_s 0xc4d8 0x35c
_o__wstrtime 0xc4fd 0x35d
_o__wstrtime_s 0xc522 0x35e
_o__wsystem 0xc546 0x35f
_o__wtmpnam_s 0xc569 0x360
_o__wtof 0xc589 0x361
_o__wtof_l 0xc5a6 0x362
_o__wtoi 0xc5c3 0x363
_o__wtoi64 0xc5e0 0x364
_o__wtoi64_l 0xc601 0x365
_o__wtoi_l 0xc622 0x366
_o__wtol 0xc63f 0x367
_o__wtol_l 0xc65c 0x368
_o__wtoll 0xc67a 0x369
_o__wtoll_l 0xc699 0x36a
_o__wunlink 0xc6ba 0x36b
_o__wutime32 0xc6dc 0x36c
_o__wutime64 0xc6ff 0x36d
_o__y0 0xc71c 0x36e
_o__y1 0xc733 0x36f
_o__yn 0xc74a 0x370
_o_abort 0xc763 0x371
_o_acos 0xc77d 0x372
_o_acosh 0xc797 0x373
_o_acoshf 0xc7b3 0x374
_o_acoshl 0xc7d0 0x375
_o_asctime 0xc7ee 0x376
_o_asctime_s 0xc80f 0x377
_o_asin 0xc82d 0x378
_o_asinh 0xc847 0x379
_o_asinhf 0xc863 0x37a
_o_asinhl 0xc880 0x37b
_o_atan 0xc89b 0x37c
_o_atan2 0xc8b5 0x37d
_o_atanh 0xc8d0 0x37e
_o_atanhf 0xc8ec 0x37f
_o_atanhl 0xc909 0x380
_o_atof 0xc924 0x381
_o_atoi 0xc93d 0x382
_o_atol 0xc956 0x383
_o_atoll 0xc970 0x384
_o_bsearch 0xc98d 0x385
_o_bsearch_s 0xc9ae 0x386
_o_btowc 0xc9cd 0x387
_o_calloc 0xc9e9 0x388
_o_cbrt 0xca04 0x389
_o_cbrtf 0xca1e 0x38a
_o_ceil 0xca38 0x38b
_o_clearerr 0xca55 0x38c
_o_clearerr_s 0xca78 0x38d
_o_cos 0xca96 0x38e
_o_cosh 0xcaae 0x38f
_o_erf 0xcac6 0x390
_o_erfc 0xcade 0x391
_o_erfcf 0xcaf8 0x392
_o_erfcl 0xcb13 0x393
_o_erff 0xcb2d 0x394
_o_erfl 0xcb46 0x395
_o_exit 0xcb5f 0x396
_o_exp 0xcb77 0x397
_o_exp2 0xcb8f 0x398
_o_exp2f 0xcba9 0x399
_o_exp2l 0xcbc4 0x39a
_o_fabs 0xcbde 0x39b
_o_fclose 0xcbf9 0x39c
_o_feof 0xcc14 0x39d
_o_ferror 0xcc2f 0x39e
_o_fflush 0xcc4c 0x39f
_o_fgetc 0xcc68 0x3a0
_o_fgetpos 0xcc85 0x3a1
_o_fgets 0xcca2 0x3a2
_o_fgetwc 0xccbe 0x3a3
_o_fgetws 0xccdb 0x3a4
_o_floor 0xccf7 0x3a5
_o_fma 0xcd10 0x3a6
_o_fmaf 0xcd28 0x3a7
_o_fmal 0xcd41 0x3a8
_o_fmod 0xcd5a 0x3a9
_o_fopen 0xcd74 0x3aa
_o_fopen_s 0xcd91 0x3ab
_o_fputc 0xcdae 0x3ac
_o_fputs 0xcdc9 0x3ad
_o_fputwc 0xcde5 0x3ae
_o_fputws 0xce02 0x3af
_o_fread 0xce1e 0x3b0
_o_fread_s 0xce3b 0x3b1
_o_free 0xce57 0x3b2
_o_freopen 0xce73 0x3b3
_o_freopen_s 0xce94 0x3b4
_o_frexp 0xceb3 0x3b5
_o_fseek 0xcece 0x3b6
_o_fsetpos 0xceeb 0x3b7
_o_ftell 0xcf08 0x3b8
_o_fwrite 0xcf24 0x3b9
_o_getc 0xcf3f 0x3ba
_o_getchar 0xcf5b 0x3bb
_o_getenv 0xcf79 0x3bc
_o_getenv_s 0xcf98 0x3bd
_o_gets 0xcfb5 0x3be
_o_gets_s 0xcfd0 0x3bf
_o_getwc 0xcfec 0x3c0
_o_getwchar 0xd00a 0x3c1
_o_hypot 0xd028 0x3c2
_o_is_wctype 0xd047 0x3c3
_o_isalnum 0xd068 0x3c4
_o_isalpha 0xd087 0x3c5
_o_isblank 0xd0a6 0x3c6
_o_iscntrl 0xd0c5 0x3c7
_o_isdigit 0xd0e4 0x3c8
_o_isgraph 0xd103 0x3c9
_o_isleadbyte 0xd125 0x3ca
_o_islower 0xd147 0x3cb
_o_isprint 0xd166 0x3cc
_o_ispunct 0xd185 0x3cd
_o_isspace 0xd1a4 0x3ce
_o_isupper 0xd1c3 0x3cf
_o_iswalnum 0xd1e3 0x3d0
_o_iswalpha 0xd204 0x3d1
_o_iswascii 0xd225 0x3d2
_o_iswblank 0xd246 0x3d3
_o_iswcntrl 0xd267 0x3d4
_o_iswctype 0xd288 0x3d5
_o_iswdigit 0xd2a9 0x3d6
_o_iswgraph 0xd2ca 0x3d7
_o_iswlower 0xd2eb 0x3d8
_o_iswprint 0xd30c 0x3d9
_o_iswpunct 0xd32d 0x3da
_o_iswspace 0xd34e 0x3db
_o_iswupper 0xd36f 0x3dc
_o_iswxdigit 0xd391 0x3dd
_o_isxdigit 0xd3b3 0x3de
_o_ldexp 0xd3d1 0x3df
_o_lgamma 0xd3ed 0x3e0
_o_lgammaf 0xd40b 0x3e1
_o_lgammal 0xd42a 0x3e2
_o_llrint 0xd448 0x3e3
_o_llrintf 0xd466 0x3e4
_o_llrintl 0xd485 0x3e5
_o_llround 0xd4a4 0x3e6
_o_llroundf 0xd4c4 0x3e7
_o_llroundl 0xd4e5 0x3e8
_o_localeconv 0xd508 0x3e9
_o_log 0xd526 0x3ea
_o_log10 0xd53f 0x3eb
_o_log1p 0xd55a 0x3ec
_o_log1pf 0xd576 0x3ed
_o_log1pl 0xd593 0x3ee
_o_log2 0xd5ae 0x3ef
_o_log2f 0xd5c8 0x3f0
_o_log2l 0xd5e3 0x3f1
_o_logb 0xd5fd 0x3f2
_o_logbf 0xd617 0x3f3
_o_logbl 0xd632 0x3f4
_o_lrint 0xd64d 0x3f5
_o_lrintf 0xd669 0x3f6
_o_lrintl 0xd686 0x3f7
_o_lround 0xd6a3 0x3f8
_o_lroundf 0xd6c1 0x3f9
_o_lroundl 0xd6e0 0x3fa
_o_malloc 0xd6fe 0x3fb
_o_mblen 0xd71a 0x3fc
_o_mbrlen 0xd736 0x3fd
_o_mbrtoc16 0xd755 0x3fe
_o_mbrtoc32 0xd776 0x3ff
_o_mbrtowc 0xd796 0x400
_o_mbsrtowcs 0xd7b7 0x401
_o_mbsrtowcs_s 0xd7dc 0x402
_o_mbstowcs 0xd800 0x403
_o_mbstowcs_s 0xd823 0x404
_o_mbtowc 0xd844 0x405
_o_memcpy_s 0xd863 0x406
_o_memset 0xd882 0x407
_o_modf 0xd89d 0x408
_o_nan 0xd8b5 0x409
_o_nanf 0xd8cd 0x40a
_o_nanl 0xd8e6 0x40b
_o_nearbyint 0xd904 0x40c
_o_nearbyintf 0xd928 0x40d
_o_nearbyintl 0xd94d 0x40e
_o_nextafter 0xd971 0x40f
_o_nextafterf 0xd995 0x410
_o_nextafterl 0xd9ba 0x411
_o_nexttoward 0xd9df 0x412
_o_nexttowardf 0xda05 0x413
_o_nexttowardl 0xda2c 0x414
_o_pow 0xda4b 0x415
_o_powf 0xda63 0x416
_o_putc 0xda7c 0x417
_o_putchar 0xda98 0x418
_o_puts 0xdab4 0x419
_o_putwc 0xdace 0x41a
_o_putwchar 0xdaec 0x41b
_o_qsort 0xdb0a 0x41c
_o_qsort_s 0xdb27 0x41d
_o_raise 0xdb44 0x41e
_o_rand 0xdb5e 0x41f
_o_rand_s 0xdb79 0x420
_o_realloc 0xdb97 0x421
_o_remainder 0xdbb8 0x422
_o_remainderf 0xdbdc 0x423
_o_remainderl 0xdc01 0x424
_o_remove 0xdc22 0x425
_o_remquo 0xdc3f 0x426
_o_remquof 0xdc5d 0x427
_o_remquol 0xdc7c 0x428
_o_rename 0xdc9a 0x429
_o_rewind 0xdcb7 0x42a
_o_rint 0xdcd2 0x42b
_o_rintf 0xdcec 0x42c
_o_rintl 0xdd07 0x42d
_o_round 0xdd22 0x42e
_o_roundf 0xdd3e 0x42f
_o_roundl 0xdd5b 0x430
_o_scalbln 0xdd79 0x431
_o_scalblnf 0xdd99 0x432
_o_scalblnl 0xddba 0x433
_o_scalbn 0xddd9 0x434
_o_scalbnf 0xddf7 0x435
_o_scalbnl 0xde16 0x436
_o_set_terminate 0xde3b 0x437
_o_setbuf 0xde5f 0x438
_o_setlocale 0xde7f 0x439
_o_setvbuf 0xdea0 0x43a
_o_sin 0xdebb 0x43b
_o_sinh 0xded3 0x43c
_o_sqrt 0xdeec 0x43d
_o_srand 0xdf06 0x43e
_o_strcat_s 0xdf24 0x43f
_o_strcoll 0xdf44 0x440
_o_strcpy_s 0xdf64 0x441
_o_strerror 0xdf85 0x442
_o_strerror_s 0xdfa8 0x443
_o_strftime 0xdfcb 0x444
_o_strncat_s 0xdfed 0x445
_o_strncpy_s 0xe010 0x446
_o_strtod 0xe030 0x447
_o_strtof 0xe04d 0x448
_o_strtok 0xe06a 0x449
_o_strtok_s 0xe089 0x44a
_o_strtol 0xe0a8 0x44b
_o_strtold 0xe0c6 0x44c
_o_strtoll 0xe0e5 0x44d
_o_strtoul 0xe104 0x44e
_o_strtoull 0xe124 0x44f
_o_system 0xe143 0x450
_o_tan 0xe15d 0x451
_o_tanh 0xe175 0x452
_o_terminate 0xe193 0x453
_o_tgamma 0xe1b3 0x454
_o_tgammaf 0xe1d1 0x455
_o_tgammal 0xe1f0 0x456
_o_tmpfile_s 0xe211 0x457
_o_tmpnam_s 0xe233 0x458
_o_tolower 0xe253 0x459
_o_toupper 0xe272 0x45a
_o_towlower 0xe292 0x45b
_o_towupper 0xe2b3 0x45c
_o_ungetc 0xe2d2 0x45d
_o_ungetwc 0xe2f0 0x45e
_o_wcrtomb 0xe30f 0x45f
_o_wcrtomb_s 0xe330 0x460
_o_wcscat_s 0xe352 0x461
_o_wcscoll 0xe372 0x462
_o_wcscpy 0xe390 0x463
_o_wcscpy_s 0xe3af 0x464
_o_wcsftime 0xe3d0 0x465
_o_wcsncat_s 0xe3f2 0x466
_o_wcsncpy_s 0xe415 0x467
_o_wcsrtombs 0xe438 0x468
_o_wcsrtombs_s 0xe45d 0x469
_o_wcstod 0xe47f 0x46a
_o_wcstof 0xe49c 0x46b
_o_wcstok 0xe4b9 0x46c
_o_wcstok_s 0xe4d8 0x46d
_o_wcstol 0xe4f7 0x46e
_o_wcstold 0xe515 0x46f
_o_wcstoll 0xe534 0x470
_o_wcstombs 0xe554 0x471
_o_wcstombs_s 0xe577 0x472
_o_wcstoul 0xe599 0x473
_o_wcstoull 0xe5b9 0x474
_o_wctob 0xe5d7 0x475
_o_wctomb 0xe5f3 0x476
_o_wctomb_s 0xe612 0x477
_o_wmemcpy_s 0xe634 0x478
_o_wmemmove_s 0xe658 0x479
_purecall 0xe679 0x47a
_seh_longjmp_unwind 0xe6a0 0x47b
_seh_longjmp_unwind4 0xe6d2 0x47c
_set_purecall_handler 0xe706 0x47d
_set_se_translator 0xe738 0x47e
_setjmp3 0xe75d 0x47f
longjmp 0xe777 0x480
memchr 0xe78f 0x481
memcmp 0xe7a6 0x482
memcpy 0xe7bd 0x483
memmove 0xe7d5 0x484
set_unexpected 0xe7f5 0x485
strchr 0xe814 0x486
strrchr 0xe82c 0x487
strstr 0xe844 0x488
unexpected 0xe85f 0x489
wcschr 0xe87a 0x48a
wcsrchr 0xe892 0x48b
wcsstr 0xe8aa 0x48c
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-process-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 8d02dd4c29bd490e672d271700511371 Copy to Clipboard
SHA1 f3035a756e2e963764912c6b432e74615ae07011 Copy to Clipboard
SHA256 c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b Copy to Clipboard
SSDeep 192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2065-11-29 11:56:28+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x688 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.14
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (36)
»
Api name EAT Address Ordinal
_beep 0x12c8 0x1
_cwait 0x12de 0x2
_execl 0x12f5 0x3
_execle 0x130d 0x4
_execlp 0x1326 0x5
_execlpe 0x1340 0x6
_execv 0x1359 0x7
_execve 0x1371 0x8
_execvp 0x138a 0x9
_execvpe 0x13a4 0xa
_loaddll 0x13bf 0xb
_spawnl 0x13d9 0xc
_spawnle 0x13f3 0xd
_spawnlp 0x140e 0xe
_spawnlpe 0x142a 0xf
_spawnv 0x1445 0x10
_spawnve 0x145f 0x11
_spawnvp 0x147a 0x12
_spawnvpe 0x1496 0x13
_unloaddll 0x14b4 0x14
_wexecl 0x14d0 0x15
_wexecle 0x14ea 0x16
_wexeclp 0x1505 0x17
_wexeclpe 0x1521 0x18
_wexecv 0x153c 0x19
_wexecve 0x1556 0x1a
_wexecvp 0x1571 0x1b
_wexecvpe 0x158d 0x1c
_wspawnl 0x15a9 0x1d
_wspawnle 0x15c5 0x1e
_wspawnlp 0x15e2 0x1f
_wspawnlpe 0x1600 0x20
_wspawnv 0x161d 0x21
_wspawnve 0x1639 0x22
_wspawnvp 0x1656 0x23
_wspawnvpe 0x1674 0x24
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-runtime-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 22.30 KB
MD5 41a348f9bedc8681fb30fa78e45edb24 Copy to Clipboard
SHA1 66e76c0574a549f293323dd6f863a8a5b54f3f9b Copy to Clipboard
SHA256 c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b Copy to Clipboard
SSDeep 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x1600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1974-05-31 18:06:00+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x15d5 0x1600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.89
.rsrc 0x10003000 0x3f0 0x400 0x1800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (107)
»
Api name EAT Address Ordinal
_Exit 0x158e 0x1
__control87_2 0x15ab 0x2
__doserrno 0x15cd 0x3
__fpe_flt_rounds 0x15f2 0x4
__fpecode 0x1616 0x5
__p___argc 0x1634 0x6
__p___argv 0x1653 0x7
__p___wargv 0x1673 0x8
__p__acmdln 0x1694 0x9
__p__pgmptr 0x16b5 0xa
__p__wcmdln 0x16d6 0xb
__p__wpgmptr 0x16f8 0xc
__pxcptinfoptrs 0x171e 0xd
__sys_errlist 0x1745 0xe
__sys_nerr 0x1767 0xf
__threadhandle 0x178a 0x10
__threadid 0x17ad 0x11
__wcserror 0x17cc 0x12
__wcserror_s 0x17ed 0x13
_assert 0x180b 0x14
_beginthread 0x1829 0x15
_beginthreadex 0x184e 0x16
_c_exit 0x186e 0x17
_cexit 0x1886 0x18
_clearfp 0x189f 0x19
_configure_narrow_argv 0x18c8 0x1a
_configure_wide_argv 0x18fd 0x1b
_control87 0x1926 0x1c
_controlfp 0x1945 0x1d
_controlfp_s 0x1966 0x1e
_crt_at_quick_exit 0x198f 0x1f
_crt_atexit 0x19b7 0x20
_crt_debugger_hook 0x19df 0x21
_endthread 0x1a06 0x22
_endthreadex 0x1a27 0x23
_errno 0x1a44 0x24
_execute_onexit_table 0x1a6a 0x25
_exit 0x1a8f 0x26
_fpieee_flt 0x1aaa 0x27
_fpreset 0x1ac8 0x28
_get_doserrno 0x1ae8 0x29
_get_errno 0x1b0a 0x2a
_get_initial_narrow_environment 0x1b3e 0x2b
_get_initial_wide_environment 0x1b85 0x2c
_get_invalid_parameter_handler 0x1bcb 0x2d
_get_narrow_winmain_command_line 0x1c14 0x2e
_get_pgmptr 0x1c4a 0x2f
_get_terminate 0x1c6e 0x30
_get_thread_local_invalid_parameter_handler 0x1cb2 0x31
_get_wide_winmain_command_line 0x1d06 0x32
_get_wpgmptr 0x1d3b 0x33
_getdllprocaddr 0x1d61 0x34
_getpid 0x1d82 0x35
_initialize_narrow_environment 0x1db2 0x36
_initialize_onexit_table 0x1df3 0x37
_initialize_wide_environment 0x1e32 0x38
_initterm 0x1e62 0x39
_initterm_e 0x1e81 0x3a
_invalid_parameter_noinfo 0x1eb0 0x3b
_invalid_parameter_noinfo_noreturn 0x1ef6 0x3c
_invoke_watson 0x1f31 0x3d
_query_app_type 0x1f59 0x3e
_register_onexit_function 0x1f8c 0x3f
_register_thread_local_exe_atexit_callback 0x1fda 0x40
_resetstkoflw 0x201c 0x41
_seh_filter_dll 0x2043 0x42
_seh_filter_exe 0x206c 0x43
_set_abort_behavior 0x2099 0x44
_set_app_type 0x20c4 0x45
_set_controlfp 0x20ea 0x46
_set_doserrno 0x2110 0x47
_set_errno 0x2132 0x48
_set_error_mode 0x2156 0x49
_set_invalid_parameter_handler 0x218e 0x4a
_set_new_handler 0x21c7 0x4b
_set_thread_local_invalid_parameter_handler 0x220d 0x4c
_seterrormode 0x2250 0x4d
_sleep 0x226e 0x4e
_statusfp 0x2288 0x4f
_statusfp2 0x22a6 0x50
_strerror 0x22c4 0x51
_strerror_s 0x22e3 0x52
_wassert 0x2301 0x53
_wcserror 0x231d 0x54
_wcserror_s 0x233c 0x55
_wperror 0x235a 0x56
_wsystem 0x2375 0x57
abort 0x238d 0x58
exit 0x23a1 0x59
feclearexcept 0x23bd 0x5a
fegetenv 0x23dd 0x5b
fegetexceptflag 0x23ff 0x5c
fegetround 0x2423 0x5d
feholdexcept 0x2444 0x5e
fesetenv 0x2463 0x5f
fesetexceptflag 0x2485 0x60
fesetround 0x24a9 0x61
fetestexcept 0x24ca 0x62
perror 0x24e7 0x63
quick_exit 0x2502 0x64
raise 0x251c 0x65
set_terminate 0x2539 0x66
signal 0x2557 0x67
strerror 0x2570 0x68
strerror_s 0x258d 0x69
system 0x25a8 0x6a
terminate 0x25c2 0x6b
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-stdio-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 23.80 KB
MD5 fefb98394cb9ef4368da798deab00e21 Copy to Clipboard
SHA1 316d86926b558c9f3f6133739c1a8477b9e60740 Copy to Clipboard
SHA256 b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7 Copy to Clipboard
SSDeep 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x1c00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2089-07-13 01:51:24+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1b61 0x1c00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.96
.rsrc 0x10003000 0x3f0 0x400 0x1e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (159)
»
Api name EAT Address Ordinal
__acrt_iob_func 0x178e 0x1
__p__commode 0x17b4 0x2
__p__fmode 0x17d5 0x3
__stdio_common_vfprintf 0x1801 0x4
__stdio_common_vfprintf_p 0x183c 0x5
__stdio_common_vfprintf_s 0x1879 0x6
__stdio_common_vfscanf 0x18b3 0x7
__stdio_common_vfwprintf 0x18ec 0x8
__stdio_common_vfwprintf_p 0x1929 0x9
__stdio_common_vfwprintf_s 0x1968 0xa
__stdio_common_vfwscanf 0x19a4 0xb
__stdio_common_vsnprintf_s 0x19e0 0xc
__stdio_common_vsnwprintf_s 0x1a20 0xd
__stdio_common_vsprintf 0x1a5d 0xe
__stdio_common_vsprintf_p 0x1a98 0xf
__stdio_common_vsprintf_s 0x1ad5 0x10
__stdio_common_vsscanf 0x1b0f 0x11
__stdio_common_vswprintf 0x1b48 0x12
__stdio_common_vswprintf_p 0x1b85 0x13
__stdio_common_vswprintf_s 0x1bc4 0x14
__stdio_common_vswscanf 0x1c00 0x15
_chsize 0x1c29 0x16
_chsize_s 0x1c44 0x17
_close 0x1c5e 0x18
_commit 0x1c76 0x19
_creat 0x1c8e 0x1a
_dup 0x1ca3 0x1b
_dup2 0x1cb7 0x1c
_eof 0x1ccb 0x1d
_fclose_nolock 0x1ce8 0x1e
_fcloseall 0x1d0b 0x1f
_fflush_nolock 0x1d2e 0x20
_fgetc_nolock 0x1d54 0x21
_fgetchar 0x1d75 0x22
_fgetwc_nolock 0x1d97 0x23
_fgetwchar 0x1dba 0x24
_filelength 0x1dda 0x25
_filelengthi64 0x1dfe 0x26
_fileno 0x1e1e 0x27
_flushall 0x1e39 0x28
_fputc_nolock 0x1e5a 0x29
_fputchar 0x1e7b 0x2a
_fputwc_nolock 0x1e9d 0x2b
_fputwchar 0x1ec0 0x2c
_fread_nolock 0x1ee2 0x2d
_fread_nolock_s 0x1f09 0x2e
_fseek_nolock 0x1f30 0x2f
_fseeki64 0x1f51 0x30
_fseeki64_nolock 0x1f75 0x31
_fsopen 0x1f97 0x32
_ftell_nolock 0x1fb6 0x33
_ftelli64 0x1fd7 0x34
_ftelli64_nolock 0x1ffb 0x35
_fwrite_nolock 0x2024 0x36
_get_fmode 0x2047 0x37
_get_osfhandle 0x206a 0x38
_get_printf_count_output 0x209b 0x39
_get_stream_buffer_pointers 0x20d9 0x3a
_getc_nolock 0x210b 0x3b
_getcwd 0x2129 0x3c
_getdcwd 0x2143 0x3d
_getmaxstdio 0x2162 0x3e
_getw 0x217e 0x3f
_getwc_nolock 0x219b 0x40
_getws 0x21b9 0x41
_getws_s 0x21d2 0x42
_isatty 0x21ec 0x43
_kbhit 0x2204 0x44
_locking 0x221d 0x45
_lseek 0x2236 0x46
_lseeki64 0x2250 0x47
_mktemp 0x226b 0x48
_mktemp_s 0x2286 0x49
_open 0x229f 0x4a
_open_osfhandle 0x22be 0x4b
_pclose 0x22df 0x4c
_pipe 0x22f6 0x4d
_popen 0x230c 0x4e
_putc_nolock 0x2329 0x4f
_putw 0x2345 0x50
_putwc_nolock 0x2362 0x51
_putws 0x2380 0x52
_read 0x2396 0x53
_rmtmp 0x23ac 0x54
_set_fmode 0x23c7 0x55
_set_printf_count_output 0x23f4 0x56
_setmaxstdio 0x2423 0x57
_setmode 0x2442 0x58
_sopen 0x245b 0x59
_sopen_dispatch 0x247b 0x5a
_sopen_s 0x249d 0x5b
_tell 0x24b5 0x5c
_telli64 0x24cd 0x5d
_tempnam 0x24e8 0x5e
_ungetc_nolock 0x2509 0x5f
_ungetwc_nolock 0x2531 0x60
_wcreat 0x2552 0x61
_wfdopen 0x256c 0x62
_wfopen 0x2586 0x63
_wfopen_s 0x25a1 0x64
_wfreopen 0x25be 0x65
_wfreopen_s 0x25dd 0x66
_wfsopen 0x25fb 0x67
_wmktemp 0x2616 0x68
_wmktemp_s 0x2633 0x69
_wopen 0x264e 0x6a
_wpopen 0x2666 0x6b
_write 0x267e 0x6c
_wsopen 0x2696 0x6d
_wsopen_dispatch 0x26b8 0x6e
_wsopen_s 0x26dc 0x6f
_wtempnam 0x26f9 0x70
_wtmpnam 0x2715 0x71
_wtmpnam_s 0x2732 0x72
clearerr 0x274f 0x73
clearerr_s 0x276c 0x74
fclose 0x2787 0x75
feof 0x279c 0x76
ferror 0x27b1 0x77
fflush 0x27c8 0x78
fgetc 0x27de 0x79
fgetpos 0x27f5 0x7a
fgets 0x280c 0x7b
fgetwc 0x2822 0x7c
fgetws 0x2839 0x7d
fopen 0x284f 0x7e
fopen_s 0x2866 0x7f
fputc 0x287d 0x80
fputs 0x2892 0x81
fputwc 0x28a8 0x82
fputws 0x28bf 0x83
fread 0x28d5 0x84
fread_s 0x28ec 0x85
freopen 0x2905 0x86
freopen_s 0x2920 0x87
fseek 0x2939 0x88
fsetpos 0x2950 0x89
ftell 0x2967 0x8a
fwrite 0x297d 0x8b
getc 0x2992 0x8c
getchar 0x29a8 0x8d
gets 0x29be 0x8e
gets_s 0x29d3 0x8f
getwc 0x29e9 0x90
getwchar 0x2a01 0x91
putc 0x2a18 0x92
putchar 0x2a2e 0x93
puts 0x2a44 0x94
putwc 0x2a58 0x95
putwchar 0x2a70 0x96
rewind 0x2a89 0x97
setbuf 0x2aa0 0x98
setvbuf 0x2ab8 0x99
tmpfile 0x2ad1 0x9a
tmpfile_s 0x2aec 0x9b
tmpnam 0x2b06 0x9c
tmpnam_s 0x2b1f 0x9d
ungetc 0x2b38 0x9e
ungetwc 0x2b50 0x9f
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-string-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 22.94 KB
MD5 404604cd100a1e60dfdaf6ecf5ba14c0 Copy to Clipboard
SHA1 58469835ab4b916927b3cabf54aee4f380ff6748 Copy to Clipboard
SHA256 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c Copy to Clipboard
SSDeep 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x1c00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2014-06-23 05:32:49+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1bef 0x1c00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.9
.rsrc 0x10003000 0x3f0 0x400 0x1e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (178)
»
Api name EAT Address Ordinal
__isascii 0x1857 0x1
__iscsym 0x1873 0x2
__iscsymf 0x188f 0x3
__iswcsym 0x18ac 0x4
__iswcsymf 0x18ca 0x5
__strncnt 0x18e8 0x6
__wcsncnt 0x1905 0x7
_isalnum_l 0x1923 0x8
_isalpha_l 0x1942 0x9
_isblank_l 0x1961 0xa
_iscntrl_l 0x1980 0xb
_isctype 0x199d 0xc
_isctype_l 0x19ba 0xd
_isdigit_l 0x19d9 0xe
_isgraph_l 0x19f8 0xf
_isleadbyte_l 0x1a1a 0x10
_islower_l 0x1a3c 0x11
_isprint_l 0x1a5b 0x12
_ispunct_l 0x1a7a 0x13
_isspace_l 0x1a99 0x14
_isupper_l 0x1ab8 0x15
_iswalnum_l 0x1ad8 0x16
_iswalpha_l 0x1af9 0x17
_iswblank_l 0x1b1a 0x18
_iswcntrl_l 0x1b3b 0x19
_iswcsym_l 0x1b5b 0x1a
_iswcsymf_l 0x1b7b 0x1b
_iswctype_l 0x1b9c 0x1c
_iswdigit_l 0x1bbd 0x1d
_iswgraph_l 0x1bde 0x1e
_iswlower_l 0x1bff 0x1f
_iswprint_l 0x1c20 0x20
_iswpunct_l 0x1c41 0x21
_iswspace_l 0x1c62 0x22
_iswupper_l 0x1c83 0x23
_iswxdigit_l 0x1ca5 0x24
_isxdigit_l 0x1cc7 0x25
_memccpy 0x1ce5 0x26
_memicmp 0x1d00 0x27
_memicmp_l 0x1d1d 0x28
_strcoll_l 0x1d3c 0x29
_strdup 0x1d58 0x2a
_stricmp 0x1d72 0x2b
_stricmp_l 0x1d8f 0x2c
_stricoll 0x1dad 0x2d
_stricoll_l 0x1dcc 0x2e
_strlwr 0x1de9 0x2f
_strlwr_l 0x1e04 0x30
_strlwr_s 0x1e21 0x31
_strlwr_s_l 0x1e40 0x32
_strncoll 0x1e5f 0x33
_strncoll_l 0x1e7e 0x34
_strnicmp 0x1e9d 0x35
_strnicmp_l 0x1ebc 0x36
_strnicoll 0x1edc 0x37
_strnicoll_l 0x1efd 0x38
_strnset 0x1f1c 0x39
_strnset_s 0x1f39 0x3a
_strrev 0x1f55 0x3b
_strset 0x1f6e 0x3c
_strset_s 0x1f89 0x3d
_strupr 0x1fa4 0x3e
_strupr_l 0x1fbf 0x3f
_strupr_s 0x1fdc 0x40
_strupr_s_l 0x1ffb 0x41
_strxfrm_l 0x201b 0x42
_tolower 0x2038 0x43
_tolower_l 0x2055 0x44
_toupper 0x2072 0x45
_toupper_l 0x208f 0x46
_towlower_l 0x20af 0x47
_towupper_l 0x20d0 0x48
_wcscoll_l 0x20f0 0x49
_wcsdup 0x210c 0x4a
_wcsicmp 0x2126 0x4b
_wcsicmp_l 0x2143 0x4c
_wcsicoll 0x2161 0x4d
_wcsicoll_l 0x2180 0x4e
_wcslwr 0x219d 0x4f
_wcslwr_l 0x21b8 0x50
_wcslwr_s 0x21d5 0x51
_wcslwr_s_l 0x21f4 0x52
_wcsncoll 0x2213 0x53
_wcsncoll_l 0x2232 0x54
_wcsnicmp 0x2251 0x55
_wcsnicmp_l 0x2270 0x56
_wcsnicoll 0x2290 0x57
_wcsnicoll_l 0x22b1 0x58
_wcsnset 0x22d0 0x59
_wcsnset_s 0x22ed 0x5a
_wcsrev 0x2309 0x5b
_wcsset 0x2322 0x5c
_wcsset_s 0x233d 0x5d
_wcsupr 0x2358 0x5e
_wcsupr_l 0x2373 0x5f
_wcsupr_s 0x2390 0x60
_wcsupr_s_l 0x23af 0x61
_wcsxfrm_l 0x23cf 0x62
_wctype 0x23eb 0x63
is_wctype 0x2406 0x64
isalnum 0x2421 0x65
isalpha 0x243a 0x66
isblank 0x2453 0x67
iscntrl 0x246c 0x68
isdigit 0x2485 0x69
isgraph 0x249e 0x6a
isleadbyte 0x24ba 0x6b
islower 0x24d6 0x6c
isprint 0x24ef 0x6d
ispunct 0x2508 0x6e
isspace 0x2521 0x6f
isupper 0x253a 0x70
iswalnum 0x2554 0x71
iswalpha 0x256f 0x72
iswascii 0x258a 0x73
iswblank 0x25a5 0x74
iswcntrl 0x25c0 0x75
iswctype 0x25db 0x76
iswdigit 0x25f6 0x77
iswgraph 0x2611 0x78
iswlower 0x262c 0x79
iswprint 0x2647 0x7a
iswpunct 0x2662 0x7b
iswspace 0x267d 0x7c
iswupper 0x2698 0x7d
iswxdigit 0x26b4 0x7e
isxdigit 0x26d0 0x7f
mblen 0x26e8 0x80
mbrlen 0x26fe 0x81
memcpy_s 0x2717 0x82
memmove_s 0x2733 0x83
memset 0x274d 0x84
strcat 0x2764 0x85
strcat_s 0x277d 0x86
strcmp 0x2796 0x87
strcoll 0x27ae 0x88
strcpy 0x27c6 0x89
strcpy_s 0x27df 0x8a
strcspn 0x27f9 0x8b
strlen 0x2811 0x8c
strncat 0x2829 0x8d
strncat_s 0x2844 0x8e
strncmp 0x285f 0x8f
strncpy 0x2878 0x90
strncpy_s 0x2893 0x91
strnlen 0x28ae 0x92
strpbrk 0x28c7 0x93
strspn 0x28df 0x94
strtok 0x28f6 0x95
strtok_s 0x290f 0x96
strxfrm 0x2929 0x97
tolower 0x2942 0x98
toupper 0x295b 0x99
towctrans 0x2976 0x9a
towlower 0x2992 0x9b
towupper 0x29ad 0x9c
wcscat 0x29c6 0x9d
wcscat_s 0x29df 0x9e
wcscmp 0x29f8 0x9f
wcscoll 0x2a10 0xa0
wcscpy 0x2a28 0xa1
wcscpy_s 0x2a41 0xa2
wcscspn 0x2a5b 0xa3
wcslen 0x2a73 0xa4
wcsncat 0x2a8b 0xa5
wcsncat_s 0x2aa6 0xa6
wcsncmp 0x2ac1 0xa7
wcsncpy 0x2ada 0xa8
wcsncpy_s 0x2af5 0xa9
wcsnlen 0x2b10 0xaa
wcspbrk 0x2b29 0xab
wcsspn 0x2b41 0xac
wcstok 0x2b58 0xad
wcstok_s 0x2b71 0xae
wcsxfrm 0x2b8b 0xaf
wctype 0x2ba3 0xb0
wmemcpy_s 0x2bbd 0xb1
wmemmove_s 0x2bdb 0xb2
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-time-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 20.30 KB
MD5 849f2c3ebf1fcba33d16153692d5810f Copy to Clipboard
SHA1 1f8eda52d31512ebfdd546be60990b95c8e28bfb Copy to Clipboard
SHA256 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d Copy to Clipboard
SSDeep 384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0 Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0xe00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2008-12-22 15:31:44+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xcbd 0xe00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.68
.rsrc 0x10002000 0x3f0 0x400 0x1000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (72)
»
Api name EAT Address Ordinal
_Getdays 0x1420 0x1
_Getmonths 0x143d 0x2
_Gettnames 0x145c 0x3
_Strftime 0x147a 0x4
_W_Getdays 0x1498 0x5
_W_Getmonths 0x14b9 0x6
_W_Gettnames 0x14dc 0x7
_Wcsftime 0x14fc 0x8
__daylight 0x151a 0x9
__dstbias 0x1538 0xa
__timezone 0x1556 0xb
__tzname 0x1573 0xc
_ctime32 0x158e 0xd
_ctime32_s 0x15ab 0xe
_ctime64 0x15c8 0xf
_ctime64_s 0x15e5 0x10
_difftime32 0x1605 0x11
_difftime64 0x1626 0x12
_ftime32 0x1644 0x13
_ftime32_s 0x1661 0x14
_ftime64 0x167e 0x15
_ftime64_s 0x169b 0x16
_futime32 0x16b9 0x17
_futime64 0x16d6 0x18
_get_daylight 0x16f7 0x19
_get_dstbias 0x171b 0x1a
_get_timezone 0x173f 0x1b
_get_tzname 0x1762 0x1c
_getsystime 0x1783 0x1d
_gmtime32 0x17a2 0x1e
_gmtime32_s 0x17c1 0x1f
_gmtime64 0x17e0 0x20
_gmtime64_s 0x17ff 0x21
_localtime32 0x1821 0x22
_localtime32_s 0x1846 0x23
_localtime64 0x186b 0x24
_localtime64_s 0x1890 0x25
_mkgmtime32 0x18b4 0x26
_mkgmtime64 0x18d5 0x27
_mktime32 0x18f4 0x28
_mktime64 0x1911 0x29
_setsystime 0x1930 0x2a
_strdate 0x194e 0x2b
_strdate_s 0x196b 0x2c
_strftime_l 0x198b 0x2d
_strtime 0x19a9 0x2e
_strtime_s 0x19c6 0x2f
_time32 0x19e2 0x30
_time64 0x19fb 0x31
_timespec32_get 0x1a1c 0x32
_timespec64_get 0x1a45 0x33
_tzset 0x1a65 0x34
_utime32 0x1a7e 0x35
_utime64 0x1a99 0x36
_wasctime 0x1ab5 0x37
_wasctime_s 0x1ad4 0x38
_wcsftime_l 0x1af5 0x39
_wctime32 0x1b14 0x3a
_wctime32_s 0x1b33 0x3b
_wctime64 0x1b52 0x3c
_wctime64_s 0x1b71 0x3d
_wstrdate 0x1b90 0x3e
_wstrdate_s 0x1baf 0x3f
_wstrtime 0x1bce 0x40
_wstrtime_s 0x1bed 0x41
_wutime32 0x1c0c 0x42
_wutime64 0x1c29 0x43
asctime 0x1c44 0x44
asctime_s 0x1c5f 0x45
clock 0x1c78 0x46
strftime 0x1c90 0x47
wcsftime 0x1cab 0x48
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-utility-l1-1-0.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 b52a0ca52c9c207874639b62b6082242 Copy to Clipboard
SHA1 6fb845d6a82102ff74bd35f42a2844d8c450413b Copy to Clipboard
SHA256 a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0 Copy to Clipboard
SSDeep 192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2105-09-06 09:19:26+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x56e 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.51
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (30)
»
Api name EAT Address Ordinal
_abs64 0x128d 0x1
_byteswap_uint64 0x12ae 0x2
_byteswap_ulong 0x12d8 0x3
_byteswap_ushort 0x1302 0x4
_lfind 0x1323 0x5
_lfind_s 0x133c 0x6
_lrotl 0x1355 0x7
_lrotr 0x136c 0x8
_lsearch 0x1385 0x9
_lsearch_s 0x13a2 0xa
_rotl 0x13bc 0xb
_rotl64 0x13d3 0xc
_rotr 0x13ea 0xd
_rotr64 0x1401 0xe
_swab 0x1418 0xf
abs 0x142b 0x10
bsearch 0x1440 0x11
bsearch_s 0x145b 0x12
div 0x1472 0x13
imaxabs 0x1487 0x14
imaxdiv 0x14a0 0x15
labs 0x14b6 0x16
ldiv 0x14c9 0x17
llabs 0x14dd 0x18
lldiv 0x14f2 0x19
qsort 0x1507 0x1a
qsort_s 0x151e 0x1b
rand 0x1534 0x1c
rand_s 0x1549 0x1d
srand 0x155f 0x1e
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/freebl3.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 324.95 KB
MD5 343aa83574577727aabe537dccfdeafc Copy to Clipboard
SHA1 9ce3b9a182429c0dba9821e2e72d3ab46f5d0a06 Copy to Clipboard
SHA256 393ae7f06fe6cd19ea6d57a93dd0acd839ee39ba386cf1ca774c4c59a3bfebd8 Copy to Clipboard
SSDeep 6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z Copy to Clipboard
ImpHash 2c54251b196d9e0cc804a7061f60558c Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Entry Point 0x1003d709
Size Of Code 0x3d200
Size Of Initialized Data 0x16600
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2018-04-27 21:41:47+00:00
Version Information (11)
»
BuildID 20180427210249
Comments -
CompanyName Mozilla Foundation
FileDescription -
FileVersion 59.0.3
InternalName -
LegalCopyright License: MPL 2
LegalTrademarks Mozilla
OriginalFilename freebl3.dll
ProductName Firefox
ProductVersion 59.0.3
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x3d055 0x3d200 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.61
.rdata 0x1003f000 0xfe9c 0x10000 0x3d600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 6.41
.data 0x1004f000 0x486c 0x400 0x4d600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.28
.rsrc 0x10054000 0x370 0x400 0x4da00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.87
.reloc 0x10055000 0x16c4 0x1800 0x4de00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.56
Imports (9)
»
nss3.dll (30)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PORT_GetError_Util 0x0 0x1003f0bc 0x4e7e4 0x4cde4 0x208
PR_NewLock 0x0 0x1003f0c0 0x4e7e8 0x4cde8 0x30e
PR_DestroyLock 0x0 0x1003f0c4 0x4e7ec 0x4cdec 0x268
PR_Lock 0x0 0x1003f0c8 0x4e7f0 0x4cdf0 0x300
PR_Unlock 0x0 0x1003f0cc 0x4e7f4 0x4cdf4 0x380
SECITEM_FreeItem_Util 0x0 0x1003f0d0 0x4e7f8 0x4cdf8 0x3af
SECITEM_ZfreeItem_Util 0x0 0x1003f0d4 0x4e7fc 0x4cdfc 0x3b5
SECITEM_CopyItem_Util 0x0 0x1003f0d8 0x4e800 0x4ce00 0x3aa
PR_NotifyCondVar 0x0 0x1003f0dc 0x4e804 0x4ce04 0x31e
NSS_SecureMemcmpZero 0x0 0x1003f0e0 0x4e808 0x4ce08 0x11b
PORT_ZAllocAlignedOffset_Util 0x0 0x1003f0e4 0x4e80c 0x4ce0c 0x218
SECITEM_CompareItem_Util 0x0 0x1003f0e8 0x4e810 0x4ce10 0x3a8
PR_NewCondVar 0x0 0x1003f0ec 0x4e814 0x4ce14 0x30d
PR_DestroyCondVar 0x0 0x1003f0f0 0x4e818 0x4ce18 0x266
PR_WaitCondVar 0x0 0x1003f0f4 0x4e81c 0x4ce1c 0x385
PORT_ZAlloc_Util 0x0 0x1003f0f8 0x4e820 0x4ce20 0x219
SECITEM_AllocItem_Util 0x0 0x1003f0fc 0x4e824 0x4ce24 0x3a6
PR_NotifyAllCondVar 0x0 0x1003f100 0x4e828 0x4ce28 0x31d
SECOID_FindOIDTag_Util 0x0 0x1003f104 0x4e82c 0x4ce2c 0x3f6
PORT_ArenaAlloc_Util 0x0 0x1003f108 0x4e830 0x4ce30 0x1f9
PORT_ArenaZAlloc_Util 0x0 0x1003f10c 0x4e834 0x4ce34 0x201
PORT_FreeArena_Util 0x0 0x1003f110 0x4e838 0x4ce38 0x205
PORT_NewArena_Util 0x0 0x1003f114 0x4e83c 0x4ce3c 0x20b
NSS_SecureMemcmp 0x0 0x1003f118 0x4e840 0x4ce40 0x11a
PR_GetEnvSecure 0x0 0x1003f11c 0x4e844 0x4ce44 0x2ad
PR_CallOnce 0x0 0x1003f120 0x4e848 0x4ce48 0x23d
PORT_SetError_Util 0x0 0x1003f124 0x4e84c 0x4ce4c 0x20f
PORT_ZFree_Util 0x0 0x1003f128 0x4e850 0x4ce50 0x21a
PORT_Free_Util 0x0 0x1003f12c 0x4e854 0x4ce54 0x206
PORT_Alloc_Util 0x0 0x1003f130 0x4e858 0x4ce58 0x1f7
KERNEL32.dll (18)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
IsDebuggerPresent 0x0 0x1003f008 0x4e730 0x4cd30 0x376
InitializeSListHead 0x0 0x1003f00c 0x4e734 0x4cd34 0x35a
DisableThreadLibraryCalls 0x0 0x1003f010 0x4e738 0x4cd38 0x11b
GetSystemTimeAsFileTime 0x0 0x1003f014 0x4e73c 0x4cd3c 0x2e2
IsProcessorFeaturePresent 0x0 0x1003f018 0x4e740 0x4cd40 0x37d
TerminateProcess 0x0 0x1003f01c 0x4e744 0x4cd44 0x57c
UnhandledExceptionFilter 0x0 0x1003f020 0x4e748 0x4cd48 0x59d
GetLogicalDrives 0x0 0x1003f024 0x4e74c 0x4cd4c 0x261
GetVolumeInformationA 0x0 0x1003f028 0x4e750 0x4cd50 0x314
QueryPerformanceCounter 0x0 0x1003f02c 0x4e754 0x4cd54 0x440
GetCurrentProcess 0x0 0x1003f030 0x4e758 0x4cd58 0x213
GetDiskFreeSpaceA 0x0 0x1003f034 0x4e75c 0x4cd5c 0x222
SetUnhandledExceptionFilter 0x0 0x1003f038 0x4e760 0x4cd60 0x55e
GetCurrentProcessId 0x0 0x1003f03c 0x4e764 0x4cd64 0x214
GetComputerNameA 0x0 0x1003f040 0x4e768 0x4cd68 0x1d8
GlobalMemoryStatus 0x0 0x1003f044 0x4e76c 0x4cd6c 0x331
GetTickCount 0x0 0x1003f048 0x4e770 0x4cd70 0x300
GetCurrentThreadId 0x0 0x1003f04c 0x4e774 0x4cd74 0x218
ADVAPI32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SystemFunction036 0x0 0x1003f000 0x4e728 0x4cd28 0x31f
VCRUNTIME140.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memset 0x0 0x1003f054 0x4e77c 0x4cd7c 0x48
__std_type_info_destroy_list 0x0 0x1003f058 0x4e780 0x4cd80 0x25
_except_handler4_common 0x0 0x1003f05c 0x4e784 0x4cd84 0x35
memcmp 0x0 0x1003f060 0x4e788 0x4cd88 0x45
memcpy 0x0 0x1003f064 0x4e78c 0x4cd8c 0x46
api-ms-win-crt-heap-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
calloc 0x0 0x1003f06c 0x4e794 0x4cd94 0x17
free 0x0 0x1003f070 0x4e798 0x4cd98 0x18
malloc 0x0 0x1003f074 0x4e79c 0x4cd9c 0x19
api-ms-win-crt-string-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_strdup 0x0 0x1003f0a4 0x4e7cc 0x4cdcc 0x29
api-ms-win-crt-runtime-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_cexit 0x0 0x1003f07c 0x4e7a4 0x4cda4 0x17
_initialize_onexit_table 0x0 0x1003f080 0x4e7a8 0x4cda8 0x36
_initialize_narrow_environment 0x0 0x1003f084 0x4e7ac 0x4cdac 0x35
_configure_narrow_argv 0x0 0x1003f088 0x4e7b0 0x4cdb0 0x19
_seh_filter_dll 0x0 0x1003f08c 0x4e7b4 0x4cdb4 0x41
_initterm_e 0x0 0x1003f090 0x4e7b8 0x4cdb8 0x39
_initterm 0x0 0x1003f094 0x4e7bc 0x4cdbc 0x38
_execute_onexit_table 0x0 0x1003f098 0x4e7c0 0x4cdc0 0x24
abort 0x0 0x1003f09c 0x4e7c4 0x4cdc4 0x57
api-ms-win-crt-utility-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
rand 0x0 0x1003f0b4 0x4e7dc 0x4cddc 0x1b
api-ms-win-crt-time-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_time64 0x0 0x1003f0ac 0x4e7d4 0x4cdd4 0x30
Exports (1)
»
Api name EAT Address Ordinal
FREEBL_GetVector 0x1ee90 0x1
Digital Signatures (3)
»
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 00:00:00+00:00
Valid Until 2019-06-28 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 12:00:00+00:00
Valid Until 2028-10-22 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 00:00:00+00:00
Valid Until 2031-11-10 00:00:00+00:00
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/mozglue.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 135.95 KB
MD5 9e682f1eb98a9d41468fc3e50f907635 Copy to Clipboard
SHA1 85e0ceca36f657ddf6547aa0744f0855a27527ee Copy to Clipboard
SHA256 830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d Copy to Clipboard
SSDeep 3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR Copy to Clipboard
ImpHash aeefa1230e6cf7c323562e45433b24dd Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Entry Point 0x1000cd12
Size Of Code 0x18400
Size Of Initialized Data 0x8400
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2018-04-27 22:06:59+00:00
Version Information (11)
»
BuildID 20180427210249
Comments -
CompanyName Mozilla Foundation
FileDescription -
FileVersion 59.0.3
InternalName -
LegalCopyright License: MPL 2
LegalTrademarks Mozilla
OriginalFilename mozglue.dll
ProductName Firefox
ProductVersion 59.0.3
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x18214 0x18400 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.7
.rdata 0x1001a000 0x62ac 0x6400 0x18800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.64
.data 0x10021000 0xb98 0x200 0x1ec00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.55
.rsrc 0x10022000 0x370 0x400 0x1ee00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.87
.reloc 0x10023000 0xe08 0x1000 0x1f200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.27
Imports (14)
»
KERNEL32.dll (76)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
WriteFile 0x0 0x1001a010 0x1ea88 0x1d288 0x605
OutputDebugStringA 0x0 0x1001a014 0x1ea8c 0x1d28c 0x40b
LoadLibraryExA 0x0 0x1001a018 0x1ea90 0x1d290 0x3b7
EncodePointer 0x0 0x1001a01c 0x1ea94 0x1d294 0x12a
LeaveCriticalSection 0x0 0x1001a020 0x1ea98 0x1d298 0x3b2
InitializeCriticalSection 0x0 0x1001a024 0x1ea9c 0x1d29c 0x355
CreateFileW 0x0 0x1001a028 0x1eaa0 0x1d2a0 0xc9
GetCurrentThreadId 0x0 0x1001a02c 0x1eaa4 0x1d2a4 0x218
UnmapViewOfFile 0x0 0x1001a030 0x1eaa8 0x1d2a8 0x5a0
GetModuleHandleA 0x0 0x1001a034 0x1eaac 0x1d2ac 0x26e
ReleaseSRWLockExclusive 0x0 0x1001a038 0x1eab0 0x1d2b0 0x4a4
AcquireSRWLockExclusive 0x0 0x1001a03c 0x1eab4 0x1d2b4 0x0
CloseHandle 0x0 0x1001a040 0x1eab8 0x1d2b8 0x85
ReleaseSRWLockShared 0x0 0x1001a044 0x1eabc 0x1d2bc 0x4a5
GetSystemInfo 0x0 0x1001a048 0x1eac0 0x1d2c0 0x2dc
LoadLibraryW 0x0 0x1001a04c 0x1eac4 0x1d2c4 0x3b9
VirtualProtectEx 0x0 0x1001a050 0x1eac8 0x1d2c8 0x5bd
DecodePointer 0x0 0x1001a054 0x1eacc 0x1d2cc 0x106
GetProcAddress 0x0 0x1001a058 0x1ead0 0x1d2d0 0x2a7
VirtualAllocEx 0x0 0x1001a05c 0x1ead4 0x1d2d4 0x5b7
AcquireSRWLockShared 0x0 0x1001a060 0x1ead8 0x1d2d8 0x1
VerSetConditionMask 0x0 0x1001a064 0x1eadc 0x1d2dc 0x5b1
GetModuleHandleW 0x0 0x1001a068 0x1eae0 0x1d2e0 0x271
FlushInstructionCache 0x0 0x1001a06c 0x1eae4 0x1d2e4 0x19c
CreateFileMappingW 0x0 0x1001a070 0x1eae8 0x1d2e8 0xc6
MapViewOfFile 0x0 0x1001a074 0x1eaec 0x1d2ec 0x3d1
VirtualQuery 0x0 0x1001a078 0x1eaf0 0x1d2f0 0x5be
IsDebuggerPresent 0x0 0x1001a07c 0x1eaf4 0x1d2f4 0x376
VirtualFree 0x0 0x1001a080 0x1eaf8 0x1d2f8 0x5b9
GetCurrentProcess 0x0 0x1001a084 0x1eafc 0x1d2fc 0x213
TerminateProcess 0x0 0x1001a088 0x1eb00 0x1d300 0x57c
InitializeCriticalSectionAndSpinCount 0x0 0x1001a08c 0x1eb04 0x1d304 0x356
GetEnvironmentVariableA 0x0 0x1001a090 0x1eb08 0x1d308 0x232
SleepConditionVariableCS 0x0 0x1001a094 0x1eb0c 0x1d30c 0x56e
WakeAllConditionVariable 0x0 0x1001a098 0x1eb10 0x1d310 0x5cf
WakeConditionVariable 0x0 0x1001a09c 0x1eb14 0x1d314 0x5d0
InitializeConditionVariable 0x0 0x1001a0a0 0x1eb18 0x1d318 0x353
GetLastError 0x0 0x1001a0a4 0x1eb1c 0x1d31c 0x25a
InitializeCriticalSectionEx 0x0 0x1001a0a8 0x1eb20 0x1d320 0x357
DeleteCriticalSection 0x0 0x1001a0ac 0x1eb24 0x1d324 0x10d
WideCharToMultiByte 0x0 0x1001a0b0 0x1eb28 0x1d328 0x5f1
SignalObjectAndWait 0x0 0x1001a0b4 0x1eb2c 0x1d32c 0x56b
WaitForSingleObject 0x0 0x1001a0b8 0x1eb30 0x1d330 0x5c7
SuspendThread 0x0 0x1001a0bc 0x1eb34 0x1d334 0x575
ResumeThread 0x0 0x1001a0c0 0x1eb38 0x1d338 0x4be
DuplicateHandle 0x0 0x1001a0c4 0x1eb3c 0x1d33c 0x128
SetEvent 0x0 0x1001a0c8 0x1eb40 0x1d340 0x507
GetCurrentThread 0x0 0x1001a0cc 0x1eb44 0x1d344 0x217
GetThreadContext 0x0 0x1001a0d0 0x1eb48 0x1d348 0x2f0
LocalFree 0x0 0x1001a0d4 0x1eb4c 0x1d34c 0x3c3
FormatMessageA 0x0 0x1001a0d8 0x1eb50 0x1d350 0x1a2
CreateEventA 0x0 0x1001a0dc 0x1eb54 0x1d354 0xba
GetSystemTimeAdjustment 0x0 0x1001a0e0 0x1eb58 0x1d358 0x2e1
GetTickCount64 0x0 0x1001a0e4 0x1eb5c 0x1d35c 0x301
QueryPerformanceFrequency 0x0 0x1001a0e8 0x1eb60 0x1d360 0x441
SystemTimeToFileTime 0x0 0x1001a0ec 0x1eb64 0x1d364 0x578
GetSystemTime 0x0 0x1001a0f0 0x1eb68 0x1d368 0x2e0
QueryPerformanceCounter 0x0 0x1001a0f4 0x1eb6c 0x1d36c 0x440
GetProcessTimes 0x0 0x1001a0f8 0x1eb70 0x1d370 0x2b7
VirtualProtect 0x0 0x1001a0fc 0x1eb74 0x1d374 0x5bc
EnterCriticalSection 0x0 0x1001a100 0x1eb78 0x1d378 0x12e
VerifyVersionInfoA 0x0 0x1001a104 0x1eb7c 0x1d37c 0x5b4
VirtualAlloc 0x0 0x1001a108 0x1eb80 0x1d380 0x5b6
SearchPathW 0x0 0x1001a10c 0x1eb84 0x1d384 0x4c9
InitializeSListHead 0x0 0x1001a110 0x1eb88 0x1d388 0x35a
DisableThreadLibraryCalls 0x0 0x1001a114 0x1eb8c 0x1d38c 0x11b
GetSystemTimeAsFileTime 0x0 0x1001a118 0x1eb90 0x1d390 0x2e2
GetCurrentProcessId 0x0 0x1001a11c 0x1eb94 0x1d394 0x214
IsProcessorFeaturePresent 0x0 0x1001a120 0x1eb98 0x1d398 0x37d
SetUnhandledExceptionFilter 0x0 0x1001a124 0x1eb9c 0x1d39c 0x55e
UnhandledExceptionFilter 0x0 0x1001a128 0x1eba0 0x1d3a0 0x59d
CreateEventW 0x0 0x1001a12c 0x1eba4 0x1d3a4 0xbd
WaitForSingleObjectEx 0x0 0x1001a130 0x1eba8 0x1d3a8 0x5c8
ResetEvent 0x0 0x1001a134 0x1ebac 0x1d3ac 0x4b8
FreeLibrary 0x0 0x1001a138 0x1ebb0 0x1d3b0 0x1a7
RaiseException 0x0 0x1001a13c 0x1ebb4 0x1d3b4 0x455
ADVAPI32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegOpenKeyExW 0x0 0x1001a000 0x1ea78 0x1d278 0x28a
RegQueryValueExW 0x0 0x1001a004 0x1ea7c 0x1d27c 0x297
RegCloseKey 0x0 0x1001a008 0x1ea80 0x1d280 0x259
dbghelp.dll (10)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
StackWalk64 0x0 0x1001a2e4 0x1ed5c 0x1d55c 0x2c
SymSetOptions 0x0 0x1001a2e8 0x1ed60 0x1d560 0xb9
EnumerateLoadedModules64 0x0 0x1001a2ec 0x1ed64 0x1d564 0x5
SymFunctionTableAccess64 0x0 0x1001a2f0 0x1ed68 0x1d568 0x64
SymGetLineFromAddr64 0x0 0x1001a2f4 0x1ed6c 0x1d56c 0x6b
SymGetModuleInfo64 0x0 0x1001a2f8 0x1ed70 0x1d570 0x7b
SymLoadModule64 0x0 0x1001a2fc 0x1ed74 0x1d574 0xa1
SymGetModuleBase64 0x0 0x1001a300 0x1ed78 0x1d578 0x79
SymFromAddr 0x0 0x1001a304 0x1ed7c 0x1d57c 0x59
SymInitialize 0x0 0x1001a308 0x1ed80 0x1d580 0x9e
VERSION.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VerQueryValueW 0x0 0x1001a218 0x1ec90 0x1d490 0x10
GetFileVersionInfoSizeW 0x0 0x1001a21c 0x1ec94 0x1d494 0x7
GetFileVersionInfoW 0x0 0x1001a220 0x1ec98 0x1d498 0x8
MSVCP140.dll (42)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
??Bid@locale@std@@QAEIXZ 0x0 0x1001a144 0x1ebbc 0x1d3bc 0x131
?_Xbad_alloc@std@@YAXXZ 0x0 0x1001a148 0x1ebc0 0x1d3c0 0x28b
?_Xlength_error@std@@YAXPBD@Z 0x0 0x1001a14c 0x1ebc4 0x1d3c4 0x28e
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA 0x0 0x1001a150 0x1ebc8 0x1d3c8 0x25c
?_BADOFF@std@@3_JB 0x0 0x1001a154 0x1ebcc 0x1d3cc 0x196
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z 0x0 0x1001a158 0x1ebd0 0x1d3d0 0x4c4
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ 0x0 0x1001a15c 0x1ebd4 0x1d3d4 0x2f
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ 0x0 0x1001a160 0x1ebd8 0x1d3d8 0xc
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x0 0x1001a164 0x1ebdc 0x1d3dc 0x34d
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x0 0x1001a168 0x1ebe0 0x1d3e0 0x3c6
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x0 0x1001a16c 0x1ebe4 0x1d3e4 0x43e
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x0 0x1001a170 0x1ebe8 0x1d3e8 0x447
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x0 0x1001a174 0x1ebec 0x1d3ec 0x350
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z 0x0 0x1001a178 0x1ebf0 0x1d3f0 0x36b
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z 0x0 0x1001a17c 0x1ebf4 0x1d3f4 0x4ba
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x0 0x1001a180 0x1ebf8 0x1d3f8 0x359
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z 0x0 0x1001a184 0x1ebfc 0x1d3fc 0x441
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z 0x0 0x1001a188 0x1ec00 0x1d400 0x4bf
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z 0x0 0x1001a18c 0x1ec04 0x1d404 0x4be
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x0 0x1001a190 0x1ec08 0x1d408 0x24a
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z 0x0 0x1001a194 0x1ec0c 0x1d40c 0x25
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ 0x0 0x1001a198 0x1ec10 0x1d410 0x7d
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ 0x0 0x1001a19c 0x1ec14 0x1d414 0x89
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ 0x0 0x1001a1a0 0x1ec18 0x1d418 0x228
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ 0x0 0x1001a1a4 0x1ec1c 0x1d41c 0x27f
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ 0x0 0x1001a1a8 0x1ec20 0x1d420 0x4d5
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ 0x0 0x1001a1ac 0x1ec24 0x1d424 0x51b
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z 0x0 0x1001a1b0 0x1ec28 0x1d428 0x543
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z 0x0 0x1001a1b4 0x1ec2c 0x1d42c 0x546
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z 0x0 0x1001a1b8 0x1ec30 0x1d430 0x4b5
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ 0x0 0x1001a1bc 0x1ec34 0x1d434 0x4fd
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z 0x0 0x1001a1c0 0x1ec38 0x1d438 0x3f6
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ 0x0 0x1001a1c4 0x1ec3c 0x1d43c 0x86
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z 0x0 0x1001a1c8 0x1ec40 0x1d440 0x10b
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z 0x0 0x1001a1cc 0x1ec44 0x1d444 0x10c
??1_Lockit@std@@QAE@XZ 0x0 0x1001a1d0 0x1ec48 0x1d448 0xa5
??0_Lockit@std@@QAE@H@Z 0x0 0x1001a1d4 0x1ec4c 0x1d44c 0x6d
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ 0x0 0x1001a1d8 0x1ec50 0x1d450 0x1d5
?classic@locale@std@@SAABV12@XZ 0x0 0x1001a1dc 0x1ec54 0x1d454 0x2a4
?id@?$ctype@D@std@@2V0locale@2@A 0x0 0x1001a1e0 0x1ec58 0x1d458 0x3cf
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x0 0x1001a1e4 0x1ec5c 0x1d45c 0x1b6
?tolower@?$ctype@D@std@@QBEDD@Z 0x0 0x1001a1e8 0x1ec60 0x1d460 0x50f
VCRUNTIME140.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memset 0x0 0x1001a1f0 0x1ec68 0x1d468 0x48
strchr 0x0 0x1001a1f4 0x1ec6c 0x1d46c 0x4a
_purecall 0x0 0x1001a1f8 0x1ec70 0x1d470 0x3d
memmove 0x0 0x1001a1fc 0x1ec74 0x1d474 0x47
_except_handler4_common 0x0 0x1001a200 0x1ec78 0x1d478 0x35
__vcrt_InitializeCriticalSectionEx 0x0 0x1001a204 0x1ec7c 0x1d47c 0x30
memcpy 0x0 0x1001a208 0x1ec80 0x1d480 0x46
__std_type_info_destroy_list 0x0 0x1001a20c 0x1ec84 0x1d484 0x25
__CxxFrameHandler3 0x0 0x1001a210 0x1ec88 0x1d488 0x10
api-ms-win-crt-stdio-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__stdio_common_vfprintf 0x0 0x1001a2a0 0x1ed18 0x1d518 0x3
__acrt_iob_func 0x0 0x1001a2a4 0x1ed1c 0x1d51c 0x0
_dup 0x0 0x1001a2a8 0x1ed20 0x1d520 0x1a
fputs 0x0 0x1001a2ac 0x1ed24 0x1d524 0x80
fflush 0x0 0x1001a2b0 0x1ed28 0x1d528 0x77
__stdio_common_vsprintf 0x0 0x1001a2b4 0x1ed2c 0x1d52c 0xd
fclose 0x0 0x1001a2b8 0x1ed30 0x1d530 0x74
_write 0x0 0x1001a2bc 0x1ed34 0x1d534 0x6b
api-ms-win-crt-math-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_fdopen 0x0 0x1001a250 0x1ecc8 0x1d4c8 0x46
_dtest 0x0 0x1001a254 0x1eccc 0x1d4cc 0x3e
_except1 0x0 0x1001a258 0x1ecd0 0x1d4d0 0x40
ceil 0x0 0x1001a25c 0x1ecd4 0x1d4d4 0xa2
api-ms-win-crt-filesystem-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wsplitpath_s 0x0 0x1001a23c 0x1ecb4 0x1d4b4 0x39
api-ms-win-crt-string-l1-1-0.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wcsnicmp 0x0 0x1001a2c4 0x1ed3c 0x1d53c 0x54
_stricmp 0x0 0x1001a2c8 0x1ed40 0x1d540 0x2a
isxdigit 0x0 0x1001a2cc 0x1ed44 0x1d544 0x7e
strncpy 0x0 0x1001a2d0 0x1ed48 0x1d548 0x8f
_strnicmp 0x0 0x1001a2d4 0x1ed4c 0x1d54c 0x34
wcstok_s 0x0 0x1001a2d8 0x1ed50 0x1d550 0xad
wcsncpy 0x0 0x1001a2dc 0x1ed54 0x1d554 0xa7
api-ms-win-crt-convert-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_strtoui64 0x0 0x1001a228 0x1eca0 0x1d4a0 0x27
_ltoa 0x0 0x1001a22c 0x1eca4 0x1d4a4 0x1b
api-ms-win-crt-runtime-l1-1-0.dll (14)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_beginthreadex 0x0 0x1001a264 0x1ecdc 0x1d4dc 0x15
_configure_narrow_argv 0x0 0x1001a268 0x1ece0 0x1d4e0 0x19
_initterm_e 0x0 0x1001a26c 0x1ece4 0x1d4e4 0x39
_errno 0x0 0x1001a270 0x1ece8 0x1d4e8 0x23
abort 0x0 0x1001a274 0x1ecec 0x1d4ec 0x57
_seh_filter_dll 0x0 0x1001a278 0x1ecf0 0x1d4f0 0x41
_initterm 0x0 0x1001a27c 0x1ecf4 0x1d4f4 0x38
_initialize_narrow_environment 0x0 0x1001a280 0x1ecf8 0x1d4f8 0x35
_initialize_onexit_table 0x0 0x1001a284 0x1ecfc 0x1d4fc 0x36
_register_onexit_function 0x0 0x1001a288 0x1ed00 0x1d500 0x3e
_execute_onexit_table 0x0 0x1001a28c 0x1ed04 0x1d504 0x24
_crt_atexit 0x0 0x1001a290 0x1ed08 0x1d508 0x1f
_cexit 0x0 0x1001a294 0x1ed0c 0x1d50c 0x17
_invalid_parameter_noinfo_noreturn 0x0 0x1001a298 0x1ed10 0x1d510 0x3b
api-ms-win-crt-heap-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
malloc 0x0 0x1001a244 0x1ecbc 0x1d4bc 0x19
free 0x0 0x1001a248 0x1ecc0 0x1d4c0 0x18
api-ms-win-crt-environment-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
getenv 0x0 0x1001a234 0x1ecac 0x1d4ac 0x10
Exports (158)
»
Api name EAT Address Ordinal
??0ConditionVariableImpl@detail@mozilla@@QAE@XZ 0x74ce 0x1
??0Decimal@blink@@QAE@ABV01@@Z 0x13dcb 0x2
??0Decimal@blink@@QAE@ABVEncodedData@01@@Z 0x13dcb 0x3
??0Decimal@blink@@QAE@H@Z 0xa8a8 0x4
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z 0x13de2 0x5
??0MutexImpl@detail@mozilla@@QAE@XZ 0x8e70 0x6
??0PrintfTarget@mozilla@@IAE@XZ 0x8b04 0x7
??0SHA1Sum@mozilla@@QAE@XZ 0x9385 0x8
??0TimeStampValue@mozilla@@AAE@_K0_N@Z 0x7b33 0x9
??1ConditionVariableImpl@detail@mozilla@@QAE@XZ 0x74a2 0xa
??1MutexImpl@detail@mozilla@@QAE@XZ 0x8e68 0xb
??4Decimal@blink@@QAEAAV01@ABV01@@Z 0x13dcb 0xc
??8Decimal@blink@@QBE_NABV01@@Z 0x13e4f 0xd
??9Decimal@blink@@QBE_NABV01@@Z 0x13ec8 0xe
??DDecimal@blink@@QBE?AV01@ABV01@@Z 0x13f14 0xf
??GDecimal@blink@@QBE?AV01@ABV01@@Z 0x14098 0x10
??GDecimal@blink@@QBE?AV01@XZ 0x141e3 0x11
??GTimeStampValue@mozilla@@QBE_KABV01@@Z 0x7b10 0x12
??HDecimal@blink@@QBE?AV01@ABV01@@Z 0x1421e 0x13
??KDecimal@blink@@QBE?AV01@ABV01@@Z 0x14358 0x14
??MDecimal@blink@@QBE_NABV01@@Z 0x1456d 0x15
??NDecimal@blink@@QBE_NABV01@@Z 0x145a2 0x16
??ODecimal@blink@@QBE_NABV01@@Z 0x145f4 0x17
??PDecimal@blink@@QBE_NABV01@@Z 0x1462b 0x18
??XDecimal@blink@@QAEAAV01@ABV01@@Z 0x1467d 0x19
??YDecimal@blink@@QAEAAV01@ABV01@@Z 0x146ac 0x1a
??YTimeStampValue@mozilla@@QAEAAV01@_J@Z 0x134ad 0x1b
??ZDecimal@blink@@QAEAAV01@ABV01@@Z 0x146db 0x1c
??ZTimeStampValue@mozilla@@QAEAAV01@_J@Z 0x134c7 0x1d
??_0Decimal@blink@@QAEAAV01@ABV01@@Z 0x1470a 0x1e
??_FDecimal@blink@@QAEXXZ 0x147e5 0x1f
?CheckQPC@TimeStampValue@mozilla@@ABE_KABV12@@Z 0x7a80 0x20
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ 0x7b7e 0x21
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z 0x7055 0x22
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z 0x17330 0x23
?DllBlocklist_CheckStatus@@YA_NXZ 0x114b8 0x24
?DllBlocklist_Initialize@@YAXI@Z 0x1490 0x25
?DllBlocklist_SetDllServices@@YAXPAVDllServicesBase@detail@mozilla@@@Z 0xbb9f 0x26
?DllBlocklist_WriteNotes@@YAXPAX@Z 0x114d0 0x27
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z 0x72a7 0x28
?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ 0x58e8 0x29
?FramePointerStackWalk@mozilla@@YAXP6AXIPAX00@ZII0PAPAX0@Z 0x12aa4 0x2a
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z 0x17b2f 0x2b
?HashBytes@mozilla@@YAIPBXI@Z 0x5890 0x2c
?IsFloat32Representable@mozilla@@YA_NN@Z 0xb773 0x2d
?MozDescribeCodeAddress@@YA_NPAXPAUMozCodeAddressDetails@@@Z 0x12af3 0x2e
?MozFormatCodeAddress@@YAXPADIIPBXPBD2H2I@Z 0x12c62 0x2f
?MozFormatCodeAddressDetails@@YAXPADIIPAXPBUMozCodeAddressDetails@@@Z 0x12cd2 0x30
?MozStackWalk@@YAXP6AXIPAX00@ZII0@Z 0x12d09 0x31
?MozStackWalkThread@@YAXP6AXIPAX00@ZII00PAU_CONTEXT@@@Z 0x12d26 0x32
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z 0x7c00 0x33
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@PA_N@Z 0x7976 0x34
?RecordProcessRestart@TimeStamp@mozilla@@SAXXZ 0x13467 0x35
?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAVPseudoStack@@PBD0PAXI@ZP6AXPAV2@@Z@Z 0xbc58 0x36
?ResolutionInTicks@BaseTimeDurationPlatformUtils@mozilla@@SA_JXZ 0x134e1 0x37
?Shutdown@TimeStamp@mozilla@@SAXXZ 0xbc90 0x38
?Startup@TimeStamp@mozilla@@SAXXZ 0xb7fc 0x39
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z 0xabe9 0x3a
?ToExponential@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z 0x184bf 0x3b
?ToFixed@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z 0x18635 0x3c
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPA_NPAVStringBuilder@2@@Z 0x6f2a 0x3d
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z 0x74e0 0x3e
?ToSecondsSigDigits@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z 0x134ed 0x3f
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z 0x714c 0x40
?Unused@mozilla@@3Uunused_t@1@B 0x21758 0x41
?abs@Decimal@blink@@QBE?AV12@XZ 0x1496f 0x42
?aes_enabled@sse_private@mozilla@@3_NA 0x21430 0x43
?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z 0x1498a 0x44
?avx2_enabled@sse_private@mozilla@@3_NA 0x21435 0x45
?avx_enabled@sse_private@mozilla@@3_NA 0x21433 0x46
?ceil@Decimal@blink@@QBE?AV12@XZ 0x14bab 0x47
?compareTo@Decimal@blink@@ABE?AV12@ABV12@@Z 0x14c65 0x48
?compress@LZ4@Compression@mozilla@@SAIPBDIPAD@Z 0x8e90 0x49
?compressLimitedOutput@LZ4@Compression@mozilla@@SAIPBDIPADI@Z 0x13557 0x4a
?decompress@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z 0x135a1 0x4b
?decompress@LZ4@Compression@mozilla@@SA_NPBDPADI@Z 0xb571 0x4c
?decompressPartial@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z 0x1384d 0x4d
?finish@SHA1Sum@mozilla@@QAEXAAY0BE@E@Z 0x9309 0x4e
?floor@Decimal@blink@@QBE?AV12@XZ 0x14d20 0x4f
?fromDouble@Decimal@blink@@SA?AV12@N@Z 0x14dda 0x50
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z 0x14e75 0x51
?gChaosFeatures@detail@mozilla@@3W4ChaosFeature@2@A 0x21b8c 0x52
?gChaosModeCounter@detail@mozilla@@3V?$Atomic@I$01X@2@A 0x215fc 0x53
?gTwoCharEscapes@detail@mozilla@@3QBDB 0x1c280 0x54
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z 0x151b2 0x55
?kBase10MaximalLength@DoubleToStringConverter@double_conversion@@2HB 0x1c278 0x56
?lock@MutexImpl@detail@mozilla@@IAEXXZ 0x8e60 0x57
?mmx_enabled@sse_private@mozilla@@3_NA 0x21437 0x58
?mozalloc_abort@@YAXQBD@Z 0x1262d 0x59
?mozalloc_handle_oom@@YAXI@Z 0x12695 0x5a
?mozalloc_set_oom_abort_handler@@YAXP6AXI@Z@Z 0xbc6d 0x5b
?nan@Decimal@blink@@SA?AV12@XZ 0x153fe 0x5c
?notify_all@ConditionVariableImpl@detail@mozilla@@QAEXXZ 0x74be 0x5d
?notify_one@ConditionVariableImpl@detail@mozilla@@QAEXXZ 0x74c6 0x5e
?print@PrintfTarget@mozilla@@QAA_NPBDZZ 0x1295a 0x5f
?remainder@Decimal@blink@@QBE?AV12@ABV12@@Z 0x156ac 0x60
?round@Decimal@blink@@QBE?AV12@XZ 0x15736 0x61
?sse3_enabled@sse_private@mozilla@@3_NA 0x21434 0x62
?sse4_1_enabled@sse_private@mozilla@@3_NA 0x21432 0x63
?sse4_2_enabled@sse_private@mozilla@@3_NA 0x21436 0x64
?sse4a_enabled@sse_private@mozilla@@3_NA 0x21438 0x65
?ssse3_enabled@sse_private@mozilla@@3_NA 0x21431 0x66
?toDouble@Decimal@blink@@QBENXZ 0x15d0e 0x67
?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ 0x15dbc 0x68
?toString@Decimal@blink@@QBE_NPADI@Z 0x16221 0x69
?unlock@MutexImpl@detail@mozilla@@IAEXXZ 0x8e50 0x6a
?update@SHA1Sum@mozilla@@QAEXPBXI@Z 0x9263 0x6b
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z 0x85e0 0x6c
?wait@ConditionVariableImpl@detail@mozilla@@QAEXAAVMutexImpl@23@@Z 0x74a3 0x6d
?wait_for@ConditionVariableImpl@detail@mozilla@@QAE?AW4CVStatus@23@AAVMutexImpl@23@ABV?$BaseTimeDuration@VTimeDurationValueCalculator@mozilla@@@3@@Z 0x7439 0x6e
?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z 0x16388 0x6f
MOZ_CrashOOL 0x188aa 0x73
MOZ_CrashPrintf 0x188be 0x74
_HeapAlloc@12 0x22a0 0x70
_HeapFree@12 0x2110 0x71
_HeapReAlloc@16 0x1d5d 0x72
_aligned_free 0x25b0 0x75
_aligned_malloc 0x12472 0x76
_expand 0x1248c 0x77
_msize 0x124ad 0x78
_recalloc 0x124c4 0x79
_strdup 0x1d80 0x7a
_wcsdup 0x125de 0x7b
calloc 0x1d26 0x7c
free 0x25b0 0x7d
gMozCrashReason 0x21780 0x7e
gMozillaPoisonBase 0x21428 0x7f
gMozillaPoisonSize 0x2142c 0x80
gMozillaPoisonValue 0x21424 0x81
jemalloc_free_dirty_pages 0x12562 0x82
jemalloc_ptr_info 0x48d7 0x83
jemalloc_purge_freed_pages 0x74a2 0x84
jemalloc_stats 0x12567 0x85
jemalloc_thread_local_arena 0x1b40 0x86
malloc 0x2420 0x87
malloc_good_size 0x12537 0x88
malloc_usable_size 0xa890 0x89
mozPoisonValueInit 0xbbf8 0x8a
moz_arena_calloc 0x2230 0x8b
moz_arena_free 0x12573 0x8c
moz_arena_malloc 0x2350 0x8d
moz_arena_memalign 0x1258a 0x8e
moz_arena_realloc 0x2070 0x8f
moz_create_arena_with_params 0xbc7a 0x90
moz_dispose_arena 0x74a2 0x91
moz_malloc_enclosing_size_of 0x126f2 0x92
moz_malloc_size_of 0xac2e 0x93
moz_malloc_usable_size 0x12720 0x94
moz_xcalloc 0x1ce8 0x95
moz_xmalloc 0x24b0 0x96
moz_xmemalign 0x1273f 0x97
moz_xrealloc 0x1f60 0x98
moz_xstrdup 0x1d41 0x99
posix_memalign 0xbb8b 0x9a
realloc 0x2190 0x9b
strdup 0x1d80 0x9c
strndup 0x125a4 0x9d
wcsdup 0x125de 0x9e
Digital Signatures (3)
»
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 00:00:00+00:00
Valid Until 2019-06-28 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 12:00:00+00:00
Valid Until 2028-10-22 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 00:00:00+00:00
Valid Until 2031-11-10 00:00:00+00:00
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/msvcp140.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 429.80 KB
MD5 109f0f02fd37c84bfc7508d4227d7ed5 Copy to Clipboard
SHA1 ef7420141bb15ac334d3964082361a460bfdb975 Copy to Clipboard
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4 Copy to Clipboard
SSDeep 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI Copy to Clipboard
ImpHash 6033404985b7d360f94b5f6fbed98789 Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Entry Point 0x1003b150
Size Of Code 0x60400
Size Of Initialized Data 0x8200
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2017-05-25 20:01:26+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription Microsoft® C Runtime Library
FileVersion 14.11.25325.0 built by: VCTOOLSREL
InternalName msvcp140.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename msvcp140.dll
ProductName Microsoft® Visual Studio® 2017
ProductVersion 14.11.25325.0
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x60372 0x60400 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.55
.data 0x10062000 0x2810 0x1800 0x60800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 4.41
.idata 0x10065000 0x1436 0x1600 0x62000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.09
.didat 0x10067000 0x34 0x200 0x63600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.72
.rsrc 0x10068000 0x3f8 0x400 0x63800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.36
.reloc 0x10069000 0x3a34 0x3c00 0x63c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.52
Imports (14)
»
VCRUNTIME140.dll (18)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memchr 0x0 0x10065108 0x65528 0x62528 0x44
memcmp 0x0 0x1006510c 0x6552c 0x6252c 0x45
__std_type_info_destroy_list 0x0 0x10065110 0x65530 0x62530 0x25
_except_handler4_common 0x0 0x10065114 0x65534 0x62534 0x35
memset 0x0 0x10065118 0x65538 0x62538 0x48
_CxxThrowException 0x0 0x1006511c 0x6553c 0x6253c 0x1
__CxxFrameHandler3 0x0 0x10065120 0x65540 0x62540 0x10
__std_exception_destroy 0x0 0x10065124 0x65544 0x62544 0x22
__current_exception 0x0 0x10065128 0x65548 0x62548 0x1c
__AdjustPointer 0x0 0x1006512c 0x6554c 0x6254c 0x9
__uncaught_exception 0x0 0x10065130 0x65550 0x62550 0x2c
__uncaught_exceptions 0x0 0x10065134 0x65554 0x62554 0x2d
memmove 0x0 0x10065138 0x65558 0x62558 0x47
__std_exception_copy 0x0 0x1006513c 0x6555c 0x6255c 0x21
_purecall 0x0 0x10065140 0x65560 0x62560 0x3d
memcpy 0x0 0x10065144 0x65564 0x62564 0x46
__processing_throw 0x0 0x10065148 0x65568 0x62568 0x1f
__std_terminate 0x0 0x1006514c 0x6556c 0x6256c 0x23
api-ms-win-crt-string-l1-1-0.dll (13)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
isspace 0x0 0x1006528c 0x656ac 0x626ac 0x6e
islower 0x0 0x10065290 0x656b0 0x626b0 0x6b
wcscpy_s 0x0 0x10065294 0x656b4 0x626b4 0xa1
wcsnlen 0x0 0x10065298 0x656b8 0x626b8 0xa9
__strncnt 0x0 0x1006529c 0x656bc 0x626bc 0x5
_wcsdup 0x0 0x100652a0 0x656c0 0x626c0 0x49
iswctype 0x0 0x100652a4 0x656c4 0x626c4 0x75
strcspn 0x0 0x100652a8 0x656c8 0x626c8 0x8a
tolower 0x0 0x100652ac 0x656cc 0x626cc 0x97
isalnum 0x0 0x100652b0 0x656d0 0x626d0 0x64
isxdigit 0x0 0x100652b4 0x656d4 0x626d4 0x7e
isdigit 0x0 0x100652b8 0x656d8 0x626d8 0x68
isupper 0x0 0x100652bc 0x656dc 0x626dc 0x6f
api-ms-win-crt-heap-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_calloc_base 0x0 0x10065188 0x655a8 0x625a8 0x9
_malloc_base 0x0 0x1006518c 0x655ac 0x625ac 0x10
malloc 0x0 0x10065190 0x655b0 0x625b0 0x19
_callnewh 0x0 0x10065194 0x655b4 0x625b4 0x8
_free_base 0x0 0x10065198 0x655b8 0x625b8 0xb
free 0x0 0x1006519c 0x655bc 0x625bc 0x18
calloc 0x0 0x100651a0 0x655c0 0x625c0 0x17
_realloc_base 0x0 0x100651a4 0x655c4 0x625c4 0x14
api-ms-win-crt-locale-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_lock_locales 0x0 0x100651ac 0x655cc 0x625cc 0xd
__pctype_func 0x0 0x100651b0 0x655d0 0x625d0 0x6
localeconv 0x0 0x100651b4 0x655d4 0x625d4 0x12
___lc_collate_cp_func 0x0 0x100651b8 0x655d8 0x625d8 0x1
___lc_locale_name_func 0x0 0x100651bc 0x655dc 0x625dc 0x2
___lc_codepage_func 0x0 0x100651c0 0x655e0 0x625e0 0x0
setlocale 0x0 0x100651c4 0x655e4 0x625e4 0x13
___mb_cur_max_func 0x0 0x100651c8 0x655e8 0x625e8 0x3
_unlock_locales 0x0 0x100651cc 0x655ec 0x625ec 0xf
api-ms-win-crt-runtime-l1-1-0.dll (18)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
terminate 0x0 0x100651ec 0x6560c 0x6260c 0x6a
abort 0x0 0x100651f0 0x65610 0x62610 0x57
_seh_filter_dll 0x0 0x100651f4 0x65614 0x62614 0x41
_initterm_e 0x0 0x100651f8 0x65618 0x62618 0x39
_initterm 0x0 0x100651fc 0x6561c 0x6261c 0x38
_cexit 0x0 0x10065200 0x65620 0x62620 0x17
_crt_atexit 0x0 0x10065204 0x65624 0x62624 0x1f
_execute_onexit_table 0x0 0x10065208 0x65628 0x62628 0x24
_register_onexit_function 0x0 0x1006520c 0x6562c 0x6262c 0x3e
_initialize_onexit_table 0x0 0x10065210 0x65630 0x62630 0x36
_initialize_narrow_environment 0x0 0x10065214 0x65634 0x62634 0x35
_configure_narrow_argv 0x0 0x10065218 0x65638 0x62638 0x19
_endthreadex 0x0 0x1006521c 0x6563c 0x6263c 0x22
_errno 0x0 0x10065220 0x65640 0x62640 0x23
_beginthreadex 0x0 0x10065224 0x65644 0x62644 0x15
_invalid_parameter_noinfo_noreturn 0x0 0x10065228 0x65648 0x62648 0x3b
_invalid_parameter_noinfo 0x0 0x1006522c 0x6564c 0x6264c 0x3a
_set_new_handler 0x0 0x10065230 0x65650 0x62650 0x4a
api-ms-win-crt-stdio-l1-1-0.dll (20)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
fputwc 0x0 0x10065238 0x65658 0x62658 0x81
__stdio_common_vsprintf_s 0x0 0x1006523c 0x6565c 0x6265c 0xf
fputs 0x0 0x10065240 0x65660 0x62660 0x80
_fsopen 0x0 0x10065244 0x65664 0x62664 0x31
fseek 0x0 0x10065248 0x65668 0x62668 0x87
_wfsopen 0x0 0x1006524c 0x6566c 0x6266c 0x66
_get_stream_buffer_pointers 0x0 0x10065250 0x65670 0x62670 0x39
fgetwc 0x0 0x10065254 0x65674 0x62674 0x7b
_fseeki64 0x0 0x10065258 0x65678 0x62678 0x2f
__acrt_iob_func 0x0 0x1006525c 0x6567c 0x6267c 0x0
fputc 0x0 0x10065260 0x65680 0x62680 0x7f
fsetpos 0x0 0x10065264 0x65684 0x62684 0x88
ungetc 0x0 0x10065268 0x65688 0x62688 0x9d
setvbuf 0x0 0x1006526c 0x6568c 0x6268c 0x98
fgetpos 0x0 0x10065270 0x65690 0x62690 0x79
fwrite 0x0 0x10065274 0x65694 0x62694 0x8a
ungetwc 0x0 0x10065278 0x65698 0x62698 0x9e
fgetc 0x0 0x1006527c 0x6569c 0x6269c 0x78
fflush 0x0 0x10065280 0x656a0 0x626a0 0x77
fclose 0x0 0x10065284 0x656a4 0x626a4 0x74
api-ms-win-crt-math-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_CIpow 0x0 0x100651d4 0x655f4 0x625f4 0xa
ldexp 0x0 0x100651d8 0x655f8 0x625f8 0xf0
frexp 0x0 0x100651dc 0x655fc 0x625fc 0xeb
api-ms-win-crt-multibyte-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_ismbblead 0x0 0x100651e4 0x65604 0x62604 0x12
api-ms-win-crt-convert-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strtof 0x0 0x10065154 0x65574 0x62574 0x5f
btowc 0x0 0x10065158 0x65578 0x62578 0x53
strtod 0x0 0x1006515c 0x6557c 0x6257c 0x5e
api-ms-win-crt-time-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_Gettnames 0x0 0x100652c4 0x656e4 0x626e4 0x2
_Getmonths 0x0 0x100652c8 0x656e8 0x626e8 0x1
_Wcsftime 0x0 0x100652cc 0x656ec 0x626ec 0x7
_Strftime 0x0 0x100652d0 0x656f0 0x626f0 0x3
_Getdays 0x0 0x100652d4 0x656f4 0x626f4 0x0
_W_Getdays 0x0 0x100652d8 0x656f8 0x626f8 0x4
_W_Gettnames 0x0 0x100652dc 0x656fc 0x626fc 0x6
_W_Getmonths 0x0 0x100652e0 0x65700 0x62700 0x5
api-ms-win-crt-filesystem-l1-1-0.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_lock_file 0x0 0x1006516c 0x6558c 0x6258c 0x16
_wrename 0x0 0x10065170 0x65590 0x62590 0x36
_wrmdir 0x0 0x10065174 0x65594 0x62594 0x37
_wremove 0x0 0x10065178 0x65598 0x62598 0x35
_wchdir 0x0 0x1006517c 0x6559c 0x6259c 0x27
_unlock_file 0x0 0x10065180 0x655a0 0x625a0 0x24
api-ms-win-crt-environment-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wgetcwd 0x0 0x10065164 0x65584 0x62584 0x8
api-ms-win-crt-utility-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
rand_s 0x0 0x100652e8 0x65708 0x62708 0x1c
KERNEL32.dll (65)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
TryEnterCriticalSection 0x0 0x10065000 0x65420 0x62420 0x57c
Sleep 0x0 0x10065004 0x65424 0x62424 0x552
GetExitCodeThread 0x0 0x10065008 0x65428 0x62428 0x22b
DuplicateHandle 0x0 0x1006500c 0x6542c 0x6242c 0x11d
GetCurrentThreadId 0x0 0x10065010 0x65430 0x62430 0x20c
GetCurrentProcess 0x0 0x10065014 0x65434 0x62434 0x207
WaitForSingleObjectEx 0x0 0x10065018 0x65438 0x62438 0x5ad
CloseHandle 0x0 0x1006501c 0x6543c 0x6243c 0x7d
GetNativeSystemInfo 0x0 0x10065020 0x65440 0x62440 0x272
QueryPerformanceFrequency 0x0 0x10065024 0x65444 0x62444 0x42c
QueryPerformanceCounter 0x0 0x10065028 0x65448 0x62448 0x42b
GetStringTypeW 0x0 0x1006502c 0x6544c 0x6244c 0x2c3
MultiByteToWideChar 0x0 0x10065030 0x65450 0x62450 0x3cf
EnterCriticalSection 0x0 0x10065034 0x65454 0x62454 0x123
LeaveCriticalSection 0x0 0x10065038 0x65458 0x62458 0x3a0
DeleteCriticalSection 0x0 0x1006503c 0x6545c 0x6245c 0x103
WideCharToMultiByte 0x0 0x10065040 0x65460 0x62460 0x5d0
EncodePointer 0x0 0x10065044 0x65464 0x62464 0x11f
RaiseException 0x0 0x10065048 0x65468 0x62468 0x43f
DecodePointer 0x0 0x1006504c 0x6546c 0x6246c 0xfc
GetCPInfo 0x0 0x10065050 0x65470 0x62470 0x1b1
CompareStringW 0x0 0x10065054 0x65474 0x62474 0x91
GetLocaleInfoW 0x0 0x10065058 0x65478 0x62478 0x252
LoadLibraryExA 0x0 0x1006505c 0x6547c 0x6247c 0x3a4
FreeLibrary 0x0 0x10065060 0x65480 0x62480 0x19c
VirtualQuery 0x0 0x10065064 0x65484 0x62484 0x5a3
VirtualProtect 0x0 0x10065068 0x65488 0x62488 0x5a1
GetSystemInfo 0x0 0x1006506c 0x6548c 0x6248c 0x2ce
InitializeSListHead 0x0 0x10065070 0x65490 0x62490 0x349
LCMapStringW 0x0 0x10065074 0x65494 0x62494 0x394
GetCurrentProcessId 0x0 0x10065078 0x65498 0x62498 0x208
AreFileApisANSI 0x0 0x1006507c 0x6549c 0x6249c 0x1b
CreateDirectoryW 0x0 0x10065080 0x654a0 0x624a0 0xb0
IsDebuggerPresent 0x0 0x10065084 0x654a4 0x624a4 0x365
TerminateProcess 0x0 0x10065088 0x654a8 0x624a8 0x561
SetUnhandledExceptionFilter 0x0 0x1006508c 0x654ac 0x624ac 0x543
UnhandledExceptionFilter 0x0 0x10065090 0x654b0 0x624b0 0x582
FindFirstFileExW 0x0 0x10065094 0x654b4 0x624b4 0x16c
FindNextFileW 0x0 0x10065098 0x654b8 0x624b8 0x17d
SetFileTime 0x0 0x1006509c 0x654bc 0x624bc 0x500
SetEndOfFile 0x0 0x100650a0 0x654c0 0x624c0 0x4ea
GetProcAddress 0x0 0x100650a4 0x654c4 0x624c4 0x29b
GetModuleHandleW 0x0 0x100650a8 0x654c8 0x624c8 0x265
GetTempPathW 0x0 0x100650ac 0x654cc 0x624cc 0x2e1
GetTickCount 0x0 0x100650b0 0x654d0 0x624d0 0x2f0
CreateHardLinkW 0x0 0x100650b4 0x654d4 0x624d4 0xc4
FindClose 0x0 0x100650b8 0x654d8 0x624d8 0x166
GetSystemTimeAsFileTime 0x0 0x100650bc 0x654dc 0x624dc 0x2d4
CreateEventW 0x0 0x100650c0 0x654e0 0x624e0 0xb4
InitializeCriticalSectionAndSpinCount 0x0 0x100650c4 0x654e4 0x624e4 0x346
SetLastError 0x0 0x100650c8 0x654e8 0x624e8 0x50b
QueueUserWorkItem 0x0 0x100650cc 0x654ec 0x624ec 0x435
GetModuleHandleExW 0x0 0x100650d0 0x654f0 0x624f0 0x264
IsProcessorFeaturePresent 0x0 0x100650d4 0x654f4 0x624f4 0x36b
CreateFileW 0x0 0x100650d8 0x654f8 0x624f8 0xc0
SetFileAttributesW 0x0 0x100650dc 0x654fc 0x624fc 0x4f7
RtlCaptureStackBackTrace 0x0 0x100650e0 0x65500 0x62500 0x4a9
GetCurrentThread 0x0 0x100650e4 0x65504 0x62504 0x20b
FormatMessageW 0x0 0x100650e8 0x65508 0x62508 0x198
CopyFileW 0x0 0x100650ec 0x6550c 0x6250c 0xa3
SetFilePointerEx 0x0 0x100650f0 0x65510 0x62510 0x4fd
GetDiskFreeSpaceExW 0x0 0x100650f4 0x65514 0x62514 0x218
GetFileAttributesExW 0x0 0x100650f8 0x65518 0x62518 0x230
GetLastError 0x0 0x100650fc 0x6551c 0x6251c 0x24e
GetFileInformationByHandle 0x0 0x10065100 0x65520 0x62520 0x235
Exports (1515)
»
Api name EAT Address Ordinal
??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z 0x29040 0x1
??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z 0x29040 0x2
??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z 0x29040 0x3
??0?$_Yarn@D@std@@QAE@ABV01@@Z 0x30cc0 0x4
??0?$_Yarn@D@std@@QAE@PBD@Z 0x14990 0x5
??0?$_Yarn@D@std@@QAE@XZ 0x149b0 0x6
??0?$_Yarn@G@std@@QAE@ABV01@@Z 0x2f6c0 0x7
??0?$_Yarn@G@std@@QAE@PBG@Z 0x2f6a0 0x8
??0?$_Yarn@G@std@@QAE@XZ 0x14920 0x9
??0?$_Yarn@_W@std@@QAE@ABV01@@Z 0x2f6c0 0xa
??0?$_Yarn@_W@std@@QAE@PB_W@Z 0x2f6a0 0xb
??0?$_Yarn@_W@std@@QAE@XZ 0x14920 0xc
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ 0x15b00 0xd
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x39dc0 0xe
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ 0x1d5e0 0xf
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z 0x34400 0x10
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ 0x1dd10 0x11
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x36f30 0x12
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z 0x37010 0x13
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x370e0 0x14
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z 0x30d90 0x15
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z 0x30e60 0x16
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z 0x34490 0x17
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x34560 0x18
??0?$basic_istream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z 0x39950 0x19
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z 0x39a60 0x1a
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z 0x16260 0x1b
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z 0x399f0 0x1c
??0?$basic_istream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z 0x33b30 0x1d
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z 0x33c40 0x1e
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z 0x1d8b0 0x1f
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z 0x33bd0 0x20
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z 0x36cc0 0x21
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z 0x36dd0 0x22
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z 0x1df90 0x23
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@@Z 0x36d60 0x24
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z 0x37e40 0x25
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z 0x15260 0x26
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z 0x37ed0 0x27
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z 0x31eb0 0x28
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z 0x1d020 0x29
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@_N@Z 0x31f40 0x2a
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z 0x350c0 0x2b
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z 0x1dba0 0x2c
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@_N@Z 0x35150 0x2d
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@ABV01@@Z 0x39c40 0x2e
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z 0x39cc0 0x2f
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ 0x15ac0 0x30
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@ABV01@@Z 0x34180 0x31
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@W4_Uninitialized@1@@Z 0x34200 0x32
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ 0x1d5a0 0x33
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@ABV01@@Z 0x36e50 0x34
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@W4_Uninitialized@1@@Z 0x36ed0 0x35
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ 0x1dcd0 0x36
??0?$codecvt@DDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x16190 0x37
??0?$codecvt@DDU_Mbstatet@@@std@@QAE@I@Z 0x30c60 0x38
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x12d10 0x39
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z 0x12cb0 0x3a
??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x11d50 0x3b
??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@KW4_Codecvt_mode@1@I@Z 0x11d80 0x3c
??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@I@Z 0x11d00 0x3d
??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x123d0 0x3e
??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@KW4_Codecvt_mode@1@I@Z 0x123f0 0x3f
??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@I@Z 0x12380 0x40
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x12850 0x41
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z 0x127f0 0x42
??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z 0x13090 0x43
??0?$ctype@D@std@@QAE@PBF_NI@Z 0x12ff0 0x44
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z 0x13b40 0x45
??0?$ctype@G@std@@QAE@I@Z 0x13af0 0x46
??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z 0x13630 0x47
??0?$ctype@_W@std@@QAE@I@Z 0x135e0 0x48
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x18e70 0x49
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z 0x30c20 0x4a
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x21290 0x4b
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z 0x30b20 0x4c
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x23690 0x4d
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z 0x30ba0 0x4e
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x184c0 0x4f
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z 0x30be0 0x50
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x208f0 0x51
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z 0x309a0 0x52
??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x22ce0 0x53
??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z 0x30b60 0x54
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAE@PBDI@Z 0x303e0 0x55
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x2be30 0x56
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z 0x30430 0x57
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z 0x2f940 0x58
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x1f9e0 0x59
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z 0x2f990 0x5a
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z 0x2ff20 0x5b
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x21e40 0x5c
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z 0x2ff70 0x5d
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x2b340 0x5e
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z 0x30220 0x5f
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z 0x2f6e0 0x60
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x1eeb0 0x61
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z 0x2f740 0x62
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z 0x2fd00 0x63
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x21390 0x64
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z 0x2fd60 0x65
??0Init@ios_base@std@@QAE@XZ 0x14000 0x66
??0_Facet_base@std@@QAE@ABV01@@Z 0x11640 0x67
??0_Facet_base@std@@QAE@XZ 0x11630 0x68
??0_Init_locks@std@@QAE@XZ 0x2e230 0x69
??0_Locimp@locale@std@@AAE@ABV012@@Z 0x11820 0x6a
??0_Locimp@locale@std@@AAE@_N@Z 0x117e0 0x6b
??0_Locinfo@std@@QAE@HPBD@Z 0x11280 0x6c
??0_Locinfo@std@@QAE@PBD@Z 0x11200 0x6d
??0_Lockit@std@@QAE@H@Z 0x2e330 0x6e
??0_Lockit@std@@QAE@XZ 0x2e320 0x6f
??0_Timevec@std@@QAE@ABV01@@Z 0x111c0 0x70
??0_Timevec@std@@QAE@PAX@Z 0x111b0 0x71
??0_UShinit@std@@QAE@XZ 0x1d930 0x72
??0_Winit@std@@QAE@XZ 0x1e010 0x73
??0codecvt_base@std@@QAE@I@Z 0x11b70 0x74
??0ctype_base@std@@QAE@I@Z 0x12dd0 0x75
??0facet@locale@std@@IAE@I@Z 0x11760 0x76
??0id@locale@std@@QAE@I@Z 0x111b0 0x77
??0ios_base@std@@IAE@XZ 0x145b0 0x78
??0task_continuation_context@Concurrency@@AAE@XZ 0x149b0 0x79
??0time_base@std@@QAE@I@Z 0x162e0 0x7a
??1?$_Yarn@D@std@@QAE@XZ 0x148a0 0x7b
??1?$_Yarn@G@std@@QAE@XZ 0x148a0 0x7c
??1?$_Yarn@_W@std@@QAE@XZ 0x148a0 0x7d
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ 0x155d0 0x7e
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ 0x155d0 0x7f
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x155d0 0x80
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ 0x36f60 0x81
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ 0x30ce0 0x82
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x34430 0x83
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ 0x16240 0x84
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ 0x1d890 0x85
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x1df70 0x86
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ 0x15240 0x87
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ 0x1d000 0x88
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x1db80 0x89
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ 0x15590 0x8a
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ 0x1d320 0x8b
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x1dc10 0x8c
??1?$codecvt@DDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x8d
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x8e
??1?$codecvt@_SDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x8f
??1?$codecvt@_UDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x90
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x91
??1?$ctype@D@std@@MAE@XZ 0x13190 0x92
??1?$ctype@G@std@@MAE@XZ 0x13bf0 0x93
??1?$ctype@_W@std@@MAE@XZ 0x136e0 0x94
??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ 0x11620 0x95
??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ 0x11620 0x96
??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ 0x11620 0x97
??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ 0x11620 0x98
??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ 0x11620 0x99
??1?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ 0x11620 0x9a
??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ 0x2bda0 0x9b
??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ 0x1f950 0x9c
??1?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ 0x21db0 0x9d
??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ 0x2b2c0 0x9e
??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ 0x1ee30 0x9f
??1?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ 0x21310 0xa0
??1Init@ios_base@std@@QAE@XZ 0x14010 0xa1
??1_Facet_base@std@@UAE@XZ 0x11620 0xa2
??1_Init_locks@std@@QAE@XZ 0x2e260 0xa3
??1_Locimp@locale@std@@MAE@XZ 0x11780 0xa4
??1_Locinfo@std@@QAE@XZ 0x11310 0xa5
??1_Lockit@std@@QAE@XZ 0x2e370 0xa6
??1_Timevec@std@@QAE@XZ 0x111e0 0xa7
??1_UShinit@std@@QAE@XZ 0x1d950 0xa8
??1_Winit@std@@QAE@XZ 0x1e030 0xa9
??1codecvt_base@std@@UAE@XZ 0x11620 0xaa
??1ctype_base@std@@UAE@XZ 0x11620 0xab
??1facet@locale@std@@MAE@XZ 0x11620 0xac
??1ios_base@std@@UAE@XZ 0x14570 0xad
??1time_base@std@@UAE@XZ 0x11620 0xae
??4?$_Iosb@H@std@@QAEAAV01@$$QAV01@@Z 0xffa0 0xaf
??4?$_Iosb@H@std@@QAEAAV01@ABV01@@Z 0xffa0 0xb0
??4?$_Yarn@D@std@@QAEAAV01@ABV01@@Z 0x30ca0 0xb1
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z 0x14930 0xb2
??4?$_Yarn@G@std@@QAEAAV01@ABV01@@Z 0x2f680 0xb3
??4?$_Yarn@G@std@@QAEAAV01@PBG@Z 0x148c0 0xb4
??4?$_Yarn@_W@std@@QAEAAV01@ABV01@@Z 0x2f680 0xb5
??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z 0x148c0 0xb6
??4?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z 0x36ff0 0xb7
??4?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z 0x30d70 0xb8
??4?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z 0x30d70 0xb9
??4?$basic_istream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z 0x39930 0xba
??4?$basic_istream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z 0x33b10 0xbb
??4?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z 0x33b10 0xbc
??4?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z 0x36ff0 0xbd
??4?$basic_ostream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z 0x30d70 0xbe
??4?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z 0x30d70 0xbf
??4?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEAAV01@ABV01@@Z 0x340f0 0xc0
??4?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEAAV01@ABV01@@Z 0x340f0 0xc1
??4?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEAAV01@ABV01@@Z 0x340f0 0xc2
??4Init@ios_base@std@@QAEAAV012@ABV012@@Z 0xffa0 0xc3
??4_Crt_new_delete@std@@QAEAAU01@$$QAU01@@Z 0xffa0 0xc4
??4_Crt_new_delete@std@@QAEAAU01@ABU01@@Z 0xffa0 0xc5
??4_Facet_base@std@@QAEAAV01@ABV01@@Z 0xffa0 0xc6
??4_Init_locks@std@@QAEAAV01@ABV01@@Z 0xffa0 0xc7
??4_Timevec@std@@QAEAAV01@ABV01@@Z 0x111c0 0xc8
??4_UShinit@std@@QAEAAV01@ABV01@@Z 0xffa0 0xc9
??4_Winit@std@@QAEAAV01@ABV01@@Z 0xffa0 0xca
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z 0x395b0 0xcb
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z 0x394d0 0xcc
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z 0x393d0 0xcd
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z 0x392f0 0xce
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z 0x39210 0xcf
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z 0x39130 0xd0
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z 0x38e90 0xd1
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z 0x38db0 0xd2
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAO@Z 0x38cd0 0xd3
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z 0x38bf0 0xd4
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z 0x39050 0xd5
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z 0x38f70 0xd6
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z 0x396c0 0xd7
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0xd8
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z 0x31e20 0xd9
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0xda
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x38b10 0xdb
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z 0x33760 0xdc
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAG@Z 0x33670 0xdd
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z 0x33560 0xde
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z 0x33470 0xdf
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAJ@Z 0x33380 0xe0
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z 0x33290 0xe1
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAM@Z 0x32fc0 0xe2
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAN@Z 0x32ed0 0xe3
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAO@Z 0x32de0 0xe4
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAPAX@Z 0x32cf0 0xe5
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_J@Z 0x331a0 0xe6
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_K@Z 0x330b0 0xe7
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_N@Z 0x33880 0xe8
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0xe9
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z 0x31e20 0xea
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0xeb
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z 0x32c00 0xec
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAF@Z 0x36960 0xed
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAG@Z 0x36870 0xee
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z 0x36760 0xef
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAI@Z 0x36670 0xf0
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAJ@Z 0x36580 0xf1
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z 0x36490 0xf2
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAM@Z 0x361c0 0xf3
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAN@Z 0x360d0 0xf4
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAO@Z 0x35fe0 0xf5
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAPAX@Z 0x35ef0 0xf6
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_J@Z 0x363a0 0xf7
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z 0x362b0 0xf8
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_N@Z 0x36a80 0xf9
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0xfa
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z 0x31e20 0xfb
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0xfc
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x35e00 0xfd
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z 0x37c60 0xfe
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z 0x37b70 0xff
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z 0x37a90 0x100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z 0x378d0 0x101
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z 0x379b0 0x102
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z 0x378d0 0x103
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z 0x37600 0x104
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z 0x37510 0x105
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z 0x37420 0x106
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0x107
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z 0x31e20 0x108
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0x109
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x37210 0x10a
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z 0x37340 0x10b
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z 0x377e0 0x10c
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z 0x376f0 0x10d
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z 0x37d60 0x10e
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z 0x31c40 0x10f
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@G@Z 0x31b60 0x110
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z 0x31a80 0x111
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z 0x318c0 0x112
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z 0x319a0 0x113
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z 0x318c0 0x114
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@M@Z 0x31610 0x115
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z 0x31520 0x116
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@O@Z 0x31430 0x117
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0x118
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z 0x31e20 0x119
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0x11a
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z 0x31210 0x11b
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z 0x31350 0x11c
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_J@Z 0x317e0 0x11d
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z 0x31700 0x11e
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z 0x31d40 0x11f
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z 0x34ee0 0x120
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z 0x34e00 0x121
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z 0x34d20 0x122
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z 0x34b60 0x123
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z 0x34c40 0x124
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z 0x34b60 0x125
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z 0x348b0 0x126
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z 0x347c0 0x127
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@O@Z 0x346d0 0x128
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0x129
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z 0x31e20 0x12a
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0x12b
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x31210 0x12c
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z 0x345f0 0x12d
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z 0x34a80 0x12e
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z 0x349a0 0x12f
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z 0x34fe0 0x130
??7ios_base@std@@QBE_NXZ 0x14060 0x131
??Bid@locale@std@@QAEIXZ 0x116e0 0x132
??Bios_base@std@@QBE_NXZ 0x14050 0x133
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ 0x8f18 0x134
??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@ 0x92a4 0x135
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ 0x92bc 0x136
??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@ 0x98ac 0x137
??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@ 0x98b4 0x138
??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@ 0x98a4 0x139
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ 0x90d4 0x13a
??_7?$basic_istream@GU?$char_traits@G@std@@@std@@6B@ 0x92b4 0x13b
??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ 0x934c 0x13c
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ 0x905c 0x13d
??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@ 0x92ac 0x13e
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ 0x92c4 0x13f
??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@ 0x8de0 0x140
??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@ 0x9264 0x141
??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@ 0x930c 0x142
??_7?$codecvt@DDU_Mbstatet@@@std@@6B@ 0x9070 0x143
??_7?$codecvt@GDU_Mbstatet@@@std@@6B@ 0x8e8c 0x144
??_7?$codecvt@_SDU_Mbstatet@@@std@@6B@ 0x9020 0x145
??_7?$codecvt@_UDU_Mbstatet@@@std@@6B@ 0x8e20 0x146
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@ 0x90a8 0x147
??_7?$ctype@D@std@@6B@ 0x8f2c 0x148
??_7?$ctype@G@std@@6B@ 0x8fe0 0x149
??_7?$ctype@_W@std@@6B@ 0x8fa0 0x14a
??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ 0x9104 0x14b
??_7?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ 0x95ac 0x14c
??_7?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ 0x9570 0x14d
??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ 0x9164 0x14e
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ 0x9664 0x14f
??_7?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ 0x95e8 0x150
??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ 0x9798 0x151
??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ 0x9474 0x152
??_7?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ 0x9694 0x153
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ 0x97f8 0x154
??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ 0x9460 0x155
??_7?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ 0x955c 0x156
??_7_Facet_base@std@@6B@ 0x904c 0x157
??_7_Locimp@locale@std@@6B@ 0x8f08 0x158
??_7codecvt_base@std@@6B@ 0x8f6c 0x159
??_7ctype_base@std@@6B@ 0x8ef8 0x15a
??_7facet@locale@std@@6B@ 0x8f5c 0x15b
??_7ios_base@std@@6B@ 0x8e84 0x15c
??_7time_base@std@@6B@ 0x90dc 0x15d
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@ 0x6550 0x15e
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@ 0x6548 0x15f
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@ 0x6550 0x160
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@ 0x6548 0x161
??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@ 0x6550 0x162
??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@ 0x6548 0x163
??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@ 0x55f4 0x164
??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@ 0x55f4 0x165
??_8?$basic_istream@_WU?$char_traits@_W@std@@@std@@7B@ 0x55f4 0x166
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@ 0x55e8 0x167
??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@ 0x55e8 0x168
??_8?$basic_ostream@_WU?$char_traits@_W@std@@@std@@7B@ 0x55e8 0x169
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x2f0d0 0x16a
??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x2f270 0x16b
??_D?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x2f1a0 0x16c
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x161e0 0x16d
??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x1d830 0x16e
??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x1df10 0x16f
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x14820 0x170
??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x1c7f0 0x171
??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x1d9c0 0x172
??_F?$codecvt@DDU_Mbstatet@@@std@@QAEXXZ 0x2ea90 0x173
??_F?$codecvt@GDU_Mbstatet@@@std@@QAEXXZ 0x12dc0 0x174
??_F?$codecvt@_SDU_Mbstatet@@@std@@QAEXXZ 0x122e0 0x175
??_F?$codecvt@_UDU_Mbstatet@@@std@@QAEXXZ 0x127e0 0x176
??_F?$codecvt@_WDU_Mbstatet@@@std@@QAEXXZ 0x12c10 0x177
??_F?$ctype@D@std@@QAEXXZ 0x13350 0x178
??_F?$ctype@G@std@@QAEXXZ 0x13c20 0x179
??_F?$ctype@_W@std@@QAEXXZ 0x13a50 0x17a
??_F?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ 0x2ec50 0x17b
??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ 0x2ec90 0x17c
??_F?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ 0x2ec70 0x17d
??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ 0x2ec60 0x17e
??_F?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ 0x2eca0 0x17f
??_F?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ 0x2ec80 0x180
??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ 0x2f2c0 0x181
??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ 0x2f540 0x182
??_F?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ 0x2f400 0x183
??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ 0x2f360 0x184
??_F?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ 0x2f5e0 0x185
??_F?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ 0x2f4a0 0x186
??_F_Locinfo@std@@QAEXXZ 0x115f0 0x187
??_F_Timevec@std@@QAEXXZ 0x111f0 0x188
??_Fcodecvt_base@std@@QAEXXZ 0x11c10 0x189
??_Fctype_base@std@@QAEXXZ 0x12df0 0x18a
??_Ffacet@locale@std@@QAEXXZ 0x11a40 0x18b
??_Fid@locale@std@@QAEXXZ 0x111f0 0x18c
??_Ftime_base@std@@QAEXXZ 0x16300 0x18d
?CaptureCallstack@platform@details@Concurrency@@YAIPAPAXII@Z 0x1c440 0x18e
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ 0xa990 0x18f
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ 0x1c460 0x190
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ 0xff90 0x191
?_Addcats@_Locinfo@std@@QAEAAV12@HPBD@Z 0x113a0 0x192
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z 0x11890 0x193
?_Addstd@ios_base@std@@SAXPAV12@@Z 0x173a0 0x194
?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z 0x11e20 0x195
?_Atexit@@YAXP6AXXZ@Z 0x17400 0x196
?_BADOFF@std@@3_JB 0x3398 0x197
?_C_str@?$_Yarn@D@std@@QBEPBDXZ 0x14880 0x198
?_C_str@?$_Yarn@G@std@@QBEPBGXZ 0x14880 0x199
?_C_str@?$_Yarn@_W@std@@QBEPB_WXZ 0x14880 0x19a
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z 0x1c470 0x19b
?_Callfns@ios_base@std@@AAEXW4event@12@@Z 0x14620 0x19c
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ 0xff90 0x19d
?_Clocptr@_Locimp@locale@std@@0PAV123@A 0x63b54 0x19e
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ 0x11740 0x19f
?_Donarrow@?$ctype@G@std@@IBEDGD@Z 0x13990 0x1a0
?_Donarrow@?$ctype@_W@std@@IBED_WD@Z 0x13990 0x1a1
?_Dowiden@?$ctype@G@std@@IBEGD@Z 0x138f0 0x1a2
?_Dowiden@?$ctype@_W@std@@IBE_WD@Z 0x138f0 0x1a3
?_Empty@?$_Yarn@D@std@@QBE_NXZ 0x14890 0x1a4
?_Empty@?$_Yarn@G@std@@QBE_NXZ 0x14890 0x1a5
?_Empty@?$_Yarn@_W@std@@QBE_NXZ 0x14890 0x1a6
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z 0x2e5f0 0x1a7
?_Ffmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADDH@Z 0x19710 0x1a8
?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADDH@Z 0x19710 0x1a9
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z 0x19710 0x1aa
?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z 0x14660 0x1ab
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z 0x16f20 0x1ac
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z 0x16f40 0x1ad
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z 0x16f40 0x1ae
?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDI@Z 0x193d0 0x1af
?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDI@Z 0x252f0 0x1b0
?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z 0x276e0 0x1b1
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x160f0 0x1b2
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x12d50 0x1b3
?_Getcat@?$codecvt@_SDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x11db0 0x1b4
?_Getcat@?$codecvt@_UDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x12420 0x1b5
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x12890 0x1b6
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x130d0 0x1b7
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x13b80 0x1b8
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x13670 0x1b9
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x18e90 0x1ba
?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x212b0 0x1bb
?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x236b0 0x1bc
?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x184e0 0x1bd
?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x20910 0x1be
?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x22d00 0x1bf
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x2bdc0 0x1c0
?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x1f970 0x1c1
?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x21dd0 0x1c2
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x2b2e0 0x1c3
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x1ee50 0x1c4
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x21330 0x1c5
?_Getcat@facet@locale@std@@SAIPAPBV123@PBV23@@Z 0x11720 0x1c6
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ 0x113f0 0x1c7
?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ 0x11410 0x1c8
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ 0x11440 0x1c9
?_Getdateorder@_Locinfo@std@@QBEHXZ 0x11540 0x1ca
?_Getdays@_Locinfo@std@@QBEPBDXZ 0x114a0 0x1cb
?_Getfalse@_Locinfo@std@@QBEPBDXZ 0x11520 0x1cc
?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z 0x197b0 0x1cd
?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z 0x25630 0x1ce
?_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z 0x27a20 0x1cf
?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z 0x1a280 0x1d0
?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z 0x28750 0x1d1
?_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z 0x290a0 0x1d2
?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z 0x2c890 0x1d3
?_Getfmt@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z 0x23c60 0x1d4
?_Getfmt@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z 0x26140 0x1d5
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ 0x1b130 0x1d6
?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z 0x19e80 0x1d7
?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z 0x25d10 0x1d8
?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z 0x28100 0x1d9
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z 0x2c6d0 0x1da
?_Getint@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0HHAAHABV?$ctype@G@2@@Z 0x23ab0 0x1db
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z 0x23ab0 0x1dc
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ 0x11470 0x1dd
?_Getmonths@_Locinfo@std@@QBEPBDXZ 0x114e0 0x1de
?_Getname@_Locinfo@std@@QBEPBDXZ 0x113e0 0x1df
?_Getptr@_Timevec@std@@QBEPAXXZ 0x107e0 0x1e0
?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ 0x11480 0x1e1
?_Gettrue@_Locinfo@std@@QBEPBDXZ 0x11530 0x1e2
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ 0x15a10 0x1e3
?_Gnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBE_JXZ 0x15a10 0x1e4
?_Gnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBE_JXZ 0x15a10 0x1e5
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x15a40 0x1e6
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ 0x1d550 0x1e7
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ 0x1d550 0x1e8
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x15a30 0x1e9
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ 0x1d540 0x1ea
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ 0x1d540 0x1eb
?_Gnpreinc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x39b10 0x1ec
?_Gnpreinc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ 0x33cf0 0x1ed
?_Gnpreinc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ 0x33cf0 0x1ee
?_Id_cnt@id@locale@std@@0HA 0x63b60 0x1ef
?_Ifmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADPBDH@Z 0x19350 0x1f0
?_Ifmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADPBDH@Z 0x19350 0x1f1
?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z 0x19350 0x1f2
?_Incref@facet@locale@std@@UAEXXZ 0x11730 0x1f3
?_Index@ios_base@std@@0HA 0x63ad0 0x1f4
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z 0x15bb0 0x1f5
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ 0x15be0 0x1f6
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAPAG0PAH001@Z 0x15bb0 0x1f7
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ 0x15be0 0x1f8
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPAPA_W0PAH001@Z 0x15bb0 0x1f9
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ 0x15be0 0x1fa
?_Init@?$codecvt@DDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x1fb
?_Init@?$codecvt@GDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x12900 0x1fc
?_Init@?$codecvt@_SDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x1fd
?_Init@?$codecvt@_UDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x1fe
?_Init@?$codecvt@_WDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x12900 0x1ff
?_Init@?$ctype@D@std@@IAEXABV_Locinfo@2@@Z 0x131b0 0x200
?_Init@?$ctype@G@std@@IAEXABV_Locinfo@2@@Z 0x13710 0x201
?_Init@?$ctype@_W@std@@IAEXABV_Locinfo@2@@Z 0x13710 0x202
?_Init@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x203
?_Init@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x204
?_Init@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x205
?_Init@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x206
?_Init@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x207
?_Init@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x208
?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x2c9c0 0x209
?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x23db0 0x20a
?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x26290 0x20b
?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x2c6b0 0x20c
?_Init@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x23a60 0x20d
?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x23a60 0x20e
?_Init@ios_base@std@@IAEXXZ 0x145c0 0x20f
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z 0x1b1a0 0x210
?_Init_cnt@Init@ios_base@std@@0HA 0x62164 0x211
?_Init_cnt@_UShinit@std@@0HA 0x62168 0x212
?_Init_cnt@_Winit@std@@0HA 0x6216c 0x213
?_Init_cnt_func@Init@ios_base@std@@CAAAHXZ 0x17430 0x214
?_Init_ctor@Init@ios_base@std@@CAXPAV123@@Z 0x17440 0x215
?_Init_dtor@Init@ios_base@std@@CAXPAV123@@Z 0x17460 0x216
?_Init_locks_ctor@_Init_locks@std@@CAXPAV12@@Z 0x2e2c0 0x217
?_Init_locks_dtor@_Init_locks@std@@CAXPAV12@@Z 0x2e2f0 0x218
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z 0x17360 0x219
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z 0x397b0 0x21a
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z 0x33980 0x21b
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z 0x36b80 0x21c
?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z 0x19080 0x21d
?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPADI@Z 0x25020 0x21e
?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z 0x27410 0x21f
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ 0x11bf0 0x220
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ 0x11bf0 0x221
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z 0x17bb0 0x222
?_Locimp_ctor@_Locimp@locale@std@@CAXPAV123@ABV123@@Z 0x17af0 0x223
?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z 0x1b280 0x224
?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z 0x17cc0 0x225
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z 0x17c80 0x226
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z 0x1b300 0x227
?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z 0x1b350 0x228
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ 0xff90 0x229
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ 0xff90 0x22a
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ 0xff90 0x22b
?_Lockit_ctor@_Lockit@std@@CAXPAV12@@Z 0x2e3d0 0x22c
?_Lockit_ctor@_Lockit@std@@CAXPAV12@H@Z 0x2e3e0 0x22d
?_Lockit_ctor@_Lockit@std@@SAXH@Z 0x2e430 0x22e
?_Lockit_dtor@_Lockit@std@@CAXPAV12@@Z 0x2e410 0x22f
?_Lockit_dtor@_Lockit@std@@SAXH@Z 0x2e460 0x230
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x231
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z 0x11e20 0x232
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x233
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x234
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x235
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x236
?_MP_Add@std@@YAXQA_K_K@Z 0x1b430 0x237
?_MP_Get@std@@YA_KQA_K@Z 0x1b380 0x238
?_MP_Mul@std@@YAXQA_K_K1@Z 0x1b4c0 0x239
?_MP_Rem@std@@YAXQA_K_K@Z 0x1b5d0 0x23a
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z 0x178e0 0x23b
?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z 0x1e7d0 0x23c
?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z 0x1e300 0x23d
?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z 0x2aeb0 0x23e
?_Mtx_delete@threads@stdext@@YAXPAX@Z 0x2ad30 0x23f
?_Mtx_lock@threads@stdext@@YAXPAX@Z 0xd400 0x240
?_Mtx_new@threads@stdext@@YAXAAPAX@Z 0x2ad00 0x241
?_Mtx_unlock@threads@stdext@@YAXPAX@Z 0xd410 0x242
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z 0x1b250 0x243
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z 0x1b230 0x244
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x17680 0x245
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x17680 0x246
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x17680 0x247
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ 0x159c0 0x248
?_Pnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBE_JXZ 0x159c0 0x249
?_Pnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBE_JXZ 0x159c0 0x24a
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x159e0 0x24b
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ 0x1d510 0x24c
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ 0x1d510 0x24d
?_Ptr_cerr@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63b0c 0x24e
?_Ptr_cin@std@@3PAV?$basic_istream@DU?$char_traits@D@std@@@1@A 0x63b10 0x24f
?_Ptr_clog@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63b14 0x250
?_Ptr_cout@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63b08 0x251
?_Ptr_wcerr@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63b74 0x252
?_Ptr_wcerr@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x63b50 0x253
?_Ptr_wcin@std@@3PAV?$basic_istream@GU?$char_traits@G@std@@@1@A 0x63b78 0x254
?_Ptr_wcin@std@@3PAV?$basic_istream@_WU?$char_traits@_W@std@@@1@A 0x63b18 0x255
?_Ptr_wclog@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63b7c 0x256
?_Ptr_wclog@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x63b4c 0x257
?_Ptr_wcout@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63b70 0x258
?_Ptr_wcout@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x63b48 0x259
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z 0x19040 0x25a
?_Put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PBGI@Z 0x24fe0 0x25b
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z 0x24fe0 0x25c
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA 0x63b64 0x25d
?_Random_device@std@@YAIXZ 0x2e6f0 0x25e
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z 0x1c590 0x25f
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z 0x19010 0x260
?_Rep@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@GI@Z 0x24fb0 0x261
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z 0x24fb0 0x262
?_ReportUnobservedException@details@Concurrency@@YAXXZ 0x1c420 0x263
?_Reschedule_chore@details@Concurrency@@YAHPBU_Threadpool_chore@12@@Z 0x1c5c0 0x264
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ 0xff90 0x265
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z 0x171e0 0x266
?_Rng_abort@std@@YAXPBD@Z 0xa9c0 0x267
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z 0x1c5f0 0x268
?_Setgloballocale@locale@std@@CAXPAX@Z 0x1b140 0x269
?_Src@?1??_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f3c 0x26a
?_Src@?1??_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f3c 0x26b
?_Src@?1??_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f3c 0x26c
?_Src@?1??_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f60 0x26d
?_Src@?1??_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f60 0x26e
?_Src@?1??_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f60 0x26f
?_Src@?1??_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1HABVlocale@3@@Z@4QBDB 0x57a0 0x270
?_Src@?1??_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1HABVlocale@3@@Z@4QBDB 0x57a0 0x271
?_Src@?1??_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1HABVlocale@3@@Z@4QBDB 0x57a0 0x272
?_Sync@ios_base@std@@0_NA 0x6215c 0x273
?_Syserror_map@std@@YAPBDH@Z 0x1bad0 0x274
?_Throw_C_error@std@@YAXH@Z 0x1c730 0x275
?_Throw_Cpp_error@std@@YAXH@Z 0x1c6f0 0x276
?_Throw_future_error@std@@YAXABVerror_code@1@@Z 0x171b0 0x277
?_Tidy@?$_Yarn@D@std@@AAEXXZ 0x148a0 0x278
?_Tidy@?$_Yarn@G@std@@AAEXXZ 0x148a0 0x279
?_Tidy@?$_Yarn@_W@std@@AAEXXZ 0x148a0 0x27a
?_Tidy@?$ctype@D@std@@IAEXXZ 0x131e0 0x27b
?_Tidy@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AAEXXZ 0x23a80 0x27c
?_Tidy@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AAEXXZ 0x23a80 0x27d
?_Tidy@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AAEXXZ 0x23a80 0x27e
?_Tidy@ios_base@std@@AAEXXZ 0x146d0 0x27f
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ 0xff90 0x280
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ 0xff90 0x281
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ 0xff90 0x282
?_W_Getdays@_Locinfo@std@@QBEPBGXZ 0x11570 0x283
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ 0x115b0 0x284
?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ 0x11550 0x285
?_Winerror_map@std@@YAHH@Z 0x1ba20 0x286
?_Winerror_message@std@@YAKKPADK@Z 0x1ba50 0x287
?_XGetLastError@std@@YAXXZ 0x2e610 0x288
?_XLgamma@std@@YAMM@Z 0x2ada0 0x289
?_XLgamma@std@@YANN@Z 0x2ae40 0x28a
?_XLgamma@std@@YAOO@Z 0x2ae40 0x28b
?_Xbad_alloc@std@@YAXXZ 0x2e790 0x28c
?_Xbad_function_call@std@@YAXXZ 0x2e900 0x28d
?_Xinvalid_argument@std@@YAXPBD@Z 0x2e7b0 0x28e
?_Xlength_error@std@@YAXPBD@Z 0x2e7f0 0x28f
?_Xout_of_range@std@@YAXPBD@Z 0x2e830 0x290
?_Xoverflow_error@std@@YAXPBD@Z 0x2e870 0x291
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z 0x2ea40 0x292
?_Xruntime_error@std@@YAXPBD@Z 0x2e8b0 0x293
?__ExceptionPtrAssign@@YAXPAXPBX@Z 0x10670 0x294
?__ExceptionPtrCompare@@YA_NPBX0@Z 0x106b0 0x295
?__ExceptionPtrCopy@@YAXPAXPBX@Z 0x10660 0x296
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z 0x10760 0x297
?__ExceptionPtrCreate@@YAXPAX@Z 0x10630 0x298
?__ExceptionPtrCurrentException@@YAXPAX@Z 0x10710 0x299
?__ExceptionPtrDestroy@@YAXPAX@Z 0x10640 0x29a
?__ExceptionPtrRethrow@@YAXPBX@Z 0x10740 0x29b
?__ExceptionPtrSwap@@YAXPAX0@Z 0x106e0 0x29c
?__ExceptionPtrToBool@@YA_NPBX@Z 0x106d0 0x29d
?always_noconv@codecvt_base@std@@QBE_NXZ 0x11b90 0x29e
?bad@ios_base@std@@QBE_NXZ 0x14190 0x29f
?c_str@?$_Yarn@D@std@@QBEPBDXZ 0x14880 0x2a0
?c_str@?$_Yarn@G@std@@QBEPBGXZ 0x14880 0x2a1
?c_str@?$_Yarn@_W@std@@QBEPB_WXZ 0x14880 0x2a2
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63b90 0x2a3
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A 0x63c90 0x2a4
?classic@locale@std@@SAABV12@XZ 0x1b170 0x2a5
?classic_table@?$ctype@D@std@@SAPBFXZ 0x13150 0x2a6
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z 0x15d00 0x2a7
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z 0x343e0 0x2a8
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z 0x15d00 0x2a9
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z 0x343e0 0x2aa
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z 0x15d00 0x2ab
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z 0x343e0 0x2ac
?clear@ios_base@std@@QAEXH@Z 0x14110 0x2ad
?clear@ios_base@std@@QAEXH_N@Z 0x14070 0x2ae
?clear@ios_base@std@@QAEXI@Z 0x14110 0x2af
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63d48 0x2b0
?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z 0x39d90 0x2b1
?copyfmt@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEAAV12@ABV12@@Z 0x34390 0x2b2
?copyfmt@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEAAV12@ABV12@@Z 0x34390 0x2b3
?copyfmt@ios_base@std@@QAEAAV12@ABV12@@Z 0x143e0 0x2b4
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63d98 0x2b5
?date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ 0x11b90 0x2b6
?date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ 0x11b90 0x2b7
?date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ 0x11b90 0x2b8
?do_always_noconv@?$codecvt@DDU_Mbstatet@@@std@@MBE_NXZ 0x15690 0x2b9
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MBE_NXZ 0x11bf0 0x2ba
?do_always_noconv@?$codecvt@_SDU_Mbstatet@@@std@@MBE_NXZ 0x11bf0 0x2bb
?do_always_noconv@?$codecvt@_UDU_Mbstatet@@@std@@MBE_NXZ 0x11bf0 0x2bc
?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MBE_NXZ 0x11bf0 0x2bd
?do_always_noconv@codecvt_base@std@@MBE_NXZ 0x11bf0 0x2be
?do_date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ 0x141d0 0x2bf
?do_date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ 0x141d0 0x2c0
?do_date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ 0x141d0 0x2c1
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ 0x122d0 0x2c2
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ 0x122d0 0x2c3
?do_encoding@?$codecvt@_UDU_Mbstatet@@@std@@MBEHXZ 0x127d0 0x2c4
?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ 0x122d0 0x2c5
?do_encoding@codecvt_base@std@@MBEHXZ 0x11c00 0x2c6
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x18bb0 0x2c7
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x18ae0 0x2c8
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x18a20 0x2c9
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x18960 0x2ca
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x186f0 0x2cb
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x18600 0x2cc
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x18600 0x2cd
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x18540 0x2ce
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x188a0 0x2cf
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x187e0 0x2d0
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x18c80 0x2d1
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x20fe0 0x2d2
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x20f10 0x2d3
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x20e50 0x2d4
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x20d90 0x2d5
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x20b20 0x2d6
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x20a30 0x2d7
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x20a30 0x2d8
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x20970 0x2d9
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x20cd0 0x2da
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x20c10 0x2db
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x210b0 0x2dc
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x233d0 0x2dd
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x23300 0x2de
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x23240 0x2df
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x23180 0x2e0
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x22f10 0x2e1
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x22e20 0x2e2
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x22e20 0x2e3
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x22d60 0x2e4
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x230c0 0x2e5
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x23000 0x2e6
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x234a0 0x2e7
?do_get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x2b370 0x2e8
?do_get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x1eee0 0x2e9
?do_get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x213c0 0x2ea
?do_get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2b820 0x2eb
?do_get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f380 0x2ec
?do_get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x217e0 0x2ed
?do_get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2b7a0 0x2ee
?do_get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f300 0x2ef
?do_get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f300 0x2f0
?do_get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2bc80 0x2f1
?do_get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f830 0x2f2
?do_get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x21c90 0x2f3
?do_get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2b7e0 0x2f4
?do_get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f340 0x2f5
?do_get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f340 0x2f6
?do_get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2b700 0x2f7
?do_get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f260 0x2f8
?do_get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x21740 0x2f9
?do_in@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z 0x15670 0x2fa
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z 0x12930 0x2fb
?do_in@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_S3AAPA_S@Z 0x11e30 0x2fc
?do_in@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_U3AAPA_U@Z 0x12490 0x2fd
?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z 0x12930 0x2fe
?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z 0x13770 0x2ff
?do_is@?$ctype@G@std@@MBE_NFG@Z 0x13750 0x300
?do_is@?$ctype@_W@std@@MBEPB_WPB_W0PAF@Z 0x13770 0x301
?do_is@?$ctype@_W@std@@MBE_NF_W@Z 0x13750 0x302
?do_length@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x15650 0x303
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x12b70 0x304
?do_length@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x12230 0x305
?do_length@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x12730 0x306
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x12b70 0x307
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ 0x12c00 0x308
?do_max_length@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ 0x122b0 0x309
?do_max_length@?$codecvt@_UDU_Mbstatet@@@std@@MBEHXZ 0x127b0 0x30a
?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ 0x12c00 0x30b
?do_max_length@codecvt_base@std@@MBEHXZ 0x11c00 0x30c
?do_narrow@?$ctype@D@std@@MBEDDD@Z 0x13320 0x30d
?do_narrow@?$ctype@D@std@@MBEPBDPBD0DPAD@Z 0x13330 0x30e
?do_narrow@?$ctype@G@std@@MBEDGD@Z 0x139e0 0x30f
?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z 0x139f0 0x310
?do_narrow@?$ctype@_W@std@@MBED_WD@Z 0x139e0 0x311
?do_narrow@?$ctype@_W@std@@MBEPB_WPB_W0DPAD@Z 0x139f0 0x312
?do_out@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z 0x15670 0x313
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z 0x129e0 0x314
?do_out@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_S1AAPB_SPAD3AAPAD@Z 0x12060 0x315
?do_out@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_U1AAPB_UPAD3AAPAD@Z 0x125d0 0x316
?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z 0x129e0 0x317
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z 0x182c0 0x318
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z 0x18240 0x319
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z 0x18010 0x31a
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z 0x17ee0 0x31b
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z 0x17e70 0x31c
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z 0x181c0 0x31d
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z 0x18140 0x31e
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z 0x18340 0x31f
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z 0x20700 0x320
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z 0x20680 0x321
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z 0x20450 0x322
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z 0x20320 0x323
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z 0x202b0 0x324
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z 0x20600 0x325
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z 0x20580 0x326
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z 0x20780 0x327
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z 0x22af0 0x328
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z 0x22a70 0x329
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z 0x22840 0x32a
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z 0x22710 0x32b
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z 0x226a0 0x32c
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z 0x229f0 0x32d
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z 0x22970 0x32e
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z 0x22b70 0x32f
?do_put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z 0x2b1e0 0x330
?do_put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z 0x1ed50 0x331
?do_put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z 0x1ed50 0x332
?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z 0x13790 0x333
?do_scan_is@?$ctype@_W@std@@MBEPB_WFPB_W0@Z 0x13790 0x334
?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z 0x137d0 0x335
?do_scan_not@?$ctype@_W@std@@MBEPB_WFPB_W0@Z 0x137d0 0x336
?do_tolower@?$ctype@D@std@@MBEDD@Z 0x13210 0x337
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z 0x13230 0x338
?do_tolower@?$ctype@G@std@@MBEGG@Z 0x13810 0x339
?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z 0x13830 0x33a
?do_tolower@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z 0x13830 0x33b
?do_tolower@?$ctype@_W@std@@MBE_W_W@Z 0x13810 0x33c
?do_toupper@?$ctype@D@std@@MBEDD@Z 0x13280 0x33d
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z 0x132a0 0x33e
?do_toupper@?$ctype@G@std@@MBEGG@Z 0x13880 0x33f
?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z 0x138a0 0x340
?do_toupper@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z 0x138a0 0x341
?do_toupper@?$ctype@_W@std@@MBE_W_W@Z 0x13880 0x342
?do_unshift@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12710 0x343
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12ad0 0x344
?do_unshift@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12210 0x345
?do_unshift@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12710 0x346
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12ad0 0x347
?do_widen@?$ctype@D@std@@MBEDD@Z 0x132f0 0x348
?do_widen@?$ctype@D@std@@MBEPBDPBD0PAD@Z 0x13300 0x349
?do_widen@?$ctype@G@std@@MBEGD@Z 0x13930 0x34a
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z 0x13940 0x34b
?do_widen@?$ctype@_W@std@@MBEPBDPBD0PA_W@Z 0x13940 0x34c
?do_widen@?$ctype@_W@std@@MBE_WD@Z 0x13930 0x34d
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15ab0 0x34e
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x15ab0 0x34f
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x15ab0 0x350
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15a80 0x351
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x1d590 0x352
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x1d590 0x353
?empty@?$_Yarn@D@std@@QBE_NXZ 0x14890 0x354
?empty@?$_Yarn@G@std@@QBE_NXZ 0x14890 0x355
?empty@?$_Yarn@_W@std@@QBE_NXZ 0x14890 0x356
?empty@locale@std@@SA?AV12@XZ 0x1b180 0x357
?encoding@codecvt_base@std@@QBEHXZ 0x11bd0 0x358
?eof@ios_base@std@@QBE_NXZ 0x14180 0x359
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15a50 0x35a
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x1d560 0x35b
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x1d560 0x35c
?exceptions@ios_base@std@@QAEXH@Z 0x141b0 0x35d
?exceptions@ios_base@std@@QAEXI@Z 0x141b0 0x35e
?exceptions@ios_base@std@@QBEHXZ 0x141a0 0x35f
?fail@ios_base@std@@QBE_NXZ 0x14060 0x360
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z 0x39d70 0x361
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ 0x39d80 0x362
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEGG@Z 0x342d0 0x363
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ 0x342f0 0x364
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE_W_W@Z 0x342d0 0x365
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ 0x342f0 0x366
?flags@ios_base@std@@QAEHH@Z 0x141e0 0x367
?flags@ios_base@std@@QBEHXZ 0x141d0 0x368
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ 0x174a0 0x369
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ 0x174a0 0x36a
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ 0x174a0 0x36b
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z 0x15a60 0x36c
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z 0x1d570 0x36d
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z 0x1d570 0x36e
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ 0x32200 0x36f
?gcount@?$basic_istream@GU?$char_traits@G@std@@@std@@QBE_JXZ 0x32200 0x370
?gcount@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QBE_JXZ 0x32200 0x371
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z 0x388d0 0x372
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z 0x388a0 0x373
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@D@Z 0x387b0 0x374
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z 0x38a00 0x375
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_JD@Z 0x388f0 0x376
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ 0x38a40 0x377
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAG@Z 0x329a0 0x378
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z 0x32970 0x379
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@G@Z 0x32870 0x37a
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z 0x32af0 0x37b
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_JG@Z 0x329d0 0x37c
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ 0x32b30 0x37d
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z 0x35b70 0x37e
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_W@Z 0x35a70 0x37f
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AA_W@Z 0x35ba0 0x380
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z 0x35cf0 0x381
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J_W@Z 0x35bd0 0x382
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x35d30 0x383
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x30aa0 0x384
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x30a60 0x385
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x30a20 0x386
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x309e0 0x387
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x23e80 0x388
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x2fc80 0x389
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x2fcc0 0x38a
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x2f7a0 0x38b
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x23e00 0x38c
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x23e40 0x38d
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x30ae0 0x38e
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x30aa0 0x38f
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x30a60 0x390
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x30a20 0x391
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x309e0 0x392
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x23e80 0x393
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x2fc80 0x394
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x2fcc0 0x395
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x2f7a0 0x396
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x23e00 0x397
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x23e40 0x398
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x30ae0 0x399
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x30aa0 0x39a
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x30a60 0x39b
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x30a20 0x39c
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x309e0 0x39d
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x23e80 0x39e
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x2fc80 0x39f
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x2fcc0 0x3a0
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x2f7a0 0x3a1
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x23e00 0x3a2
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x23e40 0x3a3
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x30ae0 0x3a4
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x2fc40 0x3a5
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z 0x30480 0x3a6
?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x2fc40 0x3a7
?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBG4@Z 0x2f9e0 0x3a8
?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x2fc40 0x3a9
?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PB_W4@Z 0x2ffc0 0x3aa
?get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fc80 0x3ab
?get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fc80 0x3ac
?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fc80 0x3ad
?get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e40 0x3ae
?get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e40 0x3af
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e40 0x3b0
?get_new_handler@std@@YAP6AXXZXZ 0x1b990 0x3b1
?get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fcc0 0x3b2
?get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fcc0 0x3b3
?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fcc0 0x3b4
?get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e80 0x3b5
?get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e80 0x3b6
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e80 0x3b7
?get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e00 0x3b8
?get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e00 0x3b9
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e00 0x3ba
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z 0x38770 0x3bb
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_JD@Z 0x38630 0x3bc
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z 0x32830 0x3bd
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_JG@Z 0x326e0 0x3be
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z 0x35a30 0x3bf
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J_W@Z 0x358e0 0x3c0
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ 0x33ee0 0x3c1
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ 0x33ee0 0x3c2
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ 0x33ee0 0x3c3
?getloc@ios_base@std@@QBE?AVlocale@2@XZ 0x142c0 0x3c4
?global@locale@std@@SA?AV12@ABV12@@Z 0x177f0 0x3c5
?good@ios_base@std@@QBE_NXZ 0x14170 0x3c6
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15aa0 0x3c7
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x15aa0 0x3c8
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x15aa0 0x3c9
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A 0x64780 0x3ca
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A 0x63e4c 0x3cb
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A 0x63e48 0x3cc
?id@?$collate@D@std@@2V0locale@2@A 0x647f0 0x3cd
?id@?$collate@G@std@@2V0locale@2@A 0x647c4 0x3ce
?id@?$collate@_W@std@@2V0locale@2@A 0x647b4 0x3cf
?id@?$ctype@D@std@@2V0locale@2@A 0x63e54 0x3d0
?id@?$ctype@G@std@@2V0locale@2@A 0x63e44 0x3d1
?id@?$ctype@_W@std@@2V0locale@2@A 0x63e50 0x3d2
?id@?$messages@D@std@@2V0locale@2@A 0x647fc 0x3d3
?id@?$messages@G@std@@2V0locale@2@A 0x647a4 0x3d4
?id@?$messages@_W@std@@2V0locale@2@A 0x647c0 0x3d5
?id@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x64800 0x3d6
?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x647d8 0x3d7
?id@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647cc 0x3d8
?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x64804 0x3d9
?id@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x647bc 0x3da
?id@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647c8 0x3db
?id@?$moneypunct@D$00@std@@2V0locale@2@A 0x647f4 0x3dc
?id@?$moneypunct@D$0A@@std@@2V0locale@2@A 0x647f8 0x3dd
?id@?$moneypunct@G$00@std@@2V0locale@2@A 0x647b0 0x3de
?id@?$moneypunct@G$0A@@std@@2V0locale@2@A 0x647b8 0x3df
?id@?$moneypunct@_W$00@std@@2V0locale@2@A 0x64794 0x3e0
?id@?$moneypunct@_W$0A@@std@@2V0locale@2@A 0x64790 0x3e1
?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x64788 0x3e2
?id@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x647d0 0x3e3
?id@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647d4 0x3e4
?id@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x64784 0x3e5
?id@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x6479c 0x3e6
?id@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647e4 0x3e7
?id@?$numpunct@D@std@@2V0locale@2@A 0x6478c 0x3e8
?id@?$numpunct@G@std@@2V0locale@2@A 0x647e0 0x3e9
?id@?$numpunct@_W@std@@2V0locale@2@A 0x647a8 0x3ea
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x647ec 0x3eb
?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x64798 0x3ec
?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647ac 0x3ed
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x647e8 0x3ee
?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x647dc 0x3ef
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647a0 0x3f0
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z 0x38540 0x3f1
?ignore@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JG@Z 0x325e0 0x3f2
?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JG@Z 0x357e0 0x3f3
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x34300 0x3f4
?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x34300 0x3f5
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x34300 0x3f6
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z 0x11e20 0x3f7
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z 0x11e20 0x3f8
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z 0x11e20 0x3f9
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z 0x142e0 0x3fa
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z 0x11c20 0x3fb
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z 0x11c20 0x3fc
?in@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_S3AAPA_S@Z 0x11c20 0x3fd
?in@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_U3AAPA_U@Z 0x11c20 0x3fe
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z 0x11c20 0x3ff
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JXZ 0x33ea0 0x400
?in_avail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JXZ 0x33ea0 0x401
?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ 0x33ea0 0x402
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z 0x15b10 0x403
?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z 0x1d5f0 0x404
?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z 0x1dd20 0x405
?intl@?$moneypunct@D$00@std@@2_NB 0x6558 0x406
?intl@?$moneypunct@D$0A@@std@@2_NB 0x6559 0x407
?intl@?$moneypunct@G$00@std@@2_NB 0x6558 0x408
?intl@?$moneypunct@G$0A@@std@@2_NB 0x6559 0x409
?intl@?$moneypunct@_W$00@std@@2_NB 0x6558 0x40a
?intl@?$moneypunct@_W$0A@@std@@2_NB 0x6559 0x40b
?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z 0x397a0 0x40c
?ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z 0x33970 0x40d
?ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z 0x36b70 0x40e
?is@?$ctype@D@std@@QBEPBDPBD0PAF@Z 0x12e20 0x40f
?is@?$ctype@D@std@@QBE_NFD@Z 0x12e00 0x410
?is@?$ctype@G@std@@QBEPBGPBG0PAF@Z 0x13420 0x411
?is@?$ctype@G@std@@QBE_NFG@Z 0x133f0 0x412
?is@?$ctype@_W@std@@QBEPB_WPB_W0PAF@Z 0x13420 0x413
?is@?$ctype@_W@std@@QBE_NF_W@Z 0x133f0 0x414
?isfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ 0xff90 0x415
?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ 0xff90 0x416
?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0xff90 0x417
?iword@ios_base@std@@QAEAAJH@Z 0x14370 0x418
?length@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x419
?length@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x41a
?length@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x41b
?length@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x41c
?length@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x41d
?max_length@codecvt_base@std@@QBEHXZ 0x11bb0 0x41e
?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEX$$QAV12@@Z 0x39d00 0x41f
?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z 0x39d00 0x420
?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEX$$QAV12@@Z 0x34260 0x421
?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXAAV12@@Z 0x34260 0x422
?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEX$$QAV12@@Z 0x34260 0x423
?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z 0x34260 0x424
?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z 0x39d20 0x425
?narrow@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEDGD@Z 0x34280 0x426
?narrow@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBED_WD@Z 0x36ee0 0x427
?narrow@?$ctype@D@std@@QBEDDD@Z 0x12fc0 0x428
?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z 0x11cd0 0x429
?narrow@?$ctype@G@std@@QBEDGD@Z 0x13580 0x42a
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z 0x135b0 0x42b
?narrow@?$ctype@_W@std@@QBED_WD@Z 0x13580 0x42c
?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z 0x135b0 0x42d
?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ 0x31e80 0x42e
?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE_NXZ 0x31e80 0x42f
?opfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE_NXZ 0x31e80 0x430
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x31e70 0x431
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x31e70 0x432
?osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x31e70 0x433
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z 0x11c60 0x434
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z 0x11c60 0x435
?out@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_S1AAPB_SPAD3AAPAD@Z 0x11c60 0x436
?out@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_U1AAPB_UPAD3AAPAD@Z 0x11c60 0x437
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z 0x11c60 0x438
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z 0x15580 0x439
?overflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z 0x1d310 0x43a
?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z 0x1d310 0x43b
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z 0x15580 0x43c
?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z 0x1d310 0x43d
?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z 0x1d310 0x43e
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x33d00 0x43f
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x33d00 0x440
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x33d00 0x441
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z 0x159f0 0x442
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z 0x1d520 0x443
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z 0x1d520 0x444
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ 0x38320 0x445
?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ 0x323b0 0x446
?peek@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x355b0 0x447
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15a90 0x448
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x15a90 0x449
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x15a90 0x44a
?precision@ios_base@std@@QAE_J_J@Z 0x14270 0x44b
?precision@ios_base@std@@QBE_JXZ 0x14260 0x44c
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x33f00 0x44d
?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x33f00 0x44e
?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x33f00 0x44f
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x33ff0 0x450
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z 0x33fd0 0x451
?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x33ff0 0x452
?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z 0x33fd0 0x453
?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x33ff0 0x454
?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z 0x33fd0 0x455
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x33f90 0x456
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z 0x33f90 0x457
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x33f90 0x458
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z 0x33f90 0x459
?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x33f90 0x45a
?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z 0x33f90 0x45b
?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PAD_J@Z 0x33f60 0x45c
?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PAG_J@Z 0x33f60 0x45d
?pubsetbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PA_W_J@Z 0x33f60 0x45e
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x17600 0x45f
?pubsync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHXZ 0x17600 0x460
?pubsync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHXZ 0x17600 0x461
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z 0x37170 0x462
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z 0x31160 0x463
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z 0x31160 0x464
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z 0x30920 0x465
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z 0x308e0 0x466
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z 0x30820 0x467
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z 0x307e0 0x468
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z 0x307a0 0x469
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z 0x308a0 0x46a
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z 0x30860 0x46b
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z 0x30960 0x46c
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z 0x30920 0x46d
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z 0x308e0 0x46e
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z 0x30820 0x46f
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z 0x307e0 0x470
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z 0x307a0 0x471
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z 0x308a0 0x472
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z 0x30860 0x473
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z 0x30960 0x474
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z 0x30920 0x475
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z 0x308e0 0x476
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z 0x30820 0x477
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z 0x307e0 0x478
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z 0x307a0 0x479
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z 0x308a0 0x47a
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z 0x30860 0x47b
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z 0x30960 0x47c
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z 0x2f7a0 0x47d
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z 0x30280 0x47e
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z 0x2f7a0 0x47f
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@PBG3@Z 0x2f7e0 0x480
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z 0x2f7a0 0x481
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@PB_W4@Z 0x2fdc0 0x482
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z 0x38250 0x483
?putback@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z 0x322e0 0x484
?putback@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z 0x354e0 0x485
?pword@ios_base@std@@QAEAAPAXH@Z 0x14390 0x486
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z 0x34360 0x487
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ 0x17620 0x488
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PAV32@@Z 0x34360 0x489
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ 0x17620 0x48a
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PAV32@@Z 0x34360 0x48b
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ 0x17620 0x48c
?rdstate@ios_base@std@@QBEHXZ 0x13140 0x48d
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z 0x38480 0x48e
?read@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z 0x32520 0x48f
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z 0x35720 0x490
?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z 0x383d0 0x491
?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_JPAG_J@Z 0x32470 0x492
?readsome@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_JPA_W_J@Z 0x35670 0x493
?register_callback@ios_base@std@@QAEXP6AXW4event@12@AAV12@H@ZH@Z 0x143b0 0x494
?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z 0x172c0 0x495
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x1ab60 0x496
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ 0x298f0 0x497
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x298f0 0x498
?scan_is@?$ctype@D@std@@QBEPBDFPBD0@Z 0x12e70 0x499
?scan_is@?$ctype@G@std@@QBEPBGFPBG0@Z 0x13450 0x49a
?scan_is@?$ctype@_W@std@@QBEPB_WFPB_W0@Z 0x13450 0x49b
?scan_not@?$ctype@D@std@@QBEPBDFPBD0@Z 0x12ea0 0x49c
?scan_not@?$ctype@G@std@@QBEPBGFPBG0@Z 0x13480 0x49d
?scan_not@?$ctype@_W@std@@QBEPB_WFPB_W0@Z 0x13480 0x49e
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x38060 0x49f
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z 0x37fc0 0x4a0
?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x320d0 0x4a1
?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JH@Z 0x32030 0x4a2
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x352e0 0x4a3
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z 0x35240 0x4a4
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x15300 0x4a5
?seekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x15300 0x4a6
?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x15300 0x4a7
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x31000 0x4a8
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z 0x30f70 0x4a9
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x31000 0x4aa
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JH@Z 0x30f70 0x4ab
?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x31000 0x4ac
?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z 0x30f70 0x4ad
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x152e0 0x4ae
?seekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x152e0 0x4af
?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x152e0 0x4b0
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z 0x1b910 0x4b1
?set_rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z 0x34210 0x4b2
?set_rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z 0x34210 0x4b3
?set_rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z 0x34210 0x4b4
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z 0x17300 0x4b5
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z 0x152d0 0x4b6
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z 0x152d0 0x4b7
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z 0x152d0 0x4b8
?setf@ios_base@std@@QAEHH@Z 0x14200 0x4b9
?setf@ios_base@std@@QAEHHH@Z 0x14220 0x4ba
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z 0x15c30 0x4bb
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z 0x1d640 0x4bc
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z 0x1d640 0x4bd
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z 0x172e0 0x4be
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z 0x39ae0 0x4bf
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z 0x15ce0 0x4c0
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z 0x33cc0 0x4c1
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z 0x1d6c0 0x4c2
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z 0x33cc0 0x4c3
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z 0x1d6c0 0x4c4
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z 0x17320 0x4c5
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z 0x15cb0 0x4c6
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z 0x343c0 0x4c7
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z 0x15cb0 0x4c8
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z 0x343c0 0x4c9
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z 0x15cb0 0x4ca
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z 0x343c0 0x4cb
?setstate@ios_base@std@@QAEXH@Z 0x14150 0x4cc
?setstate@ios_base@std@@QAEXH_N@Z 0x14130 0x4cd
?setstate@ios_base@std@@QAEXI@Z 0x14150 0x4ce
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z 0x17340 0x4cf
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x1ab20 0x4d0
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ 0x298b0 0x4d1
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x298b0 0x4d2
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z 0x33e70 0x4d3
?sgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPAG_J@Z 0x33e70 0x4d4
?sgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPA_W_J@Z 0x33e70 0x4d5
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ 0x15570 0x4d6
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ 0x15570 0x4d7
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ 0x15570 0x4d8
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x39bf0 0x4d9
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ 0x33e20 0x4da
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x33e20 0x4db
?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z 0x39ba0 0x4dc
?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z 0x33dd0 0x4dd
?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z 0x33dd0 0x4de
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z 0x1aad0 0x4df
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z 0x29860 0x4e0
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z 0x29860 0x4e1
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z 0x33d10 0x4e2
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z 0x33d10 0x4e3
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z 0x33d10 0x4e4
?stossc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ 0x39b60 0x4e5
?stossc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ 0x33d90 0x4e6
?stossc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x33d90 0x4e7
?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x39b20 0x4e8
?sungetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ 0x33d40 0x4e9
?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x33d40 0x4ea
?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z 0x39cd0 0x4eb
?swap@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXAAV12@@Z 0x34220 0x4ec
?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z 0x34220 0x4ed
?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z 0x36fc0 0x4ee
?swap@?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z 0x30d40 0x4ef
?swap@?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z 0x30d40 0x4f0
?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z 0x398e0 0x4f1
?swap@?$basic_istream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z 0x33ac0 0x4f2
?swap@?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z 0x33ac0 0x4f3
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z 0x36fc0 0x4f4
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z 0x30d40 0x4f5
?swap@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z 0x30d40 0x4f6
?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z 0x34020 0x4f7
?swap@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z 0x34020 0x4f8
?swap@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z 0x34020 0x4f9
?swap@ios_base@std@@QAEXAAV12@@Z 0x144e0 0x4fa
?sync@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ 0x38110 0x4fb
?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHXZ 0x32180 0x4fc
?sync@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEHXZ 0x35390 0x4fd
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ 0x122d0 0x4fe
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ 0x122d0 0x4ff
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ 0x122d0 0x500
?sync_with_stdio@ios_base@std@@SA_N_N@Z 0x144a0 0x501
?table@?$ctype@D@std@@QBEPBFXZ 0x13140 0x502
?table_size@?$ctype@D@std@@2IB 0x55f0 0x503
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x37f40 0x504
?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x31fb0 0x505
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x351c0 0x506
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x30ef0 0x507
?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x30ef0 0x508
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x30ef0 0x509
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@PAV32@@Z 0x155c0 0x50a
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ 0x176f0 0x50b
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@PAV32@@Z 0x155c0 0x50c
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ 0x176f0 0x50d
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@PAV32@@Z 0x155c0 0x50e
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ 0x176f0 0x50f
?tolower@?$ctype@D@std@@QBEDD@Z 0x12ed0 0x510
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z 0x12ef0 0x511
?tolower@?$ctype@G@std@@QBEGG@Z 0x12f70 0x512
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z 0x134b0 0x513
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z 0x134b0 0x514
?tolower@?$ctype@_W@std@@QBE_W_W@Z 0x12f70 0x515
?toupper@?$ctype@D@std@@QBEDD@Z 0x12f20 0x516
?toupper@?$ctype@D@std@@QBEPBDPADPBD@Z 0x12f40 0x517
?toupper@?$ctype@G@std@@QBEGG@Z 0x134e0 0x518
?toupper@?$ctype@G@std@@QBEPBGPAGPBG@Z 0x13500 0x519
?toupper@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z 0x13500 0x51a
?toupper@?$ctype@_W@std@@QBE_W_W@Z 0x134e0 0x51b
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ 0x15530 0x51c
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ 0x1d2c0 0x51d
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ 0x1d2c0 0x51e
?uncaught_exception@std@@YA_NXZ 0x1c780 0x51f
?uncaught_exceptions@std@@YAHXZ 0x1c790 0x520
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ 0x11720 0x521
?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ 0x1d300 0x522
?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ 0x1d300 0x523
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ 0x38190 0x524
?unget@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ 0x32210 0x525
?unget@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ 0x35410 0x526
?unsetf@ios_base@std@@QAEXH@Z 0x14250 0x527
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x528
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x529
?unshift@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x52a
?unshift@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x52b
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x52c
?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63e68 0x52d
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x64120 0x52e
?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A 0x63f68 0x52f
?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A 0x64220 0x530
?wclog@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63fc8 0x531
?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x64280 0x532
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x64070 0x533
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x64328 0x534
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z 0x15c60 0x535
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z 0x1d670 0x536
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z 0x1dd70 0x537
?widen@?$ctype@D@std@@QBEDD@Z 0x12f70 0x538
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z 0x12f90 0x539
?widen@?$ctype@G@std@@QBEGD@Z 0x13530 0x53a
?widen@?$ctype@G@std@@QBEPBDPBD0PAG@Z 0x13550 0x53b
?widen@?$ctype@_W@std@@QBEPBDPBD0PA_W@Z 0x13550 0x53c
?widen@?$ctype@_W@std@@QBE_WD@Z 0x13530 0x53d
?width@ios_base@std@@QAE_J_J@Z 0x142a0 0x53e
?width@ios_base@std@@QBE_JXZ 0x14290 0x53f
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z 0x310a0 0x540
?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBG_J@Z 0x310a0 0x541
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z 0x310a0 0x542
?xalloc@ios_base@std@@SAHXZ 0x14330 0x543
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z 0x15420 0x544
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z 0x1d1a0 0x545
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z 0x1d1a0 0x546
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z 0x15320 0x547
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z 0x1d090 0x548
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z 0x1d090 0x549
_Chmod 0x16c00 0x54a
_Close_dir 0x16330 0x54b
_Cnd_broadcast 0x1bf00 0x54c
_Cnd_destroy 0x1bdc0 0x54d
_Cnd_destroy_in_situ 0x1bd70 0x54e
_Cnd_do_broadcast_at_thread_exit 0xab90 0x54f
_Cnd_init 0x1bd90 0x550
_Cnd_init_in_situ 0x1bd00 0x551
_Cnd_register_at_thread_exit 0xaa90 0x552
_Cnd_signal 0x1bee0 0x553
_Cnd_timedwait 0x1bec0 0x554
_Cnd_unregister_at_thread_exit 0xab30 0x555
_Cnd_wait 0x1bea0 0x556
_Copy_file 0x16bd0 0x557
_Cosh 0xae10 0x558
_Current_get 0x16590 0x559
_Current_set 0x165c0 0x55a
_Denorm 0x62148 0x55b
_Dtest 0xb500 0x55c
_Equivalent 0x169d0 0x55d
_Exp 0xb5f0 0x55e
_FCosh 0xb710 0x55f
_FDenorm 0x62068 0x560
_FDtest 0xbc70 0x561
_FExp 0xbd40 0x562
_FInf 0x62028 0x563
_FNan 0x62048 0x564
_FSinh 0xc5a0 0x565
_FSnan 0x62078 0x566
_File_size 0x167b0 0x567
_Getcoll 0xed90 0x568
_Getctype 0xa5e0 0x569
_Getcvt 0xf150 0x56a
_Getdateorder 0x2ad50 0x56b
_Getwctype 0xc710 0x56c
_Getwctypes 0xc740 0x56d
_Hard_links 0x16730 0x56e
_Hugeval 0x62128 0x56f
_Inf 0x620e8 0x570
_LCosh 0xc760 0x571
_LDenorm 0x620c8 0x572
_LDtest 0xc960 0x573
_LExp 0xc970 0x574
_LInf 0x62088 0x575
_LNan 0x620a8 0x576
_LSinh 0xd130 0x577
_LSnan 0x620d8 0x578
_Last_write_time 0x16800 0x579
_Link 0x16ac0 0x57a
_Lock_shared_ptr_spin_lock 0xa770 0x57b
_Lstat 0x16720 0x57c
_Make_dir 0x16640 0x57d
_Mbrtowc 0xd270 0x57e
_Mtx_clear_owner 0x1c3c0 0x57f
_Mtx_current_owns 0x1c380 0x580
_Mtx_destroy 0x1c130 0x581
_Mtx_destroy_in_situ 0x1c0d0 0x582
_Mtx_getconcrtcs 0x1c3b0 0x583
_Mtx_init 0x1c0f0 0x584
_Mtx_init_in_situ 0x1c0b0 0x585
_Mtx_lock 0x1c320 0x586
_Mtx_reset_owner 0x1c3d0 0x587
_Mtx_timedlock 0x1c360 0x588
_Mtx_trylock 0x1c330 0x589
_Mtx_unlock 0x1c2f0 0x58a
_Mtxdst 0xd3f0 0x58b
_Mtxinit 0xd3d0 0x58c
_Mtxlock 0xd400 0x58d
_Mtxunlock 0xd410 0x58e
_Nan 0x62108 0x58f
_Open_dir 0x16480 0x590
_Query_perf_counter 0xadd0 0x591
_Query_perf_frequency 0xadf0 0x592
_Read_dir 0x16360 0x593
_Remove_dir 0x16670 0x594
_Rename 0x16b20 0x595
_Resize 0x16b40 0x596
_Set_last_write_time 0x16850 0x597
_Sinh 0xd950 0x598
_Snan 0x62138 0x599
_Stat 0x16690 0x59a
_Statvfs 0x168c0 0x59b
_Stod 0xdcd0 0x59c
_Stodx 0xda90 0x59d
_Stof 0xdef0 0x59e
_Stofx 0xdcf0 0x59f
_Stold 0xe440 0x5a0
_Stoldx 0xe200 0x5a1
_Stoll 0xe540 0x5a2
_Stollx 0xe460 0x5a3
_Stolx 0xe150 0x5a4
_Stoul 0xe830 0x5a5
_Stoull 0xea70 0x5a6
_Stoullx 0xe850 0x5a7
_Stoulx 0xe6b0 0x5a8
_Strcoll 0xecf0 0x5a9
_Strxfrm 0xedc0 0x5aa
_Symlink 0x16af0 0x5ab
_Symlink_get 0x165e0 0x5ac
_Temp_get 0x165f0 0x5ad
_Thrd_abort 0xa9c0 0x5ae
_Thrd_create 0xa9f0 0x5af
_Thrd_current 0xa940 0x5b0
_Thrd_detach 0xa880 0x5b1
_Thrd_equal 0xa930 0x5b2
_Thrd_exit 0xa7f0 0x5b3
_Thrd_hardware_concurrency 0xa9a0 0x5b4
_Thrd_id 0xa990 0x5b5
_Thrd_join 0xa830 0x5b6
_Thrd_sleep 0xa8a0 0x5b7
_Thrd_start 0xa800 0x5b8
_Thrd_yield 0xa920 0x5b9
_To_byte 0x16450 0x5ba
_To_wide 0x16420 0x5bb
_Tolower 0xa4d0 0x5bc
_Toupper 0xa660 0x5bd
_Towlower 0xee70 0x5be
_Towupper 0xeee0 0x5bf
_Unlink 0x16bb0 0x5c0
_Unlock_shared_ptr_spin_lock 0xa780 0x5c1
_WStod 0xf410 0x5c2
_WStodx 0xf1d0 0x5c3
_WStof 0xf630 0x5c4
_WStofx 0xf430 0x5c5
_WStold 0xfb00 0x5c6
_WStoldx 0xf8c0 0x5c7
_Wcrtomb 0xf0f0 0x5c8
_Wcscoll 0xef50 0x5c9
_Wcsxfrm 0xf010 0x5ca
_Xtime_diff_to_millis 0xad40 0x5cb
_Xtime_diff_to_millis2 0xad00 0x5cc
_Xtime_get_ticks 0xacd0 0x5cd
__Wcrtomb_lk 0xf0e0 0x5ce
__crtCloseThreadpoolTimer 0x3a250 0x5cf
__crtCloseThreadpoolWait 0x3a280 0x5d0
__crtCompareStringA 0x10940 0x5d1
__crtCompareStringEx 0x10f50 0x5d2
__crtCompareStringW 0x10bb0 0x5d3
__crtCreateEventExW 0x3a2c0 0x5d4
__crtCreateSemaphoreExW 0x3a310 0x5d5
__crtCreateSymbolicLinkW 0x3a370 0x5d6
__crtCreateThreadpoolTimer 0x3a3b0 0x5d7
__crtCreateThreadpoolWait 0x3a3e0 0x5d8
__crtFlushProcessWriteBuffers 0x3a430 0x5d9
__crtFreeLibraryWhenCallbackReturns 0x3a450 0x5da
__crtGetCurrentProcessorNumber 0x3a480 0x5db
__crtGetFileInformationByHandleEx 0x3a4a0 0x5dc
__crtGetLocaleInfoEx 0x11020 0x5dd
__crtGetSystemTimePreciseAsFileTime 0x3a4e0 0x5de
__crtGetTickCount64 0x3a510 0x5df
__crtInitOnceExecuteOnce 0x3a540 0x5e0
__crtInitializeCriticalSectionEx 0x3a5f0 0x5e1
__crtIsPackagedApp 0x3a650 0x5e2
__crtLCMapStringA 0x10c20 0x5e3
__crtLCMapStringEx 0x10fc0 0x5e4
__crtLCMapStringW 0x10e30 0x5e5
__crtSetFileInformationByHandle 0x3a690 0x5e6
__crtSetThreadpoolTimer 0x3a6d0 0x5e7
__crtSetThreadpoolWait 0x3a700 0x5e8
__crtWaitForThreadpoolTimerCallbacks 0x3a7c0 0x5e9
__set_stl_sync_api_mode 0x1c0a0 0x5ea
xtime_get 0xad80 0x5eb
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2016-08-18 20:17:17+00:00
Valid Until 2017-11-02 20:17:17+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 40 96 A9 EE 70 56 FE CC 07 00 01 00 00 01 40
Thumbprint 98 ED 99 A6 78 86 D0 20 C5 64 92 3B 7D F2 5E 9A C0 19 DF 26
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/nss3.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 1.19 MB
MD5 556ea09421a0f74d31c4c0a89a70dc23 Copy to Clipboard
SHA1 f739ba9b548ee64b13eb434a3130406d23f836e3 Copy to Clipboard
SHA256 f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb Copy to Clipboard
SSDeep 24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn Copy to Clipboard
ImpHash 2f6410b337cbd1ca3a8bf343e95c41ee Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Entry Point 0x100ee854
Size Of Code 0xee400
Size Of Initialized Data 0x41c00
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2018-04-27 22:08:33+00:00
Version Information (11)
»
BuildID 20180427210249
Comments -
CompanyName Mozilla Foundation
FileDescription -
FileVersion 59.0.3
InternalName -
LegalCopyright License: MPL 2
LegalTrademarks Mozilla
OriginalFilename nss3.dll
ProductName Firefox
ProductVersion 59.0.3
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xee3bf 0xee400 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.67
.rdata 0x100f0000 0x3508e 0x35200 0xee800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.96
.data 0x10126000 0x4590 0x2000 0x123a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 3.91
.rsrc 0x1012b000 0x368 0x400 0x125a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.85
.reloc 0x1012c000 0x7e74 0x8000 0x125e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.68
Imports (16)
»
mozglue.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
free 0x0 0x100f03cc 0x124134 0x122934 0x7c
malloc 0x0 0x100f03d0 0x124138 0x122938 0x86
strdup 0x0 0x100f03d4 0x12413c 0x12293c 0x9b
calloc 0x0 0x100f03d8 0x124140 0x122940 0x7b
malloc_usable_size 0x0 0x100f03dc 0x124144 0x122944 0x88
_HeapAlloc@12 0x0 0x100f03e0 0x124148 0x122948 0x71
_HeapReAlloc@16 0x0 0x100f03e4 0x12414c 0x12294c 0x73
realloc 0x0 0x100f03e8 0x124150 0x122950 0x9a
_HeapFree@12 0x0 0x100f03ec 0x124154 0x122954 0x72
KERNEL32.dll (114)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
HeapCreate 0x0 0x100f0034 0x123d9c 0x12259c 0x33f
EnterCriticalSection 0x0 0x100f0038 0x123da0 0x1225a0 0x12e
GetFullPathNameW 0x0 0x100f003c 0x123da4 0x1225a4 0x253
WriteFile 0x0 0x100f0040 0x123da8 0x1225a8 0x605
GetDiskFreeSpaceW 0x0 0x100f0044 0x123dac 0x1225ac 0x225
OutputDebugStringA 0x0 0x100f0048 0x123db0 0x1225b0 0x40b
LockFile 0x0 0x100f004c 0x123db4 0x1225b4 0x3cc
LeaveCriticalSection 0x0 0x100f0050 0x123db8 0x1225b8 0x3b2
InitializeCriticalSection 0x0 0x100f0054 0x123dbc 0x1225bc 0x355
SetFilePointer 0x0 0x100f0058 0x123dc0 0x1225c0 0x513
GetFullPathNameA 0x0 0x100f005c 0x123dc4 0x1225c4 0x250
SetEndOfFile 0x0 0x100f0060 0x123dc8 0x1225c8 0x501
UnlockFileEx 0x0 0x100f0064 0x123dcc 0x1225cc 0x59f
GetTempPathW 0x0 0x100f0068 0x123dd0 0x1225d0 0x2ef
CreateMutexW 0x0 0x100f006c 0x123dd4 0x1225d4 0xd8
WaitForSingleObject 0x0 0x100f0070 0x123dd8 0x1225d8 0x5c7
CreateFileW 0x0 0x100f0074 0x123ddc 0x1225dc 0xc9
GetFileAttributesW 0x0 0x100f0078 0x123de0 0x1225e0 0x23f
GetCurrentThreadId 0x0 0x100f007c 0x123de4 0x1225e4 0x218
UnmapViewOfFile 0x0 0x100f0080 0x123de8 0x1225e8 0x5a0
HeapValidate 0x0 0x100f0084 0x123dec 0x1225ec 0x349
HeapSize 0x0 0x100f0088 0x123df0 0x1225f0 0x346
MultiByteToWideChar 0x0 0x100f008c 0x123df4 0x1225f4 0x3e2
Sleep 0x0 0x100f0090 0x123df8 0x1225f8 0x56d
GetTempPathA 0x0 0x100f0094 0x123dfc 0x1225fc 0x2ee
FormatMessageW 0x0 0x100f0098 0x123e00 0x122600 0x1a3
GetDiskFreeSpaceA 0x0 0x100f009c 0x123e04 0x122604 0x222
GetLastError 0x0 0x100f00a0 0x123e08 0x122608 0x25a
GetFileAttributesA 0x0 0x100f00a4 0x123e0c 0x12260c 0x23a
GetFileAttributesExW 0x0 0x100f00a8 0x123e10 0x122610 0x23c
OutputDebugStringW 0x0 0x100f00ac 0x123e14 0x122614 0x40c
FlushViewOfFile 0x0 0x100f00b0 0x123e18 0x122618 0x19e
CreateFileA 0x0 0x100f00b4 0x123e1c 0x12261c 0xc1
LoadLibraryA 0x0 0x100f00b8 0x123e20 0x122620 0x3b6
WaitForSingleObjectEx 0x0 0x100f00bc 0x123e24 0x122624 0x5c8
DeleteFileA 0x0 0x100f00c0 0x123e28 0x122628 0x10f
DeleteFileW 0x0 0x100f00c4 0x123e2c 0x12262c 0x112
CloseHandle 0x0 0x100f00c8 0x123e30 0x122630 0x85
GetSystemInfo 0x0 0x100f00cc 0x123e34 0x122634 0x2dc
LoadLibraryW 0x0 0x100f00d0 0x123e38 0x122638 0x3b9
HeapCompact 0x0 0x100f00d4 0x123e3c 0x12263c 0x33e
HeapDestroy 0x0 0x100f00d8 0x123e40 0x122640 0x340
UnlockFile 0x0 0x100f00dc 0x123e44 0x122644 0x59e
GetProcAddress 0x0 0x100f00e0 0x123e48 0x122648 0x2a7
CreateFileMappingA 0x0 0x100f00e4 0x123e4c 0x12264c 0xc2
LocalFree 0x0 0x100f00e8 0x123e50 0x122650 0x3c3
LockFileEx 0x0 0x100f00ec 0x123e54 0x122654 0x3cd
GetFileSize 0x0 0x100f00f0 0x123e58 0x122658 0x245
DeleteCriticalSection 0x0 0x100f00f4 0x123e5c 0x12265c 0x10d
GetCurrentProcessId 0x0 0x100f00f8 0x123e60 0x122660 0x214
GetProcessHeap 0x0 0x100f00fc 0x123e64 0x122664 0x2ad
SystemTimeToFileTime 0x0 0x100f0100 0x123e68 0x122668 0x578
ReadFile 0x0 0x100f0104 0x123e6c 0x12266c 0x465
WideCharToMultiByte 0x0 0x100f0108 0x123e70 0x122670 0x5f1
GetSystemTimeAsFileTime 0x0 0x100f010c 0x123e74 0x122674 0x2e2
GetSystemTime 0x0 0x100f0110 0x123e78 0x122678 0x2e0
FormatMessageA 0x0 0x100f0114 0x123e7c 0x12267c 0x1a2
CreateFileMappingW 0x0 0x100f0118 0x123e80 0x122680 0xc6
MapViewOfFile 0x0 0x100f011c 0x123e84 0x122684 0x3d1
QueryPerformanceCounter 0x0 0x100f0120 0x123e88 0x122688 0x440
GetTickCount 0x0 0x100f0124 0x123e8c 0x12268c 0x300
FlushFileBuffers 0x0 0x100f0128 0x123e90 0x122690 0x19b
CreatePipe 0x0 0x100f012c 0x123e94 0x122694 0xdb
GetStdHandle 0x0 0x100f0130 0x123e98 0x122698 0x2cb
DebugBreak 0x0 0x100f0134 0x123e9c 0x12269c 0x103
GetModuleFileNameW 0x0 0x100f0138 0x123ea0 0x1226a0 0x26d
GetModuleHandleA 0x0 0x100f013c 0x123ea4 0x1226a4 0x26e
GetModuleHandleW 0x0 0x100f0140 0x123ea8 0x1226a8 0x271
LoadLibraryExW 0x0 0x100f0144 0x123eac 0x1226ac 0x3b8
GetThreadContext 0x0 0x100f0148 0x123eb0 0x1226b0 0x2f0
TerminateProcess 0x0 0x100f014c 0x123eb4 0x1226b4 0x57c
GetVersionExA 0x0 0x100f0150 0x123eb8 0x1226b8 0x312
GetEnvironmentStrings 0x0 0x100f0154 0x123ebc 0x1226bc 0x22f
CreateProcessA 0x0 0x100f0158 0x123ec0 0x1226c0 0xde
FreeEnvironmentStringsA 0x0 0x100f015c 0x123ec4 0x1226c4 0x1a5
GetExitCodeProcess 0x0 0x100f0160 0x123ec8 0x1226c8 0x236
GetCurrentProcess 0x0 0x100f0164 0x123ecc 0x1226cc 0x213
ReleaseSemaphore 0x0 0x100f0168 0x123ed0 0x1226d0 0x4a6
CreateSemaphoreA 0x0 0x100f016c 0x123ed4 0x1226d4 0xe6
OpenSemaphoreA 0x0 0x100f0170 0x123ed8 0x1226d8 0x403
DuplicateHandle 0x0 0x100f0174 0x123edc 0x1226dc 0x128
OpenFileMappingA 0x0 0x100f0178 0x123ee0 0x1226e0 0x3f7
InitializeCriticalSectionAndSpinCount 0x0 0x100f017c 0x123ee4 0x1226e4 0x356
TlsGetValue 0x0 0x100f0180 0x123ee8 0x1226e8 0x590
MoveFileA 0x0 0x100f0184 0x123eec 0x1226ec 0x3d9
GetFileAttributesExA 0x0 0x100f0188 0x123ef0 0x1226f0 0x23b
SetHandleInformation 0x0 0x100f018c 0x123ef4 0x1226f4 0x51f
FindFirstFileA 0x0 0x100f0190 0x123ef8 0x1226f8 0x175
GetHandleInformation 0x0 0x100f0194 0x123efc 0x1226fc 0x257
FindNextFileA 0x0 0x100f0198 0x123f00 0x122700 0x186
FindClose 0x0 0x100f019c 0x123f04 0x122704 0x171
GetFileInformationByHandle 0x0 0x100f01a0 0x123f08 0x122708 0x241
RemoveDirectoryA 0x0 0x100f01a4 0x123f0c 0x12270c 0x4a8
CreateDirectoryA 0x0 0x100f01a8 0x123f10 0x122710 0xb3
TlsSetValue 0x0 0x100f01ac 0x123f14 0x122714 0x591
SetThreadPriority 0x0 0x100f01b0 0x123f18 0x122718 0x54f
SuspendThread 0x0 0x100f01b4 0x123f1c 0x12271c 0x575
ResumeThread 0x0 0x100f01b8 0x123f20 0x122720 0x4be
GetCurrentThread 0x0 0x100f01bc 0x123f24 0x122724 0x217
TlsAlloc 0x0 0x100f01c0 0x123f28 0x122728 0x58e
RaiseException 0x0 0x100f01c4 0x123f2c 0x12272c 0x455
TlsFree 0x0 0x100f01c8 0x123f30 0x122730 0x58f
IsDebuggerPresent 0x0 0x100f01cc 0x123f34 0x122734 0x376
GlobalMemoryStatusEx 0x0 0x100f01d0 0x123f38 0x122738 0x332
MoveFileW 0x0 0x100f01d4 0x123f3c 0x12273c 0x3de
ReleaseMutex 0x0 0x100f01d8 0x123f40 0x122740 0x4a2
CreateMutexA 0x0 0x100f01dc 0x123f44 0x122744 0xd5
AreFileApisANSI 0x0 0x100f01e0 0x123f48 0x122748 0x23
TryEnterCriticalSection 0x0 0x100f01e4 0x123f4c 0x12274c 0x597
UnhandledExceptionFilter 0x0 0x100f01e8 0x123f50 0x122750 0x59d
SetUnhandledExceptionFilter 0x0 0x100f01ec 0x123f54 0x122754 0x55e
IsProcessorFeaturePresent 0x0 0x100f01f0 0x123f58 0x122758 0x37d
InitializeSListHead 0x0 0x100f01f4 0x123f5c 0x12275c 0x35a
FreeLibrary 0x0 0x100f01f8 0x123f60 0x122760 0x1a7
WINMM.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
timeGetTime 0x0 0x100f022c 0x123f94 0x122794 0x94
WSOCK32.dll (30)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
shutdown 0x16 0x100f0234 0x123f9c 0x12279c -
closesocket 0x3 0x100f0238 0x123fa0 0x1227a0 -
bind 0x2 0x100f023c 0x123fa4 0x1227a4 -
accept 0x1 0x100f0240 0x123fa8 0x1227a8 -
WSACleanup 0x74 0x100f0244 0x123fac 0x1227ac -
htons 0x9 0x100f0248 0x123fb0 0x1227b0 -
getprotobyname 0x35 0x100f024c 0x123fb4 0x1227b4 -
send 0x13 0x100f0250 0x123fb8 0x1227b8 -
getpeername 0x5 0x100f0254 0x123fbc 0x1227bc -
ntohl 0xe 0x100f0258 0x123fc0 0x1227c0 -
gethostbyname 0x34 0x100f025c 0x123fc4 0x1227c4 -
socket 0x17 0x100f0260 0x123fc8 0x1227c8 -
gethostname 0x39 0x100f0264 0x123fcc 0x1227cc -
ntohs 0xf 0x100f0268 0x123fd0 0x1227d0 -
getsockopt 0x7 0x100f026c 0x123fd4 0x1227d4 -
WSAGetLastError 0x6f 0x100f0270 0x123fd8 0x1227d8 -
htonl 0x8 0x100f0274 0x123fdc 0x1227dc -
listen 0xd 0x100f0278 0x123fe0 0x1227e0 -
getprotobynumber 0x36 0x100f027c 0x123fe4 0x1227e4 -
connect 0x4 0x100f0280 0x123fe8 0x1227e8 -
recvfrom 0x11 0x100f0284 0x123fec 0x1227ec -
recv 0x10 0x100f0288 0x123ff0 0x1227f0 -
sendto 0x14 0x100f028c 0x123ff4 0x1227f4 -
inet_ntoa 0xc 0x100f0290 0x123ff8 0x1227f8 -
getsockname 0x6 0x100f0294 0x123ffc 0x1227fc -
setsockopt 0x15 0x100f0298 0x124000 0x122800 -
WSAStartup 0x73 0x100f029c 0x124004 0x122804 -
__WSAFDIsSet 0x97 0x100f02a0 0x124008 0x122808 -
gethostbyaddr 0x33 0x100f02a4 0x12400c 0x12280c -
select 0x12 0x100f02a8 0x124010 0x122810 -
ADVAPI32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetTokenInformation 0x0 0x100f0000 0x123d68 0x122568 0x16f
AddAccessAllowedAce 0x0 0x100f0004 0x123d6c 0x12256c 0x10
GetLengthSid 0x0 0x100f0008 0x123d70 0x122570 0x14a
InitializeAcl 0x0 0x100f000c 0x123d74 0x122574 0x18d
InitializeSecurityDescriptor 0x0 0x100f0010 0x123d78 0x122578 0x18e
FreeSid 0x0 0x100f0014 0x123d7c 0x12257c 0x133
SetSecurityDescriptorDacl 0x0 0x100f0018 0x123d80 0x122580 0x2e4
SetSecurityDescriptorOwner 0x0 0x100f001c 0x123d84 0x122584 0x2e6
AllocateAndInitializeSid 0x0 0x100f0020 0x123d88 0x122588 0x20
CopySid 0x0 0x100f0024 0x123d8c 0x12258c 0x85
OpenProcessToken 0x0 0x100f0028 0x123d90 0x122590 0x214
SetSecurityDescriptorGroup 0x0 0x100f002c 0x123d94 0x122594 0x2e5
VCRUNTIME140.dll (10)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strchr 0x0 0x100f0200 0x123f68 0x122768 0x4a
memchr 0x0 0x100f0204 0x123f6c 0x12276c 0x44
memmove 0x0 0x100f0208 0x123f70 0x122770 0x47
__std_type_info_destroy_list 0x0 0x100f020c 0x123f74 0x122774 0x25
_except_handler4_common 0x0 0x100f0210 0x123f78 0x122778 0x35
memcmp 0x0 0x100f0214 0x123f7c 0x12277c 0x45
memset 0x0 0x100f0218 0x123f80 0x122780 0x48
strrchr 0x0 0x100f021c 0x123f84 0x122784 0x4b
memcpy 0x0 0x100f0220 0x123f88 0x122788 0x46
strstr 0x0 0x100f0224 0x123f8c 0x12278c 0x4c
api-ms-win-crt-runtime-l1-1-0.dll (16)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_configure_narrow_argv 0x0 0x100f02f8 0x124060 0x122860 0x19
_seh_filter_dll 0x0 0x100f02fc 0x124064 0x122864 0x41
_initterm_e 0x0 0x100f0300 0x124068 0x122868 0x39
abort 0x0 0x100f0304 0x12406c 0x12286c 0x57
_initterm 0x0 0x100f0308 0x124070 0x122870 0x38
_initialize_onexit_table 0x0 0x100f030c 0x124074 0x122874 0x36
_getpid 0x0 0x100f0310 0x124078 0x122878 0x34
_execute_onexit_table 0x0 0x100f0314 0x12407c 0x12287c 0x24
_beginthreadex 0x0 0x100f0318 0x124080 0x122880 0x15
_cexit 0x0 0x100f031c 0x124084 0x122884 0x17
_endthreadex 0x0 0x100f0320 0x124088 0x122888 0x22
_initialize_narrow_environment 0x0 0x100f0324 0x12408c 0x12288c 0x35
_errno 0x0 0x100f0328 0x124090 0x122890 0x23
_exit 0x0 0x100f032c 0x124094 0x122894 0x25
__fpe_flt_rounds 0x0 0x100f0330 0x124098 0x122898 0x3
strerror 0x0 0x100f0334 0x12409c 0x12289c 0x67
api-ms-win-crt-time-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_time64 0x0 0x100f03b0 0x124118 0x122918 0x30
_mktime64 0x0 0x100f03b4 0x12411c 0x12291c 0x28
_localtime64_s 0x0 0x100f03b8 0x124120 0x122920 0x24
strftime 0x0 0x100f03bc 0x124124 0x122924 0x46
api-ms-win-crt-utility-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
qsort 0x0 0x100f03c4 0x12412c 0x12292c 0x19
api-ms-win-crt-string-l1-1-0.dll (11)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strncmp 0x0 0x100f0380 0x1240e8 0x1228e8 0x8e
tolower 0x0 0x100f0384 0x1240ec 0x1228ec 0x97
isdigit 0x0 0x100f0388 0x1240f0 0x1228f0 0x68
strpbrk 0x0 0x100f038c 0x1240f4 0x1228f4 0x92
_stricmp 0x0 0x100f0390 0x1240f8 0x1228f8 0x2a
toupper 0x0 0x100f0394 0x1240fc 0x1228fc 0x98
isalnum 0x0 0x100f0398 0x124100 0x122900 0x64
strcmp 0x0 0x100f039c 0x124104 0x122904 0x86
strncpy 0x0 0x100f03a0 0x124108 0x122908 0x8f
isalpha 0x0 0x100f03a4 0x12410c 0x12290c 0x65
isspace 0x0 0x100f03a8 0x124110 0x122910 0x6e
api-ms-win-crt-convert-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
atoi 0x0 0x100f02b0 0x124018 0x122818 0x50
strtol 0x0 0x100f02b4 0x12401c 0x12281c 0x61
strtoul 0x0 0x100f02b8 0x124020 0x122820 0x64
api-ms-win-crt-stdio-l1-1-0.dll (16)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_close 0x0 0x100f033c 0x1240a4 0x1228a4 0x17
__acrt_iob_func 0x0 0x100f0340 0x1240a8 0x1228a8 0x0
fflush 0x0 0x100f0344 0x1240ac 0x1228ac 0x77
fclose 0x0 0x100f0348 0x1240b0 0x1228b0 0x74
__stdio_common_vfprintf 0x0 0x100f034c 0x1240b4 0x1228b4 0x3
fwrite 0x0 0x100f0350 0x1240b8 0x1228b8 0x8a
_wfopen 0x0 0x100f0354 0x1240bc 0x1228bc 0x62
setvbuf 0x0 0x100f0358 0x1240c0 0x1228c0 0x98
feof 0x0 0x100f035c 0x1240c4 0x1228c4 0x75
fgets 0x0 0x100f0360 0x1240c8 0x1228c8 0x7a
fputs 0x0 0x100f0364 0x1240cc 0x1228cc 0x80
__stdio_common_vsscanf 0x0 0x100f0368 0x1240d0 0x1228d0 0x10
_wopen 0x0 0x100f036c 0x1240d4 0x1228d4 0x69
fopen 0x0 0x100f0370 0x1240d8 0x1228d8 0x7d
__stdio_common_vsprintf 0x0 0x100f0374 0x1240dc 0x1228dc 0xd
ftell 0x0 0x100f0378 0x1240e0 0x1228e0 0x89
api-ms-win-crt-environment-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_putenv 0x0 0x100f02c0 0x124028 0x122828 0x3
getenv 0x0 0x100f02c4 0x12402c 0x12282c 0x10
__p__environ 0x0 0x100f02c8 0x124030 0x122830 0x0
api-ms-win-crt-multibyte-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_mbsinc 0x0 0x100f02ec 0x124054 0x122854 0x6f
_mbsdec 0x0 0x100f02f0 0x124058 0x122858 0x68
api-ms-win-crt-filesystem-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_waccess 0x0 0x100f02d0 0x124038 0x122838 0x25
_wstat64i32 0x0 0x100f02d4 0x12403c 0x12283c 0x3d
_access 0x0 0x100f02d8 0x124040 0x122840 0x0
api-ms-win-crt-math-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_fdopen 0x0 0x100f02e0 0x124048 0x122848 0x46
_except1 0x0 0x100f02e4 0x12404c 0x12284c 0x40
Exports (1329)
»
Api name EAT Address Ordinal
ATOB_AsciiToData 0x914fa 0x1
ATOB_AsciiToData_Util 0xb8526 0x2
ATOB_ConvertAsciiToItem_Util 0xb856a 0x3
BTOA_ConvertItemToAscii_Util 0xb89fe 0x4
BTOA_DataToAscii 0x91503 0x5
BTOA_DataToAscii_Util 0xb8a13 0x6
CERT_AddCertToListHead 0x7fcd6 0x7
CERT_AddCertToListTail 0x7fdab 0x8
CERT_AddExtension 0x82011 0x9
CERT_AddExtensionByOID 0x8203d 0xa
CERT_AsciiToName 0x7e9d1 0xb
CERT_CacheOCSPResponseFromSideChannel 0x899e3 0xc
CERT_CertChainFromCert 0x873da 0xd
CERT_CertListFromCert 0x875ac 0xe
CERT_CertificateRequestTemplate 0xf18d0 0xf
CERT_CertificateTemplate 0xf0998 0x10
CERT_ChangeCertTrust 0x85f24 0x11
CERT_CheckCertUsage 0x81de5 0x12
CERT_CheckCertValidTimes 0x7fdff 0x13
CERT_CheckNameSpace 0x8401f 0x14
CERT_ClearOCSPCache 0x89bd4 0x15
CERT_CompareCerts 0x7ff4c 0x16
CERT_CompareName 0x85762 0x17
CERT_ConvertAndDecodeCertificate 0xc6633 0x18
CERT_CopyName 0x85885 0x19
CERT_CopyRDN 0x85921 0x1a
CERT_CreateCertificate 0x87e2a 0x1b
CERT_CreateCertificateRequest 0x87f11 0x1c
CERT_CreateSubjectCertList 0x85f48 0x1d
CERT_CreateValidity 0x7ffad 0x1e
CERT_CrlTemplate 0xf0d50 0x1f
CERT_DecodeAVAValue 0x85b25 0x20
CERT_DecodeAltNameExtension 0x87198 0x21
CERT_DecodeAuthInfoAccessExtension 0x871fc 0x22
CERT_DecodeAuthKeyID 0x86f2d 0x23
CERT_DecodeBasicConstraintValue 0x87022 0x24
CERT_DecodeCRLDistributionPoints 0x8cd6f 0x25
CERT_DecodeCertFromPackage 0xc6679 0x26
CERT_DecodeCertPackage 0xc66d5 0x27
CERT_DecodeCertificatePoliciesExtension 0x851f4 0x28
CERT_DecodeNameConstraintsExtension 0x87286 0x29
CERT_DecodeOidSequence 0x852a4 0x2a
CERT_DecodePrivKeyUsagePeriodExtension 0x8728f 0x2b
CERT_DecodeTrustString 0x8020e 0x2c
CERT_DecodeUserNotice 0x85310 0x2d
CERT_DerNameToAscii 0x7e9f0 0x2e
CERT_DestroyCertArray 0x8030b 0x2f
CERT_DestroyCertList 0x8033e 0x30
CERT_DestroyCertificate 0x86038 0x31
CERT_DestroyCertificateList 0x87624 0x32
CERT_DestroyCertificatePoliciesExtension 0x8539c 0x33
CERT_DestroyCertificateRequest 0x80376 0x34
CERT_DestroyName 0x85cd3 0x35
CERT_DestroyOidSequence 0x8539c 0x36
CERT_DestroyUserNotice 0x8539c 0x37
CERT_DestroyValidity 0x80376 0x38
CERT_DisableOCSPChecking 0x89dbe 0x39
CERT_DisableOCSPDefaultResponder 0x89e15 0x3a
CERT_DupCertificate 0x80392 0x3b
CERT_EnableOCSPChecking 0x89e67 0x3c
CERT_EncodeAltNameExtension 0x872e4 0x3d
CERT_EncodeAndAddBitStrExtension 0x820de 0x3e
CERT_EncodeAuthKeyID 0x86fc1 0x3f
CERT_EncodeBasicConstraintValue 0x870d3 0x40
CERT_EncodeCRLDistributionPoints 0x8ce9d 0x41
CERT_EncodeCertPoliciesExtension 0x853b3 0x42
CERT_EncodeInfoAccessExtension 0x8731f 0x43
CERT_EncodeInhibitAnyExtension 0x853eb 0x44
CERT_EncodeNameConstraintsExtension 0x87386 0x45
CERT_EncodeNoticeReference 0x85423 0x46
CERT_EncodePolicyConstraintsExtension 0x8545b 0x47
CERT_EncodePolicyMappingExtension 0x85493 0x48
CERT_EncodeSubjectKeyID 0x8739c 0x49
CERT_EncodeUserNotice 0x854cb 0x4a
CERT_ExtractPublicKey 0x8d499 0x4b
CERT_FilterCertListByCANames 0x881e4 0x4c
CERT_FilterCertListByUsage 0x803b0 0x4d
CERT_FilterCertListForUserCerts 0x80458 0x4e
CERT_FindCertByDERCert 0x86066 0x4f
CERT_FindCertByIssuerAndSN 0x860ac 0x50
CERT_FindCertByName 0x860c1 0x51
CERT_FindCertByNickname 0x8616e 0x52
CERT_FindCertByNicknameOrEmailAddr 0x86202 0x53
CERT_FindCertByNicknameOrEmailAddrCX 0x8621b 0x54
CERT_FindCertExtension 0x81ee9 0x55
CERT_FindCertIssuer 0x882e4 0x56
CERT_FindKeyUsageExtension 0x81f05 0x57
CERT_FindUserCertByUsage 0x8778e 0x58
CERT_FindUserCertsByUsage 0x8788d 0x59
CERT_FinishCertificateRequestAttributes 0x88083 0x5a
CERT_FinishExtensions 0x82203 0x5b
CERT_ForcePostMethodForOCSP 0x89ee8 0x5c
CERT_FreeNicknames 0xbcef2 0x5d
CERT_GenTime2FormattedAscii_Util 0xbf3f5 0x5e
CERT_GetCertChainFromCert 0x883c2 0x5f
CERT_GetCertEmailAddress 0x7ea43 0x60
CERT_GetCertTimes 0x8057f 0x61
CERT_GetCertTrust 0x8630e 0x62
CERT_GetCertificateRequestExtensions 0x88161 0x63
CERT_GetCommonName 0x7ea87 0x64
CERT_GetConstrainedCertificateNames 0x8452e 0x65
CERT_GetCountryName 0x7eae9 0x66
CERT_GetDefaultCertDB 0x805d3 0x67
CERT_GetFirstEmailAddress 0x7eb11 0x68
CERT_GetGeneralNameTypeFromString 0x846b1 0x69
CERT_GetImposedNameConstraints 0x846e0 0x6a
CERT_GetLocalityName 0x7eb2e 0x6b
CERT_GetNextEmailAddress 0x7eba4 0x6c
CERT_GetNextGeneralName 0x847e7 0x6d
CERT_GetNextNameConstraint 0x847f5 0x6e
CERT_GetOCSPAuthorityInfoAccessLocation 0x89f24 0x6f
CERT_GetOidString 0x7ebd0 0x70
CERT_GetOrgName 0x7ef36 0x71
CERT_GetOrgUnitName 0x7ef4a 0x72
CERT_GetStateName 0x7ef5e 0x73
CERT_Hexify 0x87dab 0x74
CERT_ImportCerts 0x805d9 0x75
CERT_IsCACert 0x80713 0x76
CERT_IsUserCert 0x80894 0x77
CERT_MakeCANickname 0x80afe 0x78
CERT_MergeExtensions 0x8225c 0x79
CERT_NameTemplate 0xf1728 0x7a
CERT_NameToAscii 0x7ef72 0x7b
CERT_NewCertList 0x80c07 0x7c
CERT_NewTempCertificate 0x86541 0x7d
CERT_NicknameStringsFromCertList 0x88509 0x7e
CERT_OCSPCacheSettings 0x8a103 0x7f
CERT_RFC1485_EscapeAndQuote 0x7f049 0x80
CERT_RemoveCertListNode 0x80c3e 0x81
CERT_SaveSMimeProfile 0x8676a 0x82
CERT_SequenceOfCertExtensionTemplate 0xf0b38 0x83
CERT_SetOCSPFailureMode 0x8a18a 0x84
CERT_SetOCSPTimeout 0x8a1ca 0x85
CERT_SignedCrlTemplate 0xf0df0 0x86
CERT_SignedDataTemplate 0xf25d8 0x87
CERT_StartCertExtensions 0x81fd8 0x88
CERT_StartCertificateRequestAttributes 0x881b8 0x89
CERT_SubjectPublicKeyInfoTemplate 0xf23f8 0x8a
CERT_TimeChoiceTemplate 0xf0b48 0x8b
CERT_VerifyCertificate 0x886cf 0x8c
CERT_VerifySignedDataWithPublicKeyInfo 0x88aca 0x8d
DER_AsciiToTime_Util 0xb7e0e 0x8e
DER_DecodeTimeChoice_Util 0xbf470 0x8f
DER_Encode 0x9150c 0x90
DER_EncodeTimeChoice_Util 0xbf4a9 0x91
DER_Encode_Util 0xb775e 0x92
DER_GeneralizedTimeToTime 0x91515 0x93
DER_GeneralizedTimeToTime_Util 0xb7e25 0x94
DER_GetInteger 0x9151e 0x95
DER_GetInteger_Util 0xb7bce 0x96
DER_Lengths 0x91527 0x97
DER_SetUInteger 0xb7cd6 0x98
DER_UTCTimeToTime_Util 0xb8170 0x99
DSAU_DecodeDerSigToLen 0x8d064 0x9a
DSAU_EncodeDerSigWithLen 0x8d079 0x9b
DTLS_GetHandshakeTimeout 0xcf245 0x9c
DTLS_ImportFD 0xe4d4f 0x9d
GetExecutionEnvironment 0x7c3a1 0x9e
HASH_Begin 0x8d286 0x9f
HASH_Create 0x8d297 0xa0
HASH_Destroy 0x8d2e1 0xa1
HASH_End 0x8d2fe 0xa2
HASH_GetHashObject 0x8d31a 0xa3
HASH_GetType 0x1d13b 0xa4
HASH_HashBuf 0x8d3f4 0xa5
HASH_ResultLenByOidTag 0x8d468 0xa6
HASH_Update 0x8d480 0xa7
LL_MaxInt 0x754db 0xa8
LL_MaxUint 0x754ec 0xa9
LL_MinInt 0x754e4 0xaa
LL_Zero 0x754cf 0xab
NSSBase64_EncodeItem_Util 0xb8a3a 0xac
NSSSMIME_GetVersion 0xbe5aa 0xad
NSSSSL_GetVersion 0xbe5aa 0xae
NSSUTIL_ArgDecodeNumber 0xc0a73 0xaf
NSSUTIL_ArgFetchValue 0xc0b09 0xb0
NSSUTIL_ArgGetLabel 0xc0c11 0xb1
NSSUTIL_ArgGetParamValue 0xc0cb8 0xb2
NSSUTIL_ArgHasFlag 0xc0d6e 0xb3
NSSUTIL_ArgIsBlank 0xc0ddb 0xb4
NSSUTIL_ArgParseCipherFlags 0xc0e29 0xb5
NSSUTIL_ArgParseModuleSpec 0xc0e8d 0xb6
NSSUTIL_ArgParseSlotFlags 0xc1122 0xb7
NSSUTIL_ArgParseSlotInfo 0xc11c5 0xb8
NSSUTIL_ArgReadLong 0xc12c6 0xb9
NSSUTIL_ArgSkipParameter 0xc130d 0xba
NSSUTIL_ArgStrip 0xc1343 0xbb
NSSUTIL_DoModuleDBFunction 0xbfb4a 0xbc
NSSUTIL_GetVersion 0xbe5aa 0xbd
NSSUTIL_MkModuleSpec 0xc141d 0xbe
NSSUTIL_MkNSSString 0xc1503 0xbf
NSSUTIL_MkSlotString 0xc16e3 0xc0
NSSUTIL_Quote 0xc17b5 0xc1
NSS_CMSContentInfo_GetContent 0xca1a2 0xc2
NSS_CMSContentInfo_GetContentTypeTag 0xca23f 0xc3
NSS_CMSContentInfo_SetContent_Data 0xca3ab 0xc4
NSS_CMSContentInfo_SetContent_EnvelopedData 0xca3db 0xc5
NSS_CMSContentInfo_SetContent_SignedData 0xca3f3 0xc6
NSS_CMSDecoder_Cancel 0xca861 0xc7
NSS_CMSDecoder_Finish 0xca888 0xc8
NSS_CMSDecoder_Start 0xca8c5 0xc9
NSS_CMSDecoder_Update 0xca962 0xca
NSS_CMSEncoder_Cancel 0xcb5ab 0xcb
NSS_CMSEncoder_Finish 0xcb617 0xcc
NSS_CMSEncoder_Start 0xcb6dc 0xcd
NSS_CMSEncoder_Update 0xcb81e 0xce
NSS_CMSEnvelopedData_AddRecipient 0xcbe00 0xcf
NSS_CMSEnvelopedData_Create 0xcbe4c 0xd0
NSS_CMSEnvelopedData_GetContentInfo 0xca1f7 0xd1
NSS_CMSMessage_ContentLevel 0xcc243 0xd2
NSS_CMSMessage_ContentLevelCount 0xcc262 0xd3
NSS_CMSMessage_Create 0xcc27e 0xd4
NSS_CMSMessage_CreateFromDER 0xca9f5 0xd5
NSS_CMSMessage_Destroy 0xcc317 0xd6
NSS_CMSMessage_GetContent 0xcc349 0xd7
NSS_CMSMessage_GetContentInfo 0xbec54 0xd8
NSS_CMSMessage_IsEncrypted 0xcc352 0xd9
NSS_CMSMessage_IsSigned 0xcc383 0xda
NSS_CMSRecipientInfo_Create 0xcc4f1 0xdb
NSS_CMSSignedData_AddCertList 0xccbed 0xdc
NSS_CMSSignedData_AddCertificate 0xccc24 0xdd
NSS_CMSSignedData_AddSignerInfo 0xcccf7 0xde
NSS_CMSSignedData_Create 0xccdaf 0xdf
NSS_CMSSignedData_CreateCertsOnly 0xcce06 0xe0
NSS_CMSSignedData_Destroy 0xccfd7 0xe1
NSS_CMSSignedData_GetContentInfo 0xcd47f 0xe2
NSS_CMSSignedData_GetSignerInfo 0xcd4f3 0xe3
NSS_CMSSignedData_ImportCerts 0xcd517 0xe4
NSS_CMSSignedData_SetDigestValue 0xcd71c 0xe5
NSS_CMSSignedData_SignerInfoCount 0xcd7f7 0xe6
NSS_CMSSignedData_VerifySignerInfo 0xcd81a 0xe7
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs 0xcd8a4 0xe8
NSS_CMSSignerInfo_AddSMIMECaps 0xcd94b 0xe9
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs 0xcd9bf 0xea
NSS_CMSSignerInfo_AddSigningTime 0xcda66 0xeb
NSS_CMSSignerInfo_Create 0xcdae9 0xec
NSS_CMSSignerInfo_GetSignerCommonName 0xcdb8a 0xed
NSS_CMSSignerInfo_GetSignerEmailAddress 0xcdba7 0xee
NSS_CMSSignerInfo_GetSigningCertificate 0xcdbd0 0xef
NSS_CMSSignerInfo_IncludeCerts 0xcdc95 0xf0
NSS_CMSSignerInfo_Verify 0xcdf28 0xf1
NSS_FindCertKEAType 0xdf99d 0xf2
NSS_GetAlgorithmPolicy 0xbe5b0 0xf3
NSS_GetVersion 0xbe5aa 0xf4
NSS_Get_CERT_CertificateRequestTemplate 0x881d0 0xf5
NSS_Get_CERT_CertificateTemplate 0x80f7e 0xf6
NSS_Get_CERT_CrlTemplate 0x83760 0xf7
NSS_Get_CERT_NameTemplate 0x85d31 0xf8
NSS_Get_CERT_SequenceOfCertExtensionTemplate 0x80f84 0xf9
NSS_Get_CERT_SignedCrlTemplate 0x83772 0xfa
NSS_Get_CERT_SignedDataTemplate 0x8eca1 0xfb
NSS_Get_CERT_SubjectPublicKeyInfoTemplate 0x8d4c6 0xfc
NSS_Get_CERT_TimeChoiceTemplate 0x7fc7c 0xfd
NSS_Get_SECKEY_RSAPSSParamsTemplate 0x8d4cc 0xfe
NSS_Get_SECOID_AlgorithmIDTemplate 0x91530 0xff
NSS_Get_SECOID_AlgorithmIDTemplate_Util 0xbf4ee 0x100
NSS_Get_SEC_AnyTemplate_Util 0xbf4f4 0x101
NSS_Get_SEC_BMPStringTemplate 0x91536 0x102
NSS_Get_SEC_BitStringTemplate 0x9153c 0x103
NSS_Get_SEC_BitStringTemplate_Util 0xbf500 0x104
NSS_Get_SEC_BooleanTemplate_Util 0xbf506 0x105
NSS_Get_SEC_GeneralizedTimeTemplate_Util 0xbf50c 0x106
NSS_Get_SEC_IA5StringTemplate 0x91542 0x107
NSS_Get_SEC_IA5StringTemplate_Util 0xbf512 0x108
NSS_Get_SEC_IntegerTemplate 0x91548 0x109
NSS_Get_SEC_IntegerTemplate_Util 0xbf518 0x10a
NSS_Get_SEC_NullTemplate_Util 0xbf51e 0x10b
NSS_Get_SEC_ObjectIDTemplate_Util 0xbf524 0x10c
NSS_Get_SEC_OctetStringTemplate 0x9154e 0x10d
NSS_Get_SEC_OctetStringTemplate_Util 0xbf52a 0x10e
NSS_Get_SEC_SignedCertificateTemplate 0x80f8a 0x10f
NSS_Get_SEC_UTF8StringTemplate 0x91554 0x110
NSS_Get_SEC_UTF8StringTemplate_Util 0xbf542 0x111
NSS_Init 0x90391 0x112
NSS_InitWithMerge 0x903c1 0x113
NSS_Initialize 0x90435 0x114
NSS_IsInitialized 0x904a4 0x115
NSS_NoDB_Init 0x904bd 0x116
NSS_OptionGet 0x913f0 0x117
NSS_OptionSet 0x9146f 0x118
NSS_SMIMESignerInfo_SaveSMIMEProfile 0xce1ab 0x119
NSS_SMIMEUtil_FindBulkAlgForRecipients 0xcea3e 0x11a
NSS_SecureMemcmp 0xbec97 0x11b
NSS_SecureMemcmpZero 0xbecc0 0x11c
NSS_SetAlgorithmPolicy 0xbe5e3 0x11d
NSS_SetDomesticPolicy 0xe4d64 0x11e
NSS_Shutdown 0x9061c 0x11f
NSS_VersionCheck 0x90698 0x120
PK11SDR_Decrypt 0xb089d 0x121
PK11SDR_Encrypt 0xb0a9b 0x122
PK11_AlgtagToMechanism 0xa7559 0x123
PK11_Authenticate 0x9d0d8 0x124
PK11_ChangePW 0x9d114 0x125
PK11_CheckUserPassword 0x9d1dd 0x126
PK11_CipherOp 0xa0130 0x127
PK11_ConfigurePKCS11 0x907a8 0x128
PK11_CreateContextBySymKey 0xa041a 0x129
PK11_CreateDigestContext 0xa0463 0x12a
PK11_CreateGenericObject 0xab6af 0x12b
PK11_CreateMergeLog 0xa94a6 0x12c
PK11_CreatePBEV2AlgorithmID 0xaefe4 0x12d
PK11_DEREncodePublicKey 0x9a9d9 0x12e
PK11_Decrypt 0xab760 0x12f
PK11_DeleteTokenCertAndKey 0x9da15 0x130
PK11_DeleteTokenPrivateKey 0x9a9e2 0x131
PK11_DeleteTokenPublicKey 0x9aa29 0x132
PK11_Derive 0xb0f35 0x133
PK11_DeriveWithTemplate 0xb0fd0 0x134
PK11_DestroyContext 0xa04c5 0x135
PK11_DestroyGenericObject 0xab863 0x136
PK11_DestroyMergeLog 0xa94e1 0x137
PK11_DestroyObject 0xab8a3 0x138
PK11_DestroyTokenObject 0xab8d1 0x139
PK11_DigestBegin 0xa053c 0x13a
PK11_DigestFinal 0xa059b 0x13b
PK11_DigestOp 0xa07cb 0x13c
PK11_DoesMechanism 0xb3fac 0x13d
PK11_Encrypt 0xab928 0x13e
PK11_ExportDERPrivateKeyInfo 0xafd90 0x13f
PK11_ExportEncryptedPrivKeyInfo 0x9aa54 0x140
PK11_ExtractKeyValue 0xb1327 0x141
PK11_FindCertFromNickname 0x9de7f 0x142
PK11_FindCertInSlot 0x9dec3 0x143
PK11_FindCertsFromEmailAddress 0x9df25 0x144
PK11_FindCertsFromNickname 0x9df9e 0x145
PK11_FindKeyByAnyCert 0x9e019 0x146
PK11_FindKeyByDERCert 0x9e0c0 0x147
PK11_FindKeyByKeyID 0x9b0e0 0x148
PK11_FindSlotByName 0xb403c 0x149
PK11_FindSlotsByNames 0xb4152 0x14a
PK11_FreeSlot 0xb4370 0x14b
PK11_FreeSlotList 0xb4389 0x14c
PK11_FreeSlotListElement 0xb439b 0x14d
PK11_FreeSymKey 0xb141c 0x14e
PK11_GenerateKeyPair 0x9b10b 0x14f
PK11_GenerateKeyPairWithFlags 0x9b140 0x150
PK11_GenerateKeyPairWithOpFlags 0x9b163 0x151
PK11_GenerateRandom 0xb43f8 0x152
PK11_GenerateRandomOnSlot 0xb4433 0x153
PK11_GetAllSlotsForCert 0x9e28f 0x154
PK11_GetAllTokens 0xb4488 0x155
PK11_GetBestSlot 0xb4675 0x156
PK11_GetBestSlotMultiple 0xb468f 0x157
PK11_GetBlockSize 0xa75d1 0x158
PK11_GetCertFromPrivateKey 0x9e34c 0x159
PK11_GetDefaultArray 0xb48a6 0x15a
PK11_GetDefaultFlags 0xb48bd 0x15b
PK11_GetDisabledReason 0xb48c8 0x15c
PK11_GetFirstSafe 0xb48d3 0x15d
PK11_GetIVLength 0xa7833 0x15e
PK11_GetInternalKeySlot 0xb48fe 0x15f
PK11_GetInternalSlot 0xb4933 0x160
PK11_GetKeyData 0xb153e 0x161
PK11_GetKeyGen 0xa7a63 0x162
PK11_GetLowLevelKeyIDForPrivateKey 0x9bda0 0x163
PK11_GetMechanism 0xb1677 0x164
PK11_GetModInfo 0xb6180 0x165
PK11_GetModuleURI 0xb61b7 0x166
PK11_GetNextSafe 0xb4a78 0x167
PK11_GetNextSymKey 0xb1681 0x168
PK11_GetPadMechanism 0xa836c 0x169
PK11_GetPrivateKeyNickname 0x9bdb5 0x16a
PK11_GetPrivateModulusLen 0x9bdca 0x16b
PK11_GetSlotID 0xb16ba 0x16c
PK11_GetSlotInfo 0xb4b42 0x16d
PK11_GetSlotName 0xb4d95 0x16e
PK11_GetSlotSeries 0xb4da2 0x16f
PK11_GetSymKeyNickname 0xb16a5 0x170
PK11_GetTokenInfo 0xb4db1 0x171
PK11_GetTokenName 0xb4e59 0x172
PK11_GetTokenURI 0xb4e66 0x173
PK11_HasAttributeSet 0xabbdf 0x174
PK11_HasRootCerts 0xb4fa0 0x175
PK11_HashBuf 0xa094a 0x176
PK11_ImportCRL 0xaaed3 0x177
PK11_ImportCert 0x9e3df 0x178
PK11_ImportCertForKey 0x9e615 0x179
PK11_ImportDERPrivateKeyInfoAndReturnKey 0xb0620 0x17a
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey 0x9be8c 0x17b
PK11_ImportPublicKey 0x9c0c9 0x17c
PK11_ImportSymKey 0xb1704 0x17d
PK11_InitPin 0x9d48d 0x17e
PK11_IsDisabled 0xb5553 0x17f
PK11_IsFIPS 0xb62bf 0x180
PK11_IsFriendly 0xb555e 0x181
PK11_IsHW 0xb5579 0x182
PK11_IsInternal 0x7c3a1 0x183
PK11_IsLoggedIn 0x9d5d1 0x184
PK11_IsPresent 0xb55af 0x185
PK11_IsReadOnly 0x18455 0x186
PK11_IsRemovable 0xb55c0 0x187
PK11_KeyForCertExists 0x9e80a 0x188
PK11_KeyGen 0xb1940 0x189
PK11_KeyGenWithTemplate 0xb1960 0x18a
PK11_ListCerts 0x9e8f4 0x18b
PK11_ListCertsInSlot 0x9e93a 0x18c
PK11_ListFixedKeysInSlot 0xb1b26 0x18d
PK11_ListPrivKeysInSlot 0x9c57d 0x18e
PK11_ListPrivateKeysInSlot 0x9c66a 0x18f
PK11_LoadPrivKey 0x9c69c 0x190
PK11_Logout 0x9d730 0x191
PK11_LogoutAll 0x9d775 0x192
PK11_MakeIDFromPubKey 0x9c6a5 0x193
PK11_MapSignKeyType 0xa84f3 0x194
PK11_MechanismToAlgtag 0xa8520 0x195
PK11_MergeTokens 0xa94ff 0x196
PK11_NeedLogin 0x18460 0x197
PK11_NeedUserInit 0xb56cc 0x198
PK11_PBEKeyGen 0xaf044 0x199
PK11_ParamFromIV 0xa8a0e 0x19a
PK11_PrivDecrypt 0xabcd3 0x19b
PK11_PrivDecryptPKCS1 0xabd1c 0x19c
PK11_ProtectedAuthenticationPath 0x9d7c5 0x19d
PK11_PubDeriveWithKDF 0xb203a 0x19e
PK11_PubEncrypt 0xabd53 0x19f
PK11_PubEncryptPKCS1 0xabd9f 0x1a0
PK11_PubUnwrapSymKey 0xb20b2 0x1a1
PK11_PubWrapSymKey 0xb2258 0x1a2
PK11_RandomUpdate 0xb58af 0x1a3
PK11_ReadRawAttribute 0xabece 0x1a4
PK11_ReferenceSlot 0xb5a52 0x1a5
PK11_ResetToken 0xb5a5e 0x1a6
PK11_SetPasswordFunc 0x9d7d3 0x1a7
PK11_SetSymKeyNickname 0xb23a5 0x1a8
PK11_Sign 0xac007 0x1a9
PK11_SignWithMechanism 0xac02b 0x1aa
PK11_SignatureLen 0xac2bb 0x1ab
PK11_TokenKeyGenWithFlags 0xb24eb 0x1ac
PK11_UnwrapPrivKey 0xac41d 0x1ad
PK11_UnwrapSymKey 0xb2512 0x1ae
PK11_UpdateSlotAttribute 0xb5c86 0x1af
PK11_UserDisableSlot 0xb5ce3 0x1b0
PK11_UserEnableSlot 0xb5d12 0x1b1
PK11_Verify 0xac868 0x1b2
PK11_VerifyWithMechanism 0xaca0e 0x1b3
PK11_WrapPrivKey 0xacb9c 0x1b4
PK11_WrapSymKey 0xb2607 0x1b5
PL_ArenaAllocate 0x7dcfe 0x1b6
PL_ArenaFinish 0x2d55 0x1b7
PL_ArenaGrow 0x7dda2 0x1b8
PL_ArenaRelease 0x7de61 0x1b9
PL_Base64Decode 0x7d03a 0x1ba
PL_Base64Encode 0x7ce7d 0x1bb
PL_ClearArenaPool 0x7de10 0x1bc
PL_CompactArenaPool 0x2d55 0x1bd
PL_CompareStrings 0x7e46b 0x1be
PL_CompareValues 0x7e4a2 0x1bf
PL_CreateLongOptState 0x7d190 0x1c0
PL_CreateOptState 0x7d178 0x1c1
PL_DestroyOptState 0x7d242 0x1c2
PL_FPrintError 0x7d0ec 0x1c3
PL_FinishArenaPool 0x7dea4 0x1c4
PL_FreeArenaPool 0x7dea4 0x1c5
PL_GetNextOpt 0x7d262 0x1c6
PL_HashString 0x7e450 0x1c7
PL_HashTableAdd 0x7e1e4 0x1c8
PL_HashTableDestroy 0x7dfbc 0x1c9
PL_HashTableDump 0x7e447 0x1ca
PL_HashTableEnumerateEntries 0x7e3a3 0x1cb
PL_HashTableLookup 0x7e34f 0x1cc
PL_HashTableLookupConst 0x7e379 0x1cd
PL_HashTableRawAdd 0x7e0e3 0x1ce
PL_HashTableRawLookup 0x7e03a 0x1cf
PL_HashTableRawLookupConst 0x7e09a 0x1d0
PL_HashTableRawRemove 0x7e24c 0x1d1
PL_HashTableRemove 0x7e31a 0x1d2
PL_InitArenaPool 0x7dc97 0x1d3
PL_NewHashTable 0x7df10 0x1d4
PL_PrintError 0x7d152 0x1d5
PL_SizeOfArenaPoolExcludingPool 0x7deb2 0x1d6
PL_strcasecmp 0x7d422 0x1d7
PL_strcaserstr 0x7d52d 0x1d8
PL_strcasestr 0x7d4e1 0x1d9
PL_strcat 0x7d65e 0x1da
PL_strcatn 0x7d6dd 0x1db
PL_strchr 0x7d718 0x1dc
PL_strcmp 0x7d7ce 0x1dd
PL_strcpy 0x7d838 0x1de
PL_strdup 0x7d8d9 0x1df
PL_strfree 0x2cfa 0x1e0
PL_strlen 0x7d964 0x1e1
PL_strncasecmp 0x7d475 0x1e2
PL_strncaserstr 0x7d5f8 0x1e3
PL_strncasestr 0x7d593 0x1e4
PL_strncat 0x7d6a8 0x1e5
PL_strnchr 0x7d756 0x1e6
PL_strncmp 0x7d814 0x1e7
PL_strncpy 0x7d85f 0x1e8
PL_strncpyz 0x7d896 0x1e9
PL_strndup 0x7d91d 0x1ea
PL_strnlen 0x7d97e 0x1eb
PL_strnpbrk 0x7da09 0x1ec
PL_strnprbrk 0x7da48 0x1ed
PL_strnrchr 0x7d78e 0x1ee
PL_strnrstr 0x7db9f 0x1ef
PL_strnstr 0x7db32 0x1f0
PL_strpbrk 0x7d9a4 0x1f1
PL_strprbrk 0x7d9be 0x1f2
PL_strrchr 0x7d737 0x1f3
PL_strrstr 0x7dac5 0x1f4
PL_strstr 0x7da9a 0x1f5
PL_strtok_r 0x7dc0c 0x1f6
PORT_Alloc 0x9155a 0x1f7
PORT_Alloc_Util 0xbecdd 0x1f8
PORT_ArenaAlloc 0x91563 0x1f9
PORT_ArenaAlloc_Util 0xbed18 0x1fa
PORT_ArenaGrow_Util 0xbedda 0x1fb
PORT_ArenaMark_Util 0xbeef7 0x1fc
PORT_ArenaRelease_Util 0xbef30 0x1fd
PORT_ArenaStrdup 0x9156c 0x1fe
PORT_ArenaStrdup_Util 0xbef45 0x1ff
PORT_ArenaUnmark_Util 0x2d55 0x200
PORT_ArenaZAlloc 0x91575 0x201
PORT_ArenaZAlloc_Util 0xbef80 0x202
PORT_DestroyCheapArena 0xbefc8 0x203
PORT_Free 0x9157e 0x204
PORT_FreeArena 0x91583 0x205
PORT_FreeArena_Util 0xbeff2 0x206
PORT_Free_Util 0xbf076 0x207
PORT_GetError 0x91588 0x208
PORT_GetError_Util 0xbf088 0x209
PORT_InitCheapArena 0xbf097 0x20a
PORT_NewArena 0x9158d 0x20b
PORT_NewArena_Util 0xbf0b9 0x20c
PORT_Realloc_Util 0xbf11e 0x20d
PORT_RegExpSearch 0xba15f 0x20e
PORT_SetError 0x91596 0x20f
PORT_SetError_Util 0xbf155 0x210
PORT_SetUCS2_ASCIIConversionFunction 0x9159b 0x211
PORT_SetUCS2_ASCIIConversionFunction_Util 0xbf167 0x212
PORT_Strdup 0x915a0 0x213
PORT_Strdup_Util 0xbf174 0x214
PORT_UCS2_ASCIIConversion_Util 0xbf1ab 0x215
PORT_UCS2_UTF8Conversion 0x915a9 0x216
PORT_UCS2_UTF8Conversion_Util 0xbf1bc 0x217
PORT_ZAlloc 0x915b2 0x218
PORT_ZAllocAlignedOffset_Util 0xbf1e6 0x219
PORT_ZAlloc_Util 0xbf276 0x21a
PORT_ZFree_Util 0xbf2b4 0x21b
PRP_DestroyNakedCondVar 0x7a8c9 0x21c
PRP_NakedBroadcast 0x7a921 0x21d
PRP_NakedNotify 0x7a901 0x21e
PRP_NakedWait 0x7a8e5 0x21f
PRP_NewNakedCondVar 0x7a886 0x220
PRP_TryLock 0x7aaee 0x221
PR_Abort 0x694a9 0x222
PR_Accept 0x677d0 0x223
PR_AcceptRead 0x678ed 0x224
PR_Access 0x670b0 0x225
PR_AddToCounter 0x71c05 0x226
PR_AddWaitFileDesc 0x69e6f 0x227
PR_AllocFileDesc 0x675c0 0x228
PR_Assert 0x694ba 0x229
PR_AssertCurrentThreadInMonitor 0x2d55 0x22a
PR_AssertCurrentThreadOwnsLock 0x7aac6 0x22b
PR_AtomicAdd 0x7157f 0x22c
PR_AtomicDecrement 0x71560 0x22d
PR_AtomicIncrement 0x7154e 0x22e
PR_AtomicSet 0x71572 0x22f
PR_AttachSharedMemory 0x7108a 0x230
PR_AttachThread 0x7b877 0x231
PR_AttachThreadGCAble 0x711be 0x232
PR_Available 0x67753 0x233
PR_Available64 0x67762 0x234
PR_Bind 0x677e7 0x235
PR_BlockClockInterrupts 0x2d55 0x236
PR_BlockInterrupt 0x7c373 0x237
PR_CEnterMonitor 0x7c05c 0x238
PR_CExitMonitor 0x7c0aa 0x239
PR_CNotify 0x7c154 0x23a
PR_CNotifyAll 0x7c198 0x23b
PR_CSetOnMonitorRecycle 0x7c1de 0x23c
PR_CWait 0x7c10c 0x23d
PR_CallOnce 0x75097 0x23e
PR_CallOnceWithArg 0x75130 0x23f
PR_Calloc 0x6de13 0x240
PR_CancelJob 0x7954b 0x241
PR_CancelWaitFileDesc 0x6a0e8 0x242
PR_CancelWaitGroup 0x6a183 0x243
PR_CeilingLog2 0x754a5 0x244
PR_ChangeFileDescNativeHandle 0x6d0d2 0x245
PR_Cleanup 0x74a7a 0x246
PR_ClearInterrupt 0x7c366 0x247
PR_ClearThreadGCAble 0x7c42d 0x248
PR_Close 0x676e5 0x249
PR_CloseDir 0x66892 0x24a
PR_CloseFileMap 0x698e2 0x24b
PR_CloseSemaphore 0x75419 0x24c
PR_CloseSharedMemory 0x7112e 0x24d
PR_Connect 0x677a6 0x24e
PR_ConnectContinue 0x677bd 0x24f
PR_ConvertIPv4AddrToIPv6 0x76461 0x250
PR_CreateAlarm 0x713ae 0x251
PR_CreateCounter 0x71859 0x252
PR_CreateFileMap 0x697d2 0x253
PR_CreateIOLayer 0x6871d 0x254
PR_CreateIOLayerStub 0x686cb 0x255
PR_CreateMWaitEnumerator 0x6a483 0x256
PR_CreateOrderedLock 0x711be 0x257
PR_CreatePipe 0x672df 0x258
PR_CreateProcess 0x74fa0 0x259
PR_CreateProcessDetached 0x74fb5 0x25a
PR_CreateSocketPollFd 0x6c59a 0x25b
PR_CreateStack 0x71592 0x25c
PR_CreateThread 0x7b767 0x25d
PR_CreateThreadGCAble 0x7c3c7 0x25e
PR_CreateThreadPool 0x79086 0x25f
PR_CreateTrace 0x799df 0x260
PR_CreateWaitGroup 0x6a25f 0x261
PR_DecrementCounter 0x71bca 0x262
PR_Delete 0x66fdf 0x263
PR_DeleteSemaphore 0x7544b 0x264
PR_DeleteSharedMemory 0x71193 0x265
PR_DestroyAlarm 0x71437 0x266
PR_DestroyCondVar 0x7a7ec 0x267
PR_DestroyCounter 0x7198b 0x268
PR_DestroyLock 0x7aa61 0x269
PR_DestroyMWaitEnumerator 0x6a4b9 0x26a
PR_DestroyMonitor 0x7c65f 0x26b
PR_DestroyOrderedLock 0x76a1d 0x26c
PR_DestroyPollableEvent 0x676e5 0x26d
PR_DestroyProcessAttr 0x74ca4 0x26e
PR_DestroyRWLock 0x7c9f1 0x26f
PR_DestroySem 0x7cb4e 0x270
PR_DestroySocketPollFd 0x6c5f0 0x271
PR_DestroyStack 0x71626 0x272
PR_DestroyTrace 0x79b3c 0x273
PR_DestroyWaitGroup 0x6a37e 0x274
PR_DetachProcess 0x74fef 0x275
PR_DetachSharedMemory 0x710e7 0x276
PR_DetachThread 0x2d55 0x277
PR_DisableClockInterrupts 0x749c9 0x278
PR_DuplicateEnvironment 0x2d52 0x279
PR_EmulateAcceptRead 0x67973 0x27a
PR_EmulateSendFile 0x67a32 0x27b
PR_EnableClockInterrupts 0x749c9 0x27c
PR_EnterMonitor 0x7c69f 0x27d
PR_EnumerateAddrInfo 0x766c6 0x27e
PR_EnumerateHostEnt 0x75b90 0x27f
PR_EnumerateThreads 0x7bb2e 0x280
PR_EnumerateWaitGroup 0x6a4ee 0x281
PR_ErrorInstallCallback 0x746e8 0x282
PR_ErrorInstallTable 0x74695 0x283
PR_ErrorLanguages 0x7468f 0x284
PR_ErrorToName 0x74657 0x285
PR_ErrorToString 0x7450e 0x286
PR_ExitMonitor 0x7c74c 0x287
PR_ExplodeTime 0x76daf 0x288
PR_ExportFileMapAsString 0x711cf 0x289
PR_FD_CLR 0x6d111 0x28a
PR_FD_ISSET 0x6d156 0x28b
PR_FD_NCLR 0x6d19d 0x28c
PR_FD_NISSET 0x6d1f4 0x28d
PR_FD_NSET 0x6d17f 0x28e
PR_FD_SET 0x6d0fe 0x28f
PR_FD_ZERO 0x6d0e7 0x290
PR_FileDesc2NativeHandle 0x6d088 0x291
PR_FindFunctionSymbol 0x6dbe2 0x292
PR_FindFunctionSymbolAndLibrary 0x6dc6b 0x293
PR_FindNextCounterQname 0x71cd4 0x294
PR_FindNextCounterRname 0x71d1a 0x295
PR_FindNextTraceQname 0x7a0ff 0x296
PR_FindNextTraceRname 0x7a145 0x297
PR_FindSymbol 0x6dbb2 0x298
PR_FindSymbolAndLibrary 0x6dbeb 0x299
PR_FloorLog2 0x754be 0x29a
PR_FormatTime 0x78406 0x29b
PR_FormatTimeUSEnglish 0x7849d 0x29c
PR_Free 0x2cfa 0x29d
PR_FreeAddrInfo 0x766a8 0x29e
PR_FreeFileDesc 0x67615 0x29f
PR_FreeLibraryName 0x2cfa 0x2a0
PR_GMTParameters 0x774dc 0x2a1
PR_GetAddrInfoByName 0x765f2 0x2a2
PR_GetCanonNameFromAddrInfo 0x76764 0x2a3
PR_GetConnectStatus 0x6c724 0x2a4
PR_GetCounter 0x71c81 0x2a5
PR_GetCounterHandleFromName 0x71a4d 0x2a6
PR_GetCounterNameFromHandle 0x71b49 0x2a7
PR_GetCurrentThread 0x7c2f0 0x2a8
PR_GetDefaultIOMethods 0x686c5 0x2a9
PR_GetDescType 0x676d9 0x2aa
PR_GetDirectorySeparator 0x76a3b 0x2ab
PR_GetDirectorySepartor 0x76a3b 0x2ac
PR_GetEnv 0x7436c 0x2ad
PR_GetEnvSecure 0x743b6 0x2ae
PR_GetError 0x74429 0x2af
PR_GetErrorText 0x744e6 0x2b0
PR_GetErrorTextLength 0x744dd 0x2b1
PR_GetFileInfo 0x67005 0x2b2
PR_GetFileInfo64 0x6705a 0x2b3
PR_GetFileMethods 0x66ee9 0x2b4
PR_GetGCRegisters 0x76b65 0x2b5
PR_GetHostByAddr 0x75942 0x2b6
PR_GetHostByName 0x75856 0x2b7
PR_GetIPNodeByName 0x758bb 0x2b8
PR_GetIdentitiesLayer 0x68a86 0x2b9
PR_GetInheritedFD 0x74e94 0x2ba
PR_GetInheritedFileMap 0x711be 0x2bb
PR_GetLayersIdentity 0x68a70 0x2bc
PR_GetLibraryFilePathname 0x6dd29 0x2bd
PR_GetLibraryName 0x6d6c9 0x2be
PR_GetLibraryPath 0x6d648 0x2bf
PR_GetMemMapAlignment 0x6982b 0x2c0
PR_GetMonitorEntryCount 0x7c7ee 0x2c1
PR_GetNameForIdentity 0x68a1d 0x2c2
PR_GetNumberOfProcessors 0x76b05 0x2c3
PR_GetOSError 0x74432 0x2c4
PR_GetOpenFileInfo 0x67771 0x2c5
PR_GetOpenFileInfo64 0x67784 0x2c6
PR_GetPageShift 0x6de5e 0x2c7
PR_GetPageSize 0x6de72 0x2c8
PR_GetPathSeparator 0x76a3e 0x2c9
PR_GetPeerName 0x67920 0x2ca
PR_GetPhysicalMemorySize 0x76b1c 0x2cb
PR_GetPipeMethods 0x66eef 0x2cc
PR_GetProtoByName 0x75a66 0x2cd
PR_GetProtoByNumber 0x75afb 0x2ce
PR_GetRandomNoise 0x76a2c 0x2cf
PR_GetSP 0x7c393 0x2d0
PR_GetSockName 0x6790d 0x2d1
PR_GetSocketOption 0x67933 0x2d2
PR_GetSpecialFD 0x6756c 0x2d3
PR_GetStackSpaceLeft 0x76c4f 0x2d4
PR_GetSysfdTableMax 0x66fc7 0x2d5
PR_GetSystemInfo 0x76a41 0x2d6
PR_GetTCPMethods 0x6ce05 0x2d7
PR_GetThreadAffinityMask 0x2d52 0x2d8
PR_GetThreadID 0x7c2d7 0x2d9
PR_GetThreadName 0x7b9f3 0x2da
PR_GetThreadPriority 0x7c2e5 0x2db
PR_GetThreadPrivate 0x7ccff 0x2dc
PR_GetThreadScope 0x7c46c 0x2dd
PR_GetThreadState 0x7c4a9 0x2de
PR_GetThreadType 0x7c498 0x2df
PR_GetTraceEntries 0x7a4d8 0x2e0
PR_GetTraceHandleFromName 0x79fbd 0x2e1
PR_GetTraceNameFromHandle 0x7a0b9 0x2e2
PR_GetTraceOption 0x79f75 0x2e3
PR_GetUDPMethods 0x6ce0b 0x2e4
PR_GetUniqueIdentity 0x688a9 0x2e5
PR_GetVersion 0x74803 0x2e6
PR_ImplodeTime 0x76de2 0x2e7
PR_ImportFile 0x67119 0x2e8
PR_ImportFileMapFromString 0x71224 0x2e9
PR_ImportPipe 0x6715c 0x2ea
PR_ImportTCPSocket 0x6c514 0x2eb
PR_ImportUDPSocket 0x6c557 0x2ec
PR_IncrementCounter 0x71b8f 0x2ed
PR_Init 0x749d7 0x2ee
PR_Initialize 0x749e6 0x2ef
PR_InitializeNetAddr 0x75c18 0x2f0
PR_Initialized 0x74809 0x2f1
PR_Interrupt 0x7c30d 0x2f2
PR_IntervalNow 0x751d8 0x2f3
PR_IntervalToMicroseconds 0x752b4 0x2f4
PR_IntervalToMilliseconds 0x75282 0x2f5
PR_IntervalToSeconds 0x7526f 0x2f6
PR_IsNetAddrType 0x75d60 0x2f7
PR_JoinJob 0x796a1 0x2f8
PR_JoinThread 0x7b8e5 0x2f9
PR_JoinThreadPool 0x79727 0x2fa
PR_KillProcess 0x75064 0x2fb
PR_Listen 0x6780d 0x2fc
PR_LoadLibrary 0x6d7da 0x2fd
PR_LoadLibraryWithFlags 0x6d79f 0x2fe
PR_LoadStaticLibrary 0x6dc74 0x2ff
PR_LocalTimeParameters 0x7728f 0x300
PR_Lock 0x7aa7d 0x301
PR_LockFile 0x6719f 0x302
PR_LockOrderedLock 0x76a1d 0x303
PR_LogFlush 0x69421 0x304
PR_LogPrint 0x69076 0x305
PR_MakeDir 0x668e8 0x306
PR_Malloc 0x6de09 0x307
PR_MemMap 0x69842 0x308
PR_MemUnmap 0x698bc 0x309
PR_MicrosecondsToInterval 0x75248 0x30a
PR_MillisecondsToInterval 0x75221 0x30b
PR_MkDir 0x668c0 0x30c
PR_NetAddrToString 0x769ad 0x30d
PR_NewCondVar 0x7a732 0x30e
PR_NewLock 0x7a9f1 0x30f
PR_NewLogModule 0x68f3d 0x310
PR_NewMonitor 0x7c583 0x311
PR_NewNamedMonitor 0x7c64c 0x312
PR_NewPollableEvent 0x6a5cc 0x313
PR_NewProcessAttr 0x74c47 0x314
PR_NewRWLock 0x7c911 0x315
PR_NewSem 0x7caf7 0x316
PR_NewTCPSocket 0x6cef0 0x317
PR_NewTCPSocketPair 0x6cf38 0x318
PR_NewThreadPrivateIndex 0x7cbe9 0x319
PR_NewUDPSocket 0x6cf01 0x31a
PR_NormalizeTime 0x77002 0x31b
PR_Notify 0x7c8e4 0x31c
PR_NotifyAll 0x7c900 0x31d
PR_NotifyAllCondVar 0x7a85c 0x31e
PR_NotifyCondVar 0x7a832 0x31f
PR_Now 0x6df3d 0x320
PR_Open 0x66ef5 0x321
PR_OpenAnonFileMap 0x711ad 0x322
PR_OpenDir 0x6682e 0x323
PR_OpenFile 0x66f5d 0x324
PR_OpenSemaphore 0x7533c 0x325
PR_OpenSharedMemory 0x7105f 0x326
PR_OpenTCPSocket 0x6cf10 0x327
PR_OpenUDPSocket 0x6cf24 0x328
PR_ParseTimeString 0x783b5 0x329
PR_ParseTimeStringToExplodedTime 0x774e1 0x32a
PR_Poll 0x67624 0x32b
PR_PopIOLayer 0x687f9 0x32c
PR_PostSem 0x7cbba 0x32d
PR_PostSemaphore 0x753ec 0x32e
PR_ProcessAttrSetCurrentDirectory 0x74d14 0x32f
PR_ProcessAttrSetInheritableFD 0x74d77 0x330
PR_ProcessAttrSetInheritableFileMap 0x66fcd 0x331
PR_ProcessAttrSetStdioRedirect 0x74cda 0x332
PR_ProcessExit 0x74c3c 0x333
PR_PushIOLayer 0x6876c 0x334
PR_QueueJob 0x7924c 0x335
PR_QueueJob_Accept 0x793f5 0x336
PR_QueueJob_Connect 0x79413 0x337
PR_QueueJob_Read 0x793b9 0x338
PR_QueueJob_Timer 0x79475 0x339
PR_QueueJob_Write 0x793d7 0x33a
PR_RWLock_Rlock 0x7ca2c 0x33b
PR_RWLock_Unlock 0x7caa4 0x33c
PR_RWLock_Wlock 0x7ca6c 0x33d
PR_Read 0x676f4 0x33e
PR_ReadDir 0x66872 0x33f
PR_Realloc 0x6de1d 0x340
PR_RecordTraceEntries 0x7a376 0x341
PR_Recv 0x67820 0x342
PR_RecvFrom 0x6788d 0x343
PR_Rename 0x67087 0x344
PR_ResetAlarm 0x71513 0x345
PR_ResetProcessAttr 0x74c6b 0x346
PR_ResumeAll 0x7bab4 0x347
PR_RmDir 0x66915 0x348
PR_ScanStackPointers 0x76c2a 0x349
PR_SecondsToInterval 0x75213 0x34a
PR_Seek 0x67722 0x34b
PR_Seek64 0x67739 0x34c
PR_Select 0x6d2ee 0x34d
PR_Send 0x6783d 0x34e
PR_SendFile 0x67959 0x34f
PR_SendTo 0x678ad 0x350
PR_SetAlarm 0x71496 0x351
PR_SetCPUAffinityMask 0x2d52 0x352
PR_SetConcurrency 0x2d55 0x353
PR_SetCounter 0x71caa 0x354
PR_SetCurrentThreadName 0x7b97a 0x355
PR_SetEnv 0x743c6 0x356
PR_SetError 0x7443b 0x357
PR_SetErrorText 0x7445a 0x358
PR_SetFDCacheSize 0x66a69 0x359
PR_SetFDInheritable 0x67638 0x35a
PR_SetLibraryPath 0x6d5d1 0x35b
PR_SetLogBuffering 0x6902e 0x35c
PR_SetLogFile 0x68f92 0x35d
PR_SetNetAddr 0x75c94 0x35e
PR_SetPollableEvent 0x6a708 0x35f
PR_SetSocketOption 0x67946 0x360
PR_SetStdioRedirect 0x74d0f 0x361
PR_SetSysfdTableSize 0x66fcd 0x362
PR_SetThreadAffinityMask 0x2d52 0x363
PR_SetThreadDumpProc 0x7c56f 0x364
PR_SetThreadGCAble 0x7c3ee 0x365
PR_SetThreadPriority 0x7b952 0x366
PR_SetThreadPrivate 0x7cc3b 0x367
PR_SetThreadRecycleMode 0x7c3ba 0x368
PR_SetTraceOption 0x79d0d 0x369
PR_ShowStatus 0x7c505 0x36a
PR_Shutdown 0x677fa 0x36b
PR_ShutdownThreadPool 0x796f9 0x36c
PR_Sleep 0x7c23d 0x36d
PR_Socket 0x6ce35 0x36e
PR_StackPop 0x7168e 0x36f
PR_StackPush 0x71669 0x370
PR_StringToNetAddr 0x768cd 0x371
PR_SubtractFromCounter 0x71c43 0x372
PR_SuspendAll 0x7ba04 0x373
PR_Sync 0x67797 0x374
PR_SyncMemMap 0x698ff 0x375
PR_TLockFile 0x67231 0x376
PR_TestAndEnterMonitor 0x7c6fe 0x377
PR_TestAndLock 0x7aacb 0x378
PR_ThreadScanStackPointers 0x76b76 0x379
PR_TicksPerSecond 0x751f6 0x37a
PR_Trace 0x79bfe 0x37b
PR_TransmitFile 0x678cd 0x37c
PR_USPacificTimeParameters 0x773f3 0x37d
PR_UnblockClockInterrupts 0x2d55 0x37e
PR_UnblockInterrupt 0x7c383 0x37f
PR_UnloadLibrary 0x6da22 0x380
PR_Unlock 0x7aa9d 0x381
PR_UnlockFile 0x67277 0x382
PR_UnlockOrderedLock 0x66fcd 0x383
PR_VersionCheck 0x7473c 0x384
PR_Wait 0x7c829 0x385
PR_WaitCondVar 0x7a80c 0x386
PR_WaitForPollableEvent 0x6a72a 0x387
PR_WaitProcess 0x7500b 0x388
PR_WaitRecvReady 0x69f2e 0x389
PR_WaitSem 0x7cb72 0x38a
PR_WaitSemaphore 0x753ab 0x38b
PR_Write 0x6770b 0x38c
PR_Writev 0x6785a 0x38d
PR_Yield 0x7c22d 0x38e
PR_cnvtf 0x741c1 0x38f
PR_dtoa 0x740fe 0x390
PR_fprintf 0x6d49c 0x391
PR_htonl 0x764aa 0x392
PR_htonll 0x764de 0x393
PR_htons 0x7649c 0x394
PR_ntohl 0x7648e 0x395
PR_ntohll 0x764b8 0x396
PR_ntohs 0x76480 0x397
PR_smprintf 0x6b775 0x398
PR_smprintf_free 0x2cfa 0x399
PR_snprintf 0x6b80f 0x39a
PR_sprintf_append 0x6b896 0x39b
PR_sscanf 0x6c2b8 0x39c
PR_strtod 0x72649 0x39d
PR_sxprintf 0x6b67c 0x39e
PR_vfprintf 0x6d4b3 0x39f
PR_vsmprintf 0x6b788 0x3a0
PR_vsnprintf 0x6b829 0x3a1
PR_vsprintf_append 0x6b8ad 0x3a2
PR_vsxprintf 0x6b696 0x3a3
PT_FPrintStats 0x2d55 0x3a4
SECITEM_AllocArray 0xbdf16 0x3a5
SECITEM_AllocItem 0x915bb 0x3a6
SECITEM_AllocItem_Util 0xbdfe9 0x3a7
SECITEM_ArenaDupItem_Util 0xbe0a7 0x3a8
SECITEM_CompareItem_Util 0xbe126 0x3a9
SECITEM_CopyItem 0x915c4 0x3aa
SECITEM_CopyItem_Util 0xbe1b3 0x3ab
SECITEM_DupArray 0xbe218 0x3ac
SECITEM_DupItem 0x915cd 0x3ad
SECITEM_DupItem_Util 0xbe28f 0x3ae
SECITEM_FreeItem 0x915d6 0x3af
SECITEM_FreeItem_Util 0xbe2b5 0x3b0
SECITEM_HashCompare 0xbe315 0x3b1
SECITEM_ItemsAreEqual 0xbe315 0x3b2
SECITEM_ItemsAreEqual_Util 0xbe31e 0x3b3
SECITEM_ReallocItemV2 0xbe36a 0x3b4
SECITEM_ZfreeItem 0x915db 0x3b5
SECITEM_ZfreeItem_Util 0xbe411 0x3b6
SECKEY_ConvertToPublicKey 0x8d5ca 0x3b7
SECKEY_CopyPrivateKey 0x8d726 0x3b8
SECKEY_CopyPublicKey 0x8d833 0x3b9
SECKEY_CopySubjectPublicKeyInfo 0x8d9b7 0x3ba
SECKEY_CreateSubjectPublicKeyInfo 0x8db3b 0x3bb
SECKEY_DecodeDERSubjectPublicKeyInfo 0x8db7a 0x3bc
SECKEY_DestroyEncryptedPrivateKeyInfo 0x8dc00 0x3bd
SECKEY_DestroyPrivateKey 0x8dc75 0x3be
SECKEY_DestroyPrivateKeyList 0x8dd33 0x3bf
SECKEY_DestroyPublicKey 0x8dd58 0x3c0
SECKEY_DestroySubjectPublicKeyInfo 0x80376 0x3c1
SECKEY_ECParamsToBasePointOrderLen 0x8dda3 0x3c2
SECKEY_ECParamsToKeySize 0x8e059 0x3c3
SECKEY_EncodeDERSubjectPublicKeyInfo 0x8e28f 0x3c4
SECKEY_ExtractPublicKey 0x8e2c3 0x3c5
SECKEY_GetPrivateKeyType 0x7c2e5 0x3c6
SECKEY_GetPublicKeyType 0x7c2e5 0x3c7
SECKEY_ImportDERPublicKey 0x8e310 0x3c8
SECKEY_PublicKeyStrength 0x8e413 0x3c9
SECKEY_RSAPSSParamsTemplate 0xf2478 0x3ca
SECKEY_SignatureLen 0x8e4a9 0x3cb
SECMIME_DecryptionAllowed 0xc9b88 0x3cc
SECMOD_AddNewModule 0xb63cc 0x3cd
SECMOD_AddNewModuleEx 0xb63e9 0x3ce
SECMOD_CanDeleteInternalModule 0x2d52 0x3cf
SECMOD_CancelWait 0xb6519 0x3d0
SECMOD_CloseUserDB 0xb6596 0x3d1
SECMOD_CreateModule 0xad61c 0x3d2
SECMOD_DeleteInternalModule 0xb6604 0x3d3
SECMOD_DeleteModule 0xb6633 0x3d4
SECMOD_DestroyModule 0xb6797 0x3d5
SECMOD_FindModule 0xb6854 0x3d6
SECMOD_GetDeadModuleList 0xb6a0a 0x3d7
SECMOD_GetDefaultModuleList 0xb6a10 0x3d8
SECMOD_GetDefaultModuleListLock 0xb6a16 0x3d9
SECMOD_GetInternalModule 0xb6a1c 0x3da
SECMOD_GetModuleSpecList 0xad876 0x3db
SECMOD_GetReadLock 0xa143b 0x3dc
SECMOD_HasRemovableSlots 0xb6a22 0x3dd
SECMOD_InternaltoPubMechFlags 0xb6a9f 0x3de
SECMOD_LoadModule 0xad895 0x3df
SECMOD_LoadUserModule 0xadacd 0x3e0
SECMOD_OpenUserDB 0xb6c3c 0x3e1
SECMOD_PubCipherFlagstoInternal 0xbec54 0x3e2
SECMOD_PubMechFlagstoInternal 0xb6cc5 0x3e3
SECMOD_ReferenceModule 0xb6cde 0x3e4
SECMOD_ReleaseReadLock 0xa1454 0x3e5
SECMOD_UnloadUserModule 0xadb1e 0x3e6
SECMOD_UpdateModule 0xb6f60 0x3e7
SECMOD_UpdateSlotList 0xb6f78 0x3e8
SECMOD_WaitForAnyTokenEvent 0xb716f 0x3e9
SECOID_AddEntry 0x915e0 0x3ea
SECOID_AddEntry_Util 0xbe60c 0x3eb
SECOID_AlgorithmIDTemplate 0xf2938 0x3ec
SECOID_AlgorithmIDTemplate_Util 0x101278 0x3ed
SECOID_CopyAlgorithmID_Util 0xbb1ed 0x3ee
SECOID_DestroyAlgorithmID 0x915e9 0x3ef
SECOID_DestroyAlgorithmID_Util 0xbb220 0x3f0
SECOID_FindOID 0x915ee 0x3f1
SECOID_FindOIDByMechanism 0xbe77b 0x3f2
SECOID_FindOIDByTag 0x915f7 0x3f3
SECOID_FindOIDByTag_Util 0xbe7a5 0x3f4
SECOID_FindOIDTag 0x91600 0x3f5
SECOID_FindOIDTagDescription_Util 0xbe7c5 0x3f6
SECOID_FindOIDTag_Util 0xca051 0x3f7
SECOID_FindOID_Util 0xbe7de 0x3f8
SECOID_GetAlgorithmTag 0x91609 0x3f9
SECOID_GetAlgorithmTag_Util 0xbb24d 0x3fa
SECOID_Init 0xbe817 0x3fb
SECOID_SetAlgorithmID 0x91612 0x3fc
SECOID_SetAlgorithmID_Util 0xbb26a 0x3fd
SECOID_Shutdown 0xbe95c 0x3fe
SEC_ASN1Decode 0x9161b 0x3ff
SEC_ASN1DecodeInteger 0x91624 0x400
SEC_ASN1DecodeItem 0x9162d 0x401
SEC_ASN1DecodeItem_Util 0xbb3bd 0x402
SEC_ASN1Decode_Util 0xbb3dc 0x403
SEC_ASN1EncodeInteger_Util 0xbcda8 0x404
SEC_ASN1EncodeItem 0x91636 0x405
SEC_ASN1EncodeItem_Util 0xbcdc0 0x406
SEC_ASN1EncodeUnsignedInteger_Util 0xbce66 0x407
SEC_ASN1Encode_Util 0xbce7e 0x408
SEC_AnyTemplate_Util 0x1012f8 0x409
SEC_BMPStringTemplate 0xf2978 0x40a
SEC_BitStringTemplate 0xf2988 0x40b
SEC_BitStringTemplate_Util 0x101308 0x40c
SEC_BooleanTemplate_Util 0x101328 0x40d
SEC_CertNicknameConflict 0x86829 0x40e
SEC_CreateSignatureAlgorithmParameters 0x8eca7 0x40f
SEC_DeletePermCertificate 0x86861 0x410
SEC_DerSignData 0x8ed08 0x411
SEC_DerSignDataWithAlgorithmID 0x8ed29 0x412
SEC_DestroyCrl 0x83861 0x413
SEC_GeneralizedTimeTemplate_Util 0x101338 0x414
SEC_GetSignatureAlgorithmOidTag 0x8ed55 0x415
SEC_IA5StringTemplate 0xf2998 0x416
SEC_IA5StringTemplate_Util 0x101348 0x417
SEC_IntegerTemplate 0xf29a8 0x418
SEC_IntegerTemplate_Util 0x101358 0x419
SEC_NullTemplate_Util 0x101368 0x41a
SEC_ObjectIDTemplate_Util 0x101378 0x41b
SEC_OctetStringTemplate 0xf29b8 0x41c
SEC_OctetStringTemplate_Util 0x101388 0x41d
SEC_PKCS12AddCertAndKey 0xc4bbc 0x41e
SEC_PKCS12AddPasswordIntegrity 0xc4ee2 0x41f
SEC_PKCS12CreateExportContext 0xc4f3d 0x420
SEC_PKCS12CreatePasswordPrivSafe 0xc4fc2 0x421
SEC_PKCS12CreateUnencryptedSafe 0xc5169 0x422
SEC_PKCS12DecoderFinish 0xc2030 0x423
SEC_PKCS12DecoderImportBags 0xc21b6 0x424
SEC_PKCS12DecoderIterateInit 0xc220e 0x425
SEC_PKCS12DecoderIterateNext 0xc2239 0x426
SEC_PKCS12DecoderRenameCertNicknames 0xc23c8 0x427
SEC_PKCS12DecoderStart 0xc24c5 0x428
SEC_PKCS12DecoderUpdate 0xc263c 0x429
SEC_PKCS12DecoderValidateBags 0xc2687 0x42a
SEC_PKCS12DecoderVerify 0xc270d 0x42b
SEC_PKCS12DestroyExportContext 0xc5207 0x42c
SEC_PKCS12EnableCipher 0xc63c8 0x42d
SEC_PKCS12Encode 0xc5272 0x42e
SEC_PKCS12IsEncryptionAllowed 0xc6415 0x42f
SEC_PKCS12SetPreferredCipher 0xc643e 0x430
SEC_PKCS5GetPBEAlgorithm 0xaf3b7 0x431
SEC_PKCS5IsAlgorithmPBEAlgTag 0xaf463 0x432
SEC_PKCS7AddSigningTime 0xc6da8 0x433
SEC_PKCS7ContentIsEncrypted 0xc75d4 0x434
SEC_PKCS7ContentIsSigned 0xc75f8 0x435
SEC_PKCS7CopyContentInfo 0xc6baa 0x436
SEC_PKCS7CreateSignedData 0xc6fd2 0x437
SEC_PKCS7DecodeItem 0xc7632 0x438
SEC_PKCS7DecoderFinish 0xc7688 0x439
SEC_PKCS7DecoderStart 0xc76d5 0x43a
SEC_PKCS7DecoderUpdate 0xc77e6 0x43b
SEC_PKCS7DestroyContentInfo 0xc6bbb 0x43c
SEC_PKCS7Encode 0xc8655 0x43d
SEC_PKCS7IncludeCertChain 0xc7017 0x43e
SEC_PKCS7VerifyDetachedSignature 0xc789f 0x43f
SEC_QuickDERDecodeItem 0x9163f 0x440
SEC_QuickDERDecodeItem_Util 0xbb0cf 0x441
SEC_RegisterDefaultHttpClient 0x8a477 0x442
SEC_SignData 0x8ee46 0x443
SEC_SignedCertificateTemplate 0xf0a88 0x444
SEC_StringToOID 0xb9156 0x445
SEC_UTF8StringTemplate 0xf29c8 0x446
SEC_UTF8StringTemplate_Util 0x1013a8 0x447
SGN_Begin 0x8ee64 0x448
SGN_CreateDigestInfo 0x91648 0x449
SGN_CreateDigestInfo_Util 0xbdda3 0x44a
SGN_DecodeDigestInfo 0xbde91 0x44b
SGN_DestroyContext 0x8eeb0 0x44c
SGN_DestroyDigestInfo 0x91651 0x44d
SGN_DestroyDigestInfo_Util 0x80376 0x44e
SGN_End 0x8efd4 0x44f
SGN_NewContext 0x8f23b 0x450
SGN_Update 0x8f250 0x451
SSL_AuthCertificateComplete 0xe1caa 0x452
SSL_AuthCertificateHook 0xdf6f3 0x453
SSL_CipherPrefGet 0xe4dd6 0x454
SSL_CipherPrefSet 0xe4e23 0x455
SSL_CipherPrefSetDefault 0xe4e58 0x456
SSL_ClearSessionCache 0xe1719 0x457
SSL_ConfigSecureServer 0xdf9de 0x458
SSL_ConfigSecureServerWithCertChain 0xdf9f9 0x459
SSL_ConfigServerSessionIDCache 0xe365a 0x45a
SSL_ExportKeyingMaterial 0xe0d99 0x45b
SSL_ForceHandshake 0xe1d5a 0x45c
SSL_GetChannelInfo 0xe0f12 0x45d
SSL_GetCipherSuiteInfo 0xe1154 0x45e
SSL_GetClientAuthDataHook 0xdf720 0x45f
SSL_GetExperimentalAPI 0xe4e6c 0x460
SSL_GetImplementedCiphers 0xe0b5f 0x461
SSL_GetNextProto 0xe4ec4 0x462
SSL_GetNumImplementedCiphers 0xe0b65 0x463
SSL_GetPreliminaryChannelInfo 0xe11bb 0x464
SSL_GetSRTPCipher 0xe4f4e 0x465
SSL_GetStatistics 0xd087c 0x466
SSL_HandshakeCallback 0xe1e8d 0x467
SSL_HandshakeNegotiatedExtension 0xe1b3d 0x468
SSL_ImplementedCiphers 0x103488 0x469
SSL_ImportFD 0xe4f84 0x46a
SSL_NamedGroupConfig 0xe4f99 0x46b
SSL_NumImplementedCiphers 0x103518 0x46c
SSL_OptionSet 0xe5020 0x46d
SSL_OptionSetDefault 0xe5470 0x46e
SSL_PeerCertificate 0xdf74d 0x46f
SSL_PeerCertificateChain 0xdf778 0x470
SSL_PeerSignedCertTimestamps 0xe57f0 0x471
SSL_PeerStapledOCSPResponses 0xe5822 0x472
SSL_ResetHandshake 0xe1f1c 0x473
SSL_SNISocketConfigHook 0xe20e8 0x474
SSL_SendAdditionalKeyShares 0xe77d8 0x475
SSL_SetCanFalseStartCallback 0xe2115 0x476
SSL_SetDowngradeCheckVersion 0xe5852 0x477
SSL_SetNextProtoNego 0xe596c 0x478
SSL_SetPKCS11PinArg 0xdf7fa 0x479
SSL_SetSRTPCiphers 0xe5a2d 0x47a
SSL_SetSockPeerID 0xe5ac5 0x47b
SSL_SetStapledOCSPResponses 0xdfa86 0x47c
SSL_SetTrustAnchors 0xe21a4 0x47d
SSL_SetURL 0xe2255 0x47e
SSL_ShutdownServerSessionIDCache 0xe3682 0x47f
SSL_SignatureSchemePrefSet 0xd0882 0x480
SSL_VersionRangeGet 0xe5b22 0x481
SSL_VersionRangeGetDefault 0xe5bc4 0x482
SSL_VersionRangeGetSupported 0xe5c07 0x483
SSL_VersionRangeSet 0xe5c80 0x484
SSL_VersionRangeSetDefault 0xe5d6f 0x485
SetExecutionEnvironment 0x7c3ac 0x486
UTIL_SetForkState 0xbea5c 0x487
VFY_Begin 0x8f75b 0x488
VFY_CreateContext 0x8f7b7 0x489
VFY_DestroyContext 0x8f7f9 0x48a
VFY_End 0x8f86d 0x48b
VFY_EndWithSignature 0x8f87e 0x48c
VFY_Update 0x8faca 0x48d
VFY_VerifyData 0x8fb01 0x48e
VFY_VerifyDataWithAlgorithmID 0x8fb6c 0x48f
VFY_VerifyDigestDirect 0x8fbbc 0x490
_NSSUTIL_Access 0xbfc42 0x491
_NSSUTIL_EvaluateConfigDir 0xc17ca 0x492
_NSSUTIL_GetSecmodName 0xc18e2 0x493
_NSSUTIL_UTF8ToWide 0xbfd09 0x494
_PR_AddSleepQ 0x7bbab 0x495
_PR_CreateThread 0x7b300 0x496
_PR_DelSleepQ 0x7bca0 0x497
_PR_GetPrimordialCPU 0x7a67b 0x498
_PR_MD_FREE_CV 0x6f810 0x499
_PR_MD_INIT_LOCKS 0x6f934 0x49a
_PR_MD_NEW_CV 0x6f800 0x49b
_PR_MD_NEW_LOCK 0x6f951 0x49c
_PR_MD_NOTIFYALL_CV 0x6f921 0x49d
_PR_MD_NOTIFY_CV 0x6f90e 0x49e
_PR_MD_UNLOCK 0x6f99f 0x49f
_PR_MD_WAIT_CV 0x6f81b 0x4a0
_PR_NativeCreateThread 0x7b1e4 0x4a1
_SGN_VerifyPKCS1DigestInfo 0xb9ef2 0x4a2
__PK11_SetCertificateNickname 0x9ee9e 0x4a3
_pr_push_ipv6toipv4_layer 0x68209 0x4a4
_pr_test_ipv6_socket 0x6ce11 0x4a5
sqlite3_aggregate_context 0x1d1c4 0x4a6
sqlite3_auto_extension 0x39f4e 0x4a7
sqlite3_bind_blob 0x1d720 0x4a8
sqlite3_bind_double 0x1d784 0x4a9
sqlite3_bind_int 0x1d7e4 0x4aa
sqlite3_bind_int64 0x1d802 0x4ab
sqlite3_bind_null 0x1d84d 0x4ac
sqlite3_bind_parameter_count 0x1daaf 0x4ad
sqlite3_bind_parameter_index 0x1dadd 0x4ae
sqlite3_bind_parameter_name 0x1dac3 0x4af
sqlite3_bind_text 0x1d8cd 0x4b0
sqlite3_bind_text16 0x1d941 0x4b1
sqlite3_bind_value 0x1d95f 0x4b2
sqlite3_busy_handler 0x53727 0x4b3
sqlite3_busy_timeout 0x537b0 0x4b4
sqlite3_changes 0x5316d 0x4b5
sqlite3_clear_bindings 0x1c89d 0x4b6
sqlite3_close 0x53341 0x4b7
sqlite3_collation_needed 0x54b51 0x4b8
sqlite3_collation_needed16 0x54b88 0x4b9
sqlite3_column_blob 0x1d357 0x4ba
sqlite3_column_bytes 0x1d37e 0x4bb
sqlite3_column_bytes16 0x1d3a7 0x4bc
sqlite3_column_count 0x1d2bb 0x4bd
sqlite3_column_double 0x1d3ce 0x4be
sqlite3_column_int 0x1d3fc 0x4bf
sqlite3_column_int64 0x1d423 0x4c0
sqlite3_column_name 0x1d562 0x4c1
sqlite3_column_name16 0x1d57a 0x4c2
sqlite3_column_text 0x1d453 0x4c3
sqlite3_column_text16 0x1d4b6 0x4c4
sqlite3_column_type 0x1d4dd 0x4c5
sqlite3_column_value 0x1d47c 0x4c6
sqlite3_commit_hook 0x53b77 0x4c7
sqlite3_complete 0x52640 0x4c8
sqlite3_complete16 0x52857 0x4c9
sqlite3_config 0x52b0a 0x4ca
sqlite3_create_collation 0x54a8e 0x4cb
sqlite3_create_collation16 0x54aee 0x4cc
sqlite3_create_function 0x5399a 0x4cd
sqlite3_create_function16 0x53a66 0x4ce
sqlite3_create_module 0x46270 0x4cf
sqlite3_data_count 0x1d2d2 0x4d0
sqlite3_db_filename 0x55248 0x4d1
sqlite3_db_handle 0x1db8c 0x4d2
sqlite3_db_mutex 0x52e81 0x4d3
sqlite3_db_status 0x1110 0x4d4
sqlite3_declare_vtab 0x46a7f 0x4d5
sqlite3_enable_load_extension 0x39f1a 0x4d6
sqlite3_enable_shared_cache 0xfe44 0x4d7
sqlite3_errcode 0x53f47 0x4d8
sqlite3_errmsg 0x53e4e 0x4d9
sqlite3_errmsg16 0x53ebf 0x4da
sqlite3_exec 0x398ae 0x4db
sqlite3_expanded_sql 0x1dc8a 0x4dc
sqlite3_extended_result_codes 0x54e69 0x4dd
sqlite3_file_control 0x54e99 0x4de
sqlite3_finalize 0x1c7d3 0x4df
sqlite3_free 0x32d6 0x4e0
sqlite3_free_table 0x438ac 0x4e1
sqlite3_get_autocommit 0x54bbf 0x4e2
sqlite3_get_auxdata 0x1d1e6 0x4e3
sqlite3_get_table 0x4374b 0x4e4
sqlite3_initialize 0x528be 0x4e5
sqlite3_interrupt 0x537eb 0x4e6
sqlite3_last_insert_rowid 0x53137 0x4e7
sqlite3_libversion 0x528ae 0x4e8
sqlite3_libversion_number 0x528b4 0x4e9
sqlite3_load_extension 0x39ede 0x4ea
sqlite3_malloc 0x3236 0x4eb
sqlite3_memory_highwater 0x30e8 0x4ec
sqlite3_memory_used 0x30c4 0x4ed
sqlite3_mprintf 0x4999 0x4ee
sqlite3_mutex_alloc 0x2dc0 0x4ef
sqlite3_mutex_enter 0x2e0b 0x4f0
sqlite3_mutex_free 0x2df9 0x4f1
sqlite3_mutex_leave 0x2e31 0x4f2
sqlite3_mutex_try 0x2e1d 0x4f3
sqlite3_next_stmt 0x1dbd8 0x4f4
sqlite3_open 0x549c9 0x4f5
sqlite3_open16 0x549f7 0x4f6
sqlite3_open_v2 0x549df 0x4f7
sqlite3_overload_function 0x53acf 0x4f8
sqlite3_prepare 0x3d509 0x4f9
sqlite3_prepare16 0x3d682 0x4fa
sqlite3_prepare16_v2 0x3d6a0 0x4fb
sqlite3_prepare_v2 0x3d529 0x4fc
sqlite3_progress_handler 0x53765 0x4fd
sqlite3_realloc 0x3492 0x4fe
sqlite3_release_memory 0x2d52 0x4ff
sqlite3_reset 0x1c83f 0x500
sqlite3_reset_auto_extension 0x3a031 0x501
sqlite3_result_blob 0x1cb21 0x502
sqlite3_result_double 0x1cb79 0x503
sqlite3_result_error 0x1cbae 0x504
sqlite3_result_error16 0x1cbd4 0x505
sqlite3_result_error_code 0x1cd6f 0x506
sqlite3_result_error_nomem 0x1cdce 0x507
sqlite3_result_int 0x1cbfb 0x508
sqlite3_result_int64 0x1cc12 0x509
sqlite3_result_null 0x1cc2b 0x50a
sqlite3_result_text 0x1cc84 0x50b
sqlite3_result_text16 0x1ccea 0x50c
sqlite3_result_text16be 0x1cd05 0x50d
sqlite3_result_text16le 0x1ccea 0x50e
sqlite3_result_value 0x1cd20 0x50f
sqlite3_rollback_hook 0x53be7 0x510
sqlite3_set_authorizer 0x2de91 0x511
sqlite3_set_auxdata 0x1d21e 0x512
sqlite3_shutdown 0x52a7d 0x513
sqlite3_sleep 0x54e3e 0x514
sqlite3_snprintf 0x4a02 0x515
sqlite3_sql 0x1dc74 0x516
sqlite3_status 0x1090 0x517
sqlite3_step 0x1cfda 0x518
sqlite3_stmt_readonly 0x1db9e 0x519
sqlite3_stmt_status 0x1dc07 0x51a
sqlite3_total_changes 0x53178 0x51b
sqlite3_trace_v2 0x53b32 0x51c
sqlite3_unlock_notify 0x5538f 0x51d
sqlite3_update_hook 0x53baf 0x51e
sqlite3_uri_parameter 0x55148 0x51f
sqlite3_user_data 0x1d12d 0x520
sqlite3_value_blob 0x1c90d 0x521
sqlite3_value_bytes 0x1c959 0x522
sqlite3_value_bytes16 0x1c96a 0x523
sqlite3_value_double 0x1c978 0x524
sqlite3_value_int 0x1c992 0x525
sqlite3_value_int64 0x1c992 0x526
sqlite3_value_numeric_type 0x1e13e 0x527
sqlite3_value_text 0x1ca11 0x528
sqlite3_value_text16 0x1ca22 0x529
sqlite3_value_text16be 0x1ca30 0x52a
sqlite3_value_text16le 0x1ca22 0x52b
sqlite3_value_type 0x1ca3e 0x52c
sqlite3_version 0x113420 0x52d
sqlite3_vfs_find 0x2b8c 0x52e
sqlite3_vfs_register 0x2c38 0x52f
sqlite3_vfs_unregister 0x2c8e 0x530
sqlite3_vmprintf 0x4922 0x531
Digital Signatures (3)
»
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 00:00:00+00:00
Valid Until 2019-06-28 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 12:00:00+00:00
Valid Until 2028-10-22 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 00:00:00+00:00
Valid Until 2031-11-10 00:00:00+00:00
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/nssdbm3.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 90.45 KB
MD5 569a7a65658a46f9412bdfa04f86e2b2 Copy to Clipboard
SHA1 44cc0038e891ae73c43b61a71a46c97f98b1030d Copy to Clipboard
SHA256 541a293c450e609810279f121a5e9dfa4e924d52e8b0c6c543512b5026efe7ec Copy to Clipboard
SSDeep 1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw Copy to Clipboard
ImpHash d13d5fc7f2f1cf397f0d0cfd732db7a2 Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Entry Point 0x10011f81
Size Of Code 0x11a00
Size Of Initialized Data 0x3000
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2018-04-27 21:41:18+00:00
Version Information (11)
»
BuildID 20180427210249
Comments -
CompanyName Mozilla Foundation
FileDescription -
FileVersion 59.0.3
InternalName -
LegalCopyright License: MPL 2
LegalTrademarks Mozilla
OriginalFilename nssdbm3.dll
ProductName Firefox
ProductVersion 59.0.3
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x118e4 0x11a00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.49
.rdata 0x10013000 0x1f34 0x2000 0x11e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.98
.data 0x10015000 0x3f8 0x200 0x13e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.48
.rsrc 0x10016000 0x370 0x400 0x14000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.87
.reloc 0x10017000 0x6a4 0x800 0x14400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 5.89
Imports (9)
»
nss3.dll (92)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PL_HashTableEnumerateEntries 0x0 0x100130e4 0x141c4 0x12fc4 0x1ca
SECITEM_AllocItem_Util 0x0 0x100130e8 0x141c8 0x12fc8 0x3a6
PR_Now 0x0 0x100130ec 0x141cc 0x12fcc 0x31f
DER_DecodeTimeChoice_Util 0x0 0x100130f0 0x141d0 0x12fd0 0x8e
NSS_Get_SEC_AnyTemplate_Util 0x0 0x100130f4 0x141d4 0x12fd4 0x100
NSS_Get_SEC_BitStringTemplate_Util 0x0 0x100130f8 0x141d8 0x12fd8 0x103
NSS_Get_SEC_ObjectIDTemplate_Util 0x0 0x100130fc 0x141dc 0x12fdc 0x10b
PORT_InitCheapArena 0x0 0x10013100 0x141e0 0x12fe0 0x209
PORT_DestroyCheapArena 0x0 0x10013104 0x141e4 0x12fe4 0x202
PORT_ArenaMark_Util 0x0 0x10013108 0x141e8 0x12fe8 0x1fb
PORT_ArenaRelease_Util 0x0 0x1001310c 0x141ec 0x12fec 0x1fc
PORT_ArenaUnmark_Util 0x0 0x10013110 0x141f0 0x12ff0 0x1ff
PORT_ArenaStrdup_Util 0x0 0x10013114 0x141f4 0x12ff4 0x1fe
SECITEM_CompareItem_Util 0x0 0x10013118 0x141f8 0x12ff8 0x3a8
PR_OpenFile 0x0 0x1001311c 0x141fc 0x12ffc 0x323
PL_HashTableLookup 0x0 0x10013120 0x14200 0x13000 0x1cb
PR_EnterMonitor 0x0 0x10013124 0x14204 0x13004 0x27c
PR_ExitMonitor 0x0 0x10013128 0x14208 0x13008 0x286
NSSUTIL_ArgGetParamValue 0x0 0x1001312c 0x1420c 0x1300c 0xb1
NSSUTIL_ArgHasFlag 0x0 0x10013130 0x14210 0x13010 0xb2
NSSUTIL_ArgReadLong 0x0 0x10013134 0x14214 0x13014 0xb8
NSSUTIL_Quote 0x0 0x10013138 0x14218 0x13018 0xc0
NSSUTIL_ArgParseSlotFlags 0x0 0x1001313c 0x1421c 0x1301c 0xb6
NSSUTIL_ArgParseSlotInfo 0x0 0x10013140 0x14220 0x13020 0xb7
NSSUTIL_MkSlotString 0x0 0x10013144 0x14224 0x13024 0xbf
NSSUTIL_ArgParseModuleSpec 0x0 0x10013148 0x14228 0x13028 0xb5
NSSUTIL_MkModuleSpec 0x0 0x1001314c 0x1422c 0x1302c 0xbd
NSSUTIL_ArgParseCipherFlags 0x0 0x10013150 0x14230 0x13030 0xb4
NSSUTIL_MkNSSString 0x0 0x10013154 0x14234 0x13034 0xbe
PR_GetError 0x0 0x10013158 0x14238 0x13038 0x2ae
NSSBase64_EncodeItem_Util 0x0 0x1001315c 0x1423c 0x1303c 0xab
PL_HashTableRemove 0x0 0x10013160 0x14240 0x13040 0x1d1
PL_HashTableAdd 0x0 0x10013164 0x14244 0x13044 0x1c7
SECOID_Shutdown 0x0 0x10013168 0x14248 0x13048 0x3fd
SECOID_Init 0x0 0x1001316c 0x1424c 0x1304c 0x3fa
SECITEM_HashCompare 0x0 0x10013170 0x14250 0x13050 0x3b0
PL_CompareValues 0x0 0x10013174 0x14254 0x13054 0x1be
PL_HashTableDestroy 0x0 0x10013178 0x14258 0x13058 0x1c8
PL_NewHashTable 0x0 0x1001317c 0x1425c 0x1305c 0x1d3
PR_FindSymbol 0x0 0x10013180 0x14260 0x13060 0x297
PR_LoadLibrary 0x0 0x10013184 0x14264 0x13064 0x2fc
SECITEM_ItemsAreEqual_Util 0x0 0x10013188 0x14268 0x13068 0x3b2
PORT_Realloc_Util 0x0 0x1001318c 0x1426c 0x1306c 0x20c
DER_SetUInteger 0x0 0x10013190 0x14270 0x13070 0x97
PR_htonl 0x0 0x10013194 0x14274 0x13074 0x391
NSS_Get_SEC_OctetStringTemplate_Util 0x0 0x10013198 0x14278 0x13078 0x10d
PR_ntohl 0x0 0x1001319c 0x1427c 0x1307c 0x394
SECOID_GetAlgorithmTag_Util 0x0 0x100131a0 0x14280 0x13080 0x3f9
SECOID_SetAlgorithmID_Util 0x0 0x100131a4 0x14284 0x13084 0x3fc
SECOID_FindOIDByTag_Util 0x0 0x100131a8 0x14288 0x13088 0x3f3
SECOID_FindOIDTag_Util 0x0 0x100131ac 0x1428c 0x1308c 0x3f6
SEC_ASN1EncodeInteger_Util 0x0 0x100131b0 0x14290 0x13090 0x403
SEC_ASN1EncodeItem_Util 0x0 0x100131b4 0x14294 0x13094 0x405
SEC_QuickDERDecodeItem_Util 0x0 0x100131b8 0x14298 0x13098 0x440
PR_Unlock 0x0 0x100131bc 0x1429c 0x1309c 0x380
PR_Lock 0x0 0x100131c0 0x142a0 0x130a0 0x300
PR_DestroyLock 0x0 0x100131c4 0x142a4 0x130a4 0x268
PR_NewLock 0x0 0x100131c8 0x142a8 0x130a8 0x30e
SECITEM_ZfreeItem_Util 0x0 0x100131cc 0x142ac 0x130ac 0x3b5
SECITEM_FreeItem_Util 0x0 0x100131d0 0x142b0 0x130b0 0x3af
SECITEM_DupItem_Util 0x0 0x100131d4 0x142b4 0x130b4 0x3ad
SECITEM_CopyItem_Util 0x0 0x100131d8 0x142b8 0x130b8 0x3aa
PORT_ArenaZAlloc_Util 0x0 0x100131dc 0x142bc 0x130bc 0x201
PORT_ArenaAlloc_Util 0x0 0x100131e0 0x142c0 0x130c0 0x1f9
PORT_FreeArena_Util 0x0 0x100131e4 0x142c4 0x130c4 0x205
PORT_NewArena_Util 0x0 0x100131e8 0x142c8 0x130c8 0x20b
PORT_GetError_Util 0x0 0x100131ec 0x142cc 0x130cc 0x208
PORT_SetError_Util 0x0 0x100131f0 0x142d0 0x130d0 0x20f
PORT_Strdup_Util 0x0 0x100131f4 0x142d4 0x130d4 0x213
NSS_Get_SECOID_AlgorithmIDTemplate_Util 0x0 0x100131f8 0x142d8 0x130d8 0xff
PR_smprintf_free 0x0 0x100131fc 0x142dc 0x130dc 0x398
PR_smprintf 0x0 0x10013200 0x142e0 0x130e0 0x397
PR_MkDir 0x0 0x10013204 0x142e4 0x130e4 0x30b
PR_Access 0x0 0x10013208 0x142e8 0x130e8 0x224
PR_Delete 0x0 0x1001320c 0x142ec 0x130ec 0x262
PR_Write 0x0 0x10013210 0x142f0 0x130f0 0x38b
PR_Read 0x0 0x10013214 0x142f4 0x130f4 0x33d
PR_DestroyMonitor 0x0 0x10013218 0x142f8 0x130f8 0x26a
PR_Close 0x0 0x1001321c 0x142fc 0x130fc 0x248
PORT_ZAlloc_Util 0x0 0x10013220 0x14300 0x13100 0x219
PR_GetDirectorySeparator 0x0 0x10013224 0x14304 0x13104 0x2aa
PR_GetEnvSecure 0x0 0x10013228 0x14308 0x13108 0x2ad
PR_CallOnce 0x0 0x1001322c 0x1430c 0x1310c 0x23d
PR_SetError 0x0 0x10013230 0x14310 0x13110 0x356
PR_Free 0x0 0x10013234 0x14314 0x13114 0x29c
PORT_Free_Util 0x0 0x10013238 0x14318 0x13118 0x206
PORT_Alloc_Util 0x0 0x1001323c 0x1431c 0x1311c 0x1f7
PR_GetLibraryFilePathname 0x0 0x10013240 0x14320 0x13120 0x2bc
PR_FindFunctionSymbol 0x0 0x10013244 0x14324 0x13124 0x291
PR_UnloadLibrary 0x0 0x10013248 0x14328 0x13128 0x37f
PR_NewMonitor 0x0 0x1001324c 0x1432c 0x1312c 0x310
PR_LoadLibraryWithFlags 0x0 0x10013250 0x14330 0x13130 0x2fd
KERNEL32.dll (13)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InitializeSListHead 0x0 0x10013000 0x140e0 0x12ee0 0x35a
DisableThreadLibraryCalls 0x0 0x10013004 0x140e4 0x12ee4 0x11b
GetSystemTimeAsFileTime 0x0 0x10013008 0x140e8 0x12ee8 0x2e2
GetCurrentThreadId 0x0 0x1001300c 0x140ec 0x12eec 0x218
GetCurrentProcessId 0x0 0x10013010 0x140f0 0x12ef0 0x214
QueryPerformanceCounter 0x0 0x10013014 0x140f4 0x12ef4 0x440
IsProcessorFeaturePresent 0x0 0x10013018 0x140f8 0x12ef8 0x37d
TerminateProcess 0x0 0x1001301c 0x140fc 0x12efc 0x57c
GetCurrentProcess 0x0 0x10013020 0x14100 0x12f00 0x213
SetUnhandledExceptionFilter 0x0 0x10013024 0x14104 0x12f04 0x55e
UnhandledExceptionFilter 0x0 0x10013028 0x14108 0x12f08 0x59d
FlushFileBuffers 0x0 0x1001302c 0x1410c 0x12f0c 0x19b
IsDebuggerPresent 0x0 0x10013030 0x14110 0x12f10 0x376
VCRUNTIME140.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_except_handler4_common 0x0 0x10013038 0x14118 0x12f18 0x35
memmove 0x0 0x1001303c 0x1411c 0x12f1c 0x47
memcmp 0x0 0x10013040 0x14120 0x12f20 0x45
memset 0x0 0x10013044 0x14124 0x12f24 0x48
strrchr 0x0 0x10013048 0x14128 0x12f28 0x4b
memcpy 0x0 0x1001304c 0x1412c 0x12f2c 0x46
__std_type_info_destroy_list 0x0 0x10013050 0x14130 0x12f30 0x25
api-ms-win-crt-runtime-l1-1-0.dll (11)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initialize_onexit_table 0x0 0x1001307c 0x1415c 0x12f5c 0x36
_initialize_narrow_environment 0x0 0x10013080 0x14160 0x12f60 0x35
_configure_narrow_argv 0x0 0x10013084 0x14164 0x12f64 0x19
_seh_filter_dll 0x0 0x10013088 0x14168 0x12f68 0x41
_initterm 0x0 0x1001308c 0x1416c 0x12f6c 0x38
_execute_onexit_table 0x0 0x10013090 0x14170 0x12f70 0x24
_getpid 0x0 0x10013094 0x14174 0x12f74 0x34
_errno 0x0 0x10013098 0x14178 0x12f78 0x23
abort 0x0 0x1001309c 0x1417c 0x12f7c 0x57
_cexit 0x0 0x100130a0 0x14180 0x12f80 0x17
_initterm_e 0x0 0x100130a4 0x14184 0x12f84 0x39
api-ms-win-crt-heap-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
calloc 0x0 0x1001306c 0x1414c 0x12f4c 0x17
free 0x0 0x10013070 0x14150 0x12f50 0x18
malloc 0x0 0x10013074 0x14154 0x12f54 0x19
api-ms-win-crt-stdio-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_lseek 0x0 0x100130ac 0x1418c 0x12f8c 0x45
_get_osfhandle 0x0 0x100130b0 0x14190 0x12f90 0x37
__acrt_iob_func 0x0 0x100130b4 0x14194 0x12f94 0x0
fwrite 0x0 0x100130b8 0x14198 0x12f98 0x8a
_write 0x0 0x100130bc 0x1419c 0x12f9c 0x6b
_read 0x0 0x100130c0 0x141a0 0x12fa0 0x52
_close 0x0 0x100130c4 0x141a4 0x12fa4 0x17
_open 0x0 0x100130c8 0x141a8 0x12fa8 0x49
api-ms-win-crt-environment-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
getenv 0x0 0x10013058 0x14138 0x12f38 0x10
api-ms-win-crt-filesystem-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_stat64i32 0x0 0x10013060 0x14140 0x12f40 0x20
_unlink 0x0 0x10013064 0x14144 0x12f44 0x23
api-ms-win-crt-string-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
tolower 0x0 0x100130d0 0x141b0 0x12fb0 0x97
isdigit 0x0 0x100130d4 0x141b4 0x12fb4 0x68
_strdup 0x0 0x100130d8 0x141b8 0x12fb8 0x29
strncmp 0x0 0x100130dc 0x141bc 0x12fbc 0x8e
Exports (7)
»
Api name EAT Address Ordinal
legacy_AddSecmodDB 0x10d1b 0x1
legacy_DeleteSecmodDB 0x10dd1 0x2
legacy_Open 0xae88 0x3
legacy_ReadSecmodDB 0x10e51 0x4
legacy_ReleaseSecmodDBData 0x10fab 0x5
legacy_SetCryptFunctions 0xb556 0x6
legacy_Shutdown 0xaf93 0x7
Digital Signatures (3)
»
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 00:00:00+00:00
Valid Until 2019-06-28 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 12:00:00+00:00
Valid Until 2028-10-22 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 00:00:00+00:00
Valid Until 2031-11-10 00:00:00+00:00
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/softokn3.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 140.95 KB
MD5 67827db2380b5848166a411bae9f0632 Copy to Clipboard
SHA1 f68f1096c5a3f7b90824aa0f7b9da372228363ff Copy to Clipboard
SHA256 9a7f11c212d61856dfc494de111911b7a6d9d5e9795b0b70bbbc998896f068ae Copy to Clipboard
SSDeep 3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv Copy to Clipboard
ImpHash 4d153c0cea0b76890c21127ac6dbd559 Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Entry Point 0x1001bc97
Size Of Code 0x1b600
Size Of Initialized Data 0x6000
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2018-04-27 21:41:18+00:00
Version Information (11)
»
BuildID 20180427210249
Comments -
CompanyName Mozilla Foundation
FileDescription -
FileVersion 59.0.3
InternalName -
LegalCopyright License: MPL 2
LegalTrademarks Mozilla
OriginalFilename softokn3.dll
ProductName Firefox
ProductVersion 59.0.3
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1b4cb 0x1b600 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.41
.rdata 0x1001d000 0x43fa 0x4400 0x1ba00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.17
.data 0x10022000 0x700 0x400 0x1fe00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.71
.rsrc 0x10023000 0x370 0x400 0x20200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.87
.reloc 0x10024000 0xe60 0x1000 0x20600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.34
Imports (9)
»
nss3.dll (110)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SECITEM_HashCompare 0x0 0x1001d0b0 0x20520 0x1ef20 0x3b0
PR_SecondsToInterval 0x0 0x1001d0b4 0x20524 0x1ef24 0x349
PR_NewLock 0x0 0x1001d0b8 0x20528 0x1ef28 0x30e
PR_DestroyLock 0x0 0x1001d0bc 0x2052c 0x1ef2c 0x268
DER_SetUInteger 0x0 0x1001d0c0 0x20530 0x1ef30 0x97
PR_Sleep 0x0 0x1001d0c4 0x20534 0x1ef34 0x36c
PR_smprintf_free 0x0 0x1001d0c8 0x20538 0x1ef38 0x398
SECOID_Init 0x0 0x1001d0cc 0x2053c 0x1ef3c 0x3fa
SECOID_Shutdown 0x0 0x1001d0d0 0x20540 0x1ef40 0x3fd
UTIL_SetForkState 0x0 0x1001d0d4 0x20544 0x1ef44 0x486
NSSUTIL_DoModuleDBFunction 0x0 0x1001d0d8 0x20548 0x1ef48 0xbb
_NSSUTIL_GetSecmodName 0x0 0x1001d0dc 0x2054c 0x1ef4c 0x492
SEC_QuickDERDecodeItem_Util 0x0 0x1001d0e0 0x20550 0x1ef50 0x440
NSS_Get_SEC_OctetStringTemplate_Util 0x0 0x1001d0e4 0x20554 0x1ef54 0x10d
_SGN_VerifyPKCS1DigestInfo 0x0 0x1001d0e8 0x20558 0x1ef58 0x4a1
DER_Encode_Util 0x0 0x1001d0ec 0x2055c 0x1ef5c 0x91
SGN_CreateDigestInfo_Util 0x0 0x1001d0f0 0x20560 0x1ef60 0x449
SGN_DestroyDigestInfo_Util 0x0 0x1001d0f4 0x20564 0x1ef64 0x44d
SECOID_FindOIDByMechanism 0x0 0x1001d0f8 0x20568 0x1ef68 0x3f1
PL_HashTableEnumerateEntries 0x0 0x1001d0fc 0x2056c 0x1ef6c 0x1ca
PL_strcasecmp 0x0 0x1001d100 0x20570 0x1ef70 0x1d6
PORT_Strdup_Util 0x0 0x1001d104 0x20574 0x1ef74 0x213
sqlite3_close 0x0 0x1001d108 0x20578 0x1ef78 0x4b6
sqlite3_exec 0x0 0x1001d10c 0x2057c 0x1ef7c 0x4da
sqlite3_busy_timeout 0x0 0x1001d110 0x20580 0x1ef80 0x4b3
sqlite3_mprintf 0x0 0x1001d114 0x20584 0x1ef84 0x4ed
sqlite3_free 0x0 0x1001d118 0x20588 0x1ef88 0x4df
sqlite3_open 0x0 0x1001d11c 0x2058c 0x1ef8c 0x4f4
sqlite3_prepare_v2 0x0 0x1001d120 0x20590 0x1ef90 0x4fb
PORT_FreeArena_Util 0x0 0x1001d124 0x20594 0x1ef94 0x205
sqlite3_bind_int 0x0 0x1001d128 0x20598 0x1ef98 0x4a9
PL_NewHashTable 0x0 0x1001d12c 0x2059c 0x1ef9c 0x1d3
sqlite3_step 0x0 0x1001d130 0x205a0 0x1efa0 0x517
sqlite3_column_blob 0x0 0x1001d134 0x205a4 0x1efa4 0x4b9
sqlite3_column_bytes 0x0 0x1001d138 0x205a8 0x1efa8 0x4ba
sqlite3_column_int 0x0 0x1001d13c 0x205ac 0x1efac 0x4be
sqlite3_finalize 0x0 0x1001d140 0x205b0 0x1efb0 0x4de
sqlite3_reset 0x0 0x1001d144 0x205b4 0x1efb4 0x4ff
sqlite3_file_control 0x0 0x1001d148 0x205b8 0x1efb8 0x4dd
PR_IntervalNow 0x0 0x1001d14c 0x205bc 0x1efbc 0x2f2
PR_MillisecondsToInterval 0x0 0x1001d150 0x205c0 0x1efc0 0x30a
PR_GetCurrentThread 0x0 0x1001d154 0x205c4 0x1efc4 0x2a7
PR_Now 0x0 0x1001d158 0x205c8 0x1efc8 0x31f
PL_CompareValues 0x0 0x1001d15c 0x205cc 0x1efcc 0x1be
PR_NewMonitor 0x0 0x1001d160 0x205d0 0x1efd0 0x310
PR_DestroyMonitor 0x0 0x1001d164 0x205d4 0x1efd4 0x26a
PR_EnterMonitor 0x0 0x1001d168 0x205d8 0x1efd8 0x27c
PR_ExitMonitor 0x0 0x1001d16c 0x205dc 0x1efdc 0x286
_NSSUTIL_UTF8ToWide 0x0 0x1001d170 0x205e0 0x1efe0 0x493
_NSSUTIL_Access 0x0 0x1001d174 0x205e4 0x1efe4 0x490
PR_smprintf 0x0 0x1001d178 0x205e8 0x1efe8 0x397
_NSSUTIL_EvaluateConfigDir 0x0 0x1001d17c 0x205ec 0x1efec 0x491
PL_strncasecmp 0x0 0x1001d180 0x205f0 0x1eff0 0x1e1
NSSUTIL_ArgFetchValue 0x0 0x1001d184 0x205f4 0x1eff4 0xaf
NSSUTIL_ArgStrip 0x0 0x1001d188 0x205f8 0x1eff8 0xba
NSSUTIL_ArgSkipParameter 0x0 0x1001d18c 0x205fc 0x1effc 0xb9
NSSUTIL_ArgGetLabel 0x0 0x1001d190 0x20600 0x1f000 0xb0
NSSUTIL_ArgDecodeNumber 0x0 0x1001d194 0x20604 0x1f004 0xae
NSSUTIL_ArgIsBlank 0x0 0x1001d198 0x20608 0x1f008 0xb3
NSSUTIL_ArgHasFlag 0x0 0x1001d19c 0x2060c 0x1f00c 0xb2
PORT_NewArena_Util 0x0 0x1001d1a0 0x20610 0x1f010 0x20b
PORT_GetError_Util 0x0 0x1001d1a4 0x20614 0x1f014 0x208
PR_GetEnv 0x0 0x1001d1a8 0x20618 0x1f018 0x2ac
PORT_ArenaAlloc_Util 0x0 0x1001d1ac 0x2061c 0x1f01c 0x1f9
PORT_ArenaGrow_Util 0x0 0x1001d1b0 0x20620 0x1f020 0x1fa
PORT_Realloc_Util 0x0 0x1001d1b4 0x20624 0x1f024 0x20c
SECOID_DestroyAlgorithmID_Util 0x0 0x1001d1b8 0x20628 0x1f028 0x3ef
SECOID_GetAlgorithmTag_Util 0x0 0x1001d1bc 0x2062c 0x1f02c 0x3f9
SECOID_CopyAlgorithmID_Util 0x0 0x1001d1c0 0x20630 0x1f030 0x3ed
SECOID_SetAlgorithmID_Util 0x0 0x1001d1c4 0x20634 0x1f034 0x3fc
DER_GetInteger_Util 0x0 0x1001d1c8 0x20638 0x1f038 0x95
PL_HashTableLookupConst 0x0 0x1001d1cc 0x2063c 0x1f03c 0x1cc
PL_HashTableLookup 0x0 0x1001d1d0 0x20640 0x1f040 0x1cb
PL_HashTableRemove 0x0 0x1001d1d4 0x20644 0x1f044 0x1d1
SEC_ASN1EncodeInteger_Util 0x0 0x1001d1d8 0x20648 0x1f048 0x403
PL_HashTableAdd 0x0 0x1001d1dc 0x2064c 0x1f04c 0x1c7
SEC_ASN1EncodeItem_Util 0x0 0x1001d1e0 0x20650 0x1f050 0x405
SEC_ASN1DecodeItem_Util 0x0 0x1001d1e4 0x20654 0x1f054 0x401
SECITEM_ZfreeItem_Util 0x0 0x1001d1e8 0x20658 0x1f058 0x3b5
SECITEM_FreeItem_Util 0x0 0x1001d1ec 0x2065c 0x1f05c 0x3af
SECITEM_DupItem_Util 0x0 0x1001d1f0 0x20660 0x1f060 0x3ad
SECITEM_AllocItem_Util 0x0 0x1001d1f4 0x20664 0x1f064 0x3a6
PORT_ZFree_Util 0x0 0x1001d1f8 0x20668 0x1f068 0x21a
PORT_ZAlloc_Util 0x0 0x1001d1fc 0x2066c 0x1f06c 0x219
SECITEM_CopyItem_Util 0x0 0x1001d200 0x20670 0x1f070 0x3aa
PORT_ArenaZAlloc_Util 0x0 0x1001d204 0x20674 0x1f074 0x201
NSS_Get_SECOID_AlgorithmIDTemplate_Util 0x0 0x1001d208 0x20678 0x1f078 0xff
NSS_Get_SEC_ObjectIDTemplate_Util 0x0 0x1001d20c 0x2067c 0x1f07c 0x10b
NSS_Get_SEC_BitStringTemplate_Util 0x0 0x1001d210 0x20680 0x1f080 0x103
NSS_Get_SEC_AnyTemplate_Util 0x0 0x1001d214 0x20684 0x1f084 0x100
PR_Unlock 0x0 0x1001d218 0x20688 0x1f088 0x380
PR_Access 0x0 0x1001d21c 0x2068c 0x1f08c 0x224
PR_Lock 0x0 0x1001d220 0x20690 0x1f090 0x300
PL_HashTableDestroy 0x0 0x1001d224 0x20694 0x1f094 0x1c8
PORT_SetError_Util 0x0 0x1001d228 0x20698 0x1f098 0x20f
sqlite3_bind_text 0x0 0x1001d22c 0x2069c 0x1f09c 0x4af
SECITEM_CompareItem_Util 0x0 0x1001d230 0x206a0 0x1f0a0 0x3a8
PR_snprintf 0x0 0x1001d234 0x206a4 0x1f0a4 0x399
PR_GetDirectorySeparator 0x0 0x1001d238 0x206a8 0x1f0a8 0x2aa
PR_GetEnvSecure 0x0 0x1001d23c 0x206ac 0x1f0ac 0x2ad
PR_CallOnce 0x0 0x1001d240 0x206b0 0x1f0b0 0x23d
PR_SetError 0x0 0x1001d244 0x206b4 0x1f0b4 0x356
PR_Free 0x0 0x1001d248 0x206b8 0x1f0b8 0x29c
PORT_Free_Util 0x0 0x1001d24c 0x206bc 0x1f0bc 0x206
PORT_Alloc_Util 0x0 0x1001d250 0x206c0 0x1f0c0 0x1f7
PR_GetLibraryFilePathname 0x0 0x1001d254 0x206c4 0x1f0c4 0x2bc
PR_FindFunctionSymbol 0x0 0x1001d258 0x206c8 0x1f0c8 0x291
PR_UnloadLibrary 0x0 0x1001d25c 0x206cc 0x1f0cc 0x37f
sqlite3_bind_blob 0x0 0x1001d260 0x206d0 0x1f0d0 0x4a7
PR_LoadLibraryWithFlags 0x0 0x1001d264 0x206d4 0x1f0d4 0x2fd
KERNEL32.dll (14)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InitializeSListHead 0x0 0x1001d000 0x20470 0x1ee70 0x35a
DisableThreadLibraryCalls 0x0 0x1001d004 0x20474 0x1ee74 0x11b
GetSystemTimeAsFileTime 0x0 0x1001d008 0x20478 0x1ee78 0x2e2
GetCurrentThreadId 0x0 0x1001d00c 0x2047c 0x1ee7c 0x218
GetCurrentProcessId 0x0 0x1001d010 0x20480 0x1ee80 0x214
QueryPerformanceCounter 0x0 0x1001d014 0x20484 0x1ee84 0x440
IsProcessorFeaturePresent 0x0 0x1001d018 0x20488 0x1ee88 0x37d
TerminateProcess 0x0 0x1001d01c 0x2048c 0x1ee8c 0x57c
GetCurrentProcess 0x0 0x1001d020 0x20490 0x1ee90 0x213
SetUnhandledExceptionFilter 0x0 0x1001d024 0x20494 0x1ee94 0x55e
UnhandledExceptionFilter 0x0 0x1001d028 0x20498 0x1ee98 0x59d
WideCharToMultiByte 0x0 0x1001d02c 0x2049c 0x1ee9c 0x5f1
GetTempPathA 0x0 0x1001d030 0x204a0 0x1eea0 0x2ee
IsDebuggerPresent 0x0 0x1001d034 0x204a4 0x1eea4 0x376
VCRUNTIME140.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strrchr 0x0 0x1001d03c 0x204ac 0x1eeac 0x4b
_except_handler4_common 0x0 0x1001d040 0x204b0 0x1eeb0 0x35
memcpy 0x0 0x1001d044 0x204b4 0x1eeb4 0x46
memset 0x0 0x1001d048 0x204b8 0x1eeb8 0x48
memcmp 0x0 0x1001d04c 0x204bc 0x1eebc 0x45
__std_type_info_destroy_list 0x0 0x1001d050 0x204c0 0x1eec0 0x25
api-ms-win-crt-string-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
islower 0x0 0x1001d0a0 0x20510 0x1ef10 0x6b
isupper 0x0 0x1001d0a4 0x20514 0x1ef14 0x6f
isdigit 0x0 0x1001d0a8 0x20518 0x1ef18 0x68
api-ms-win-crt-convert-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
atoi 0x0 0x1001d058 0x204c8 0x1eec8 0x50
api-ms-win-crt-stdio-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__stdio_common_vsprintf 0x0 0x1001d098 0x20508 0x1ef08 0xd
api-ms-win-crt-heap-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
free 0x0 0x1001d068 0x204d8 0x1eed8 0x18
malloc 0x0 0x1001d06c 0x204dc 0x1eedc 0x19
api-ms-win-crt-filesystem-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wchmod 0x0 0x1001d060 0x204d0 0x1eed0 0x28
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initialize_narrow_environment 0x0 0x1001d074 0x204e4 0x1eee4 0x35
_initterm 0x0 0x1001d078 0x204e8 0x1eee8 0x38
_configure_narrow_argv 0x0 0x1001d07c 0x204ec 0x1eeec 0x19
_initialize_onexit_table 0x0 0x1001d080 0x204f0 0x1eef0 0x36
_execute_onexit_table 0x0 0x1001d084 0x204f4 0x1eef4 0x24
_cexit 0x0 0x1001d088 0x204f8 0x1eef8 0x17
_seh_filter_dll 0x0 0x1001d08c 0x204fc 0x1eefc 0x41
_initterm_e 0x0 0x1001d090 0x20500 0x1ef00 0x39
Exports (4)
»
Api name EAT Address Ordinal
C_GetFunctionList 0x6246 0x1
FC_GetFunctionList 0x3218 0x2
NSC_GetFunctionList 0x6246 0x3
NSC_ModuleDBFunc 0x7663 0x4
Digital Signatures (3)
»
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 00:00:00+00:00
Valid Until 2019-06-28 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 12:00:00+00:00
Valid Until 2028-10-22 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 00:00:00+00:00
Valid Until 2031-11-10 00:00:00+00:00
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/ucrtbase.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 1.09 MB
MD5 d6326267ae77655f312d2287903db4d3 Copy to Clipboard
SHA1 1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f Copy to Clipboard
SHA256 0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9 Copy to Clipboard
SSDeep 24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb Copy to Clipboard
ImpHash 1200ab27b3dc27748d0142a31f7a47c7 Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Entry Point 0x10023df0
Size Of Code 0x105a00
Size Of Initialized Data 0xe000
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2054-02-08 16:22:31+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription Microsoft® C Runtime Library
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName ucrtbase.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ucrtbase.dll
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x105a00 0x105a00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.73
.data 0x10107000 0x1b1c 0xe00 0x105e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.22
.idata 0x10109000 0x1536 0x1600 0x106c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.16
.rsrc 0x1010b000 0x410 0x600 0x108200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.47
.reloc 0x1010c000 0xa624 0xa800 0x108800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.78
Imports (25)
»
api-ms-win-core-errorhandling-l1-1-0.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetLastError 0x0 0x10109048 0x1094e8 0x1070e8 0x4
UnhandledExceptionFilter 0x0 0x1010904c 0x1094ec 0x1070ec 0x6
SetUnhandledExceptionFilter 0x0 0x10109050 0x1094f0 0x1070f0 0x5
GetLastError 0x0 0x10109054 0x1094f4 0x1070f4 0x1
SetErrorMode 0x0 0x10109058 0x1094f8 0x1070f8 0x3
RaiseException 0x0 0x1010905c 0x1094fc 0x1070fc 0x2
api-ms-win-core-heap-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
HeapFree 0x0 0x101090ec 0x10958c 0x10718c 0x6
GetProcessHeap 0x0 0x101090f0 0x109590 0x107190 0x0
HeapAlloc 0x0 0x101090f4 0x109594 0x107194 0x2
HeapSize 0x0 0x101090f8 0x109598 0x107198 0xb
HeapReAlloc 0x0 0x101090fc 0x10959c 0x10719c 0x9
HeapValidate 0x0 0x10109100 0x1095a0 0x1071a0 0xe
HeapQueryInformation 0x0 0x10109104 0x1095a4 0x1071a4 0x8
HeapCompact 0x0 0x10109108 0x1095a8 0x1071a8 0x3
HeapWalk 0x0 0x1010910c 0x1095ac 0x1071ac 0xf
api-ms-win-core-synch-l1-1-0.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LeaveCriticalSection 0x0 0x10109238 0x1096d8 0x1072d8 0x13
InitializeCriticalSectionAndSpinCount 0x0 0x1010923c 0x1096dc 0x1072dc 0x10
WaitForSingleObject 0x0 0x10109240 0x1096e0 0x1072e0 0x27
DeleteCriticalSection 0x0 0x10109244 0x1096e4 0x1072e4 0xd
EnterCriticalSection 0x0 0x10109248 0x1096e8 0x1072e8 0xe
api-ms-win-core-processthreads-l1-1-0.dll (17)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCurrentThreadId 0x0 0x101091c0 0x109660 0x107260 0xd
GetCurrentProcess 0x0 0x101091c4 0x109664 0x107264 0xa
TerminateProcess 0x0 0x101091c8 0x109668 0x107268 0x2a
CreateThread 0x0 0x101091cc 0x10966c 0x10726c 0x5
TlsFree 0x0 0x101091d0 0x109670 0x107270 0x2d
ExitThread 0x0 0x101091d4 0x109674 0x107274 0x8
GetCurrentProcessId 0x0 0x101091d8 0x109678 0x107278 0xb
GetExitCodeProcess 0x0 0x101091dc 0x10967c 0x10727c 0xe
GetStartupInfoW 0x0 0x101091e0 0x109680 0x107280 0x15
ResumeThread 0x0 0x101091e4 0x109684 0x107284 0x20
TlsGetValue 0x0 0x101091e8 0x109688 0x107288 0x2e
ExitProcess 0x0 0x101091ec 0x10968c 0x10728c 0x7
TlsSetValue 0x0 0x101091f0 0x109690 0x107290 0x2f
TlsAlloc 0x0 0x101091f4 0x109694 0x107294 0x2c
CreateProcessA 0x0 0x101091f8 0x109698 0x107298 0x0
CreateProcessW 0x0 0x101091fc 0x10969c 0x10729c 0x2
GetCurrentThread 0x0 0x10109200 0x1096a0 0x1072a0 0xc
api-ms-win-core-processenvironment-l1-1-0.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCurrentDirectoryA 0x0 0x1010918c 0x10962c 0x10722c 0x6
GetCurrentDirectoryW 0x0 0x10109190 0x109630 0x107230 0x7
GetCommandLineW 0x0 0x10109194 0x109634 0x107234 0x5
GetCommandLineA 0x0 0x10109198 0x109638 0x107238 0x4
SetEnvironmentVariableA 0x0 0x1010919c 0x10963c 0x10723c 0x11
GetStdHandle 0x0 0x101091a0 0x109640 0x107240 0xc
SetStdHandle 0x0 0x101091a4 0x109644 0x107244 0x13
SetCurrentDirectoryA 0x0 0x101091a8 0x109648 0x107248 0xe
SetEnvironmentVariableW 0x0 0x101091ac 0x10964c 0x10724c 0x12
GetEnvironmentStringsW 0x0 0x101091b0 0x109650 0x107250 0x9
FreeEnvironmentStringsW 0x0 0x101091b4 0x109654 0x107254 0x3
SetCurrentDirectoryW 0x0 0x101091b8 0x109658 0x107258 0xf
api-ms-win-core-file-l1-1-0.dll (26)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetFileTime 0x0 0x10109064 0x109504 0x107104 0x44
CreateDirectoryW 0x0 0x10109068 0x109508 0x107108 0x2
SetFileAttributesW 0x0 0x1010906c 0x10950c 0x10710c 0x40
GetFileAttributesExW 0x0 0x10109070 0x109510 0x107110 0x21
RemoveDirectoryW 0x0 0x10109074 0x109514 0x107114 0x3d
GetDriveTypeW 0x0 0x10109078 0x109518 0x107118 0x1e
GetFileInformationByHandle 0x0 0x1010907c 0x10951c 0x10711c 0x23
GetFullPathNameA 0x0 0x10109080 0x109520 0x107120 0x2a
GetFullPathNameW 0x0 0x10109084 0x109524 0x107124 0x2b
FindFirstFileExA 0x0 0x10109088 0x109528 0x107128 0xf
DeleteFileW 0x0 0x1010908c 0x10952c 0x10712c 0x7
SetEndOfFile 0x0 0x10109090 0x109530 0x107130 0x3e
FlushFileBuffers 0x0 0x10109094 0x109534 0x107134 0x18
UnlockFileEx 0x0 0x10109098 0x109538 0x107138 0x47
LockFileEx 0x0 0x1010909c 0x10953c 0x10713c 0x37
WriteFile 0x0 0x101090a0 0x109540 0x107140 0x48
SetFilePointerEx 0x0 0x101090a4 0x109544 0x107144 0x43
FindNextFileA 0x0 0x101090a8 0x109548 0x107148 0x14
CreateFileW 0x0 0x101090ac 0x10954c 0x10714c 0x4
GetLogicalDrives 0x0 0x101090b0 0x109550 0x107150 0x2d
GetDiskFreeSpaceW 0x0 0x101090b4 0x109554 0x107154 0x1c
FindNextFileW 0x0 0x101090b8 0x109558 0x107158 0x15
ReadFile 0x0 0x101090bc 0x10955c 0x10715c 0x39
FindFirstFileExW 0x0 0x101090c0 0x109560 0x107160 0x10
FindClose 0x0 0x101090c4 0x109564 0x107164 0xa
GetFileType 0x0 0x101090c8 0x109568 0x107168 0x27
api-ms-win-core-libraryloader-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetModuleHandleExW 0x0 0x10109120 0x1095c0 0x1071c0 0xa
GetModuleHandleW 0x0 0x10109124 0x1095c4 0x1071c4 0xb
FreeLibraryAndExitThread 0x0 0x10109128 0x1095c8 0x1071c8 0x4
LoadLibraryExA 0x0 0x1010912c 0x1095cc 0x1071cc 0xd
GetModuleFileNameA 0x0 0x10109130 0x1095d0 0x1071d0 0x6
LoadLibraryExW 0x0 0x10109134 0x1095d4 0x1071d4 0xe
GetModuleFileNameW 0x0 0x10109138 0x1095d8 0x1071d8 0x7
GetProcAddress 0x0 0x1010913c 0x1095dc 0x1071dc 0xc
FreeLibrary 0x0 0x10109140 0x1095e0 0x1071e0 0x3
api-ms-win-core-string-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetStringTypeW 0x0 0x10109224 0x1096c4 0x1072c4 0x5
WideCharToMultiByte 0x0 0x10109228 0x1096c8 0x1072c8 0x7
MultiByteToWideChar 0x0 0x1010922c 0x1096cc 0x1072cc 0x6
CompareStringW 0x0 0x10109230 0x1096d0 0x1072d0 0x2
api-ms-win-core-debug-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
OutputDebugStringA 0x0 0x10109038 0x1094d8 0x1070d8 0x2
IsDebuggerPresent 0x0 0x1010903c 0x1094dc 0x1070dc 0x1
OutputDebugStringW 0x0 0x10109040 0x1094e0 0x1070e0 0x3
api-ms-win-core-localization-l1-2-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCPInfo 0x0 0x10109148 0x1095e8 0x1071e8 0x9
GetUserDefaultLCID 0x0 0x1010914c 0x1095ec 0x1071ec 0x1e
GetOEMCP 0x0 0x10109150 0x1095f0 0x1071f0 0x15
LCMapStringW 0x0 0x10109154 0x1095f4 0x1071f4 0x2f
GetACP 0x0 0x10109158 0x1095f8 0x1071f8 0x8
IsValidLocale 0x0 0x1010915c 0x1095fc 0x1071fc 0x2a
IsValidCodePage 0x0 0x10109160 0x109600 0x107200 0x28
EnumSystemLocalesW 0x0 0x10109164 0x109604 0x107204 0x3
GetLocaleInfoW 0x0 0x10109168 0x109608 0x107208 0x12
api-ms-win-core-datetime-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetTimeFormatW 0x0 0x1010902c 0x1094cc 0x1070cc 0x3
GetDateFormatW 0x0 0x10109030 0x1094d0 0x1070d0 0x1
api-ms-win-core-sysinfo-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetSystemInfo 0x0 0x10109258 0x1096f8 0x1072f8 0x7
GetLocalTime 0x0 0x1010925c 0x1096fc 0x1072fc 0x2
GetSystemTimeAsFileTime 0x0 0x10109260 0x109700 0x107300 0xa
SetLocalTime 0x0 0x10109264 0x109704 0x107304 0x15
api-ms-win-core-processthreads-l1-1-1.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
IsProcessorFeaturePresent 0x0 0x10109208 0x1096a8 0x1072a8 0x9
api-ms-win-core-console-l1-1-0.dll (10)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ReadConsoleW 0x0 0x10109000 0x1094a0 0x1070a0 0x9
WriteConsoleW 0x0 0x10109004 0x1094a4 0x1070a4 0xd
SetConsoleCtrlHandler 0x0 0x10109008 0x1094a8 0x1070a8 0xa
PeekConsoleInputA 0x0 0x1010900c 0x1094ac 0x1070ac 0x5
GetConsoleCP 0x0 0x10109010 0x1094b0 0x1070b0 0x1
SetConsoleMode 0x0 0x10109014 0x1094b4 0x1070b4 0xb
GetNumberOfConsoleInputEvents 0x0 0x10109018 0x1094b8 0x1070b8 0x4
GetConsoleMode 0x0 0x1010901c 0x1094bc 0x1070bc 0x2
ReadConsoleInputW 0x0 0x10109020 0x1094c0 0x1070c0 0x8
ReadConsoleInputA 0x0 0x10109024 0x1094c4 0x1070c4 0x7
api-ms-win-core-handle-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DuplicateHandle 0x0 0x101090e0 0x109580 0x107180 0x2
CloseHandle 0x0 0x101090e4 0x109584 0x107184 0x0
api-ms-win-core-file-l1-2-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetTempPathW 0x0 0x101090d0 0x109570 0x107170 0x1
api-ms-win-core-namedpipe-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PeekNamedPipe 0x0 0x10109180 0x109620 0x107220 0x6
CreatePipe 0x0 0x10109184 0x109624 0x107224 0x2
api-ms-win-core-timezone-l1-1-0.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetTimeZoneInformation 0x0 0x1010926c 0x10970c 0x10730c 0x2
SystemTimeToFileTime 0x0 0x10109270 0x109710 0x107310 0x6
SystemTimeToTzSpecificLocalTime 0x0 0x10109274 0x109714 0x107314 0x7
FileTimeToSystemTime 0x0 0x10109278 0x109718 0x107318 0x0
TzSpecificLocalTimeToSystemTime 0x0 0x1010927c 0x10971c 0x10731c 0x8
api-ms-win-core-file-l2-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MoveFileExW 0x0 0x101090d8 0x109578 0x107178 0x6
api-ms-win-core-synch-l1-2-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
Sleep 0x0 0x10109250 0x1096f0 0x1072f0 0x9
api-ms-win-core-profile-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
QueryPerformanceFrequency 0x0 0x10109210 0x1096b0 0x1072b0 0x1
QueryPerformanceCounter 0x0 0x10109214 0x1096b4 0x1072b4 0x0
api-ms-win-core-memory-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VirtualQuery 0x0 0x10109170 0x109610 0x107210 0xd
VirtualProtect 0x0 0x10109174 0x109614 0x107214 0xb
VirtualAlloc 0x0 0x10109178 0x109618 0x107218 0x7
api-ms-win-core-util-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
Beep 0x0 0x10109284 0x109724 0x107324 0x0
EncodePointer 0x0 0x10109288 0x109728 0x107328 0x3
DecodePointer 0x0 0x1010928c 0x10972c 0x10732c 0x1
api-ms-win-core-rtlsupport-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RtlUnwind 0x0 0x1010921c 0x1096bc 0x1072bc 0x2
api-ms-win-core-interlocked-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InterlockedPushEntrySList 0x0 0x10109114 0x1095b4 0x1071b4 0x9
InterlockedFlushSList 0x0 0x10109118 0x1095b8 0x1071b8 0x6
Exports (2542)
»
Api name EAT Address Ordinal
_CIacos 0x40490 0x1
_CIasin 0x41070 0x2
_CIatan 0x41cb0 0x3
_CIatan2 0x3fde0 0x4
_CIcos 0x42660 0x5
_CIcosh 0x3fdfc 0x6
_CIexp 0x3fd90 0x7
_CIfmod 0x40020 0x8
_CIlog 0x43930 0x9
_CIlog10 0x432e0 0xa
_CIpow 0x440e0 0xb
_CIsin 0x45a10 0xc
_CIsinh 0x3fdf0 0xd
_CIsqrt 0x45eb0 0xe
_CItan 0x460d0 0xf
_CItanh 0x3fe04 0x10
_Cbuild 0xae810 0x11
_Cmulcc 0xae3b0 0x12
_Cmulcr 0xae450 0x13
_CreateFrameInfo 0x46910 0x14
_CxxThrowException 0x46ab0 0x15
_EH_prolog 0x52220 0x16
_Exit 0x95070 0x17
_FCbuild 0xae910 0x18
_FCmulcc 0xae5d0 0x19
_FCmulcr 0xae620 0x1a
_FindAndUnlinkFrame 0x46940 0x1b
_Getdays 0x37320 0x1c
_Getmonths 0x37450 0x1d
_Gettnames 0x34fa0 0x1e
_IsExceptionObjectToBeDestroyed 0x46bf0 0x1f
_LCbuild 0xae810 0x20
_LCmulcc 0xae3b0 0x21
_LCmulcr 0xae450 0x22
_NLG_Dispatch2 0x46f73 0x23
_NLG_Return 0x46fa7 0x24
_NLG_Return2 0x46f7d 0x25
_SetWinRTOutOfMemoryExceptionCallback 0x46c20 0x26
_Strftime 0xd6630 0x27
_W_Getdays 0x38170 0x28
_W_Getmonths 0x382f0 0x29
_W_Gettnames 0x35010 0x2a
_Wcsftime 0xd9870 0x2b
__AdjustPointer 0x46c40 0x2c
__BuildCatchObject 0x478e0 0x2d
__BuildCatchObjectHelper 0x47980 0x2e
__CxxDetectRethrow 0x47d40 0x2f
__CxxExceptionFilter 0x47da0 0x30
__CxxFrameHandler 0x46a40 0x31
__CxxFrameHandler2 0x46a40 0x32
__CxxFrameHandler3 0x46a40 0x33
__CxxLongjmpUnwind 0x46a80 0x34
__CxxQueryExceptionSize 0x47f00 0x35
__CxxRegisterExceptionObject 0x47f10 0x36
__CxxUnregisterExceptionObject 0x47fc0 0x37
__DestructExceptionObject 0x46b40 0x38
__FrameUnwindFilter 0x46c70 0x39
__GetPlatformExceptionInfo 0x46cc0 0x3a
__RTCastToVoid 0x485d0 0x3b
__RTDynamicCast 0x48640 0x3c
__RTtypeid 0x48730 0x3d
__TypeMatch 0x47ca0 0x3e
___lc_codepage_func 0x24260 0x3f
___lc_collate_cp_func 0x21fe0 0x40
___lc_locale_name_func 0x24330 0x41
___mb_cur_max_func 0x23e20 0x42
___mb_cur_max_l_func 0x90890 0x43
__acrt_iob_func 0x24000 0x44
__conio_common_vcprintf 0xbea00 0x45
__conio_common_vcprintf_p 0xbea30 0x46
__conio_common_vcprintf_s 0xbea60 0x47
__conio_common_vcscanf 0xc32e0 0x48
__conio_common_vcwprintf 0xbea90 0x49
__conio_common_vcwprintf_p 0xbeac0 0x4a
__conio_common_vcwprintf_s 0xbeaf0 0x4b
__conio_common_vcwscanf 0xc3310 0x4c
__control87_2 0x586c0 0x4d
__current_exception 0x46d20 0x4e
__current_exception_context 0x46d30 0x4f
__daylight 0xd6d40 0x50
__dcrt_get_wide_environment_from_os 0x34e70 0x51
__dcrt_initial_narrow_environment 0x1089f4 0x52
__doserrno 0x910b0 0x53
__dstbias 0xd6d60 0x54
__fpe_flt_rounds 0xb1850 0x55
__fpecode 0x91e30 0x56
__initialize_lconv_for_unsigned_char 0x3bb60 0x57
__intrinsic_abnormal_termination 0x46f2a 0x58
__intrinsic_setjmp 0x487c0 0x59
__isascii 0x3a330 0x5a
__iscsym 0x8c9e0 0x5b
__iscsymf 0x8ca10 0x5c
__iswcsym 0x8d260 0x5d
__iswcsymf 0x8d290 0x5e
__libm_sse2_acos 0x562f0 0x5f
__libm_sse2_acosf 0x55f00 0x60
__libm_sse2_asin 0x56b70 0x61
__libm_sse2_asinf 0x567a0 0x62
__libm_sse2_atan 0x57690 0x63
__libm_sse2_atan2 0x56fc0 0x64
__libm_sse2_atanf 0x574e0 0x65
__libm_sse2_cos 0x57a10 0x66
__libm_sse2_cosf 0x578b0 0x67
__libm_sse2_exp 0x57d20 0x68
__libm_sse2_expf 0x57bc0 0x69
__libm_sse2_log 0x59320 0x6a
__libm_sse2_log10 0x58f50 0x6b
__libm_sse2_log10f 0x58dd0 0x6c
__libm_sse2_logf 0x591a0 0x6d
__libm_sse2_pow 0x59c10 0x6e
__libm_sse2_powf 0x59550 0x6f
__libm_sse2_sin 0x5a7e0 0x70
__libm_sse2_sinf 0x5a690 0x71
__libm_sse2_tan 0x5ab40 0x72
__libm_sse2_tanf 0x5a9a0 0x73
__p___argc 0x21470 0x74
__p___argv 0x933d0 0x75
__p___wargv 0x3b1e0 0x76
__p__acmdln 0x933e0 0x77
__p__commode 0x218b0 0x78
__p__environ 0xd9ac0 0x79
__p__fmode 0xd2e50 0x7a
__p__mbcasemap 0x90e30 0x7b
__p__mbctype 0x90e50 0x7c
__p__pgmptr 0x933f0 0x7d
__p__wcmdln 0x93400 0x7e
__p__wenviron 0xd9ae0 0x7f
__p__wpgmptr 0x93410 0x80
__pctype_func 0x23620 0x81
__processing_throw 0x46d40 0x82
__pwctype_func 0x8f2e0 0x83
__pxcptinfoptrs 0x91e40 0x84
__report_gsfailure 0x522a0 0x85
__setusermatherr 0xb5670 0x86
__std_exception_copy 0x48800 0x87
__std_exception_destroy 0x48870 0x88
__std_terminate 0x46d50 0x89
__std_type_info_compare 0x488c0 0x8a
__std_type_info_destroy_list 0x48910 0x8b
__std_type_info_hash 0x48940 0x8c
__std_type_info_name 0x48970 0x8d
__stdio_common_vfprintf 0xa6c20 0x8e
__stdio_common_vfprintf_p 0xa6c50 0x8f
__stdio_common_vfprintf_s 0xa6c80 0x90
__stdio_common_vfscanf 0x9ec80 0x91
__stdio_common_vfwprintf 0x388e0 0x92
__stdio_common_vfwprintf_p 0xa6cb0 0x93
__stdio_common_vfwprintf_s 0xa6ce0 0x94
__stdio_common_vfwscanf 0x9ecb0 0x95
__stdio_common_vsnprintf_s 0x261b0 0x96
__stdio_common_vsnwprintf_s 0x22a10 0x97
__stdio_common_vsprintf 0x2d5b0 0x98
__stdio_common_vsprintf_p 0xa6d10 0x99
__stdio_common_vsprintf_s 0x22d00 0x9a
__stdio_common_vsscanf 0x29470 0x9b
__stdio_common_vswprintf 0x24de0 0x9c
__stdio_common_vswprintf_p 0xa6d40 0x9d
__stdio_common_vswprintf_s 0x2f290 0x9e
__stdio_common_vswscanf 0x2a0e0 0x9f
__strncnt 0x3cfe0 0xa0
__sys_errlist 0x92530 0xa1
__sys_nerr 0x92540 0xa2
__threadhandle 0x8e450 0xa3
__threadid 0x8e460 0xa4
__timezone 0xd6d80 0xa5
__toascii 0x8ca40 0xa6
__tzname 0xd6da0 0xa7
__unDName 0x4e1e0 0xa8
__unDNameEx 0x4e280 0xa9
__uncaught_exception 0x46d60 0xaa
__uncaught_exceptions 0x46d70 0xab
__wcserror 0x932b0 0xac
__wcserror_s 0x932d0 0xad
__wcsncnt 0x3eb70 0xae
_abs64 0x3bda0 0xaf
_access 0xc5240 0xb0
_access_s 0xc5260 0xb1
_aligned_free 0x3b960 0xb2
_aligned_malloc 0x3b940 0xb3
_aligned_msize 0x8d3d0 0xb4
_aligned_offset_malloc 0x8d510 0xb5
_aligned_offset_realloc 0x8d530 0xb6
_aligned_offset_recalloc 0x8da40 0xb7
_aligned_realloc 0x8dbb0 0xb8
_aligned_recalloc 0x8dbd0 0xb9
_assert 0x94d70 0xba
_atodbl 0x875e0 0xbb
_atodbl_l 0x87600 0xbc
_atof_l 0x87620 0xbd
_atoflt 0x87640 0xbe
_atoflt_l 0x87660 0xbf
_atoi64 0x3b4f0 0xc0
_atoi64_l 0x885c0 0xc1
_atoi_l 0x885f0 0xc2
_atol_l 0x885f0 0xc3
_atoldbl 0x88500 0xc4
_atoldbl_l 0x88520 0xc5
_atoll_l 0x885c0 0xc6
_beep 0xf0790 0xc7
_beginthread 0x951d0 0xc8
_beginthreadex 0x3aea0 0xc9
_byteswap_uint64 0xa9680 0xca
_byteswap_ulong 0xa9720 0xcb
_byteswap_ushort 0xa9760 0xcc
_c_exit 0x95030 0xcd
_cabs 0xf3060 0xce
_callnewh 0x8e130 0xcf
_calloc_base 0x27800 0xd0
_cexit 0x95050 0xd1
_cgets 0xb93f0 0xd2
_cgets_s 0xb9620 0xd3
_cgetws 0xb9770 0xd4
_cgetws_s 0xb99a0 0xd5
_chdir 0xeee60 0xd6
_chdrive 0xeeec0 0xd7
_chgsign 0xf3e70 0xd8
_chgsignf 0xf3eb0 0xd9
_chkesp 0x4e370 0xda
_chmod 0xc52c0 0xdb
_chsize 0xcede0 0xdc
_chsize_s 0xcf660 0xdd
_clearfp 0x589f0 0xde
_close 0x31e60 0xdf
_commit 0x34a00 0xe0
_configthreadlocale 0x3a070 0xe1
_configure_narrow_argv 0x358a0 0xe2
_configure_wide_argv 0x359b0 0xe3
_control87 0x541b0 0xe4
_controlfp 0xf3550 0xe5
_controlfp_s 0x397a0 0xe6
_copysign 0xf3ee0 0xe7
_copysignf 0xf3f10 0xe8
_cputs 0xbeb20 0xe9
_cputws 0xbebd0 0xea
_creat 0xcfc40 0xeb
_create_locale 0x3b370 0xec
_crt_at_quick_exit 0x950f0 0xed
_crt_atexit 0x21f90 0xee
_crt_debugger_hook 0x525b0 0xef
_ctime32 0xd4cc0 0xf0
_ctime32_s 0xd4ce0 0xf1
_ctime64 0xd4d00 0xf2
_ctime64_s 0xd4d20 0xf3
_cwait 0xe4070 0xf4
_d_int 0x21650 0xf5
_dclass 0xb57e0 0xf6
_dexp 0xb0b40 0xf7
_difftime32 0xd4ec0 0xf8
_difftime64 0x3ba00 0xf9
_dlog 0x21500 0xfa
_dnorm 0xb8a10 0xfb
_dpcomp 0xb56b0 0xfc
_dpoly 0xb0600 0xfd
_dscale 0xb8c70 0xfe
_dsign 0xb5710 0xff
_dsin 0xb48f0 0x100
_dtest 0x20f10 0x101
_dunscale 0x214a0 0x102
_dup 0xcfe20 0x103
_dup2 0xd0210 0x104
_dupenv_s 0xda080 0x105
_ecvt 0x890d0 0x106
_ecvt_s 0x343f0 0x107
_endthread 0x95350 0x108
_endthreadex 0x95360 0x109
_eof 0xd0690 0x10a
_errno 0x261e0 0x10b
_except1 0xb2d40 0x10c
_except_handler2 0x4e3a8 0x10d
_except_handler3 0x4e478 0x10e
_except_handler4_common 0x4e600 0x10f
_execl 0xe0050 0x110
_execle 0xe0080 0x111
_execlp 0xe07b0 0x112
_execlpe 0xe07e0 0x113
_execute_onexit_table 0x238c0 0x114
_execv 0xe20f0 0x115
_execve 0xe2110 0x116
_execvp 0xe3280 0x117
_execvpe 0xe32a0 0x118
_exit 0x95070 0x119
_expand 0x8dc40 0x11a
_fclose_nolock 0x31cc0 0x11b
_fcloseall 0x95450 0x11c
_fcvt 0x89120 0x11d
_fcvt_s 0x891d0 0x11e
_fd_int 0x20ba0 0x11f
_fdclass 0xb5730 0x120
_fdexp 0xb0e60 0x121
_fdlog 0xb5060 0x122
_fdnorm 0xb8ba0 0x123
_fdopen 0x95780 0x124
_fdpcomp 0xb5750 0x125
_fdpoly 0xb03b0 0x126
_fdscale 0xb8ee0 0x127
_fdsign 0xb57b0 0x128
_fdsin 0xb4110 0x129
_fdtest 0xb92b0 0x12a
_fdunscale 0xb9350 0x12b
_fflush_nolock 0x33c50 0x12c
_fgetc_nolock 0x959d0 0x12d
_fgetchar 0x95af0 0x12e
_fgetwc_nolock 0x95fb0 0x12f
_fgetwchar 0x96200 0x130
_filelength 0xd0e80 0x131
_filelengthi64 0xd0ea0 0x132
_fileno 0x31450 0x133
_findclose 0xc7e50 0x134
_findfirst32 0xc7f50 0x135
_findfirst32i64 0xc7f70 0x136
_findfirst64 0xc7f90 0x137
_findfirst64i32 0xc7fb0 0x138
_findnext32 0xc7fd0 0x139
_findnext32i64 0xc8030 0x13a
_findnext64 0xc80a0 0x13b
_findnext64i32 0xc8110 0x13c
_finite 0x38970 0x13d
_flushall 0x959c0 0x13e
_fpclass 0xf3f40 0x13f
_fpieee_flt 0x57f70 0x140
_fpreset 0x58ae0 0x141
_fputc_nolock 0x96700 0x142
_fputchar 0x96880 0x143
_fputwc_nolock 0x33ca0 0x144
_fputwchar 0x96950 0x145
_fread_nolock 0x96a20 0x146
_fread_nolock_s 0x32610 0x147
_free_base 0x27e40 0x148
_free_locale 0x90bc0 0x149
_fseek_nolock 0x96df0 0x14a
_fseeki64 0x96e10 0x14b
_fseeki64_nolock 0x96e30 0x14c
_fsopen 0x340e0 0x14d
_fstat32 0xce1c0 0x14e
_fstat32i64 0xce1e0 0x14f
_fstat64 0xce200 0x150
_fstat64i32 0xce220 0x151
_ftell_nolock 0x97490 0x152
_ftelli64 0x974a0 0x153
_ftelli64_nolock 0x974b0 0x154
_ftime32 0xd5330 0x155
_ftime32_s 0xd5330 0x156
_ftime64 0xd5350 0x157
_ftime64_s 0xd5350 0x158
_ftol 0x431b0 0x159
_fullpath 0xc8610 0x15a
_futime32 0xd9140 0x15b
_futime64 0xd9160 0x15c
_fwrite_nolock 0x31860 0x15d
_gcvt 0x89380 0x15e
_gcvt_s 0x893b0 0x15f
_get_current_locale 0x90c90 0x160
_get_daylight 0xd6dc0 0x161
_get_doserrno 0x91180 0x162
_get_dstbias 0xd6ed0 0x163
_get_errno 0x396a0 0x164
_get_fmode 0x395c0 0x165
_get_heap_handle 0x3bde0 0x166
_get_initial_narrow_environment 0xd9b00 0x167
_get_initial_wide_environment 0x3b180 0x168
_get_invalid_parameter_handler 0x91680 0x169
_get_narrow_winmain_command_line 0x37590 0x16a
_get_osfhandle 0x348f0 0x16b
_get_pgmptr 0x93420 0x16c
_get_printf_count_output 0xa6d70 0x16d
_get_purecall_handler 0x4e790 0x16e
_get_stream_buffer_pointers 0x387f0 0x16f
_get_terminate 0x92550 0x170
_get_thread_local_invalid_parameter_handler 0x916b0 0x171
_get_timezone 0xd6fe0 0x172
_get_tzname 0xd70f0 0x173
_get_unexpected 0x4e820 0x174
_get_wide_winmain_command_line 0x38470 0x175
_get_wpgmptr 0x93530 0x176
_getc_nolock 0x95b10 0x177
_getch 0xc3340 0x178
_getch_nolock 0xc33a0 0x179
_getche 0xc3480 0x17a
_getche_nolock 0xc34e0 0x17b
_getcwd 0xf0600 0x17c
_getdcwd 0xf0620 0x17d
_getdiskfree 0xef2a0 0x17e
_getdllprocaddr 0xdf9e0 0x17f
_getdrive 0xef100 0x180
_getdrives 0xef290 0x181
_getmaxstdio 0xa7600 0x182
_getmbcp 0x90e70 0x183
_getpid 0x91670 0x184
_getsystime 0xf07d0 0x185
_getw 0x978a0 0x186
_getwc_nolock 0x96220 0x187
_getwch 0xc37d0 0x188
_getwch_nolock 0xc3830 0x189
_getwche 0xc3910 0x18a
_getwche_nolock 0xc3970 0x18b
_getws 0x977a0 0x18c
_getws_s 0x977c0 0x18d
_global_unwind2 0x46e40 0x18e
_gmtime32 0xd5370 0x18f
_gmtime32_s 0x37c90 0x190
_gmtime64 0x37bf0 0x191
_gmtime64_s 0x37d80 0x192
_heapchk 0xe4390 0x193
_heapmin 0xe43b0 0x194
_heapwalk 0x8dfb0 0x195
_hypot 0xf3340 0x196
_hypotf 0xf3370 0x197
_i64toa 0x8c6f0 0x198
_i64toa_s 0x8c740 0x199
_i64tow 0x8c790 0x19a
_i64tow_s 0x8c7e0 0x19b
_initialize_narrow_environment 0x3bbe0 0x19c
_initialize_onexit_table 0x23f50 0x19d
_initialize_wide_environment 0x21ea0 0x19e
_initterm 0x229a0 0x19f
_initterm_e 0x226f0 0x1a0
_invalid_parameter_noinfo 0x918c0 0x1a1
_invalid_parameter_noinfo_noreturn 0x918e0 0x1a2
_invoke_watson 0x91900 0x1a3
_is_exception_typeof 0x46d90 0x1a4
_isalnum_l 0x8ca60 0x1a5
_isalpha_l 0x8cab0 0x1a6
_isatty 0x31400 0x1a7
_isblank_l 0x8cb00 0x1a8
_iscntrl_l 0x315c0 0x1a9
_isctype 0x89780 0x1aa
_isctype_l 0x897c0 0x1ab
_isdigit_l 0x8cb50 0x1ac
_isgraph_l 0x8cba0 0x1ad
_isleadbyte_l 0x8d1f0 0x1ae
_islower_l 0x8cbf0 0x1af
_ismbbalnum 0xe4570 0x1b0
_ismbbalnum_l 0xe4590 0x1b1
_ismbbalpha 0xe45b0 0x1b2
_ismbbalpha_l 0xe45d0 0x1b3
_ismbbblank 0xe45f0 0x1b4
_ismbbblank_l 0xe4620 0x1b5
_ismbbgraph 0xe4650 0x1b6
_ismbbgraph_l 0xe4670 0x1b7
_ismbbkalnum 0xe4690 0x1b8
_ismbbkalnum_l 0xe46b0 0x1b9
_ismbbkana 0xe46d0 0x1ba
_ismbbkana_l 0xe46f0 0x1bb
_ismbbkprint 0xe4750 0x1bc
_ismbbkprint_l 0xe4770 0x1bd
_ismbbkpunct 0xe4790 0x1be
_ismbbkpunct_l 0xe47b0 0x1bf
_ismbblead 0x2b360 0x1c0
_ismbblead_l 0xe47d0 0x1c1
_ismbbprint 0xe47f0 0x1c2
_ismbbprint_l 0xe4810 0x1c3
_ismbbpunct 0xe4830 0x1c4
_ismbbpunct_l 0xe4850 0x1c5
_ismbbtrail 0xe4870 0x1c6
_ismbbtrail_l 0xe4890 0x1c7
_ismbcalnum 0xe4430 0x1c8
_ismbcalnum_l 0xe4450 0x1c9
_ismbcalpha 0xe44d0 0x1ca
_ismbcalpha_l 0xe44f0 0x1cb
_ismbcblank 0xe4cf0 0x1cc
_ismbcblank_l 0xe4d10 0x1cd
_ismbcdigit 0xe48b0 0x1ce
_ismbcdigit_l 0xe48d0 0x1cf
_ismbcgraph 0xe4930 0x1d0
_ismbcgraph_l 0xe4950 0x1d1
_ismbchira 0xe49d0 0x1d2
_ismbchira_l 0xe49f0 0x1d3
_ismbckata 0xe4a50 0x1d4
_ismbckata_l 0xe4a70 0x1d5
_ismbcl0 0xe55b0 0x1d6
_ismbcl0_l 0xe55d0 0x1d7
_ismbcl1 0xe5640 0x1d8
_ismbcl1_l 0xe5660 0x1d9
_ismbcl2 0xe56e0 0x1da
_ismbcl2_l 0xe5700 0x1db
_ismbclegal 0xe4b50 0x1dc
_ismbclegal_l 0xe4b70 0x1dd
_ismbclower 0xe4bd0 0x1de
_ismbclower_l 0xe4bf0 0x1df
_ismbcprint 0xe4c50 0x1e0
_ismbcprint_l 0xe4c70 0x1e1
_ismbcpunct 0xe4d90 0x1e2
_ismbcpunct_l 0xe4db0 0x1e3
_ismbcspace 0xe4fb0 0x1e4
_ismbcspace_l 0xe4fd0 0x1e5
_ismbcsymbol 0xe4ad0 0x1e6
_ismbcsymbol_l 0xe4af0 0x1e7
_ismbcupper 0xe5030 0x1e8
_ismbcupper_l 0xe5050 0x1e9
_ismbslead 0xe4e20 0x1ea
_ismbslead_l 0xe4e40 0x1eb
_ismbstrail 0x898c0 0x1ec
_ismbstrail_l 0x898e0 0x1ed
_isnan 0x34df0 0x1ee
_isprint_l 0x8cc40 0x1ef
_ispunct_l 0x8cc90 0x1f0
_isspace_l 0x31610 0x1f1
_isupper_l 0x8cce0 0x1f2
_iswalnum_l 0x23bb0 0x1f3
_iswalpha_l 0x21f70 0x1f4
_iswblank_l 0x8d380 0x1f5
_iswcntrl_l 0x8d240 0x1f6
_iswcsym_l 0x8d260 0x1f7
_iswcsymf_l 0x8d290 0x1f8
_iswctype_l 0x89a50 0x1f9
_iswdigit_l 0x23c90 0x1fa
_iswgraph_l 0x8d2c0 0x1fb
_iswlower_l 0x8d2e0 0x1fc
_iswprint_l 0x8d300 0x1fd
_iswpunct_l 0x8d320 0x1fe
_iswspace_l 0x8d340 0x1ff
_iswupper_l 0x8d3b0 0x200
_iswxdigit_l 0x21880 0x201
_isxdigit_l 0x8cd30 0x202
_itoa 0x8c830 0x203
_itoa_s 0x8c870 0x204
_itow 0x8c8b0 0x205
_itow_s 0x37110 0x206
_j0 0xaa7c0 0x207
_j1 0xaa920 0x208
_jn 0xaaab0 0x209
_kbhit 0xc35d0 0x20a
_ld_int 0xb9330 0x20b
_ldclass 0xb57e0 0x20c
_ldexp 0xb11b0 0x20d
_ldlog 0xb51f0 0x20e
_ldpcomp 0xb56b0 0x20f
_ldpoly 0xb0600 0x210
_ldscale 0xb9090 0x211
_ldsign 0xb5710 0x212
_ldsin 0xb48f0 0x213
_ldtest 0xb9340 0x214
_ldunscale 0xb93e0 0x215
_lfind 0xa97d0 0x216
_lfind_s 0xa9aa0 0x217
_libm_sse2_acos_precise 0x40b00 0x218
_libm_sse2_asin_precise 0x41700 0x219
_libm_sse2_atan_precise 0x42060 0x21a
_libm_sse2_cos_precise 0x42900 0x21b
_libm_sse2_exp_precise 0x42dd0 0x21c
_libm_sse2_log10_precise 0x43680 0x21d
_libm_sse2_log_precise 0x43cb0 0x21e
_libm_sse2_pow_precise 0x44e60 0x21f
_libm_sse2_sin_precise 0x45cd0 0x220
_libm_sse2_sqrt_precise 0x45f70 0x221
_libm_sse2_tan_precise 0x46420 0x222
_loaddll 0xdfa20 0x223
_local_unwind2 0x46ea6 0x224
_local_unwind4 0x4e8a0 0x225
_localtime32 0xd5b80 0x226
_localtime32_s 0xd5bb0 0x227
_localtime64 0xd5bd0 0x228
_localtime64_s 0xd5c00 0x229
_lock_file 0x3bba0 0x22a
_lock_locales 0x2c7e0 0x22b
_locking 0xd10c0 0x22c
_logb 0xf3ff0 0x22d
_longjmpex 0x4ea10 0x22e
_lrotl 0xaa2a0 0x22f
_lrotr 0xaa300 0x230
_lsearch 0xa9dc0 0x231
_lsearch_s 0xaa030 0x232
_lseek 0xd1620 0x233
_lseeki64 0x53900 0x234
_ltoa 0x24ab0 0x235
_ltoa_s 0x8c870 0x236
_ltow 0x8c8b0 0x237
_ltow_s 0x37110 0x238
_makepath 0xc8cb0 0x239
_makepath_s 0xc8ce0 0x23a
_malloc_base 0x28d70 0x23b
_mbbtombc 0xee700 0x23c
_mbbtombc_l 0xee720 0x23d
_mbbtype 0xe50b0 0x23e
_mbbtype_l 0xe50d0 0x23f
_mbcasemap 0x108378 0x240
_mbccpy 0xe5160 0x241
_mbccpy_l 0xe5180 0x242
_mbccpy_s 0xe51b0 0x243
_mbccpy_s_l 0xe51e0 0x244
_mbcjistojms 0xee3a0 0x245
_mbcjistojms_l 0xee3c0 0x246
_mbcjmstojis 0xee540 0x247
_mbcjmstojis_l 0xee560 0x248
_mbclen 0xe5530 0x249
_mbclen_l 0xe5570 0x24a
_mbctohira 0xee140 0x24b
_mbctohira_l 0xee160 0x24c
_mbctokata 0xee1a0 0x24d
_mbctokata_l 0xee1c0 0x24e
_mbctolower 0xee200 0x24f
_mbctolower_l 0xee220 0x250
_mbctombb 0xee7b0 0x251
_mbctombb_l 0xee7d0 0x252
_mbctoupper 0xee2d0 0x253
_mbctoupper_l 0xee2f0 0x254
_mblen_l 0x89a70 0x255
_mbsbtype 0xe5780 0x256
_mbsbtype_l 0xe57a0 0x257
_mbscat_s 0xe59e0 0x258
_mbscat_s_l 0xe5a00 0x259
_mbschr 0xe5f30 0x25a
_mbschr_l 0xe5f50 0x25b
_mbscmp 0xe60d0 0x25c
_mbscmp_l 0xe60f0 0x25d
_mbscoll 0xe62d0 0x25e
_mbscoll_l 0xe62f0 0x25f
_mbscpy_s 0xe6540 0x260
_mbscpy_s_l 0xe6560 0x261
_mbscspn 0xe6970 0x262
_mbscspn_l 0xe6990 0x263
_mbsdec 0xe6b40 0x264
_mbsdec_l 0xe6b60 0x265
_mbsdup 0x3c7f0 0x266
_mbsicmp 0xe6cc0 0x267
_mbsicmp_l 0xe6ce0 0x268
_mbsicoll 0xe7030 0x269
_mbsicoll_l 0xe7050 0x26a
_mbsinc 0xe72a0 0x26b
_mbsinc_l 0xe73c0 0x26c
_mbslen 0xe73f0 0x26d
_mbslen_l 0xe7410 0x26e
_mbslwr 0xe7530 0x26f
_mbslwr_l 0xe7560 0x270
_mbslwr_s 0xe7590 0x271
_mbslwr_s_l 0xe75b0 0x272
_mbsnbcat 0xe79f0 0x273
_mbsnbcat_l 0xe7a10 0x274
_mbsnbcat_s 0xe7c10 0x275
_mbsnbcat_s_l 0xe7c40 0x276
_mbsnbcmp 0xe8270 0x277
_mbsnbcmp_l 0xe8290 0x278
_mbsnbcnt 0xe8490 0x279
_mbsnbcnt_l 0xe84b0 0x27a
_mbsnbcoll 0xe8610 0x27b
_mbsnbcoll_l 0xe8630 0x27c
_mbsnbcpy 0xe8980 0x27d
_mbsnbcpy_l 0xe89a0 0x27e
_mbsnbcpy_s 0xe8b40 0x27f
_mbsnbcpy_s_l 0xe8b70 0x280
_mbsnbicmp 0xe9060 0x281
_mbsnbicmp_l 0xe9080 0x282
_mbsnbicoll 0xe9330 0x283
_mbsnbicoll_l 0xe9350 0x284
_mbsnbset 0xe95c0 0x285
_mbsnbset_l 0xe95e0 0x286
_mbsnbset_s 0xe9880 0x287
_mbsnbset_s_l 0xe98b0 0x288
_mbsncat 0xe9d60 0x289
_mbsncat_l 0xe9d80 0x28a
_mbsncat_s 0xe9f70 0x28b
_mbsncat_s_l 0xe9fa0 0x28c
_mbsnccnt 0xea5b0 0x28d
_mbsnccnt_l 0xea5d0 0x28e
_mbsncmp 0xea730 0x28f
_mbsncmp_l 0xea750 0x290
_mbsncoll 0xea930 0x291
_mbsncoll_l 0xea950 0x292
_mbsncpy 0xeacc0 0x293
_mbsncpy_l 0xeace0 0x294
_mbsncpy_s 0xeae80 0x295
_mbsncpy_s_l 0xeaeb0 0x296
_mbsnextc 0xeb3e0 0x297
_mbsnextc_l 0xeb400 0x298
_mbsnicmp 0xeb540 0x299
_mbsnicmp_l 0xeb560 0x29a
_mbsnicoll 0xeb7f0 0x29b
_mbsnicoll_l 0xeb810 0x29c
_mbsninc 0xebb80 0x29d
_mbsninc_l 0xebba0 0x29e
_mbsnlen 0xe7480 0x29f
_mbsnlen_l 0xe74a0 0x2a0
_mbsnset 0xebbd0 0x2a1
_mbsnset_l 0xebbf0 0x2a2
_mbsnset_s 0xebf20 0x2a3
_mbsnset_s_l 0xebf50 0x2a4
_mbspbrk 0xec400 0x2a5
_mbspbrk_l 0xec420 0x2a6
_mbsrchr 0xec5e0 0x2a7
_mbsrchr_l 0xec600 0x2a8
_mbsrev 0xec780 0x2a9
_mbsrev_l 0xec7a0 0x2aa
_mbsset 0xeca00 0x2ab
_mbsset_l 0xeca20 0x2ac
_mbsset_s 0xecc90 0x2ad
_mbsset_s_l 0xeccb0 0x2ae
_mbsspn 0xed060 0x2af
_mbsspn_l 0xed080 0x2b0
_mbsspnp 0xed230 0x2b1
_mbsspnp_l 0xed250 0x2b2
_mbsstr 0xed410 0x2b3
_mbsstr_l 0xed430 0x2b4
_mbstok 0xed5f0 0x2b5
_mbstok_l 0xed6e0 0x2b6
_mbstok_s 0xed7d0 0x2b7
_mbstok_s_l 0xed7f0 0x2b8
_mbstowcs_l 0x8aaf0 0x2b9
_mbstowcs_s_l 0x292c0 0x2ba
_mbstrlen 0x8d050 0x2bb
_mbstrlen_l 0x8d090 0x2bc
_mbstrnlen 0x8d0b0 0x2bd
_mbstrnlen_l 0x8d0d0 0x2be
_mbsupr 0xedc80 0x2bf
_mbsupr_l 0xedcb0 0x2c0
_mbsupr_s 0xedce0 0x2c1
_mbsupr_s_l 0xedd00 0x2c2
_mbtowc_l 0x2c470 0x2c3
_memccpy 0x3c1e0 0x2c4
_memicmp 0x3c330 0x2c5
_memicmp_l 0x3c3a0 0x2c6
_mkdir 0xc8d70 0x2c7
_mkgmtime32 0x37a30 0x2c8
_mkgmtime64 0x37730 0x2c9
_mktemp 0xd2600 0x2ca
_mktemp_s 0xd2620 0x2cb
_mktime32 0xd60d0 0x2cc
_mktime64 0xd60f0 0x2cd
_msize 0x235f0 0x2ce
_nextafter 0xb5870 0x2cf
_o__CIacos 0x545b0 0x2d0
_o__CIasin 0x54610 0x2d1
_o__CIatan 0x54670 0x2d2
_o__CIatan2 0x544f0 0x2d3
_o__CIcos 0x53ee0 0x2d4
_o__CIcosh 0x546d0 0x2d5
_o__CIexp 0x540c0 0x2d6
_o__CIfmod 0x54730 0x2d7
_o__CIlog 0x54320 0x2d8
_o__CIlog10 0x54550 0x2d9
_o__CIpow 0x54490 0x2da
_o__CIsin 0x53fd0 0x2db
_o__CIsinh 0x54790 0x2dc
_o__CIsqrt 0x53df0 0x2dd
_o__CItan 0x54380 0x2de
_o__CItanh 0x547f0 0x2df
_o__Getdays 0x37300 0x2e0
_o__Getmonths 0x37310 0x2e1
_o__Gettnames 0x34f90 0x2e2
_o__Strftime 0x7f580 0x2e3
_o__W_Getdays 0x38150 0x2e4
_o__W_Getmonths 0x38160 0x2e5
_o__W_Gettnames 0x34fb0 0x2e6
_o__Wcsftime 0x7f5b0 0x2e7
_o____lc_codepage_func 0x2b710 0x2e8
_o____lc_collate_cp_func 0x3b150 0x2e9
_o____lc_locale_name_func 0x2b3f0 0x2ea
_o____mb_cur_max_func 0x2c460 0x2eb
_o___acrt_iob_func 0x23fa0 0x2ec
_o___conio_common_vcprintf 0x7f5e0 0x2ed
_o___conio_common_vcprintf_p 0x7f610 0x2ee
_o___conio_common_vcprintf_s 0x7f640 0x2ef
_o___conio_common_vcscanf 0x7f670 0x2f0
_o___conio_common_vcwprintf 0x7f6a0 0x2f1
_o___conio_common_vcwprintf_p 0x7f6d0 0x2f2
_o___conio_common_vcwprintf_s 0x7f700 0x2f3
_o___conio_common_vcwscanf 0x7f730 0x2f4
_o___daylight 0x7f760 0x2f5
_o___dstbias 0x7f770 0x2f6
_o___fpe_flt_rounds 0x7f780 0x2f7
_o___libm_sse2_acos 0x54850 0x2f8
_o___libm_sse2_acosf 0x54900 0x2f9
_o___libm_sse2_asin 0x549b0 0x2fa
_o___libm_sse2_asinf 0x54a60 0x2fb
_o___libm_sse2_atan 0x54b10 0x2fc
_o___libm_sse2_atan2 0x54bc0 0x2fd
_o___libm_sse2_atanf 0x54c80 0x2fe
_o___libm_sse2_cos 0x54d30 0x2ff
_o___libm_sse2_cosf 0x54de0 0x300
_o___libm_sse2_exp 0x54e90 0x301
_o___libm_sse2_expf 0x54f40 0x302
_o___libm_sse2_log 0x54ff0 0x303
_o___libm_sse2_log10 0x550a0 0x304
_o___libm_sse2_log10f 0x55150 0x305
_o___libm_sse2_logf 0x55200 0x306
_o___libm_sse2_pow 0x552b0 0x307
_o___libm_sse2_powf 0x55370 0x308
_o___libm_sse2_sin 0x55430 0x309
_o___libm_sse2_sinf 0x554e0 0x30a
_o___libm_sse2_tan 0x55590 0x30b
_o___libm_sse2_tanf 0x55640 0x30c
_o___p___argc 0x21460 0x30d
_o___p___argv 0x7f790 0x30e
_o___p___wargv 0x3b1d0 0x30f
_o___p__acmdln 0x7f7a0 0x310
_o___p__commode 0x218a0 0x311
_o___p__environ 0x7f7b0 0x312
_o___p__fmode 0x7f7c0 0x313
_o___p__mbcasemap 0x7f7d0 0x314
_o___p__mbctype 0x7f7e0 0x315
_o___p__pgmptr 0x7f7f0 0x316
_o___p__wcmdln 0x7f800 0x317
_o___p__wenviron 0x7f810 0x318
_o___p__wpgmptr 0x7f820 0x319
_o___pctype_func 0x23590 0x31a
_o___pwctype_func 0x7f830 0x31b
_o___std_exception_copy 0x39830 0x31c
_o___std_exception_destroy 0x39e60 0x31d
_o___std_type_info_destroy_list 0x38bd0 0x31e
_o___std_type_info_name 0x7f840 0x31f
_o___stdio_common_vfprintf 0x7f860 0x320
_o___stdio_common_vfprintf_p 0x7f890 0x321
_o___stdio_common_vfprintf_s 0x7f8c0 0x322
_o___stdio_common_vfscanf 0x7f8f0 0x323
_o___stdio_common_vfwprintf 0x38850 0x324
_o___stdio_common_vfwprintf_p 0x7f920 0x325
_o___stdio_common_vfwprintf_s 0x7f950 0x326
_o___stdio_common_vfwscanf 0x7f980 0x327
_o___stdio_common_vsnprintf_s 0x39fe0 0x328
_o___stdio_common_vsnwprintf_s 0x22660 0x329
_o___stdio_common_vsprintf 0x2da40 0x32a
_o___stdio_common_vsprintf_p 0x7f9b0 0x32b
_o___stdio_common_vsprintf_s 0x3a9e0 0x32c
_o___stdio_common_vsscanf 0x3b290 0x32d
_o___stdio_common_vswprintf 0x24db0 0x32e
_o___stdio_common_vswprintf_p 0x7f9e0 0x32f
_o___stdio_common_vswprintf_s 0x22630 0x330
_o___stdio_common_vswscanf 0x3a930 0x331
_o___timezone 0x7fa10 0x332
_o___tzname 0x7fa20 0x333
_o___wcserror 0x7fa30 0x334
_o__access 0x7fa50 0x335
_o__access_s 0x7fa70 0x336
_o__aligned_free 0x3bc20 0x337
_o__aligned_malloc 0x3ba90 0x338
_o__aligned_msize 0x7fa90 0x339
_o__aligned_offset_malloc 0x7fab0 0x33a
_o__aligned_offset_realloc 0x7fad0 0x33b
_o__aligned_offset_recalloc 0x7fb00 0x33c
_o__aligned_realloc 0x7fb30 0x33d
_o__aligned_recalloc 0x7fb60 0x33e
_o__atodbl 0x7fb90 0x33f
_o__atodbl_l 0x7fbb0 0x340
_o__atof_l 0x7fbd0 0x341
_o__atoflt 0x7fbf0 0x342
_o__atoflt_l 0x7fc10 0x343
_o__atoi64 0x85390 0x344
_o__atoi64_l 0x7fc30 0x345
_o__atoi_l 0x7fc50 0x346
_o__atol_l 0x7fc50 0x347
_o__atoldbl 0x7fc70 0x348
_o__atoldbl_l 0x7fc90 0x349
_o__atoll_l 0x7fc30 0x34a
_o__beep 0x7fcb0 0x34b
_o__beginthread 0x7fcd0 0x34c
_o__beginthreadex 0x3ae20 0x34d
_o__cabs 0x7fcf0 0x34e
_o__callnewh 0x7fd20 0x34f
_o__calloc_base 0x398b0 0x350
_o__cexit 0x7fd40 0x351
_o__cgets 0x7fd50 0x352
_o__cgets_s 0x7fd70 0x353
_o__cgetws 0x7fd90 0x354
_o__cgetws_s 0x7fdb0 0x355
_o__chdir 0x7fdd0 0x356
_o__chdrive 0x7fdf0 0x357
_o__chmod 0x7fe10 0x358
_o__chsize 0x7fe30 0x359
_o__chsize_s 0x7fe50 0x35a
_o__close 0x7fe70 0x35b
_o__commit 0x7fe90 0x35c
_o__configthreadlocale 0x3b560 0x35d
_o__configure_narrow_argv 0x35880 0x35e
_o__configure_wide_argv 0x35990 0x35f
_o__controlfp_s 0x39730 0x360
_o__cputs 0x7feb0 0x361
_o__cputws 0x7fed0 0x362
_o__creat 0x7fef0 0x363
_o__create_locale 0x3b310 0x364
_o__crt_atexit 0x21e40 0x365
_o__ctime32_s 0x7ff10 0x366
_o__ctime64_s 0x7ff30 0x367
_o__cwait 0x7ff50 0x368
_o__d_int 0x7ff70 0x369
_o__dclass 0x7ff90 0x36a
_o__difftime32 0x7ffb0 0x36b
_o__difftime64 0x7ffd0 0x36c
_o__dlog 0x7fff0 0x36d
_o__dnorm 0x80020 0x36e
_o__dpcomp 0x80040 0x36f
_o__dpoly 0x81990 0x370
_o__dscale 0x80070 0x371
_o__dsign 0x80090 0x372
_o__dsin 0x81a00 0x373
_o__dtest 0x800b0 0x374
_o__dunscale 0x800d0 0x375
_o__dup 0x800f0 0x376
_o__dup2 0x80110 0x377
_o__dupenv_s 0x80130 0x378
_o__ecvt 0x80150 0x379
_o__ecvt_s 0x80180 0x37a
_o__endthread 0x801b0 0x37b
_o__endthreadex 0x801c0 0x37c
_o__eof 0x801e0 0x37d
_o__errno 0x23b20 0x37e
_o__except1 0x80200 0x37f
_o__execute_onexit_table 0x23820 0x380
_o__execv 0x80230 0x381
_o__execve 0x80250 0x382
_o__execvp 0x80280 0x383
_o__execvpe 0x802a0 0x384
_o__exit 0x802d0 0x385
_o__expand 0x802f0 0x386
_o__fclose_nolock 0x80310 0x387
_o__fcloseall 0x80330 0x388
_o__fcvt 0x80340 0x389
_o__fcvt_s 0x80370 0x38a
_o__fd_int 0x803a0 0x38b
_o__fdclass 0x803c0 0x38c
_o__fdexp 0x803e0 0x38d
_o__fdlog 0x80400 0x38e
_o__fdopen 0x80430 0x38f
_o__fdpcomp 0x80450 0x390
_o__fdpoly 0x80480 0x391
_o__fdscale 0x804a0 0x392
_o__fdsign 0x804c0 0x393
_o__fdsin 0x804e0 0x394
_o__fflush_nolock 0x80500 0x395
_o__fgetc_nolock 0x80520 0x396
_o__fgetchar 0x80540 0x397
_o__fgetwc_nolock 0x80550 0x398
_o__fgetwchar 0x80570 0x399
_o__filelength 0x80580 0x39a
_o__filelengthi64 0x805a0 0x39b
_o__fileno 0x805c0 0x39c
_o__findclose 0x805e0 0x39d
_o__findfirst32 0x80600 0x39e
_o__findfirst32i64 0x80620 0x39f
_o__findfirst64 0x80640 0x3a0
_o__findfirst64i32 0x80660 0x3a1
_o__findnext32 0x80680 0x3a2
_o__findnext32i64 0x806a0 0x3a3
_o__findnext64 0x806c0 0x3a4
_o__findnext64i32 0x806e0 0x3a5
_o__flushall 0x80700 0x3a6
_o__fpclass 0x80710 0x3a7
_o__fputc_nolock 0x80730 0x3a8
_o__fputchar 0x86300 0x3a9
_o__fputwc_nolock 0x80750 0x3aa
_o__fputwchar 0x86360 0x3ab
_o__fread_nolock 0x80770 0x3ac
_o__fread_nolock_s 0x807a0 0x3ad
_o__free_base 0x3ba70 0x3ae
_o__free_locale 0x807d0 0x3af
_o__fseek_nolock 0x807f0 0x3b0
_o__fseeki64 0x80820 0x3b1
_o__fseeki64_nolock 0x80850 0x3b2
_o__fsopen 0x34c00 0x3b3
_o__fstat32 0x80880 0x3b4
_o__fstat32i64 0x808a0 0x3b5
_o__fstat64 0x808c0 0x3b6
_o__fstat64i32 0x808e0 0x3b7
_o__ftell_nolock 0x80900 0x3b8
_o__ftelli64 0x80920 0x3b9
_o__ftelli64_nolock 0x80940 0x3ba
_o__ftime32 0x80960 0x3bb
_o__ftime32_s 0x80980 0x3bc
_o__ftime64 0x809a0 0x3bd
_o__ftime64_s 0x809c0 0x3be
_o__fullpath 0x809e0 0x3bf
_o__futime32 0x80a00 0x3c0
_o__futime64 0x80a20 0x3c1
_o__fwrite_nolock 0x80a40 0x3c2
_o__gcvt 0x80a70 0x3c3
_o__gcvt_s 0x80aa0 0x3c4
_o__get_daylight 0x80ad0 0x3c5
_o__get_doserrno 0x80af0 0x3c6
_o__get_dstbias 0x80b10 0x3c7
_o__get_errno 0x39630 0x3c8
_o__get_fmode 0x80b30 0x3c9
_o__get_heap_handle 0x80b50 0x3ca
_o__get_initial_narrow_environment 0x80b60 0x3cb
_o__get_initial_wide_environment 0x3bbf0 0x3cc
_o__get_invalid_parameter_handler 0x80b70 0x3cd
_o__get_narrow_winmain_command_line 0x372f0 0x3ce
_o__get_osfhandle 0x80b80 0x3cf
_o__get_pgmptr 0x80ba0 0x3d0
_o__get_stream_buffer_pointers 0x38780 0x3d1
_o__get_terminate 0x80bc0 0x3d2
_o__get_thread_local_invalid_parameter_handler 0x80bd0 0x3d3
_o__get_timezone 0x80be0 0x3d4
_o__get_tzname 0x80c00 0x3d5
_o__get_wide_winmain_command_line 0x38140 0x3d6
_o__get_wpgmptr 0x80c20 0x3d7
_o__getc_nolock 0x80c40 0x3d8
_o__getch 0x80c60 0x3d9
_o__getch_nolock 0x80c70 0x3da
_o__getche 0x80c80 0x3db
_o__getche_nolock 0x80c90 0x3dc
_o__getcwd 0x80ca0 0x3dd
_o__getdcwd 0x80cc0 0x3de
_o__getdiskfree 0x80cf0 0x3df
_o__getdllprocaddr 0x80d10 0x3e0
_o__getdrive 0x80d30 0x3e1
_o__getdrives 0x80d40 0x3e2
_o__getmbcp 0x80d50 0x3e3
_o__getsystime 0x80d60 0x3e4
_o__getw 0x80d80 0x3e5
_o__getwc_nolock 0x80da0 0x3e6
_o__getwch 0x80dc0 0x3e7
_o__getwch_nolock 0x80dd0 0x3e8
_o__getwche 0x80de0 0x3e9
_o__getwche_nolock 0x80df0 0x3ea
_o__getws 0x80e00 0x3eb
_o__getws_s 0x80e20 0x3ec
_o__gmtime32 0x80e40 0x3ed
_o__gmtime32_s 0x37c20 0x3ee
_o__gmtime64 0x80e60 0x3ef
_o__gmtime64_s 0x80e80 0x3f0
_o__heapchk 0x80ea0 0x3f1
_o__heapmin 0x80eb0 0x3f2
_o__hypot 0x85a60 0x3f3
_o__hypotf 0x80ec0 0x3f4
_o__i64toa 0x80ef0 0x3f5
_o__i64toa_s 0x80f10 0x3f6
_o__i64tow 0x80f40 0x3f7
_o__i64tow_s 0x80f60 0x3f8
_o__initialize_narrow_environment 0x3b9f0 0x3f9
_o__initialize_onexit_table 0x23f30 0x3fa
_o__initialize_wide_environment 0x3b930 0x3fb
_o__invalid_parameter_noinfo 0x80f90 0x3fc
_o__invalid_parameter_noinfo_noreturn 0x80fa0 0x3fd
_o__isatty 0x80fb0 0x3fe
_o__isctype 0x80fd0 0x3ff
_o__isctype_l 0x80ff0 0x400
_o__isleadbyte_l 0x81010 0x401
_o__ismbbalnum 0x81030 0x402
_o__ismbbalnum_l 0x81050 0x403
_o__ismbbalpha 0x81070 0x404
_o__ismbbalpha_l 0x81090 0x405
_o__ismbbblank 0x810b0 0x406
_o__ismbbblank_l 0x810d0 0x407
_o__ismbbgraph 0x810f0 0x408
_o__ismbbgraph_l 0x81110 0x409
_o__ismbbkalnum 0x81130 0x40a
_o__ismbbkalnum_l 0x81150 0x40b
_o__ismbbkana 0x81170 0x40c
_o__ismbbkana_l 0x81190 0x40d
_o__ismbbkprint 0x811b0 0x40e
_o__ismbbkprint_l 0x811d0 0x40f
_o__ismbbkpunct 0x811f0 0x410
_o__ismbbkpunct_l 0x81210 0x411
_o__ismbblead 0x2b380 0x412
_o__ismbblead_l 0x81230 0x413
_o__ismbbprint 0x81250 0x414
_o__ismbbprint_l 0x81270 0x415
_o__ismbbpunct 0x81290 0x416
_o__ismbbpunct_l 0x812b0 0x417
_o__ismbbtrail 0x812d0 0x418
_o__ismbbtrail_l 0x812f0 0x419
_o__ismbcalnum 0x81310 0x41a
_o__ismbcalnum_l 0x81330 0x41b
_o__ismbcalpha 0x81350 0x41c
_o__ismbcalpha_l 0x81370 0x41d
_o__ismbcblank 0x81390 0x41e
_o__ismbcblank_l 0x813b0 0x41f
_o__ismbcdigit 0x813d0 0x420
_o__ismbcdigit_l 0x813f0 0x421
_o__ismbcgraph 0x81410 0x422
_o__ismbcgraph_l 0x81430 0x423
_o__ismbchira 0x81450 0x424
_o__ismbchira_l 0x81470 0x425
_o__ismbckata 0x81490 0x426
_o__ismbckata_l 0x814b0 0x427
_o__ismbcl0 0x814d0 0x428
_o__ismbcl0_l 0x814f0 0x429
_o__ismbcl1 0x81510 0x42a
_o__ismbcl1_l 0x81530 0x42b
_o__ismbcl2 0x81550 0x42c
_o__ismbcl2_l 0x81570 0x42d
_o__ismbclegal 0x81590 0x42e
_o__ismbclegal_l 0x815b0 0x42f
_o__ismbclower 0x815d0 0x430
_o__ismbclower_l 0x815f0 0x431
_o__ismbcprint 0x81610 0x432
_o__ismbcprint_l 0x81630 0x433
_o__ismbcpunct 0x81650 0x434
_o__ismbcpunct_l 0x81670 0x435
_o__ismbcspace 0x81690 0x436
_o__ismbcspace_l 0x816b0 0x437
_o__ismbcsymbol 0x816d0 0x438
_o__ismbcsymbol_l 0x816f0 0x439
_o__ismbcupper 0x81710 0x43a
_o__ismbcupper_l 0x81730 0x43b
_o__ismbslead 0x81750 0x43c
_o__ismbslead_l 0x81770 0x43d
_o__ismbstrail 0x817a0 0x43e
_o__ismbstrail_l 0x817c0 0x43f
_o__iswctype_l 0x817f0 0x440
_o__itoa 0x81810 0x441
_o__itoa_s 0x81840 0x442
_o__itow 0x81860 0x443
_o__itow_s 0x37000 0x444
_o__j0 0x81890 0x445
_o__j1 0x818b0 0x446
_o__jn 0x818d0 0x447
_o__kbhit 0x81900 0x448
_o__ld_int 0x81910 0x449
_o__ldclass 0x7ff90 0x44a
_o__ldexp 0x81930 0x44b
_o__ldlog 0x81960 0x44c
_o__ldpcomp 0x80040 0x44d
_o__ldpoly 0x81990 0x44e
_o__ldscale 0x819c0 0x44f
_o__ldsign 0x819e0 0x450
_o__ldsin 0x81a00 0x451
_o__ldtest 0x81a20 0x452
_o__ldunscale 0x81a40 0x453
_o__lfind 0x81a60 0x454
_o__lfind_s 0x81a90 0x455
_o__libm_sse2_acos_precise 0x556f0 0x456
_o__libm_sse2_asin_precise 0x557a0 0x457
_o__libm_sse2_atan_precise 0x55850 0x458
_o__libm_sse2_cos_precise 0x55900 0x459
_o__libm_sse2_exp_precise 0x559b0 0x45a
_o__libm_sse2_log10_precise 0x55a60 0x45b
_o__libm_sse2_log_precise 0x55b10 0x45c
_o__libm_sse2_pow_precise 0x543e0 0x45d
_o__libm_sse2_sin_precise 0x55bc0 0x45e
_o__libm_sse2_sqrt_precise 0x55c70 0x45f
_o__libm_sse2_tan_precise 0x55d20 0x460
_o__loaddll 0x81ac0 0x461
_o__localtime32 0x81ae0 0x462
_o__localtime32_s 0x81b00 0x463
_o__localtime64 0x81b20 0x464
_o__localtime64_s 0x81b40 0x465
_o__lock_file 0x81b60 0x466
_o__locking 0x81b80 0x467
_o__logb 0x81ba0 0x468
_o__lsearch 0x81bc0 0x469
_o__lsearch_s 0x81bf0 0x46a
_o__lseek 0x81c20 0x46b
_o__lseeki64 0x81c40 0x46c
_o__ltoa 0x24a40 0x46d
_o__ltoa_s 0x81840 0x46e
_o__ltow 0x81c60 0x46f
_o__ltow_s 0x81c80 0x470
_o__makepath 0x81ca0 0x471
_o__makepath_s 0x81cd0 0x472
_o__malloc_base 0x81d00 0x473
_o__mbbtombc 0x81d20 0x474
_o__mbbtombc_l 0x81d40 0x475
_o__mbbtype 0x81d60 0x476
_o__mbbtype_l 0x81d80 0x477
_o__mbccpy 0x81da0 0x478
_o__mbccpy_l 0x81dc0 0x479
_o__mbccpy_s 0x81de0 0x47a
_o__mbccpy_s_l 0x81e00 0x47b
_o__mbcjistojms 0x81e30 0x47c
_o__mbcjistojms_l 0x81e50 0x47d
_o__mbcjmstojis 0x81e70 0x47e
_o__mbcjmstojis_l 0x81e90 0x47f
_o__mbclen 0x81eb0 0x480
_o__mbclen_l 0x81ed0 0x481
_o__mbctohira 0x81ef0 0x482
_o__mbctohira_l 0x81f10 0x483
_o__mbctokata 0x81f30 0x484
_o__mbctokata_l 0x81f50 0x485
_o__mbctolower 0x81f70 0x486
_o__mbctolower_l 0x81f90 0x487
_o__mbctombb 0x81fb0 0x488
_o__mbctombb_l 0x81fd0 0x489
_o__mbctoupper 0x81ff0 0x48a
_o__mbctoupper_l 0x82010 0x48b
_o__mblen_l 0x82030 0x48c
_o__mbsbtype 0x82050 0x48d
_o__mbsbtype_l 0x82070 0x48e
_o__mbscat_s 0x82090 0x48f
_o__mbscat_s_l 0x820c0 0x490
_o__mbschr 0x820f0 0x491
_o__mbschr_l 0x82110 0x492
_o__mbscmp 0x82140 0x493
_o__mbscmp_l 0x82160 0x494
_o__mbscoll 0x82190 0x495
_o__mbscoll_l 0x821b0 0x496
_o__mbscpy_s 0x821e0 0x497
_o__mbscpy_s_l 0x82210 0x498
_o__mbscspn 0x82240 0x499
_o__mbscspn_l 0x82260 0x49a
_o__mbsdec 0x82290 0x49b
_o__mbsdec_l 0x822b0 0x49c
_o__mbsicmp 0x822e0 0x49d
_o__mbsicmp_l 0x82300 0x49e
_o__mbsicoll 0x82330 0x49f
_o__mbsicoll_l 0x82350 0x4a0
_o__mbsinc 0x82380 0x4a1
_o__mbsinc_l 0x823a0 0x4a2
_o__mbslen 0x823c0 0x4a3
_o__mbslen_l 0x823e0 0x4a4
_o__mbslwr 0x82400 0x4a5
_o__mbslwr_l 0x82420 0x4a6
_o__mbslwr_s 0x82440 0x4a7
_o__mbslwr_s_l 0x82460 0x4a8
_o__mbsnbcat 0x82490 0x4a9
_o__mbsnbcat_l 0x824c0 0x4aa
_o__mbsnbcat_s 0x824f0 0x4ab
_o__mbsnbcat_s_l 0x82520 0x4ac
_o__mbsnbcmp 0x82550 0x4ad
_o__mbsnbcmp_l 0x82580 0x4ae
_o__mbsnbcnt 0x825b0 0x4af
_o__mbsnbcnt_l 0x825d0 0x4b0
_o__mbsnbcoll 0x82600 0x4b1
_o__mbsnbcoll_l 0x82630 0x4b2
_o__mbsnbcpy 0x82660 0x4b3
_o__mbsnbcpy_l 0x82690 0x4b4
_o__mbsnbcpy_s 0x826c0 0x4b5
_o__mbsnbcpy_s_l 0x826f0 0x4b6
_o__mbsnbicmp 0x82720 0x4b7
_o__mbsnbicmp_l 0x82750 0x4b8
_o__mbsnbicoll 0x82780 0x4b9
_o__mbsnbicoll_l 0x827b0 0x4ba
_o__mbsnbset 0x827e0 0x4bb
_o__mbsnbset_l 0x82810 0x4bc
_o__mbsnbset_s 0x82840 0x4bd
_o__mbsnbset_s_l 0x82870 0x4be
_o__mbsncat 0x828a0 0x4bf
_o__mbsncat_l 0x828d0 0x4c0
_o__mbsncat_s 0x82900 0x4c1
_o__mbsncat_s_l 0x82930 0x4c2
_o__mbsnccnt 0x82960 0x4c3
_o__mbsnccnt_l 0x82980 0x4c4
_o__mbsncmp 0x829b0 0x4c5
_o__mbsncmp_l 0x829e0 0x4c6
_o__mbsncoll 0x82a10 0x4c7
_o__mbsncoll_l 0x82a40 0x4c8
_o__mbsncpy 0x82a70 0x4c9
_o__mbsncpy_l 0x82aa0 0x4ca
_o__mbsncpy_s 0x82ad0 0x4cb
_o__mbsncpy_s_l 0x82b00 0x4cc
_o__mbsnextc 0x82b30 0x4cd
_o__mbsnextc_l 0x82b50 0x4ce
_o__mbsnicmp 0x82b70 0x4cf
_o__mbsnicmp_l 0x82ba0 0x4d0
_o__mbsnicoll 0x82bd0 0x4d1
_o__mbsnicoll_l 0x82c00 0x4d2
_o__mbsninc 0x82c30 0x4d3
_o__mbsninc_l 0x82c50 0x4d4
_o__mbsnlen 0x82c70 0x4d5
_o__mbsnlen_l 0x82c90 0x4d6
_o__mbsnset 0x82cc0 0x4d7
_o__mbsnset_l 0x82cf0 0x4d8
_o__mbsnset_s 0x82d20 0x4d9
_o__mbsnset_s_l 0x82d50 0x4da
_o__mbspbrk 0x82d80 0x4db
_o__mbspbrk_l 0x82da0 0x4dc
_o__mbsrchr 0x82dd0 0x4dd
_o__mbsrchr_l 0x82df0 0x4de
_o__mbsrev 0x82e20 0x4df
_o__mbsrev_l 0x82e40 0x4e0
_o__mbsset 0x82e60 0x4e1
_o__mbsset_l 0x82e80 0x4e2
_o__mbsset_s 0x82ea0 0x4e3
_o__mbsset_s_l 0x82ec0 0x4e4
_o__mbsspn 0x82ee0 0x4e5
_o__mbsspn_l 0x82f00 0x4e6
_o__mbsspnp 0x82f30 0x4e7
_o__mbsspnp_l 0x82f50 0x4e8
_o__mbsstr 0x82f80 0x4e9
_o__mbsstr_l 0x82fa0 0x4ea
_o__mbstok 0x82fd0 0x4eb
_o__mbstok_l 0x82ff0 0x4ec
_o__mbstok_s 0x83010 0x4ed
_o__mbstok_s_l 0x83030 0x4ee
_o__mbstowcs_l 0x83050 0x4ef
_o__mbstowcs_s_l 0x83070 0x4f0
_o__mbstrlen 0x830a0 0x4f1
_o__mbstrlen_l 0x830c0 0x4f2
_o__mbstrnlen 0x830e0 0x4f3
_o__mbstrnlen_l 0x83100 0x4f4
_o__mbsupr 0x83120 0x4f5
_o__mbsupr_l 0x83140 0x4f6
_o__mbsupr_s 0x83160 0x4f7
_o__mbsupr_s_l 0x83180 0x4f8
_o__mbtowc_l 0x831b0 0x4f9
_o__memicmp 0x831d0 0x4fa
_o__memicmp_l 0x831f0 0x4fb
_o__mkdir 0x83210 0x4fc
_o__mkgmtime32 0x37a10 0x4fd
_o__mkgmtime64 0x83230 0x4fe
_o__mktemp 0x83250 0x4ff
_o__mktemp_s 0x83270 0x500
_o__mktime32 0x83290 0x501
_o__mktime64 0x832b0 0x502
_o__msize 0x832d0 0x503
_o__nextafter 0x861c0 0x504
_o__open_osfhandle 0x832f0 0x505
_o__pclose 0x83310 0x506
_o__pipe 0x83330 0x507
_o__popen 0x83350 0x508
_o__purecall 0x83370 0x509
_o__putc_nolock 0x83380 0x50a
_o__putch 0x833a0 0x50b
_o__putch_nolock 0x833c0 0x50c
_o__putenv 0x833e0 0x50d
_o__putenv_s 0x83400 0x50e
_o__putw 0x83420 0x50f
_o__putwc_nolock 0x83440 0x510
_o__putwch 0x83460 0x511
_o__putwch_nolock 0x83480 0x512
_o__putws 0x834a0 0x513
_o__read 0x834c0 0x514
_o__realloc_base 0x21f50 0x515
_o__recalloc 0x22c80 0x516
_o__register_onexit_function 0x27130 0x517
_o__resetstkoflw 0x834e0 0x518
_o__rmdir 0x834f0 0x519
_o__rmtmp 0x83510 0x51a
_o__scalb 0x83520 0x51b
_o__searchenv 0x83550 0x51c
_o__searchenv_s 0x83570 0x51d
_o__seh_filter_dll 0x83590 0x51e
_o__seh_filter_exe 0x835b0 0x51f
_o__set_abort_behavior 0x835d0 0x520
_o__set_app_type 0x3ac40 0x521
_o__set_doserrno 0x835f0 0x522
_o__set_errno 0x3a730 0x523
_o__set_fmode 0x3b540 0x524
_o__set_invalid_parameter_handler 0x83610 0x525
_o__set_new_handler 0x83630 0x526
_o__set_new_mode 0x3b520 0x527
_o__set_thread_local_invalid_parameter_handler 0x83650 0x528
_o__seterrormode 0x83670 0x529
_o__setmbcp 0x83690 0x52a
_o__setmode 0x836b0 0x52b
_o__setsystime 0x836d0 0x52c
_o__sleep 0x836f0 0x52d
_o__sopen 0x83710 0x52e
_o__sopen_dispatch 0x83730 0x52f
_o__sopen_s 0x83760 0x530
_o__spawnv 0x83790 0x531
_o__spawnve 0x837c0 0x532
_o__spawnvp 0x837f0 0x533
_o__spawnvpe 0x83820 0x534
_o__splitpath 0x83850 0x535
_o__splitpath_s 0x3af60 0x536
_o__stat32 0x83880 0x537
_o__stat32i64 0x838a0 0x538
_o__stat64 0x838c0 0x539
_o__stat64i32 0x838e0 0x53a
_o__strcoll_l 0x83900 0x53b
_o__strdate 0x83930 0x53c
_o__strdate_s 0x83950 0x53d
_o__strdup 0x83970 0x53e
_o__strerror 0x83990 0x53f
_o__strerror_s 0x839b0 0x540
_o__strftime_l 0x839e0 0x541
_o__stricmp 0x38990 0x542
_o__stricmp_l 0x83a10 0x543
_o__stricoll 0x83a40 0x544
_o__stricoll_l 0x83a60 0x545
_o__strlwr 0x83a90 0x546
_o__strlwr_l 0x83ab0 0x547
_o__strlwr_s 0x83ad0 0x548
_o__strlwr_s_l 0x83af0 0x549
_o__strncoll 0x83b20 0x54a
_o__strncoll_l 0x83b50 0x54b
_o__strnicmp 0x38af0 0x54c
_o__strnicmp_l 0x83b80 0x54d
_o__strnicoll 0x83bb0 0x54e
_o__strnicoll_l 0x83be0 0x54f
_o__strnset_s 0x83c10 0x550
_o__strset_s 0x83c30 0x551
_o__strtime 0x83c60 0x552
_o__strtime_s 0x83c80 0x553
_o__strtod_l 0x83ca0 0x554
_o__strtof_l 0x83cc0 0x555
_o__strtoi64 0x83ce0 0x556
_o__strtoi64_l 0x83d10 0x557
_o__strtol_l 0x83d40 0x558
_o__strtold_l 0x83ca0 0x559
_o__strtoll_l 0x83d10 0x55a
_o__strtoui64 0x33c20 0x55b
_o__strtoui64_l 0x83d80 0x55c
_o__strtoul_l 0x83d60 0x55d
_o__strtoull_l 0x83d80 0x55e
_o__strupr 0x83db0 0x55f
_o__strupr_l 0x83dd0 0x560
_o__strupr_s 0x83df0 0x561
_o__strupr_s_l 0x83e10 0x562
_o__strxfrm_l 0x83e40 0x563
_o__swab 0x83e60 0x564
_o__tell 0x83e80 0x565
_o__telli64 0x83ea0 0x566
_o__timespec32_get 0x83ec0 0x567
_o__timespec64_get 0x83ee0 0x568
_o__tolower 0x3bcc0 0x569
_o__tolower_l 0x83f00 0x56a
_o__toupper 0x83f20 0x56b
_o__toupper_l 0x83f40 0x56c
_o__towlower_l 0x83f60 0x56d
_o__towupper_l 0x83f80 0x56e
_o__tzset 0x83fa0 0x56f
_o__ui64toa 0x83fb0 0x570
_o__ui64toa_s 0x3a420 0x571
_o__ui64tow 0x83fd0 0x572
_o__ui64tow_s 0x375a0 0x573
_o__ultoa 0x83ff0 0x574
_o__ultoa_s 0x84010 0x575
_o__ultow 0x84030 0x576
_o__ultow_s 0x37070 0x577
_o__umask 0x84050 0x578
_o__umask_s 0x84070 0x579
_o__ungetc_nolock 0x84090 0x57a
_o__ungetch 0x840b0 0x57b
_o__ungetch_nolock 0x840d0 0x57c
_o__ungetwc_nolock 0x840f0 0x57d
_o__ungetwch 0x84110 0x57e
_o__ungetwch_nolock 0x84130 0x57f
_o__unlink 0x84150 0x580
_o__unloaddll 0x84170 0x581
_o__unlock_file 0x84190 0x582
_o__utime32 0x841b0 0x583
_o__utime64 0x841d0 0x584
_o__waccess 0x841f0 0x585
_o__waccess_s 0x84210 0x586
_o__wasctime 0x84230 0x587
_o__wasctime_s 0x84250 0x588
_o__wchdir 0x84270 0x589
_o__wchmod 0x84290 0x58a
_o__wcreat 0x842b0 0x58b
_o__wcreate_locale 0x842d0 0x58c
_o__wcscoll_l 0x842f0 0x58d
_o__wcsdup 0x3b1b0 0x58e
_o__wcserror 0x84320 0x58f
_o__wcserror_s 0x84340 0x590
_o__wcsftime_l 0x84360 0x591
_o__wcsicmp 0x27850 0x592
_o__wcsicmp_l 0x84390 0x593
_o__wcsicoll 0x843c0 0x594
_o__wcsicoll_l 0x843e0 0x595
_o__wcslwr 0x84410 0x596
_o__wcslwr_l 0x84430 0x597
_o__wcslwr_s 0x395f0 0x598
_o__wcslwr_s_l 0x84450 0x599
_o__wcsncoll 0x84480 0x59a
_o__wcsncoll_l 0x844b0 0x59b
_o__wcsnicmp 0x24950 0x59c
_o__wcsnicmp_l 0x844e0 0x59d
_o__wcsnicoll 0x84510 0x59e
_o__wcsnicoll_l 0x84540 0x59f
_o__wcsnset 0x84570 0x5a0
_o__wcsnset_s 0x84590 0x5a1
_o__wcsset 0x845b0 0x5a2
_o__wcsset_s 0x845d0 0x5a3
_o__wcstod_l 0x845f0 0x5a4
_o__wcstof_l 0x84610 0x5a5
_o__wcstoi64 0x3b6a0 0x5a6
_o__wcstoi64_l 0x84650 0x5a7
_o__wcstol_l 0x84630 0x5a8
_o__wcstold_l 0x845f0 0x5a9
_o__wcstoll_l 0x84650 0x5aa
_o__wcstombs_l 0x84680 0x5ab
_o__wcstombs_s_l 0x846a0 0x5ac
_o__wcstoui64 0x3a350 0x5ad
_o__wcstoui64_l 0x846f0 0x5ae
_o__wcstoul_l 0x846d0 0x5af
_o__wcstoull_l 0x846f0 0x5b0
_o__wcsupr 0x84720 0x5b1
_o__wcsupr_l 0x84740 0x5b2
_o__wcsupr_s 0x39610 0x5b3
_o__wcsupr_s_l 0x84760 0x5b4
_o__wcsxfrm_l 0x84790 0x5b5
_o__wctime32 0x847b0 0x5b6
_o__wctime32_s 0x847d0 0x5b7
_o__wctime64 0x847f0 0x5b8
_o__wctime64_s 0x84810 0x5b9
_o__wctomb_l 0x84830 0x5ba
_o__wctomb_s_l 0x84850 0x5bb
_o__wdupenv_s 0x84880 0x5bc
_o__wexecv 0x848a0 0x5bd
_o__wexecve 0x848c0 0x5be
_o__wexecvp 0x848f0 0x5bf
_o__wexecvpe 0x84910 0x5c0
_o__wfdopen 0x84940 0x5c1
_o__wfindfirst32 0x84960 0x5c2
_o__wfindfirst32i64 0x84980 0x5c3
_o__wfindfirst64 0x849a0 0x5c4
_o__wfindfirst64i32 0x849c0 0x5c5
_o__wfindnext32 0x849e0 0x5c6
_o__wfindnext32i64 0x84a00 0x5c7
_o__wfindnext64 0x84a20 0x5c8
_o__wfindnext64i32 0x84a40 0x5c9
_o__wfopen 0x84a60 0x5ca
_o__wfopen_s 0x84a80 0x5cb
_o__wfreopen 0x84aa0 0x5cc
_o__wfreopen_s 0x84ac0 0x5cd
_o__wfsopen 0x84ae0 0x5ce
_o__wfullpath 0x84b00 0x5cf
_o__wgetcwd 0x84b20 0x5d0
_o__wgetdcwd 0x84b40 0x5d1
_o__wgetenv 0x84b70 0x5d2
_o__wgetenv_s 0x84b90 0x5d3
_o__wmakepath 0x84bb0 0x5d4
_o__wmakepath_s 0x84be0 0x5d5
_o__wmkdir 0x384d0 0x5d6
_o__wmktemp 0x84c10 0x5d7
_o__wmktemp_s 0x84c30 0x5d8
_o__wperror 0x84c50 0x5d9
_o__wpopen 0x84c70 0x5da
_o__wputenv 0x84c90 0x5db
_o__wputenv_s 0x84cb0 0x5dc
_o__wremove 0x84cd0 0x5dd
_o__wrename 0x84cf0 0x5de
_o__write 0x84d10 0x5df
_o__wrmdir 0x84d30 0x5e0
_o__wsearchenv 0x84d50 0x5e1
_o__wsearchenv_s 0x84d70 0x5e2
_o__wsetlocale 0x84d90 0x5e3
_o__wsopen_dispatch 0x84db0 0x5e4
_o__wsopen_s 0x84de0 0x5e5
_o__wspawnv 0x84e10 0x5e6
_o__wspawnve 0x84e40 0x5e7
_o__wspawnvp 0x84e70 0x5e8
_o__wspawnvpe 0x84ea0 0x5e9
_o__wsplitpath 0x84ed0 0x5ea
_o__wsplitpath_s 0x24610 0x5eb
_o__wstat32 0x84f00 0x5ec
_o__wstat32i64 0x84f20 0x5ed
_o__wstat64 0x84f40 0x5ee
_o__wstat64i32 0x84f60 0x5ef
_o__wstrdate 0x84f80 0x5f0
_o__wstrdate_s 0x84fa0 0x5f1
_o__wstrtime 0x84fc0 0x5f2
_o__wstrtime_s 0x84fe0 0x5f3
_o__wsystem 0x85000 0x5f4
_o__wtmpnam_s 0x85020 0x5f5
_o__wtof 0x22560 0x5f6
_o__wtof_l 0x85040 0x5f7
_o__wtoi 0x384f0 0x5f8
_o__wtoi64 0x2ea10 0x5f9
_o__wtoi64_l 0x85080 0x5fa
_o__wtoi_l 0x85060 0x5fb
_o__wtol 0x3b8d0 0x5fc
_o__wtol_l 0x85060 0x5fd
_o__wtoll 0x2ea10 0x5fe
_o__wtoll_l 0x85080 0x5ff
_o__wunlink 0x850a0 0x600
_o__wutime32 0x850c0 0x601
_o__wutime64 0x850e0 0x602
_o__y0 0x85100 0x603
_o__y1 0x85120 0x604
_o__yn 0x85140 0x605
_o_abort 0x85170 0x606
_o_acos 0x85180 0x607
_o_acosh 0x851a0 0x608
_o_acoshf 0x851c0 0x609
_o_acoshl 0x851e0 0x60a
_o_asctime 0x85200 0x60b
_o_asctime_s 0x85220 0x60c
_o_asin 0x85240 0x60d
_o_asinh 0x85260 0x60e
_o_asinhf 0x85280 0x60f
_o_asinhl 0x852a0 0x610
_o_atan 0x852c0 0x611
_o_atan2 0x852e0 0x612
_o_atanh 0x85310 0x613
_o_atanhf 0x85330 0x614
_o_atanhl 0x85350 0x615
_o_atof 0x85370 0x616
_o_atoi 0x3ac20 0x617
_o_atol 0x2c440 0x618
_o_atoll 0x85390 0x619
_o_bsearch 0x23670 0x61a
_o_bsearch_s 0x20db0 0x61b
_o_btowc 0x853b0 0x61c
_o_calloc 0x2b6f0 0x61d
_o_cbrt 0x853d0 0x61e
_o_cbrtf 0x853f0 0x61f
_o_ceil 0x23800 0x620
_o_clearerr 0x85410 0x621
_o_clearerr_s 0x85430 0x622
_o_cos 0x85450 0x623
_o_cosh 0x85470 0x624
_o_erf 0x85490 0x625
_o_erfc 0x854b0 0x626
_o_erfcf 0x854d0 0x627
_o_erfcl 0x854f0 0x628
_o_erff 0x85510 0x629
_o_erfl 0x85530 0x62a
_o_exit 0x21780 0x62b
_o_exp 0x85550 0x62c
_o_exp2 0x85570 0x62d
_o_exp2f 0x85590 0x62e
_o_exp2l 0x855b0 0x62f
_o_fabs 0x855d0 0x630
_o_fclose 0x34be0 0x631
_o_feof 0x855f0 0x632
_o_ferror 0x85610 0x633
_o_fflush 0x85630 0x634
_o_fgetc 0x85650 0x635
_o_fgetpos 0x85670 0x636
_o_fgets 0x85690 0x637
_o_fgetwc 0x856b0 0x638
_o_fgetws 0x856d0 0x639
_o_floor 0x24810 0x63a
_o_fma 0x856f0 0x63b
_o_fmaf 0x85720 0x63c
_o_fmal 0x856f0 0x63d
_o_fmod 0x85750 0x63e
_o_fopen 0x85780 0x63f
_o_fopen_s 0x857a0 0x640
_o_fputc 0x857c0 0x641
_o_fputs 0x857e0 0x642
_o_fputwc 0x85800 0x643
_o_fputws 0x85820 0x644
_o_fread 0x85840 0x645
_o_fread_s 0x85870 0x646
_o_free 0x27be0 0x647
_o_freopen 0x858a0 0x648
_o_freopen_s 0x858c0 0x649
_o_frexp 0x858e0 0x64a
_o_fseek 0x85900 0x64b
_o_fsetpos 0x85930 0x64c
_o_ftell 0x85950 0x64d
_o_fwrite 0x85970 0x64e
_o_getc 0x859a0 0x64f
_o_getchar 0x80540 0x650
_o_getenv 0x859c0 0x651
_o_getenv_s 0x859e0 0x652
_o_gets 0x85a00 0x653
_o_gets_s 0x85a20 0x654
_o_getwc 0x85a40 0x655
_o_getwchar 0x80570 0x656
_o_hypot 0x85a60 0x657
_o_is_wctype 0x85a90 0x658
_o_isalnum 0x85ab0 0x659
_o_isalpha 0x24b60 0x65a
_o_isblank 0x85ad0 0x65b
_o_iscntrl 0x3b080 0x65c
_o_isdigit 0x24050 0x65d
_o_isgraph 0x85af0 0x65e
_o_isleadbyte 0x85b10 0x65f
_o_islower 0x85b30 0x660
_o_isprint 0x85b50 0x661
_o_ispunct 0x85b70 0x662
_o_isspace 0x248e0 0x663
_o_isupper 0x39890 0x664
_o_iswalnum 0x23b90 0x665
_o_iswalpha 0x3b060 0x666
_o_iswascii 0x3b160 0x667
_o_iswblank 0x85b90 0x668
_o_iswcntrl 0x85bb0 0x669
_o_iswctype 0x85bd0 0x66a
_o_iswdigit 0x23c70 0x66b
_o_iswgraph 0x85bf0 0x66c
_o_iswlower 0x85c10 0x66d
_o_iswprint 0x85c30 0x66e
_o_iswpunct 0x85c50 0x66f
_o_iswspace 0x26090 0x670
_o_iswupper 0x85c70 0x671
_o_iswxdigit 0x3b8b0 0x672
_o_isxdigit 0x24020 0x673
_o_ldexp 0x85c90 0x674
_o_lgamma 0x85cc0 0x675
_o_lgammaf 0x85ce0 0x676
_o_lgammal 0x85d00 0x677
_o_llrint 0x85d20 0x678
_o_llrintf 0x85d40 0x679
_o_llrintl 0x85d60 0x67a
_o_llround 0x20e30 0x67b
_o_llroundf 0x85d80 0x67c
_o_llroundl 0x85da0 0x67d
_o_localeconv 0x22c30 0x67e
_o_log 0x85dc0 0x67f
_o_log10 0x85de0 0x680
_o_log1p 0x85e00 0x681
_o_log1pf 0x85e20 0x682
_o_log1pl 0x85e40 0x683
_o_log2 0x21480 0x684
_o_log2f 0x85e60 0x685
_o_log2l 0x85e80 0x686
_o_logb 0x85ea0 0x687
_o_logbf 0x85ec0 0x688
_o_logbl 0x85ee0 0x689
_o_lrint 0x85f00 0x68a
_o_lrintf 0x85f20 0x68b
_o_lrintl 0x85f40 0x68c
_o_lround 0x20c70 0x68d
_o_lroundf 0x85f60 0x68e
_o_lroundl 0x85f80 0x68f
_o_malloc 0x27b20 0x690
_o_mblen 0x85fa0 0x691
_o_mbrlen 0x85fc0 0x692
_o_mbrtoc16 0x85fe0 0x693
_o_mbrtoc32 0x86000 0x694
_o_mbrtowc 0x86020 0x695
_o_mbsrtowcs 0x86040 0x696
_o_mbsrtowcs_s 0x86060 0x697
_o_mbstowcs 0x3b7a0 0x698
_o_mbstowcs_s 0x3bab0 0x699
_o_mbtowc 0x86090 0x69a
_o_memcpy_s 0x24830 0x69b
_o_memset 0x27ca0 0x69c
_o_modf 0x860b0 0x69d
_o_nan 0x860d0 0x69e
_o_nanf 0x860f0 0x69f
_o_nanl 0x86110 0x6a0
_o_nearbyint 0x86130 0x6a1
_o_nearbyintf 0x86150 0x6a2
_o_nearbyintl 0x86170 0x6a3
_o_nextafter 0x861c0 0x6a4
_o_nextafterf 0x86190 0x6a5
_o_nextafterl 0x861c0 0x6a6
_o_nexttoward 0x861f0 0x6a7
_o_nexttowardf 0x86220 0x6a8
_o_nexttowardl 0x86250 0x6a9
_o_pow 0x86280 0x6aa
_o_powf 0x862b0 0x6ab
_o_putc 0x862e0 0x6ac
_o_putchar 0x86300 0x6ad
_o_puts 0x86320 0x6ae
_o_putwc 0x86340 0x6af
_o_putwchar 0x86360 0x6b0
_o_qsort 0x21810 0x6b1
_o_qsort_s 0x22010 0x6b2
_o_raise 0x86380 0x6b3
_o_rand 0x2d9c0 0x6b4
_o_rand_s 0x39ef0 0x6b5
_o_realloc 0x23910 0x6b6
_o_remainder 0x863d0 0x6b7
_o_remainderf 0x863a0 0x6b8
_o_remainderl 0x863d0 0x6b9
_o_remove 0x86400 0x6ba
_o_remquo 0x86420 0x6bb
_o_remquof 0x86450 0x6bc
_o_remquol 0x86420 0x6bd
_o_rename 0x86480 0x6be
_o_rewind 0x864a0 0x6bf
_o_rint 0x864c0 0x6c0
_o_rintf 0x864e0 0x6c1
_o_rintl 0x86500 0x6c2
_o_round 0x21440 0x6c3
_o_roundf 0x20890 0x6c4
_o_roundl 0x86520 0x6c5
_o_scalbln 0x86540 0x6c6
_o_scalblnf 0x86570 0x6c7
_o_scalblnl 0x86590 0x6c8
_o_scalbn 0x86540 0x6c9
_o_scalbnf 0x865b0 0x6ca
_o_scalbnl 0x86540 0x6cb
_o_set_terminate 0x865e0 0x6cc
_o_setbuf 0x86600 0x6cd
_o_setlocale 0x2b2f0 0x6ce
_o_setvbuf 0x86620 0x6cf
_o_sin 0x86640 0x6d0
_o_sinh 0x86660 0x6d1
_o_sqrt 0x86680 0x6d2
_o_srand 0x23410 0x6d3
_o_strcat_s 0x866a0 0x6d4
_o_strcoll 0x866d0 0x6d5
_o_strcpy_s 0x3a9b0 0x6d6
_o_strerror 0x866f0 0x6d7
_o_strerror_s 0x86710 0x6d8
_o_strftime 0x398d0 0x6d9
_o_strncat_s 0x86740 0x6da
_o_strncpy_s 0x3abd0 0x6db
_o_strtod 0x867d0 0x6dc
_o_strtof 0x86770 0x6dd
_o_strtok 0x86790 0x6de
_o_strtok_s 0x867b0 0x6df
_o_strtol 0x3a280 0x6e0
_o_strtold 0x867d0 0x6e1
_o_strtoll 0x867f0 0x6e2
_o_strtoul 0x86820 0x6e3
_o_strtoull 0x33c20 0x6e4
_o_system 0x86840 0x6e5
_o_tan 0x86860 0x6e6
_o_tanh 0x86880 0x6e7
_o_terminate 0x868a0 0x6e8
_o_tgamma 0x868b0 0x6e9
_o_tgammaf 0x868d0 0x6ea
_o_tgammal 0x868f0 0x6eb
_o_tmpfile_s 0x86910 0x6ec
_o_tmpnam_s 0x86930 0x6ed
_o_tolower 0x279f0 0x6ee
_o_toupper 0x3ac00 0x6ef
_o_towlower 0x3a630 0x6f0
_o_towupper 0x27910 0x6f1
_o_ungetc 0x86950 0x6f2
_o_ungetwc 0x86970 0x6f3
_o_wcrtomb 0x86990 0x6f4
_o_wcrtomb_s 0x869b0 0x6f5
_o_wcscat_s 0x23c40 0x6f6
_o_wcscoll 0x869e0 0x6f7
_o_wcscpy 0x86a00 0x6f8
_o_wcscpy_s 0x24300 0x6f9
_o_wcsftime 0x86a20 0x6fa
_o_wcsncat_s 0x86a40 0x6fb
_o_wcsncpy_s 0x23e70 0x6fc
_o_wcsrtombs 0x86a70 0x6fd
_o_wcsrtombs_s 0x86a90 0x6fe
_o_wcstod 0x218c0 0x6ff
_o_wcstof 0x86ac0 0x700
_o_wcstok 0x86ae0 0x701
_o_wcstok_s 0x3a900 0x702
_o_wcstol 0x3a7f0 0x703
_o_wcstold 0x86b10 0x704
_o_wcstoll 0x3b6a0 0x705
_o_wcstombs 0x3b710 0x706
_o_wcstombs_s 0x86b30 0x707
_o_wcstoul 0x38c20 0x708
_o_wcstoull 0x86b60 0x709
_o_wctob 0x86b90 0x70a
_o_wctomb 0x86bb0 0x70b
_o_wctomb_s 0x86bd0 0x70c
_o_wmemcpy_s 0x23c10 0x70d
_o_wmemmove_s 0x86bf0 0x70e
_open 0xd2830 0x70f
_open_osfhandle 0x38d40 0x710
_pclose 0xc4e80 0x711
_pipe 0xc3e00 0x712
_popen 0xc4fc0 0x713
_purecall 0x4e7b0 0x714
_putc_nolock 0x96730 0x715
_putch 0xc5060 0x716
_putch_nolock 0xc50a0 0x717
_putenv 0xdb2f0 0x718
_putenv_s 0xdb310 0x719
_putw 0xa7040 0x71a
_putwc_nolock 0x968a0 0x71b
_putwch 0xc51b0 0x71c
_putwch_nolock 0xc51f0 0x71d
_putws 0xa71b0 0x71e
_query_app_type 0x8e470 0x71f
_query_new_handler 0x8e180 0x720
_query_new_mode 0x8e280 0x721
_read 0x32430 0x722
_realloc_base 0x23d90 0x723
_recalloc 0x23d00 0x724
_register_onexit_function 0x271e0 0x725
_register_thread_local_exe_atexit_callback 0x95090 0x726
_resetstkoflw 0xf0690 0x727
_rmdir 0xc8e90 0x728
_rmtmp 0xa73d0 0x729
_rotl 0xaa2a0 0x72a
_rotl64 0xaa2c0 0x72b
_rotr 0xaa300 0x72c
_rotr64 0xaa320 0x72d
_scalb 0xf40e0 0x72e
_searchenv 0xdd880 0x72f
_searchenv_s 0xdd8b0 0x730
_seh_filter_dll 0x91410 0x731
_seh_filter_exe 0x91440 0x732
_seh_longjmp_unwind 0x4e584 0x734
_seh_longjmp_unwind4 0x4e978 0x733
_set_SSE2_enable 0xf3610 0x735
_set_abort_behavior 0x93330 0x736
_set_app_type 0x3ac90 0x737
_set_controlfp 0x58bf0 0x738
_set_doserrno 0x91270 0x739
_set_errno 0x234c0 0x73a
_set_error_mode 0x91af0 0x73b
_set_fmode 0x3a8d0 0x73c
_set_invalid_parameter_handler 0x3bce0 0x73d
_set_new_handler 0x8e1f0 0x73e
_set_new_mode 0x3a8a0 0x73f
_set_printf_count_output 0xa6d90 0x740
_set_purecall_handler 0x4e7f0 0x741
_set_se_translator 0x4ea20 0x742
_set_thread_local_invalid_parameter_handler 0x91940 0x743
_seterrormode 0xf0770 0x744
_setjmp3 0x4ea40 0x745
_setmaxstdio 0xa7630 0x746
_setmbcp 0x90ec0 0x747
_setmode 0xd2bf0 0x748
_setsystime 0xf0940 0x749
_sleep 0xf07b0 0x74a
_sopen 0xd2850 0x74b
_sopen_dispatch 0xd2890 0x74c
_sopen_s 0xd28c0 0x74d
_spawnl 0xe00b0 0x74e
_spawnle 0xe00e0 0x74f
_spawnlp 0xe0810 0x750
_spawnlpe 0xe0840 0x751
_spawnv 0xe2130 0x752
_spawnve 0xe2150 0x753
_spawnvp 0xe32c0 0x754
_spawnvpe 0xe32e0 0x755
_splitpath 0xc9800 0x756
_splitpath_s 0x3aff0 0x757
_stat32 0xce240 0x758
_stat32i64 0xce260 0x759
_stat64 0xce280 0x75a
_stat64i32 0xce2a0 0x75b
_statusfp 0x58c70 0x75c
_statusfp2 0x58d20 0x75d
_strcoll_l 0x3c660 0x75e
_strdate 0xd65b0 0x75f
_strdate_s 0xd65d0 0x760
_strdup 0x3c7f0 0x761
_strerror 0x932f0 0x762
_strerror_s 0x93310 0x763
_strftime_l 0xd6660 0x764
_stricmp 0x3c890 0x765
_stricmp_l 0x3c8e0 0x766
_stricoll 0x3c980 0x767
_stricoll_l 0x3c9b0 0x768
_strlwr 0x3cc50 0x769
_strlwr_l 0x3ccc0 0x76a
_strlwr_s 0x3cce0 0x76b
_strlwr_s_l 0x3cd00 0x76c
_strncoll 0x3d010 0x76d
_strncoll_l 0x3d090 0x76e
_strnicmp 0x3d350 0x76f
_strnicmp_l 0x3d3d0 0x770
_strnicoll 0x3d490 0x771
_strnicoll_l 0x3d4c0 0x772
_strnset 0x3d9a0 0x773
_strnset_s 0x3d9d0 0x774
_strrev 0x3da90 0x775
_strset 0x3dad0 0x776
_strset_s 0x3db00 0x777
_strtime 0xd6b20 0x778
_strtime_s 0xd6b40 0x779
_strtod_l 0x8b0f0 0x77a
_strtof_l 0x8b0d0 0x77b
_strtoi64 0x8b190 0x77c
_strtoi64_l 0x8b210 0x77d
_strtoimax_l 0x8b210 0x77e
_strtol_l 0x8b1d0 0x77f
_strtold_l 0x8b0f0 0x780
_strtoll_l 0x8b210 0x781
_strtoui64 0x30f90 0x782
_strtoui64_l 0x8b250 0x783
_strtoul_l 0x8b290 0x784
_strtoull_l 0x8b250 0x785
_strtoumax_l 0x8b250 0x786
_strupr 0x3de70 0x787
_strupr_l 0x3dee0 0x788
_strupr_s 0x3df00 0x789
_strupr_s_l 0x3df20 0x78a
_strxfrm_l 0x3df60 0x78b
_swab 0x8b410 0x78c
_tell 0xd2e00 0x78d
_telli64 0xd2e20 0x78e
_tempnam 0xa8110 0x78f
_time32 0x34c40 0x790
_time64 0x34d40 0x791
_timespec32_get 0xd6d00 0x792
_timespec64_get 0xd6d20 0x793
_tolower 0x3bd30 0x794
_tolower_l 0x8b550 0x795
_toupper 0x8b570 0x796
_toupper_l 0x8b590 0x797
_towlower_l 0x38b40 0x798
_towupper_l 0x52c50 0x799
_tzset 0xd7c10 0x79a
_ui64toa 0x8c8f0 0x79b
_ui64toa_s 0x3a4a0 0x79c
_ui64tow 0x8c920 0x79d
_ui64tow_s 0x37620 0x79e
_ultoa 0x8c950 0x79f
_ultoa_s 0x8c980 0x7a0
_ultow 0x8c9b0 0x7a1
_ultow_s 0x370e0 0x7a2
_umask 0xd2e70 0x7a3
_umask_s 0xd2ea0 0x7a4
_ungetc_nolock 0xa8e40 0x7a5
_ungetch 0xc3740 0x7a6
_ungetch_nolock 0xc37a0 0x7a7
_ungetwc_nolock 0xa9200 0x7a8
_ungetwch 0xc39c0 0x7a9
_ungetwch_nolock 0xc3a20 0x7aa
_unlink 0xce340 0x7ab
_unloaddll 0xdfa40 0x7ac
_unlock_file 0x3bbc0 0x7ad
_unlock_locales 0x38830 0x7ae
_utime32 0xd9180 0x7af
_utime64 0xd91a0 0x7b0
_waccess 0xce3a0 0x7b1
_waccess_s 0xce3c0 0x7b2
_wasctime 0xd3aa0 0x7b3
_wasctime_s 0xd3ac0 0x7b4
_wassert 0x94d90 0x7b5
_wchdir 0xeee80 0x7b6
_wchmod 0xce9b0 0x7b7
_wcreat 0xcfc80 0x7b8
_wcreate_locale 0x3b3e0 0x7b9
_wcscoll_l 0x3e1c0 0x7ba
_wcsdup 0x3e400 0x7bb
_wcserror 0x924d0 0x7bc
_wcserror_s 0x924f0 0x7bd
_wcsftime_l 0xd98a0 0x7be
_wcsicmp 0x3e470 0x7bf
_wcsicmp_l 0x3e510 0x7c0
_wcsicoll 0x3e600 0x7c1
_wcsicoll_l 0x3e6a0 0x7c2
_wcslwr 0x3e8f0 0x7c3
_wcslwr_l 0x3e960 0x7c4
_wcslwr_s 0x3e980 0x7c5
_wcslwr_s_l 0x3e9a0 0x7c6
_wcsncoll 0x3eba0 0x7c7
_wcsncoll_l 0x3ec20 0x7c8
_wcsnicmp 0x3ee00 0x7c9
_wcsnicmp_l 0x3eec0 0x7ca
_wcsnicoll 0x3efd0 0x7cb
_wcsnicoll_l 0x3f0a0 0x7cc
_wcsnset 0x3f1d0 0x7cd
_wcsnset_s 0x3f290 0x7ce
_wcsrev 0x3f2f0 0x7cf
_wcsset 0x3f330 0x7d0
_wcsset_s 0x3f360 0x7d1
_wcstod_l 0x8b110 0x7d2
_wcstof_l 0x8b130 0x7d3
_wcstoi64 0x3b6d0 0x7d4
_wcstoi64_l 0x8b310 0x7d5
_wcstoimax_l 0x8b310 0x7d6
_wcstol_l 0x8b2d0 0x7d7
_wcstold_l 0x8b110 0x7d8
_wcstoll_l 0x8b310 0x7d9
_wcstombs_l 0x8c0b0 0x7da
_wcstombs_s_l 0x2b070 0x7db
_wcstoui64 0x3a380 0x7dc
_wcstoui64_l 0x8b390 0x7dd
_wcstoul_l 0x8b350 0x7de
_wcstoull_l 0x8b390 0x7df
_wcstoumax_l 0x8b390 0x7e0
_wcsupr 0x3f6b0 0x7e1
_wcsupr_l 0x3f720 0x7e2
_wcsupr_s 0x3f740 0x7e3
_wcsupr_s_l 0x3f760 0x7e4
_wcsxfrm_l 0x3f7a0 0x7e5
_wctime32 0xd4d40 0x7e6
_wctime32_s 0xd4d60 0x7e7
_wctime64 0xd4d80 0x7e8
_wctime64_s 0xd4da0 0x7e9
_wctomb_l 0x8c0d0 0x7ea
_wctomb_s_l 0x2c4e0 0x7eb
_wctype 0x6b50 0x7ec
_wdupenv_s 0x21920 0x7ed
_wexecl 0xe0110 0x7ee
_wexecle 0xe0140 0x7ef
_wexeclp 0xe0870 0x7f0
_wexeclpe 0xe08a0 0x7f1
_wexecv 0xe2170 0x7f2
_wexecve 0xe2190 0x7f3
_wexecvp 0xe3300 0x7f4
_wexecvpe 0xe3320 0x7f5
_wfdopen 0x957a0 0x7f6
_wfindfirst32 0xc8180 0x7f7
_wfindfirst32i64 0xc81a0 0x7f8
_wfindfirst64 0xc81c0 0x7f9
_wfindfirst64i32 0xc81e0 0x7fa
_wfindnext32 0xc8200 0x7fb
_wfindnext32i64 0xc8220 0x7fc
_wfindnext64 0xc8240 0x7fd
_wfindnext64i32 0xc8260 0x7fe
_wfopen 0x34c20 0x7ff
_wfopen_s 0x966a0 0x800
_wfreopen 0x96cb0 0x801
_wfreopen_s 0x96ce0 0x802
_wfsopen 0x32500 0x803
_wfullpath 0x21360 0x804
_wgetcwd 0xf0640 0x805
_wgetdcwd 0xf0660 0x806
_wgetenv 0xda0b0 0x807
_wgetenv_s 0xda0d0 0x808
_wmakepath 0xc8d10 0x809
_wmakepath_s 0xc8d40 0x80a
_wmkdir 0x38590 0x80b
_wmktemp 0xd2640 0x80c
_wmktemp_s 0xd2660 0x80d
_wopen 0xd28f0 0x80e
_wperror 0x92780 0x80f
_wpopen 0xc4fe0 0x810
_wputenv 0xdb4e0 0x811
_wputenv_s 0xdb500 0x812
_wremove 0xcec20 0x813
_wrename 0x3bc90 0x814
_write 0x310d0 0x815
_wrmdir 0xcebf0 0x816
_wsearchenv 0xdd8d0 0x817
_wsearchenv_s 0xdd900 0x818
_wsetlocale 0x28f80 0x819
_wsopen 0xd2910 0x81a
_wsopen_dispatch 0xd2950 0x81b
_wsopen_s 0xd2980 0x81c
_wspawnl 0xe0170 0x81d
_wspawnle 0xe01a0 0x81e
_wspawnlp 0xe08d0 0x81f
_wspawnlpe 0xe0900 0x820
_wspawnv 0xe21b0 0x821
_wspawnve 0xe21d0 0x822
_wspawnvp 0xe3340 0x823
_wspawnvpe 0xe3360 0x824
_wsplitpath 0xc9830 0x825
_wsplitpath_s 0x246a0 0x826
_wstat32 0xce2c0 0x827
_wstat32i64 0xce2e0 0x828
_wstat64 0xce300 0x829
_wstat64i32 0xce320 0x82a
_wstrdate 0xd65f0 0x82b
_wstrdate_s 0xd6610 0x82c
_wstrtime 0xd6b60 0x82d
_wstrtime_s 0xd6b80 0x82e
_wsystem 0xe4030 0x82f
_wtempnam 0xa8130 0x830
_wtmpnam 0xa8b70 0x831
_wtmpnam_s 0xa8ba0 0x832
_wtof 0x225d0 0x833
_wtof_l 0x87680 0x834
_wtoi 0x38560 0x835
_wtoi64 0x2e980 0x836
_wtoi64_l 0x88620 0x837
_wtoi_l 0x88650 0x838
_wtol 0x38560 0x839
_wtol_l 0x88650 0x83a
_wtoll 0x2e980 0x83b
_wtoll_l 0x88620 0x83c
_wunlink 0xcec50 0x83d
_wutime32 0xd91c0 0x83e
_wutime64 0xd91e0 0x83f
_y0 0xaac20 0x840
_y1 0xaadf0 0x841
_yn 0xaafd0 0x842
abort 0x93360 0x843
abs 0x3bdc0 0x844
acos 0x40440 0x845
acosh 0xaa440 0x846
acoshf 0xaa360 0x847
acoshl 0xaa440 0x848
asctime 0xd3ae0 0x849
asctime_s 0xd3b00 0x84a
asin 0x41020 0x84b
asinh 0xaa5b0 0x84c
asinhf 0xaa4f0 0x84d
asinhl 0xaa5b0 0x84e
atan 0x41c50 0x84f
atan2 0x41ca0 0x850
atanh 0xaa720 0x851
atanhf 0xaa650 0x852
atanhl 0xaa720 0x853
atof 0x20d40 0x854
atoi 0x2c3d0 0x855
atol 0x2c3d0 0x856
atoll 0x3b4f0 0x857
bsearch 0x236f0 0x858
bsearch_s 0x21ab0 0x859
btowc 0x8a6b0 0x85a
c16rtomb 0x88680 0x85b
c32rtomb 0x887b0 0x85c
cabs 0xab150 0x85d
cabsf 0xab110 0x85e
cabsl 0xab150 0x85f
cacos 0xaba80 0x860
cacosf 0xab1a0 0x861
cacosh 0xab420 0x862
cacoshf 0xab7c0 0x863
cacoshl 0xab420 0x864
cacosl 0xaba80 0x865
calloc 0x24040 0x866
carg 0xabe00 0x867
cargf 0xabdc0 0x868
cargl 0xabe00 0x869
casin 0xabe50 0x86a
casinf 0xabf00 0x86b
casinh 0xabf60 0x86c
casinhf 0xac2d0 0x86d
casinhl 0xabf60 0x86e
casinl 0xabe50 0x86f
catan 0xacbc0 0x870
catanf 0xac550 0x871
catanh 0xac8e0 0x872
catanhf 0xac5b0 0x873
catanhl 0xac8e0 0x874
catanl 0xacbc0 0x875
cbrt 0xacd70 0x876
cbrtf 0xacc70 0x877
cbrtl 0xacd70 0x878
ccos 0xace80 0x879
ccosf 0xacf00 0x87a
ccosh 0xad020 0x87b
ccoshf 0xad2c0 0x87c
ccoshl 0xad530 0x87d
ccosl 0xad6f0 0x87e
ceil 0x42350 0x87f
cexp 0xad770 0x880
cexpf 0xad970 0x881
cexpl 0xadb40 0x882
cimag 0xadd80 0x883
cimagf 0xadd40 0x884
cimagl 0xadd80 0x885
clearerr 0x95380 0x886
clearerr_s 0x95390 0x887
clock 0x35770 0x888
clog 0xaddc0 0x889
clog10 0xadff0 0x88a
clog10f 0xae050 0x88b
clog10l 0xadff0 0x88c
clogf 0xae0b0 0x88d
clogl 0xaddc0 0x88e
conj 0xae300 0x88f
conjf 0xae2c0 0x890
conjl 0xae300 0x891
copysign 0xae380 0x892
copysignf 0xae350 0x893
copysignl 0xae380 0x894
cos 0x42600 0x895
cosh 0x42650 0x896
cpow 0xae4c0 0x897
cpowf 0xae660 0x898
cpowl 0xae700 0x899
cproj 0xae840 0x89a
cprojf 0xae940 0x89b
cprojl 0xae840 0x89c
creal 0xaea20 0x89d
crealf 0xae9e0 0x89e
creall 0xaea20 0x89f
csin 0xaea60 0x8a0
csinf 0xaeb10 0x8a1
csinh 0xaecb0 0x8a2
csinhf 0xaef90 0x8a3
csinhl 0xaf220 0x8a4
csinl 0xaf390 0x8a5
csqrt 0xaf5f0 0x8a6
csqrtf 0xaf9e0 0x8a7
csqrtl 0xaf5f0 0x8a8
ctan 0xafbd0 0x8a9
ctanf 0xafc80 0x8aa
ctanh 0xafce0 0x8ab
ctanhf 0xafe80 0x8ac
ctanhl 0xafce0 0x8ad
ctanl 0xafbd0 0x8ae
div 0x3b580 0x8af
erf 0xb0090 0x8b0
erfc 0xb01b0 0x8b1
erfcf 0xb03f0 0x8b2
erfcl 0xb0630 0x8b3
erff 0xb0890 0x8b4
erfl 0xb0a20 0x8b5
exit 0x21c90 0x8b6
exp 0x42ac0 0x8b7
exp2 0xb0d80 0x8b8
exp2f 0xb10c0 0x8b9
exp2l 0xb13f0 0x8ba
expm1 0xb14d0 0x8bb
expm1f 0xb15b0 0x8bc
expm1l 0xb14d0 0x8bd
fabs 0xb1680 0x8be
fclose 0x31c50 0x8bf
fdim 0xb16d0 0x8c0
fdimf 0xb1720 0x8c1
fdiml 0xb16d0 0x8c2
feclearexcept 0xb1780 0x8c3
fegetenv 0xb17e0 0x8c4
fegetexceptflag 0xb1810 0x8c5
fegetround 0xb18a0 0x8c6
feholdexcept 0xb18d0 0x8c7
feof 0x957c0 0x8c8
ferror 0x958c0 0x8c9
fesetenv 0xb1920 0x8ca
fesetexceptflag 0xb1960 0x8cb
fesetround 0xb19c0 0x8cc
fetestexcept 0xb1a30 0x8cd
fflush 0x31660 0x8ce
fgetc 0x95b30 0x8cf
fgetpos 0x349b0 0x8d0
fgets 0x95f70 0x8d1
fgetwc 0x96240 0x8d2
fgetws 0x95f90 0x8d3
floor 0x430b0 0x8d4
fma 0xb1aa0 0x8d5
fmaf 0xb2310 0x8d6
fmal 0xb1aa0 0x8d7
fmax 0xb2b60 0x8d8
fmaxf 0xb2bd0 0x8d9
fmaxl 0xb2b60 0x8da
fmin 0xb2c40 0x8db
fminf 0xb2cb0 0x8dc
fminl 0xb2c40 0x8dd
fmod 0x40010 0x8de
fopen 0x966c0 0x8df
fopen_s 0x966e0 0x8e0
fputc 0x96740 0x8e1
fputs 0x31b30 0x8e2
fputwc 0x968b0 0x8e3
fputws 0x96970 0x8e4
fread 0x327f0 0x8e5
fread_s 0x32770 0x8e6
free 0x27e10 0x8e7
freopen 0x96d10 0x8e8
freopen_s 0x96d40 0x8e9
frexp 0xb35f0 0x8ea
fseek 0x31560 0x8eb
fsetpos 0x96e50 0x8ec
ftell 0x974c0 0x8ed
fwrite 0x31760 0x8ee
getc 0x95c60 0x8ef
getchar 0x95af0 0x8f0
getenv 0x3a0c0 0x8f1
getenv_s 0x3a140 0x8f2
gets 0x977e0 0x8f3
gets_s 0x97800 0x8f4
getwc 0x962d0 0x8f5
getwchar 0x96200 0x8f6
hypot 0xf3340 0x8f7
ilogb 0xb37f0 0x8f8
ilogbf 0xb3840 0x8f9
ilogbl 0xb37f0 0x8fa
imaxabs 0x3bda0 0x8fb
imaxdiv 0xa9780 0x8fc
is_wctype 0xf0680 0x8fd
isalnum 0x38c90 0x8fe
isalpha 0x27e70 0x8ff
isblank 0x8cd80 0x900
iscntrl 0x31580 0x901
isdigit 0x286a0 0x902
isgraph 0x8cdc0 0x903
isleadbyte 0x8d360 0x904
islower 0x8ce00 0x905
isprint 0x8ce40 0x906
ispunct 0x8ce80 0x907
isspace 0x28200 0x908
isupper 0x38cc0 0x909
iswalnum 0x23bb0 0x90a
iswalpha 0x21f70 0x90b
iswascii 0x3abb0 0x90c
iswblank 0x8d380 0x90d
iswcntrl 0x8d240 0x90e
iswctype 0x23cb0 0x90f
iswdigit 0x23c90 0x910
iswgraph 0x8d2c0 0x911
iswlower 0x8d2e0 0x912
iswprint 0x8d300 0x913
iswpunct 0x8d320 0x914
iswspace 0x35840 0x915
iswupper 0x8d3b0 0x916
iswxdigit 0x21880 0x917
isxdigit 0x286d0 0x918
labs 0x3bdc0 0x919
ldexp 0xb3890 0x91a
ldiv 0x3b580 0x91b
lgamma 0xb3ac0 0x91c
lgammaf 0xb42e0 0x91d
lgammal 0xb4ae0 0x91e
llabs 0x3bda0 0x91f
lldiv 0xa9d80 0x920
llrint 0xb4d90 0x921
llrintf 0xb4d00 0x922
llrintl 0xb4d90 0x923
llround 0x20eb0 0x924
llroundf 0xb4e20 0x925
llroundl 0xb4e90 0x926
localeconv 0x22d80 0x927
log 0x43240 0x928
log10 0x43290 0x929
log1p 0xb4fc0 0x92a
log1pf 0xb4f00 0x92b
log1pl 0xb4fc0 0x92c
log2 0x21760 0x92d
log2f 0xb51d0 0x92e
log2l 0xb5380 0x92f
logb 0xb5410 0x930
logbf 0xb53a0 0x931
logbl 0xb5410 0x932
longjmp 0x4eac0 0x933
lrint 0xb5480 0x934
lrintf 0xb5510 0x935
lrintl 0xb5480 0x936
lround 0x20ce0 0x937
lroundf 0xb55a0 0x938
lroundl 0xb5610 0x939
malloc 0x28d60 0x93a
mblen 0x89b40 0x93b
mbrlen 0x8a710 0x93c
mbrtoc16 0x89b80 0x93d
mbrtoc32 0x89de0 0x93e
mbrtowc 0x8a750 0x93f
mbsrtowcs 0x8a7b0 0x940
mbsrtowcs_s 0x8a7d0 0x941
mbstowcs 0x3b810 0x942
mbstowcs_s 0x3bb30 0x943
mbtowc 0x8ab10 0x944
memchr 0x4eae0 0x945
memcmp 0x4eba0 0x946
memcpy 0x50120 0x947
memcpy_s 0x3c240 0x948
memmove 0x506a0 0x949
memmove_s 0x3c2d0 0x94a
memset 0x50c20 0x94b
modf 0x43f40 0x94c
nan 0xb5800 0x94d
nanf 0xb57d0 0x94e
nanl 0xb5800 0x94f
nearbyint 0xb5810 0x950
nearbyintf 0xb5840 0x951
nearbyintl 0xb5810 0x952
nextafter 0xb5870 0x953
nextafterf 0xb58a0 0x954
nextafterl 0xb5870 0x955
nexttoward 0xb58d0 0x956
nexttowardf 0xb5a40 0x957
nexttowardl 0xb58d0 0x958
norm 0xb5bc0 0x959
normf 0xb5b80 0x95a
norml 0xb5bc0 0x95b
perror 0x91a30 0x95c
pow 0x44090 0x95d
powf 0x86c20 0x95e
putc 0x96870 0x95f
putchar 0x96880 0x960
puts 0xa6e80 0x961
putwc 0x96940 0x962
putwchar 0x96950 0x963
qsort 0x22080 0x964
qsort_s 0x22f40 0x965
quick_exit 0x950d0 0x966
raise 0x91f20 0x967
rand 0x23490 0x968
rand_s 0x39f50 0x969
realloc 0x23d80 0x96a
remainder 0xb5da0 0x96b
remainderf 0xf4100 0x96c
remainderl 0xb5da0 0x96d
remove 0xce350 0x96e
remquo 0xb5fc0 0x96f
remquof 0xb5dd0 0x970
remquol 0xb5fc0 0x971
rename 0xc8dc0 0x972
rewind 0xa72e0 0x973
rint 0xb6460 0x974
rintf 0xb62e0 0x975
rintl 0xb6460 0x976
round 0x215f0 0x977
roundf 0x20b40 0x978
roundl 0xb64b0 0x979
scalbln 0xb6560 0x97a
scalblnf 0xb6510 0x97b
scalblnl 0xb6560 0x97c
scalbn 0xb6560 0x97d
scalbnf 0xb6510 0x97e
scalbnl 0xb6560 0x97f
set_terminate 0x92640 0x980
set_unexpected 0x4e840 0x981
setbuf 0xa7480 0x982
setlocale 0x29000 0x983
setvbuf 0xa7870 0x984
signal 0x3b5a0 0x985
sin 0x459b0 0x986
sinh 0x45a00 0x987
sqrt 0x45ea0 0x988
srand 0x23470 0x989
strcat 0x3c460 0x98a
strcat_s 0x3c550 0x98b
strchr 0x50d80 0x98c
strcmp 0x3c5c0 0x98d
strcoll 0x3c720 0x98e
strcpy 0x3c450 0x98f
strcpy_s 0x3c740 0x990
strcspn 0x3c7a0 0x991
strerror 0x3a650 0x992
strerror_s 0x92510 0x993
strftime 0x39940 0x994
strlen 0x3ca50 0x995
strncat 0x3cd40 0x996
strncat_s 0x3cf50 0x997
strncmp 0x3cf60 0x998
strncpy 0x3d160 0x999
strncpy_s 0x3d340 0x99a
strnlen 0x3d590 0x99b
strpbrk 0x3da50 0x99c
strrchr 0x50eb0 0x99d
strspn 0x3db50 0x99e
strstr 0x51000 0x99f
strtod 0x20f60 0x9a0
strtof 0x8b150 0x9a1
strtoimax 0x8b190 0x9a2
strtok 0x3dba0 0x9a3
strtok_s 0x3dcb0 0x9a4
strtol 0x3a2f0 0x9a5
strtold 0x20f60 0x9a6
strtoll 0x33be0 0x9a7
strtoul 0x39eb0 0x9a8
strtoull 0x30f90 0x9a9
strtoumax 0x8b3d0 0x9aa
strxfrm 0x3e090 0x9ab
system 0xe4050 0x9ac
tan 0x46070 0x9ad
tanh 0x460c0 0x9ae
terminate 0x92730 0x9af
tgamma 0xb6e90 0x9b0
tgammaf 0xb78e0 0x9b1
tgammal 0xb83d0 0x9b2
tmpfile 0xa8cb0 0x9b3
tmpfile_s 0xa8ce0 0x9b4
tmpnam 0xa8d00 0x9b5
tmpnam_s 0xa8d30 0x9b6
tolower 0x33f30 0x9b7
toupper 0x33e90 0x9b8
towctrans 0x8c1b0 0x9b9
towlower 0x38b20 0x9ba
towupper 0x2a980 0x9bb
trunc 0xb85d0 0x9bc
truncf 0xb85f0 0x9bd
truncl 0xb85d0 0x9be
unexpected 0x4e870 0x9bf
ungetc 0xa9010 0x9c0
ungetwc 0xa92c0 0x9c1
wcrtomb 0x8bb70 0x9c2
wcrtomb_s 0x8bbb0 0x9c3
wcscat 0x3e0b0 0x9c4
wcscat_s 0x3e0f0 0x9c5
wcschr 0x51270 0x9c6
wcscmp 0x3e170 0x9c7
wcscoll 0x3e280 0x9c8
wcscpy 0x3e300 0x9c9
wcscpy_s 0x3e330 0x9ca
wcscspn 0x3e3a0 0x9cb
wcsftime 0xd98d0 0x9cc
wcslen 0x3d6c0 0x9cd
wcsncat 0x3e9e0 0x9ce
wcsncat_s 0x3eb20 0x9cf
wcsncmp 0x3eb30 0x9d0
wcsncpy 0x3ecd0 0x9d1
wcsncpy_s 0x3edf0 0x9d2
wcsnlen 0x3d7f0 0x9d3
wcspbrk 0x3f2a0 0x9d4
wcsrchr 0x51330 0x9d5
wcsrtombs 0x8bd10 0x9d6
wcsrtombs_s 0x8bd30 0x9d7
wcsspn 0x3f3c0 0x9d8
wcsstr 0x513e0 0x9d9
wcstod 0x21bb0 0x9da
wcstof 0x8b170 0x9db
wcstoimax 0x3b6d0 0x9dc
wcstok 0x3f410 0x9dd
wcstok_s 0x3f4f0 0x9de
wcstol 0x3a860 0x9df
wcstold 0x21bb0 0x9e0
wcstoll 0x3b6d0 0x9e1
wcstombs 0x3b780 0x9e2
wcstombs_s 0x3b840 0x9e3
wcstoul 0x28b10 0x9e4
wcstoull 0x3b220 0x9e5
wcstoumax 0x3a380 0x9e6
wcsxfrm 0x3f8f0 0x9e7
wctob 0x8c050 0x9e8
wctomb 0x8c140 0x9e9
wctomb_s 0x8c180 0x9ea
wctrans 0x8c1e0 0x9eb
wctype 0x8c250 0x9ec
wmemcpy_s 0x3f910 0x9ed
wmemmove_s 0x3f9d0 0x9ee
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/vcruntime140.dll Dropped File Binary
Whitelisted
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 81.82 KB
MD5 7587bf9cb4147022cd5681b015183046 Copy to Clipboard
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628 Copy to Clipboard
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d Copy to Clipboard
SSDeep 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF Copy to Clipboard
ImpHash fa315c9bc46ab41d4bc4e3f94023067f Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
PE Information
»
Image Base 0x10000000
Entry Point 0x1000ae00
Size Of Code 0xea00
Size Of Initialized Data 0x2000
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2017-05-25 20:01:16+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription Microsoft® C Runtime Library
FileVersion 14.11.25325.0 built by: VCTOOLSREL
InternalName vcruntime140.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename vcruntime140.dll
ProductName Microsoft® Visual Studio® 2017
ProductVersion 14.11.25325.0
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xe9c4 0xea00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.62
.data 0x10010000 0x644 0x200 0xee00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 3.71
.idata 0x10011000 0x5b8 0x600 0xf000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.04
.rsrc 0x10012000 0x408 0x600 0xf600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.46
.reloc 0x10013000 0xa94 0xc00 0xfc00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.21
Imports (6)
»
api-ms-win-crt-runtime-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
abort 0x0 0x1001109c 0x111e8 0xf1e8 0x57
terminate 0x0 0x100110a0 0x111ec 0xf1ec 0x6a
api-ms-win-crt-string-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strcpy_s 0x0 0x100110b0 0x111fc 0xf1fc 0x89
wcsncmp 0x0 0x100110b4 0x11200 0xf200 0xa6
api-ms-win-crt-heap-l1-1-0.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
malloc 0x0 0x10011084 0x111d0 0xf1d0 0x19
_free_base 0x0 0x10011088 0x111d4 0xf1d4 0xb
free 0x0 0x1001108c 0x111d8 0xf1d8 0x18
_malloc_base 0x0 0x10011090 0x111dc 0xf1dc 0x10
_calloc_base 0x0 0x10011094 0x111e0 0xf1e0 0x9
api-ms-win-crt-stdio-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__stdio_common_vsprintf_s 0x0 0x100110a8 0x111f4 0xf1f4 0xf
api-ms-win-crt-convert-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
atol 0x0 0x1001107c 0x111c8 0xf1c8 0x51
KERNEL32.dll (30)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LeaveCriticalSection 0x0 0x10011000 0x1114c 0xf14c 0x3a0
TerminateProcess 0x0 0x10011004 0x11150 0xf150 0x561
GetCurrentProcess 0x0 0x10011008 0x11154 0xf154 0x207
SetUnhandledExceptionFilter 0x0 0x1001100c 0x11158 0xf158 0x543
UnhandledExceptionFilter 0x0 0x10011010 0x1115c 0xf15c 0x582
GetSystemTimeAsFileTime 0x0 0x10011014 0x11160 0xf160 0x2d4
GetCurrentThreadId 0x0 0x10011018 0x11164 0xf164 0x20c
GetCurrentProcessId 0x0 0x1001101c 0x11168 0xf168 0x208
QueryPerformanceCounter 0x0 0x10011020 0x1116c 0xf16c 0x42b
IsProcessorFeaturePresent 0x0 0x10011024 0x11170 0xf170 0x36b
GetModuleHandleW 0x0 0x10011028 0x11174 0xf174 0x265
GetModuleFileNameW 0x0 0x1001102c 0x11178 0xf178 0x261
LoadLibraryExW 0x0 0x10011030 0x1117c 0xf17c 0x3a5
TlsFree 0x0 0x10011034 0x11180 0xf180 0x574
TlsGetValue 0x0 0x10011038 0x11184 0xf184 0x575
FreeLibrary 0x0 0x1001103c 0x11188 0xf188 0x19c
RtlUnwind 0x0 0x10011040 0x1118c 0xf18c 0x4ad
VirtualQuery 0x0 0x10011044 0x11190 0xf190 0x5a3
EncodePointer 0x0 0x10011048 0x11194 0xf194 0x11f
InterlockedFlushSList 0x0 0x1001104c 0x11198 0xf198 0x352
InterlockedPushEntrySList 0x0 0x10011050 0x1119c 0xf19c 0x355
RaiseException 0x0 0x10011054 0x111a0 0xf1a0 0x43f
EnterCriticalSection 0x0 0x10011058 0x111a4 0xf1a4 0x123
DeleteCriticalSection 0x0 0x1001105c 0x111a8 0xf1a8 0x103
SetLastError 0x0 0x10011060 0x111ac 0xf1ac 0x50b
GetLastError 0x0 0x10011064 0x111b0 0xf1b0 0x24e
TlsSetValue 0x0 0x10011068 0x111b4 0xf1b4 0x576
InitializeCriticalSectionAndSpinCount 0x0 0x1001106c 0x111b8 0xf1b8 0x346
TlsAlloc 0x0 0x10011070 0x111bc 0xf1bc 0x573
GetProcAddress 0x0 0x10011074 0x111c0 0xf1c0 0x29b
Exports (81)
»
Api name EAT Address Ordinal
_CreateFrameInfo 0xe540 0x1
_CxxThrowException 0x4690 0x2
_EH_prolog 0xeb50 0x3
_FindAndUnlinkFrame 0xe570 0x4
_IsExceptionObjectToBeDestroyed 0x2ce0 0x5
_NLG_Dispatch2 0xb463 0x6
_NLG_Return 0xd0b7 0x7
_NLG_Return2 0xb46d 0x8
_SetWinRTOutOfMemoryExceptionCallback 0x2c20 0x9
__AdjustPointer 0x2ad0 0xa
__BuildCatchObject 0x3930 0xb
__BuildCatchObjectHelper 0x3800 0xc
__CxxDetectRethrow 0x3cb0 0xd
__CxxExceptionFilter 0x3ab0 0xe
__CxxFrameHandler 0xe660 0xf
__CxxFrameHandler2 0xe660 0x10
__CxxFrameHandler3 0xe660 0x11
__CxxLongjmpUnwind 0xe6a0 0x12
__CxxQueryExceptionSize 0x3e10 0x13
__CxxRegisterExceptionObject 0x3c00 0x14
__CxxUnregisterExceptionObject 0x3d00 0x15
__DestructExceptionObject 0x2c40 0x16
__FrameUnwindFilter 0x2bd0 0x17
__GetPlatformExceptionInfo 0x2b00 0x18
__RTCastToVoid 0x3e60 0x19
__RTDynamicCast 0x3f80 0x1a
__RTtypeid 0x3f00 0x1b
__TypeMatch 0x3420 0x1c
__current_exception 0x2ba0 0x1d
__current_exception_context 0x2bb0 0x1e
__intrinsic_setjmp 0xb260 0x1f
__processing_throw 0x2bc0 0x20
__report_gsfailure 0xeba0 0x21
__std_exception_copy 0x4470 0x22
__std_exception_destroy 0x44e0 0x23
__std_terminate 0x2c30 0x24
__std_type_info_compare 0x4500 0x25
__std_type_info_destroy_list 0x4660 0x26
__std_type_info_hash 0x4540 0x27
__std_type_info_name 0x4570 0x28
__telemetry_main_invoke_trigger 0x2670 0x29
__telemetry_main_return_trigger 0x2670 0x2a
__unDName 0x4d20 0x2b
__unDNameEx 0x4dc0 0x2c
__uncaught_exception 0x2b90 0x2d
__uncaught_exceptions 0x2b50 0x2e
__vcrt_GetModuleFileNameW 0x4bd0 0x2f
__vcrt_GetModuleHandleW 0x4bf0 0x30
__vcrt_InitializeCriticalSectionEx 0x4b80 0x31
__vcrt_LoadLibraryExW 0x4c00 0x32
_chkesp 0xb670 0x33
_except_handler2 0xae28 0x34
_except_handler3 0xaef8 0x35
_except_handler4_common 0xb500 0x36
_get_purecall_handler 0x4c80 0x37
_get_unexpected 0x4700 0x38
_global_unwind2 0xb330 0x39
_is_exception_typeof 0x2d10 0x3a
_local_unwind2 0xb396 0x3b
_local_unwind4 0xb030 0x3c
_longjmpex 0xb320 0x3d
_purecall 0x4c20 0x3e
_seh_longjmp_unwind 0xb004 0x40
_seh_longjmp_unwind4 0xb108 0x3f
_set_purecall_handler 0x4c40 0x41
_set_se_translator 0x4760 0x42
_setjmp3 0xb2a0 0x43
longjmp 0x26d0 0x44
memchr 0xd0e0 0x45
memcmp 0xbb10 0x46
memcpy 0xd190 0x47
memmove 0xd710 0x48
memset 0xdc90 0x49
set_unexpected 0x4720 0x4a
strchr 0xddf0 0x4b
strrchr 0xdf20 0x4c
strstr 0xe060 0x4d
unexpected 0x4740 0x4e
wcschr 0x26f0 0x4f
wcsrchr 0x2790 0x50
wcsstr 0x2840 0x51
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2016-08-18 20:17:17+00:00
Valid Until 2017-11-02 20:17:17+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 40 96 A9 EE 70 56 FE CC 07 00 01 00 00 01 40
Thumbprint 98 ED 99 A6 78 86 D0 20 C5 64 92 3B 7D F2 5E 9A C0 19 DF 26
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\aETAdzjz\AppData\Local\Temp\182028482867542631482656.tmp Dropped File Sqlite
Whitelisted
...
»
Also Known As C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Cookies (Dropped File)
Mime Type application/x-sqlite3
File Size 28.00 KB
MD5 4a755de35d5f03cd209e9f5725fe92b5 Copy to Clipboard
SHA1 08ad49071afdb4c2b095c6bcb07336ab2f267387 Copy to Clipboard
SHA256 aecd0296f38fa691e15177c5fe550172c938c61036a910bf05e8f71faa2b442d Copy to Clipboard
SSDeep 24:TLEag/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fB:ToR/ecVTgPOpEveoJZFrU1cQB Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
C:\Users\aETAdzjz\AppData\Local\Temp\2035036576518928862638.tmp-shm Dropped File Stream
Whitelisted
...
»
Also Known As C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp-shm (Dropped File)
Mime Type application/octet-stream
File Size 32.00 KB
MD5 b7c14ec6110fa820ca6b65f5aec85911 Copy to Clipboard
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4 Copy to Clipboard
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb Copy to Clipboard
SSDeep 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX Copy to Clipboard
ImpHash -
File Reputation Information
»
Severity
Whitelisted
C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\\aetadzjz@live[2].txt Dropped File Text
Unknown
...
»
Mime Type text/plain
File Size 64 Bytes
MD5 0755beab2e195850485c6aa4fd79870a Copy to Clipboard
SHA1 6f6d35a033e466749b8fd1574d7827a91faaa82c Copy to Clipboard
SHA256 58f82370f5b62c631e96b51171d2264c4c759be04bb111ab29f26c6d96e08952 Copy to Clipboard
SSDeep 3:vpqMLJUQ2W0cpStcwVTdD:vEMWXbc8tZhp Copy to Clipboard
ImpHash -
C:\Users\aETAdzjz\AppData\Local\Temp\182004765502204915563913.tmp Dropped File Sqlite
Unknown
...
»
Also Known As C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Login Data (Dropped File)
Mime Type application/x-sqlite3
File Size 18.00 KB
MD5 a031e9d545551a24e4c77344f84539d4 Copy to Clipboard
SHA1 db8b3fd502f0953c7a28e71b75e8c06a460a7449 Copy to Clipboard
SHA256 fe117e2f56177afe116cd747fe1df06d60f4ab5e324530f8fbdcecb826e63e1c Copy to Clipboard
SSDeep 24:LLi4N0KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6UwcpYMQW:zNz+JH3yJUheCVE9V8MX0PFlNU1uW Copy to Clipboard
ImpHash -
C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp Dropped File Sqlite
Unknown
...
»
Also Known As C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\cookies.sqlite (Dropped File)
Mime Type application/x-sqlite3
File Size 512.00 KB
MD5 6389834774166f7a20359003254939f2 Copy to Clipboard
SHA1 7b996a476a9f7fe763ab19c39d3dc318966d18b8 Copy to Clipboard
SHA256 23b1cf9e40b9ba27ec7eb7cd01b4609e4418aba063275fb2a0aebcf28f8f8620 Copy to Clipboard
SSDeep 96:Dbn5HKlV8/VDHLRilOhFTFf6FdqA9LJp6Y/e2DkrGJ6hmCcaLeU8ukONPk7iriQ:3n5HKEnhTFiPsvW7iri Copy to Clipboard
ImpHash -
C:\Users\aETAdzjz\AppData\Local\Temp\182031918183732679381489.tmp Dropped File Sqlite
Unknown
...
»
Also Known As C:\Users\aETAdzjz\AppData\Local\Temp\182031289079242754423543.tmp (Dropped File)
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Web Data (Dropped File)
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Default\Web Data (Dropped File)
Mime Type application/x-sqlite3
File Size 64.00 KB
MD5 f167061aa11d4d88bce348a7704db935 Copy to Clipboard
SHA1 5806e2ac52fe48573dca9b2ac8e4504d7d781b6e Copy to Clipboard
SHA256 5be8fbb1985582aa220e9bb5d8781c4e3c21206e31cff7f911cdb2fbbed1acb9 Copy to Clipboard
SSDeep 96:GKuNQIoYnMvqyWx7pnqH+w/fVIrECuKdPraBdUDBBVWqwmKT/WTPepeWbtxY:tJkMvuzzTP6bt Copy to Clipboard
ImpHash -
C:\Users\aETAdzjz\AppData\Local\Temp\182032848139586271779370.tmp Dropped File Sqlite
Unknown
...
»
Also Known As C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\formhistory.sqlite (Dropped File)
Mime Type application/x-sqlite3
File Size 192.00 KB
MD5 b8f205f9f2dbf68c60dcfc3df3e9053d Copy to Clipboard
SHA1 1581961d4cf6f304fbe88233d7017f9e71b6b4e4 Copy to Clipboard
SHA256 c20353043062ed74b77a57e471bf4293b7e57b9b51942a2616c25dc16a9e7e20 Copy to Clipboard
SSDeep 12:DBl/Zed12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLZs1x7WxHaiSlMxosJF/Ezo Copy to Clipboard
ImpHash -
C:\Users\aETAdzjz\AppData\Local\Temp\182033787308292230589271.tmp Dropped File Sqlite
Unknown
...
»
Also Known As C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\History (Dropped File)
Mime Type application/x-sqlite3
File Size 112.00 KB
MD5 1d0658e804791ee90258526373d8e5c4 Copy to Clipboard
SHA1 5ed7e68d094e2a41fca037f9ec12698213c49976 Copy to Clipboard
SHA256 b00114acc920b170147d1a11b5272f210fd1bb8033ee0c7a072680508d1ee305 Copy to Clipboard
SSDeep 48:T9aC3BdjNPp+suktLReRK+nVaNU74ePLrL2Iua6maxNPM5ETQTcrQHIvYysX0jpi:RVdvUVaN+LrL2IlLvU+kYysX0j4t Copy to Clipboard
ImpHash -
C:\Users\aETAdzjz\AppData\Local\Temp\2035036576518928862638.tmp Dropped File Sqlite
Unknown
...
»
Also Known As C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\places.sqlite (Dropped File)
Mime Type application/x-sqlite3
File Size 10.00 MB
MD5 4217fd1f9c0d91c9d57cc6767f58c0b5 Copy to Clipboard
SHA1 91f3008494f3a842a5b59319c5a75e15ff6c405e Copy to Clipboard
SHA256 c2b933557ca7812205a57a0f724cdb464e7b06cbbb77a657fb337c0307e888c8 Copy to Clipboard
SSDeep 384:QS+qYFlfk44jGaCvySv3Lxj0eu1Du1ju1Uu1Evdj44V/Dd:1+qYj+cF3LxgYD Copy to Clipboard
ImpHash -
c:\users\aetadzjz\appdata\local\temp\~df5194c6aa1bfaf880.tmp Dropped File OLE Compound
Unknown
...
»
Mime Type application/CDFV2
File Size 16.00 KB
MD5 d9e26abfee257a16b73784abf585ee31 Copy to Clipboard
SHA1 7845b5cbd10dc89cc9ad845830a04ab7a77bd2df Copy to Clipboard
SHA256 24a0db74df70100e8b502007852bab296ad099dacc1af14462eb2c5075c547d5 Copy to Clipboard
SSDeep 12:rl3lKFQCb77XAINVirpYRHYY6USswaWwEB8K8OMgyEEXstLBs:ri1NVirpUPBwaWu9RPEEk Copy to Clipboard
ImpHash -
1932d8c415f078ca690f84b2a7ec372d03ff32beb804629619fe3775e7850099 Downloaded File Stream
Unknown
...
»
Parent File analysis.pcap
Mime Type application/octet-stream
File Size 105 Bytes
MD5 86a42d3b113836c1c1479970288f1b11 Copy to Clipboard
SHA1 4dfa181dde8c5ba010cb2a0d6d8a74a835a1ddd7 Copy to Clipboard
SHA256 1932d8c415f078ca690f84b2a7ec372d03ff32beb804629619fe3775e7850099 Copy to Clipboard
SSDeep 3:wcaJHofQdXDk1h2caCi20f6fATikiub78Dv:wcaJofQdXQecH0f64QO8Dv Copy to Clipboard
ImpHash -
bb7c277a1ea7a3bb3882861f8571185ee64edbf10e837b2010361380139f5444 Downloaded File Text
Unknown
...
»
Parent File analysis.pcap
Mime Type text/plain
File Size 7 Bytes
MD5 0fc9ece6a952fb99876dc1c0ed720b24 Copy to Clipboard
SHA1 99ef5a5fac0807bce8a5164d0c2e4dca012b0fcc Copy to Clipboard
SHA256 bb7c277a1ea7a3bb3882861f8571185ee64edbf10e837b2010361380139f5444 Copy to Clipboard
SSDeep 3:oqu:oV Copy to Clipboard
ImpHash -
d6dcb74ede20ce104e6cf1b52dd5551105feaf027401ef34d7ca5a5d3333fa95 Downloaded File Stream
Unknown
...
»
Parent File analysis.pcap
Mime Type application/octet-stream
File Size 4.27 MB
MD5 7c342898a34f5fc5ce6dd147f5492427 Copy to Clipboard
SHA1 681bf1e0ca4394c89d68d2b5ad1f75f4e54e04b1 Copy to Clipboard
SHA256 d6dcb74ede20ce104e6cf1b52dd5551105feaf027401ef34d7ca5a5d3333fa95 Copy to Clipboard
SSDeep 49152:y9zgkv58gK28UBvyFfYELWcLPik69kBREGr1YdgIVWfo74T+BP3E:EFRUaaqnG5ihETCP3E Copy to Clipboard
ImpHash -
db997093559061c627f0580b0046fbc6c93be52f6bb3056c17688ab60ea3e729 Downloaded File Stream
Unknown
...
»
Parent File analysis.pcap
Mime Type application/octet-stream
File Size 128.42 KB
MD5 8e99b89611a54ea10706d3abcabf3b99 Copy to Clipboard
SHA1 eed8a788db31c39463e24e1f0197f366700fafca Copy to Clipboard
SHA256 db997093559061c627f0580b0046fbc6c93be52f6bb3056c17688ab60ea3e729 Copy to Clipboard
SSDeep 3072:55B4b9jFsfD22PXsE7TxKRGvgkKkGAkVzM5yrUk75TCpKhs9:osFkKdKRIhKtAkVzM5yrUkha Copy to Clipboard
ImpHash -
Equation3_1 Embedded File Stream
Unknown
...
»
Parent File C:\Users\aETAdzjz\Desktop\API .doc.rtf
Mime Type application/octet-stream
File Size 415.49 KB
MD5 0de20195a34bb53aeec70f622a926f6d Copy to Clipboard
SHA1 f02975c3c5d386975ad1e662f094b7cc077a73cf Copy to Clipboard
SHA256 2cade4fc6b55395aa4bc691c03755e609bdb1b25b82750d2046929b6d39ca251 Copy to Clipboard
SSDeep 6144:0DKVMHO3ZKWEZkBetYMIx2SBD7VIXng1dNQ13Si6u4er12v1vTUX7zP7RFk9O73n:0DKVF3wWoNtNE3BPeXgQ1MGp3kYTP9eu Copy to Clipboard
ImpHash -
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image