1858 lines
44 KiB
JSON
1858 lines
44 KiB
JSON
|
{
|
||
|
|
"modules": [
|
||
|
|
{
|
||
|
|
"name": "AnyDesk.exe",
|
||
|
|
"base": "0x10000",
|
||
|
|
"size": 37330944,
|
||
|
|
"path": "C:\\Users\\Mes\\Downloads\\AnyDesk.exe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "ntdll.dll",
|
||
|
|
"base": "0x772a0000",
|
||
|
|
"size": 1830912,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\ntdll.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "KERNEL32.DLL",
|
||
|
|
"base": "0x76090000",
|
||
|
|
"size": 983040,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\KERNEL32.DLL"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "KERNELBASE.dll",
|
||
|
|
"base": "0x764f0000",
|
||
|
|
"size": 2916352,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\KERNELBASE.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "WINMM.dll",
|
||
|
|
"base": "0x745d0000",
|
||
|
|
"size": 208896,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\WINMM.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "ucrtbase.dll",
|
||
|
|
"base": "0x76360000",
|
||
|
|
"size": 1114112,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\ucrtbase.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "SHLWAPI.dll",
|
||
|
|
"base": "0x74ba0000",
|
||
|
|
"size": 335872,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\SHLWAPI.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "Windows.Storage.dll",
|
||
|
|
"base": "0x75890000",
|
||
|
|
"size": 7225344,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\Windows.Storage.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "combase.dll",
|
||
|
|
"base": "0x74db0000",
|
||
|
|
"size": 2695168,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\combase.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "RPCRT4.dll",
|
||
|
|
"base": "0x76f60000",
|
||
|
|
"size": 770048,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\RPCRT4.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "msvcp_win.dll",
|
||
|
|
"base": "0x77100000",
|
||
|
|
"size": 544768,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\msvcp_win.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "advapi32.dll",
|
||
|
|
"base": "0x74c00000",
|
||
|
|
"size": 544768,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\advapi32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "msvcrt.dll",
|
||
|
|
"base": "0x749f0000",
|
||
|
|
"size": 815104,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\msvcrt.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "sechost.dll",
|
||
|
|
"base": "0x75130000",
|
||
|
|
"size": 536576,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\sechost.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "WS2_32.dll",
|
||
|
|
"base": "0x74c90000",
|
||
|
|
"size": 397312,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\WS2_32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "ole32.dll",
|
||
|
|
"base": "0x74780000",
|
||
|
|
"size": 1380352,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\ole32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "GDI32.dll",
|
||
|
|
"base": "0x77020000",
|
||
|
|
"size": 139264,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\GDI32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "win32u.dll",
|
||
|
|
"base": "0x748e0000",
|
||
|
|
"size": 106496,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\win32u.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "gdi32full.dll",
|
||
|
|
"base": "0x77190000",
|
||
|
|
"size": 962560,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\gdi32full.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "USER32.dll",
|
||
|
|
"base": "0x76190000",
|
||
|
|
"size": 1871872,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\USER32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "IMM32.DLL",
|
||
|
|
"base": "0x74900000",
|
||
|
|
"size": 151552,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\IMM32.DLL"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "OLEAUT32.dll",
|
||
|
|
"base": "0x74d00000",
|
||
|
|
"size": 651264,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\OLEAUT32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "COMCTL32.dll",
|
||
|
|
"base": "0x743a0000",
|
||
|
|
"size": 2265088,
|
||
|
|
"path": "C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7922_none_85b5d4f5f7b04a77\\COMCTL32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "gdiplus.dll",
|
||
|
|
"base": "0x74220000",
|
||
|
|
"size": 1556480,
|
||
|
|
"path": "C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.26100.7920_none_b6a0f56b52429103\\gdiplus.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "SHELL32.dll",
|
||
|
|
"base": "0x75250000",
|
||
|
|
"size": 6512640,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\SHELL32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "wintypes.dll",
|
||
|
|
"base": "0x74680000",
|
||
|
|
"size": 1019904,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\wintypes.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "IPHLPAPI.DLL",
|
||
|
|
"base": "0x741f0000",
|
||
|
|
"size": 159744,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\IPHLPAPI.DLL"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "WINHTTP.dll",
|
||
|
|
"base": "0x74100000",
|
||
|
|
"size": 921600,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\WINHTTP.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "CRYPT32.dll",
|
||
|
|
"base": "0x75f80000",
|
||
|
|
"size": 1085440,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\CRYPT32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "Secur32.dll",
|
||
|
|
"base": "0x740f0000",
|
||
|
|
"size": 40960,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\Secur32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "SSPICLI.DLL",
|
||
|
|
"base": "0x740c0000",
|
||
|
|
"size": 176128,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\SSPICLI.DLL"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "MSIMG32.dll",
|
||
|
|
"base": "0x740b0000",
|
||
|
|
"size": 24576,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\MSIMG32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "PSAPI.DLL",
|
||
|
|
"base": "0x77280000",
|
||
|
|
"size": 24576,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\PSAPI.DLL"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "SETUPAPI.dll",
|
||
|
|
"base": "0x767c0000",
|
||
|
|
"size": 4526080,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\SETUPAPI.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "MPR.dll",
|
||
|
|
"base": "0x74090000",
|
||
|
|
"size": 102400,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\MPR.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "WINSPOOL.DRV",
|
||
|
|
"base": "0x74000000",
|
||
|
|
"size": 561152,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\WINSPOOL.DRV"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "shcore.dll",
|
||
|
|
"base": "0x74ac0000",
|
||
|
|
"size": 860160,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\shcore.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "cfgmgr32.dll",
|
||
|
|
"base": "0x73fb0000",
|
||
|
|
"size": 274432,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\cfgmgr32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "kernel.appcore.dll",
|
||
|
|
"base": "0x73f90000",
|
||
|
|
"size": 86016,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\kernel.appcore.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "bcryptPrimitives.dll",
|
||
|
|
"base": "0x750b0000",
|
||
|
|
"size": 475136,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\bcryptPrimitives.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "uxtheme.dll",
|
||
|
|
"base": "0x73f00000",
|
||
|
|
"size": 524288,
|
||
|
|
"path": "C:\\WINDOWS\\system32\\uxtheme.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "profapi.dll",
|
||
|
|
"base": "0x73ee0000",
|
||
|
|
"size": 118784,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\profapi.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "ntmarta.dll",
|
||
|
|
"base": "0x73eb0000",
|
||
|
|
"size": 167936,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\ntmarta.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "MSCTF.dll",
|
||
|
|
"base": "0x76e40000",
|
||
|
|
"size": 1150976,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\MSCTF.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "WindowsCodecs.dll",
|
||
|
|
"base": "0x73cc0000",
|
||
|
|
"size": 1961984,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\WindowsCodecs.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "clbcatq.dll",
|
||
|
|
"base": "0x751c0000",
|
||
|
|
"size": 548864,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\clbcatq.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "thumbcache.dll",
|
||
|
|
"base": "0x73c60000",
|
||
|
|
"size": 335872,
|
||
|
|
"path": "C:\\Windows\\System32\\thumbcache.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "policymanager.dll",
|
||
|
|
"base": "0x73bb0000",
|
||
|
|
"size": 651264,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\policymanager.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "avrt.dll",
|
||
|
|
"base": "0x73ba0000",
|
||
|
|
"size": 36864,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\avrt.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "PROPSYS.dll",
|
||
|
|
"base": "0x73ac0000",
|
||
|
|
"size": 860160,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\PROPSYS.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "LINKINFO.dll",
|
||
|
|
"base": "0x73ab0000",
|
||
|
|
"size": 45056,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\LINKINFO.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "ntshrui.dll",
|
||
|
|
"base": "0x73a20000",
|
||
|
|
"size": 532480,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\ntshrui.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "srvcli.dll",
|
||
|
|
"base": "0x739f0000",
|
||
|
|
"size": 122880,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\srvcli.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "cscapi.dll",
|
||
|
|
"base": "0x739d0000",
|
||
|
|
"size": 57344,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\cscapi.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "bcrypt.dll",
|
||
|
|
"base": "0x739b0000",
|
||
|
|
"size": 114688,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\bcrypt.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "DPAPI.dll",
|
||
|
|
"base": "0x739a0000",
|
||
|
|
"size": 36864,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\DPAPI.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "CRYPTBASE.dll",
|
||
|
|
"base": "0x73990000",
|
||
|
|
"size": 40960,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\CRYPTBASE.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "TextShaping.dll",
|
||
|
|
"base": "0x738e0000",
|
||
|
|
"size": 675840,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\TextShaping.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "dwmapi.dll",
|
||
|
|
"base": "0x738b0000",
|
||
|
|
"size": 151552,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\dwmapi.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "textinputframework.dll",
|
||
|
|
"base": "0x737a0000",
|
||
|
|
"size": 1060864,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\textinputframework.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "CoreMessaging.dll",
|
||
|
|
"base": "0x736c0000",
|
||
|
|
"size": 905216,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\CoreMessaging.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "CoreUIComponents.dll",
|
||
|
|
"base": "0x73420000",
|
||
|
|
"size": 2695168,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\CoreUIComponents.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "explorerframe.dll",
|
||
|
|
"base": "0x731f0000",
|
||
|
|
"size": 2256896,
|
||
|
|
"path": "C:\\WINDOWS\\system32\\explorerframe.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "dataexchange.dll",
|
||
|
|
"base": "0x72c20000",
|
||
|
|
"size": 311296,
|
||
|
|
"path": "C:\\WINDOWS\\system32\\dataexchange.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "twinapi.appcore.dll",
|
||
|
|
"base": "0x72a30000",
|
||
|
|
"size": 1986560,
|
||
|
|
"path": "C:\\WINDOWS\\system32\\twinapi.appcore.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "DNSAPI.dll",
|
||
|
|
"base": "0x72d50000",
|
||
|
|
"size": 933888,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\DNSAPI.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "NSI.dll",
|
||
|
|
"base": "0x770f0000",
|
||
|
|
"size": 28672,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\NSI.dll"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"tls_exports": [
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "NtReadFile",
|
||
|
|
"address": "0x773191b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "NtReadFileScatter",
|
||
|
|
"address": "0x77319450",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "NtWriteFile",
|
||
|
|
"address": "0x773191d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "NtWriteFileGather",
|
||
|
|
"address": "0x77319320",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "RtlDisownModuleHeapAllocation",
|
||
|
|
"address": "0x77312520",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "ZwReadFile",
|
||
|
|
"address": "0x773191b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "ZwReadFileScatter",
|
||
|
|
"address": "0x77319450",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "ZwWriteFile",
|
||
|
|
"address": "0x773191d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ntdll.dll",
|
||
|
|
"name": "ZwWriteFileGather",
|
||
|
|
"address": "0x77319320",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "CopyFileW",
|
||
|
|
"address": "0x760af130",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "CreateDirectoryW",
|
||
|
|
"address": "0x760ae9c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "CreateFileA",
|
||
|
|
"address": "0x760ae9f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "CreateFileW",
|
||
|
|
"address": "0x760aea00",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "HeapFree",
|
||
|
|
"address": "0x760a41b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "LZCreateFileW",
|
||
|
|
"address": "0x760c34e0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "MoveFileExW",
|
||
|
|
"address": "0x760c1b60",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "MoveFileW",
|
||
|
|
"address": "0x760f0160",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "MoveFileWithProgressA",
|
||
|
|
"address": "0x760f0190",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "MoveFileWithProgressW",
|
||
|
|
"address": "0x760c1b80",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "ReadFile",
|
||
|
|
"address": "0x760aedc0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "ReadFileEx",
|
||
|
|
"address": "0x760aedd0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "ReadFileScatter",
|
||
|
|
"address": "0x760aede0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "RemoveDirectoryW",
|
||
|
|
"address": "0x760aee20",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "VirtualAlloc",
|
||
|
|
"address": "0x760a65f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "VirtualAllocEx",
|
||
|
|
"address": "0x760c2df0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "VirtualAllocExNuma",
|
||
|
|
"address": "0x760c2dd0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "VirtualFree",
|
||
|
|
"address": "0x760a5010",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "VirtualFreeEx",
|
||
|
|
"address": "0x760c2e10",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "WriteFile",
|
||
|
|
"address": "0x760aeed0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "WriteFileEx",
|
||
|
|
"address": "0x760aeee0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNEL32.DLL",
|
||
|
|
"name": "WriteFileGather",
|
||
|
|
"address": "0x760aeef0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "AppPolicyGetCreateFileAccess",
|
||
|
|
"address": "0x76709fa0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "BuildIoRingReadFile",
|
||
|
|
"address": "0x766717e0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "BuildIoRingReadFileScatter",
|
||
|
|
"address": "0x766718d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "BuildIoRingWriteFile",
|
||
|
|
"address": "0x76671ae0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "BuildIoRingWriteFileGather",
|
||
|
|
"address": "0x76671bf0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "CopyFileW",
|
||
|
|
"address": "0x766d6be0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "CreateDirectoryW",
|
||
|
|
"address": "0x76625d40",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "CreateFileA",
|
||
|
|
"address": "0x76655b20",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "CreateFileW",
|
||
|
|
"address": "0x76636c70",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "MoveFileExW",
|
||
|
|
"address": "0x766d82c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "MoveFileWithProgressTransactedW",
|
||
|
|
"address": "0x766d8300",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "MoveFileWithProgressW",
|
||
|
|
"address": "0x766d8cc0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "ReadFile",
|
||
|
|
"address": "0x766481a0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "ReadFileEx",
|
||
|
|
"address": "0x7672df40",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "ReadFileScatter",
|
||
|
|
"address": "0x7672dff0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "RemoveDirectoryW",
|
||
|
|
"address": "0x76733b60",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "VirtualAlloc",
|
||
|
|
"address": "0x766253f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "VirtualAlloc2",
|
||
|
|
"address": "0x7672a630",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "VirtualAlloc2FromApp",
|
||
|
|
"address": "0x7672a6c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "VirtualAllocEx",
|
||
|
|
"address": "0x76625450",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "VirtualAllocExNuma",
|
||
|
|
"address": "0x76625480",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "VirtualAllocFromApp",
|
||
|
|
"address": "0x7672a6f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "VirtualFree",
|
||
|
|
"address": "0x76646540",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "VirtualFreeEx",
|
||
|
|
"address": "0x7672a730",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "WriteFile",
|
||
|
|
"address": "0x76648d50",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "WriteFileEx",
|
||
|
|
"address": "0x7672e260",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "KERNELBASE.dll",
|
||
|
|
"name": "WriteFileGather",
|
||
|
|
"address": "0x7672e310",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_aligned_free",
|
||
|
|
"address": "0x763cb980",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_aligned_malloc",
|
||
|
|
"address": "0x763cb9a0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_aligned_offset_malloc",
|
||
|
|
"address": "0x763cbbc0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_aligned_offset_realloc",
|
||
|
|
"address": "0x7640cbf0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_aligned_offset_recalloc",
|
||
|
|
"address": "0x7640ce50",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_aligned_realloc",
|
||
|
|
"address": "0x763cba10",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_aligned_recalloc",
|
||
|
|
"address": "0x7640d110",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_calloc_base",
|
||
|
|
"address": "0x763a2540",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_free_base",
|
||
|
|
"address": "0x763900b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_free_locale",
|
||
|
|
"address": "0x763a51b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_getdiskfree",
|
||
|
|
"address": "0x764465d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_malloc_base",
|
||
|
|
"address": "0x7638df10",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__aligned_free",
|
||
|
|
"address": "0x763dfd10",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__aligned_malloc",
|
||
|
|
"address": "0x763cb390",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__aligned_offset_malloc",
|
||
|
|
"address": "0x763e7440",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__aligned_offset_realloc",
|
||
|
|
"address": "0x76402120",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__aligned_offset_recalloc",
|
||
|
|
"address": "0x76402150",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__aligned_realloc",
|
||
|
|
"address": "0x76402180",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__aligned_recalloc",
|
||
|
|
"address": "0x764021b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__calloc_base",
|
||
|
|
"address": "0x763cb370",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__free_base",
|
||
|
|
"address": "0x763dbf90",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__free_locale",
|
||
|
|
"address": "0x76402ed0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__getdiskfree",
|
||
|
|
"address": "0x764033f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__malloc_base",
|
||
|
|
"address": "0x763dcc70",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__realloc_base",
|
||
|
|
"address": "0x763d9f70",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o__recalloc",
|
||
|
|
"address": "0x763cd630",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o_calloc",
|
||
|
|
"address": "0x763cb3b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o_free",
|
||
|
|
"address": "0x763c72c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o_malloc",
|
||
|
|
"address": "0x763c7c10",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_o_realloc",
|
||
|
|
"address": "0x763d9f90",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_realloc_base",
|
||
|
|
"address": "0x763c1900",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "_recalloc",
|
||
|
|
"address": "0x763c1620",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "calloc",
|
||
|
|
"address": "0x763cb450",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "free",
|
||
|
|
"address": "0x76390080",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "malloc",
|
||
|
|
"address": "0x76390100",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "ucrtbase.dll",
|
||
|
|
"name": "realloc",
|
||
|
|
"address": "0x763ce5b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "combase.dll",
|
||
|
|
"name": "WindowsPreallocateStringBuffer",
|
||
|
|
"address": "0x74e47d80",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcp_win.dll",
|
||
|
|
"name": "__std_calloc_crt",
|
||
|
|
"address": "0x771225e0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcp_win.dll",
|
||
|
|
"name": "__std_free_crt",
|
||
|
|
"address": "0x77122600",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "advapi32.dll",
|
||
|
|
"name": "CryptDecrypt",
|
||
|
|
"address": "0x74c28c90",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "advapi32.dll",
|
||
|
|
"name": "CryptEncrypt",
|
||
|
|
"address": "0x74c3e270",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "advapi32.dll",
|
||
|
|
"name": "MIDL_user_free_Ext",
|
||
|
|
"address": "0x74c3f9b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "__freefls@4",
|
||
|
|
"address": "0x74a58680",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_free",
|
||
|
|
"address": "0x74a36230",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_free_dbg",
|
||
|
|
"address": "0x74a466d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_malloc",
|
||
|
|
"address": "0x74a36250",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_malloc_dbg",
|
||
|
|
"address": "0x74a36250",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_offset_malloc",
|
||
|
|
"address": "0x74a36270",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_offset_malloc_dbg",
|
||
|
|
"address": "0x74a466e0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_offset_realloc",
|
||
|
|
"address": "0x74a36330",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_offset_realloc_dbg",
|
||
|
|
"address": "0x74a46700",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_realloc",
|
||
|
|
"address": "0x74a364c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_aligned_realloc_dbg",
|
||
|
|
"address": "0x74a364c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_calloc_dbg",
|
||
|
|
"address": "0x74a46730",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_free_dbg",
|
||
|
|
"address": "0x74a46770",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_free_locale",
|
||
|
|
"address": "0x74a47640",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_freea",
|
||
|
|
"address": "0x74a3aba0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_freea_s",
|
||
|
|
"address": "0x74a3aba0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_getdiskfree",
|
||
|
|
"address": "0x74a253d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_malloc_dbg",
|
||
|
|
"address": "0x74a46790",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "_realloc_dbg",
|
||
|
|
"address": "0x74a467d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "calloc",
|
||
|
|
"address": "0x74a387f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "free",
|
||
|
|
"address": "0x74a38840",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "malloc",
|
||
|
|
"address": "0x74a38a30",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "msvcrt.dll",
|
||
|
|
"name": "realloc",
|
||
|
|
"address": "0x74a38b20",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "WSARecv",
|
||
|
|
"address": "0x74ca0b90",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "WSARecvDisconnect",
|
||
|
|
"address": "0x74cbf230",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "WSARecvFrom",
|
||
|
|
"address": "0x74caace0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "WSASend",
|
||
|
|
"address": "0x74ca01e0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "WSASendDisconnect",
|
||
|
|
"address": "0x74cc0fe0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "WSASendMsg",
|
||
|
|
"address": "0x74c9f610",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "WSASendTo",
|
||
|
|
"address": "0x74cc10a0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "freeaddrinfo",
|
||
|
|
"address": "0x74c952d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "recv",
|
||
|
|
"address": "0x74ca6380",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "recvfrom",
|
||
|
|
"address": "0x74caaba0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "recvfrom",
|
||
|
|
"address": "0x74caaba0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "send",
|
||
|
|
"address": "0x74ca6c30",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "sendto",
|
||
|
|
"address": "0x74caa3f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WS2_32.dll",
|
||
|
|
"name": "sendto",
|
||
|
|
"address": "0x74caa3f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "CreateBitmap",
|
||
|
|
"address": "0x77024870",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "CreateBitmapFromDxSurface",
|
||
|
|
"address": "0x77024cf0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "CreateBitmapFromDxSurface2",
|
||
|
|
"address": "0x77024ce0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "CreateBitmapIndirect",
|
||
|
|
"address": "0x7702a7b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "CreateCompatibleBitmap",
|
||
|
|
"address": "0x77024ac0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "CreateDIBSection",
|
||
|
|
"address": "0x7702a850",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "EngCreateBitmap",
|
||
|
|
"address": "0x77027220",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "GetDIBits",
|
||
|
|
"address": "0x770247b0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "SetDIBits",
|
||
|
|
"address": "0x7702c150",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "GDI32.dll",
|
||
|
|
"name": "SetDIBitsToDevice",
|
||
|
|
"address": "0x770298d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtGdiCreateBitmap",
|
||
|
|
"address": "0x748e17d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtGdiCreateBitmapFromDxSurface",
|
||
|
|
"address": "0x748e2b20",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtGdiCreateBitmapFromDxSurface2",
|
||
|
|
"address": "0x748e2b30",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtGdiCreateCompatibleBitmap",
|
||
|
|
"address": "0x748e15d0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtGdiCreateDIBSection",
|
||
|
|
"address": "0x748e1a90",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtGdiEngCreateBitmap",
|
||
|
|
"address": "0x748e3990",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtGdiGetDIBitsInternal",
|
||
|
|
"address": "0x748e1940",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtGdiSetDIBitsToDeviceInternal",
|
||
|
|
"address": "0x748e13c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtRIMGetDevicePreparsedDataLockfree",
|
||
|
|
"address": "0x748e4950",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtRIMGetDevicePropertiesLockfree",
|
||
|
|
"address": "0x748e4970",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtUserCloseClipboard",
|
||
|
|
"address": "0x748e1d30",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtUserEmptyClipboard",
|
||
|
|
"address": "0x748e1fb0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtUserGetClipboardData",
|
||
|
|
"address": "0x748e1fc0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtUserGetOpenClipboardWindow",
|
||
|
|
"address": "0x748e1dc0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtUserOpenClipboard",
|
||
|
|
"address": "0x748e1d40",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "win32u.dll",
|
||
|
|
"name": "NtUserSetClipboardData",
|
||
|
|
"address": "0x748e1d50",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "CreateBitmap",
|
||
|
|
"address": "0x771d0c50",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "CreateBitmapIndirect",
|
||
|
|
"address": "0x771f4b40",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "CreateCompatibleBitmap",
|
||
|
|
"address": "0x771d0930",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "CreateDIBSection",
|
||
|
|
"address": "0x771f4c80",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "EngCreateBitmap",
|
||
|
|
"address": "0x771e7b20",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "GetDIBits",
|
||
|
|
"address": "0x771d03f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "NtGdiCreateBitmap",
|
||
|
|
"address": "0x771d6510",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "NtGdiCreateBitmapFromDxSurface",
|
||
|
|
"address": "0x771d6530",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "NtGdiCreateBitmapFromDxSurface2",
|
||
|
|
"address": "0x771d6520",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "NtGdiCreateCompatibleBitmap",
|
||
|
|
"address": "0x771d6570",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "NtGdiCreateDIBSection",
|
||
|
|
"address": "0x771d65a0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "NtGdiGetDIBitsInternal",
|
||
|
|
"address": "0x771d6d20",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "NtGdiSetDIBitsToDeviceInternal",
|
||
|
|
"address": "0x771d7510",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "SetDIBits",
|
||
|
|
"address": "0x771f51a0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdi32full.dll",
|
||
|
|
"name": "SetDIBitsToDevice",
|
||
|
|
"address": "0x771f52e0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "USER32.dll",
|
||
|
|
"name": "CloseClipboard",
|
||
|
|
"address": "0x76231a90",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "USER32.dll",
|
||
|
|
"name": "EmptyClipboard",
|
||
|
|
"address": "0x76231b00",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "USER32.dll",
|
||
|
|
"name": "GetClipboardData",
|
||
|
|
"address": "0x76236c80",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "USER32.dll",
|
||
|
|
"name": "GetOpenClipboardWindow",
|
||
|
|
"address": "0x761c9440",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "USER32.dll",
|
||
|
|
"name": "OpenClipboard",
|
||
|
|
"address": "0x76222eb0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "USER32.dll",
|
||
|
|
"name": "RIMGetDevicePreparsedDataLockfree",
|
||
|
|
"address": "0x761ca730",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "USER32.dll",
|
||
|
|
"name": "RIMGetDevicePropertiesLockfree",
|
||
|
|
"address": "0x761ca750",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "USER32.dll",
|
||
|
|
"name": "SetClipboardData",
|
||
|
|
"address": "0x76238210",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromDirectDrawSurface",
|
||
|
|
"address": "0x742c27c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromFile",
|
||
|
|
"address": "0x74278920",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromFileICM",
|
||
|
|
"address": "0x742c2880",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromGdiDib",
|
||
|
|
"address": "0x74243520",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromGraphics",
|
||
|
|
"address": "0x7428f6f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromHBITMAP",
|
||
|
|
"address": "0x7426b090",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromHICON",
|
||
|
|
"address": "0x7428f2a0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromResource",
|
||
|
|
"address": "0x7428ecb0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromScan0",
|
||
|
|
"address": "0x74255d50",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromStream",
|
||
|
|
"address": "0x74296c60",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "gdiplus.dll",
|
||
|
|
"name": "GdipCreateBitmapFromStreamICM",
|
||
|
|
"address": "0x742c29f0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "CRYPT32.dll",
|
||
|
|
"name": "CryptDecryptAndVerifyMessageSignature",
|
||
|
|
"address": "0x7600a9c0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "CRYPT32.dll",
|
||
|
|
"name": "CryptDecryptMessage",
|
||
|
|
"address": "0x7600aac0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "CRYPT32.dll",
|
||
|
|
"name": "CryptDecryptMessage",
|
||
|
|
"address": "0x7600aac0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "CRYPT32.dll",
|
||
|
|
"name": "CryptEncryptMessage",
|
||
|
|
"address": "0x7600ab00",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "CRYPT32.dll",
|
||
|
|
"name": "CryptEncryptMessage",
|
||
|
|
"address": "0x7600ab00",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "CRYPT32.dll",
|
||
|
|
"name": "CryptSignAndEncryptMessage",
|
||
|
|
"address": "0x7600ae80",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "SSPICLI.DLL",
|
||
|
|
"name": "DecryptMessage",
|
||
|
|
"address": "0x740dec80",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "SSPICLI.DLL",
|
||
|
|
"name": "EncryptMessage",
|
||
|
|
"address": "0x740dec20",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "SETUPAPI.dll",
|
||
|
|
"name": "SetupDecompressOrCopyFileW",
|
||
|
|
"address": "0x76823630",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "kernel.appcore.dll",
|
||
|
|
"name": "AppPolicyGetCreateFileAccess",
|
||
|
|
"address": "0x73f93890",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "IWICImagingFactory_CreateBitmapClipper_Proxy",
|
||
|
|
"address": "0x73e0da40",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "IWICImagingFactory_CreateBitmapFlipRotator_Proxy",
|
||
|
|
"address": "0x73e0da80",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "IWICImagingFactory_CreateBitmapFromHBITMAP_Proxy",
|
||
|
|
"address": "0x73e0dac0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "IWICImagingFactory_CreateBitmapFromHICON_Proxy",
|
||
|
|
"address": "0x73e0db00",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "IWICImagingFactory_CreateBitmapFromMemory_Proxy",
|
||
|
|
"address": "0x73e0db40",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "IWICImagingFactory_CreateBitmapFromSource_Proxy",
|
||
|
|
"address": "0x73e0db90",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "IWICImagingFactory_CreateBitmapScaler_Proxy",
|
||
|
|
"address": "0x73e0dbd0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "IWICImagingFactory_CreateBitmap_Proxy",
|
||
|
|
"address": "0x73e0dc10",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "WICCreateBitmapFromSection",
|
||
|
|
"address": "0x73e0e0e0",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "WindowsCodecs.dll",
|
||
|
|
"name": "WICCreateBitmapFromSectionEx",
|
||
|
|
"address": "0x73e0e110",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "bcrypt.dll",
|
||
|
|
"name": "BCryptDecrypt",
|
||
|
|
"address": "0x739b6d10",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "bcrypt.dll",
|
||
|
|
"name": "BCryptDecrypt",
|
||
|
|
"address": "0x739b6d10",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "bcrypt.dll",
|
||
|
|
"name": "BCryptEncrypt",
|
||
|
|
"address": "0x739b6a30",
|
||
|
|
"type": "function"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"module": "bcrypt.dll",
|
||
|
|
"name": "BCryptEncrypt",
|
||
|
|
"address": "0x739b6a30",
|
||
|
|
"type": "function"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"strings": [
|
||
|
|
{
|
||
|
|
"pattern": "file_transfer",
|
||
|
|
"count": 602,
|
||
|
|
"first_addr": "0x1159cf9",
|
||
|
|
"context": "ccept.connected.file_transfer=Connected..ad.accept.connected.fil"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "clipboard",
|
||
|
|
"count": 641,
|
||
|
|
"first_addr": "0x115977f",
|
||
|
|
"context": ".ad.accept.auth.clipboard=Allow to use clipboard..ad.accept.auth"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "Clipboard",
|
||
|
|
"count": 143,
|
||
|
|
"first_addr": "0x117a14e",
|
||
|
|
"context": ".perm.clipboard=Clipboard..ad.status.sess.remote.perm.clipboard_"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "identity",
|
||
|
|
"count": 73,
|
||
|
|
"first_addr": "0xf41014",
|
||
|
|
"context": "time_hint...psk_identity....psk_identity_hint...tlsext_hostname."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "Identity",
|
||
|
|
"count": 11,
|
||
|
|
"first_addr": "0xf4dbe7",
|
||
|
|
"context": ".id-aca-chargingIdentity.id-aca-accessIdentity...id-aca-authenti"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "user_image",
|
||
|
|
"count": 63,
|
||
|
|
"first_addr": "0x10d0827",
|
||
|
|
"context": "ettings.general.user_image.title=User Image..at.settings.general"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "avatar",
|
||
|
|
"count": 2,
|
||
|
|
"first_addr": "0x18a18a8",
|
||
|
|
"context": "........meeting_avatar.png..meeting_avatar_thumb.png........ ..."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "codec",
|
||
|
|
"count": 1,
|
||
|
|
"first_addr": "0x1858cd1",
|
||
|
|
"context": "art....lossless_codec..report_kbd_focus....reset_vp_resolution.s"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "Codec",
|
||
|
|
"count": 1,
|
||
|
|
"first_addr": "0x189e6ac",
|
||
|
|
"context": "ion mismatch....Codec does not implement requested capability..."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "bitmap",
|
||
|
|
"count": 5,
|
||
|
|
"first_addr": "0x184f405",
|
||
|
|
"context": "ould not create bitmap (%i)........Could not create bitmap from "
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "Bitmap",
|
||
|
|
"count": 12,
|
||
|
|
"first_addr": "0x18c68ae",
|
||
|
|
"context": "..MFGetStrideForBitmapInfoHeader..size....en-GB...es-ES...de-DE."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "PNG",
|
||
|
|
"count": 560,
|
||
|
|
"first_addr": "0xbef255",
|
||
|
|
"context": "....D$8.....D$ .PNG.D$$....u..D$H..D$P.D$DSU.l$TV.t$T..t$\\W.~..."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "validate_path",
|
||
|
|
"count": 1,
|
||
|
|
"first_addr": "0xf6277d",
|
||
|
|
"context": "rBlocks....addr_validate_path_internal.ASIdentifiers...rdi.asnum"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "ad.security",
|
||
|
|
"count": 408,
|
||
|
|
"first_addr": "0x1673f9a",
|
||
|
|
"context": "_capture=false..ad.security.connect.send_user_list=0..ad.securit"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "TLS",
|
||
|
|
"count": 240,
|
||
|
|
"first_addr": "0xf3a039",
|
||
|
|
"context": "_void_function.DTLSv1..DTLSv1.2....TLSv1...TLSv1.1.TLSv1.2.TLSv1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "handshake",
|
||
|
|
"count": 73,
|
||
|
|
"first_addr": "0xf39ff7",
|
||
|
|
"context": "_and_alg.SSL_do_handshake....ssl_undefined_function..ssl_undefin"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"pattern": "Handshake",
|
||
|
|
"count": 2,
|
||
|
|
"first_addr": "0xf42317",
|
||
|
|
"context": "ssl3.RequirePostHandshake....RequestPostHandshake....Once....Req"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"tls_indicators": [
|
||
|
|
{
|
||
|
|
"name": "SSPICLI.DLL",
|
||
|
|
"base": "0x740c0000",
|
||
|
|
"size": 176128,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\SSPICLI.DLL"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "bcryptPrimitives.dll",
|
||
|
|
"base": "0x750b0000",
|
||
|
|
"size": 475136,
|
||
|
|
"path": "C:\\WINDOWS\\System32\\bcryptPrimitives.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "bcrypt.dll",
|
||
|
|
"base": "0x739b0000",
|
||
|
|
"size": 114688,
|
||
|
|
"path": "C:\\WINDOWS\\SYSTEM32\\bcrypt.dll"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|