├── info ├── Libraries.txt ├── html │ ├── MESS.html │ ├── com-crypt.html │ ├── BAT2EXEC.html │ ├── ExeLITE.html │ ├── List.html │ ├── Optlink.html │ ├── PGMPAK.html │ ├── TinyProg.html │ ├── CC.html │ ├── DxPack.html │ ├── EXE-Crypt.html │ ├── EXE2COM.html │ ├── NASM.html │ ├── Topspeed Modula.html │ ├── ASPack.html │ ├── CEPexe.html │ ├── Cygwin.html │ ├── Gardian Angel.html │ ├── MinGW.html │ ├── PRO-PACK.html │ ├── Photo Compiler.html │ ├── SelfProtect386.html │ ├── BSTAR_FORTH(16).html │ ├── Babel .NET.html │ ├── E2C.html │ ├── Go Link.html │ ├── NOS Packer.html │ ├── PECRYPT32.html │ ├── Borland C++.html │ ├── Turbo Linker.html │ ├── Virtual Pascal.html │ ├── CauseWay DOS Extender.html │ ├── EXECUTRIX-COMPRESSOR.html │ ├── Go32Stub DOS-Extender.html │ ├── Microsoft Linker.html │ ├── RSX DPMI DOS Extender.html │ ├── Zortech(Symantec) C.html │ ├── PECompact.html │ ├── Visual Prolog.html │ ├── yara_info.html │ ├── Private EXE Protector.html │ ├── Dotfuscator.html │ ├── die_info.html │ ├── nfd_info.html │ ├── Intel IPP.html │ ├── DOS_16M DOS Extender.html │ ├── Kryptonit.html │ ├── UDIF.html │ ├── DEB.html │ ├── markdown-pdf.html │ ├── Armadillo.html │ ├── kkrunchy.html │ ├── VbsToExe.html │ ├── TrueCrypt-VeraCrypt installer.html │ ├── HackShield.html │ ├── NsPacK.html │ ├── UPX.html │ ├── Embarcadero Delphi.html │ ├── FDM Installer.html │ ├── _NET Reactor.html │ ├── Inno Setup Module.html │ ├── mdpdf.html │ ├── Watcom.html │ ├── VMProtect.html │ ├── ARJ.html │ ├── Excelsior JET.html │ ├── HP C++.html │ ├── XML.html │ ├── Denuvo protector.html │ ├── AutoIt.html │ ├── Pascal.html │ ├── Petite.html │ ├── (Win)Upack.html │ ├── ISO 9660.html │ ├── Borland Delphi.html │ ├── gcc.html │ ├── Enigma Virtual Box.html │ ├── MFC.html │ ├── GNU linker ld (GNU Binutils).html │ ├── Agile .NET.html │ ├── MASM32.html │ ├── Free Pascal.html │ ├── pdb.html │ ├── FASM.html │ ├── Visual Basic.html │ ├── GLIBC.html │ ├── IntelliProtector.html │ ├── DeepSea.html │ ├── _NET.html │ ├── Microsoft Compiled HTML Help.html │ ├── Cocoa.html │ ├── Obsidium.html │ ├── Oracle Solaris Studio.html │ ├── RosASM.html │ ├── Xojo.html │ ├── aPACK.html │ ├── SDL.html │ ├── RTF.html │ ├── Microsoft Visual C++.html │ ├── python.html │ ├── Microsoft Visual C_C++.html │ ├── Nullsoft Scriptable Install System.html │ ├── SafeNet Sentinel LDK.html │ ├── Carbon.html │ ├── Guitar Pro.html │ ├── 7-Zip.html │ ├── Go.html │ ├── PKLITE32.html │ ├── HTML.html │ ├── Wine.html │ ├── polink.html │ ├── QT.html │ └── MPRESS.html ├── ELF.sections.txt ├── PE.sections.txt └── Functions.txt ├── README.md ├── xinfodbtransfer.pri ├── dialogxinfodbtransferprocess.pri ├── xinfodb.cmake ├── xinfodb.pri ├── dialogxinfodbtransferprocess.cmake ├── LICENSE ├── xinfodboptionswidget.h ├── xinfomenu.h ├── xinfodbtransfer.h ├── xinfodboptionswidget.cpp ├── xinfodboptionswidget.ui ├── xinfodbtransfer.cpp ├── xinfomenu.cpp └── xinfodb.h /info/Libraries.txt: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /info/html/MESS.html: -------------------------------------------------------------------------------- 1 | by Stonehead 2 | -------------------------------------------------------------------------------- /info/html/com-crypt.html: -------------------------------------------------------------------------------- 1 | by Misha 2 | -------------------------------------------------------------------------------- /info/html/BAT2EXEC.html: -------------------------------------------------------------------------------- 1 | Douglas Boling 2 | -------------------------------------------------------------------------------- /info/html/ExeLITE.html: -------------------------------------------------------------------------------- 1 | by Code Blasters 2 | -------------------------------------------------------------------------------- /info/html/List.html: -------------------------------------------------------------------------------- 1 | by Vernon D. Buerg 2 | -------------------------------------------------------------------------------- /info/html/Optlink.html: -------------------------------------------------------------------------------- 1 | by SLR Systems 2 | -------------------------------------------------------------------------------- /info/html/PGMPAK.html: -------------------------------------------------------------------------------- 1 | by Todor Todorov 2 | -------------------------------------------------------------------------------- /info/html/TinyProg.html: -------------------------------------------------------------------------------- 1 | by Tranzoa, Co. 2 | -------------------------------------------------------------------------------- /info/html/CC.html: -------------------------------------------------------------------------------- 1 | 1991 by Basil V.Vorontsov 2 | -------------------------------------------------------------------------------- /info/html/DxPack.html: -------------------------------------------------------------------------------- 1 | Site: http://kaimi.ru 2 | -------------------------------------------------------------------------------- /info/html/EXE-Crypt.html: -------------------------------------------------------------------------------- 1 | 1992 by Muad'dib 2 | -------------------------------------------------------------------------------- /info/html/EXE2COM.html: -------------------------------------------------------------------------------- 1 | by Basil V. Vorontsov 2 | -------------------------------------------------------------------------------- /info/html/NASM.html: -------------------------------------------------------------------------------- 1 | Site: http://www.nasm.us 2 | -------------------------------------------------------------------------------- /info/html/Topspeed Modula.html: -------------------------------------------------------------------------------- 1 | 1989 by JPI 2 | -------------------------------------------------------------------------------- /info/html/ASPack.html: -------------------------------------------------------------------------------- 1 | Site: http://www.aspack.com 2 | -------------------------------------------------------------------------------- /info/html/CEPexe.html: -------------------------------------------------------------------------------- 1 | by Marcello Marin Isola 2 | -------------------------------------------------------------------------------- /info/html/Cygwin.html: -------------------------------------------------------------------------------- 1 | Site: http://cygwin.com 2 | -------------------------------------------------------------------------------- /info/html/Gardian Angel.html: -------------------------------------------------------------------------------- 1 | by Stefan Verkoyen 2 | -------------------------------------------------------------------------------- /info/html/MinGW.html: -------------------------------------------------------------------------------- 1 | Site: http://www.mingw.org 2 | -------------------------------------------------------------------------------- /info/html/PRO-PACK.html: -------------------------------------------------------------------------------- 1 | by Rob Northen Computing 2 | -------------------------------------------------------------------------------- /info/html/Photo Compiler.html: -------------------------------------------------------------------------------- 1 | www.davidesperalta.com -------------------------------------------------------------------------------- /info/html/SelfProtect386.html: -------------------------------------------------------------------------------- 1 | (1996) by Syrius 2 | -------------------------------------------------------------------------------- /info/html/BSTAR_FORTH(16).html: -------------------------------------------------------------------------------- 1 | 1992 by Gary Chanson 2 | -------------------------------------------------------------------------------- /info/html/Babel .NET.html: -------------------------------------------------------------------------------- 1 | Site: https://babelfor.net/ 2 | -------------------------------------------------------------------------------- /info/html/E2C.html: -------------------------------------------------------------------------------- 1 | (1996) by The DoP Timisoara/Romania 2 | -------------------------------------------------------------------------------- /info/html/Go Link.html: -------------------------------------------------------------------------------- 1 | Site: http://www.godevtool.com/ 2 | -------------------------------------------------------------------------------- /info/html/NOS Packer.html: -------------------------------------------------------------------------------- 1 | by NOS Microsystems Ltd. 2 | -------------------------------------------------------------------------------- /info/html/PECRYPT32.html: -------------------------------------------------------------------------------- 1 | by random, acpizer & killa 2 | -------------------------------------------------------------------------------- /info/html/Borland C++.html: -------------------------------------------------------------------------------- 1 | Site: http://www.borland.com 2 | -------------------------------------------------------------------------------- /info/html/Turbo Linker.html: -------------------------------------------------------------------------------- 1 | Site: http://www.borland.com 2 | -------------------------------------------------------------------------------- /info/html/Virtual Pascal.html: -------------------------------------------------------------------------------- 1 | 1996-98 by fPrint (UK) Ltd 2 | -------------------------------------------------------------------------------- /info/html/CauseWay DOS Extender.html: -------------------------------------------------------------------------------- 1 | 1992-1997 by John Wildsmith 2 | -------------------------------------------------------------------------------- /info/html/EXECUTRIX-COMPRESSOR.html: -------------------------------------------------------------------------------- 1 | by Knowledge Dynamics Corp 2 | -------------------------------------------------------------------------------- /info/html/Go32Stub DOS-Extender.html: -------------------------------------------------------------------------------- 1 | 1993-1995 by DJ Delorie 2 | -------------------------------------------------------------------------------- /info/html/Microsoft Linker.html: -------------------------------------------------------------------------------- 1 | Site: http://msdn.microsoft.com 2 | -------------------------------------------------------------------------------- /info/html/RSX DPMI DOS Extender.html: -------------------------------------------------------------------------------- 1 | 1994 by Rainer Schnitker 2 | -------------------------------------------------------------------------------- /info/html/Zortech(Symantec) C.html: -------------------------------------------------------------------------------- 1 | 1988-1993 by Walter Bright 2 | -------------------------------------------------------------------------------- /info/html/PECompact.html: -------------------------------------------------------------------------------- 1 | Site: http://www.bitsum.com/pecompact.php 2 | -------------------------------------------------------------------------------- /info/html/Visual Prolog.html: -------------------------------------------------------------------------------- 1 | 1984-2000 Prolog Development Center A/S 2 | -------------------------------------------------------------------------------- /info/html/yara_info.html: -------------------------------------------------------------------------------- 1 | Site: https://github.com/VirusTotal/yara 2 | -------------------------------------------------------------------------------- /info/html/Private EXE Protector.html: -------------------------------------------------------------------------------- 1 | Site: http://private-exe-protector.com/ 2 | -------------------------------------------------------------------------------- /info/html/Dotfuscator.html: -------------------------------------------------------------------------------- 1 | Site: https://www.preemptive.com/products/dotfuscator/overview 2 | -------------------------------------------------------------------------------- /info/html/die_info.html: -------------------------------------------------------------------------------- 1 | Detect It Easy 2 | 3 | https://github.com/horsicq/Detect-It-Easy 4 | -------------------------------------------------------------------------------- /info/html/nfd_info.html: -------------------------------------------------------------------------------- 1 | Nauz File Detector 2 | 3 | https://github.com/horsicq/Formats 4 | -------------------------------------------------------------------------------- /info/html/Intel IPP.html: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/horsicq/XInfoDB/master/info/html/Intel IPP.html -------------------------------------------------------------------------------- /info/html/DOS_16M DOS Extender.html: -------------------------------------------------------------------------------- 1 | 1987-1991 by Rational Systems, Inc. 2 | 1995 by Tenberry Software 3 | -------------------------------------------------------------------------------- /info/html/Kryptonit.html: -------------------------------------------------------------------------------- 1 | Kryptonit - Delphi code protector by A.S.L. 2 | 3 | Site: http://www.asl.xn.pl/ 4 | -------------------------------------------------------------------------------- /info/html/UDIF.html: -------------------------------------------------------------------------------- 1 | Apple Universal Disk Image Format (UDIF) - dmg files. 2 | 3 | Site: http://apple.com 4 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # XInfoDB 2 | 3 | Thanks Adam for PE sections names: https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/ 4 | -------------------------------------------------------------------------------- /info/html/DEB.html: -------------------------------------------------------------------------------- 1 | deb is the extension of the Debian software package format and the most often used name for such binary packages. 2 | -------------------------------------------------------------------------------- /info/html/markdown-pdf.html: -------------------------------------------------------------------------------- 1 | Node module that converts Markdown files to PDFs. 2 | 3 | Site: https://github.com/alanshaw/markdown-pdf 4 | -------------------------------------------------------------------------------- /info/html/Armadillo.html: -------------------------------------------------------------------------------- 1 | SoftwarePassport technology protects Windows or Mac applications. 2 | 3 | Site: http://www.siliconrealms.com/ 4 | -------------------------------------------------------------------------------- /info/html/kkrunchy.html: -------------------------------------------------------------------------------- 1 | kkrunchy is a small exe packer primarily meant for 64k intros. 2 | 3 | Site: http://www.farb-rausch.de/~fg/kkrunchy/ 4 | -------------------------------------------------------------------------------- /info/html/VbsToExe.html: -------------------------------------------------------------------------------- 1 | A web application that can convert VBScript/JScript (.vbs/.js) files to EXE (.exe) format 2 | 3 | Site: http://www.f2ko.de/en/index.php 4 | -------------------------------------------------------------------------------- /info/html/TrueCrypt-VeraCrypt installer.html: -------------------------------------------------------------------------------- 1 | TrueCrypt setup or older VeraCrypt setup 2 | packed data in overlay : zlib or lzma 3 | Site : http://truecrypt.sourceforge.net/ 4 | -------------------------------------------------------------------------------- /info/html/HackShield.html: -------------------------------------------------------------------------------- 1 | AhnLab HackShield for Online Game offers the security and stability with the latest technology. 2 | 3 | Site: http://hackshield.ahnlab.com/hs/site/en/main/main.do 4 | -------------------------------------------------------------------------------- /info/html/NsPacK.html: -------------------------------------------------------------------------------- 1 | NsPack is a software that allows you to compress executables. The program can compress 32- and 64-bit EXE, DLL, OCX, SCR Windows programs, as well as C# .NET programs. 2 | -------------------------------------------------------------------------------- /info/html/UPX.html: -------------------------------------------------------------------------------- 1 | UPX (ultimate packer for executables) is a free and open source executable packer supporting a number of file formats from different operating systems. 2 | 3 | Site: http://upx.sourceforge.net 4 | -------------------------------------------------------------------------------- /info/html/Embarcadero Delphi.html: -------------------------------------------------------------------------------- 1 | In 2006, Borland's developer tools section were transferred to a wholly owned subsidiary known as CodeGear, which was sold to Embarcadero Technologies in 2008. 2 | 3 | Site: http://www.embarcadero.com/products/delphi 4 | -------------------------------------------------------------------------------- /info/html/FDM Installer.html: -------------------------------------------------------------------------------- 1 | It is a powerful, easy-to-use and absolutely free download accelerator and manager. 2 | 3 | Moreover, FDM is 100% safe, open-source software distributed under GPL license. 4 | 5 | Site: http://www.freedownloadmanager.org/ 6 | -------------------------------------------------------------------------------- /info/html/_NET Reactor.html: -------------------------------------------------------------------------------- 1 | .NET Reactor is a powerful code protection and software licensing system for software written for the .NET Framework, and supports all languages that generate .NET assemblies. 2 | 3 | Site: http://www.eziriz.de/dotnet_reactor.htm 4 | -------------------------------------------------------------------------------- /info/html/Inno Setup Module.html: -------------------------------------------------------------------------------- 1 | Inno Setup is a free installer for Windows programs. First introduced in 1997, Inno Setup today rivals and even surpasses many commercial installers in feature set and stability. 2 | 3 | Site: http://www.jrsoftware.org/isinfo.php 4 | -------------------------------------------------------------------------------- /info/html/mdpdf.html: -------------------------------------------------------------------------------- 1 | A command line markdown to pdf converter with support for page headers, footers, and custom stylesheets. 2 | Mdpdf is incredibly configurable and has a JavaScript API for more extravogant usage. 3 | 4 | Site: https://github.com/elliotblackburn/mdpdf 5 | -------------------------------------------------------------------------------- /info/html/Watcom.html: -------------------------------------------------------------------------------- 1 | Open Watcom is a project of the open source community to maintain and enhance the Watcom C, C++, and Fortran cross compilers and tools. An Open Source license from Sybase allows free commercial and non-commercial use of Open Watcom. 2 | 3 | Site: http://www.openwatcom.org/ 4 | -------------------------------------------------------------------------------- /info/html/VMProtect.html: -------------------------------------------------------------------------------- 1 | VMProtect protects code by executing it on a virtual machine with non-standard architecture that makes it extremely difficult to analyze and crack the software. Besides that, VMProtect generates and verifies serial numbers, limits free upgrades and much more. 2 | 3 | Site: http://vmpsoft.com 4 | -------------------------------------------------------------------------------- /info/html/ARJ.html: -------------------------------------------------------------------------------- 1 | ARJ32 is a Windows 32 bit console mode version of the original ARJ archiver. ARJ32 supports the long filenames of Windows 7, Windows Vista, Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Millenium. ARJ32 does NOT run in single-user DOS. 2 | 3 | Site: http://www.arjsoftware.com/ 4 | -------------------------------------------------------------------------------- /info/html/Excelsior JET.html: -------------------------------------------------------------------------------- 1 | Excelsior JET is a certified Java SE technology implementation designed to help accelerate Java applications, secure them against reverse engineering, and distribute Java software products without the need to use the Java Runtime Environment (JRE). 2 | 3 | Site: http://www.excelsior-usa.com/jetinternals.html 4 | -------------------------------------------------------------------------------- /info/html/HP C++.html: -------------------------------------------------------------------------------- 1 | The HP C/aC++ Developer's Bundle includes the utilities for creating C and C++ programs. These tools provide features such as performance analysis, code analysis, and the HP-UX Developer's Toolkit. This product runs on HP-UX 11i v3, on the HP Integrity and HP 9000 systems. 2 | 3 | Site: http://www.hp.com/go/acc 4 | -------------------------------------------------------------------------------- /info/html/XML.html: -------------------------------------------------------------------------------- 1 | Extensible Markup Language (XML) is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. It is defined in the XML 1.0 Specification produced by the W3C, and several other related specifications, all free open standards. 2 | 3 | Site: http://www.w3.org/TR/REC-xml/ 4 | -------------------------------------------------------------------------------- /info/html/Denuvo protector.html: -------------------------------------------------------------------------------- 1 | Denuvo Anti-Tamper technology prevents the debugging, reverse engineering and changing of executable files to strengthen the security of games. It is not a DRM solution, but rather, Denuvo Anti-tamper protects DRM solutions, such as Origin Online Access or the Steam license management system, from being circumvented. 2 | 3 | Site: http://www.denuvo.com 4 | -------------------------------------------------------------------------------- /info/html/AutoIt.html: -------------------------------------------------------------------------------- 1 | AutoIt is a freeware automation language for Microsoft Windows. In its earliest release, the software was primarily intended to create automation scripts (sometimes called macros) for Microsoft Windows programs but has since grown to include enhancements in both programming language design and overall functionality. 2 | 3 | Site: http://www.autoitscript.com/autoit3/ 4 | -------------------------------------------------------------------------------- /info/html/Pascal.html: -------------------------------------------------------------------------------- 1 | Pascal is an influential imperative and procedural programming language, designed in 1968-1969 and published in 1970 by Niklaus Wirth as a small and efficient language intended to encourage good programming practices using structured programming and data structuring. 2 | 3 | A derivative known as Object Pascal designed for object-oriented programming was developed in 1985. 4 | -------------------------------------------------------------------------------- /info/html/Petite.html: -------------------------------------------------------------------------------- 1 | Petite is a Win32 (Windows 95/98/2000/NT/XP) executable (EXE/DLL/etc...) compressor. The compressed executables decompress themselves at run time, and can be used just like the original non-compressed versions. Petite also adds virus detection to the compressed executables - they will check themselves for infection every time they are executed. 2 | 3 | Site: http://www.un4seen.com/petite/ 4 | -------------------------------------------------------------------------------- /info/html/(Win)Upack.html: -------------------------------------------------------------------------------- 1 | Upack is a packer that can compress Windows PE file, which may self-decompress and run normally without any other decompresser. 2 | 3 | It can pack executable files of Windows PE format files with almost the best compression ratio. Whereas DOS-EXEs(MZ), Win3.x-EXE/DLLs(NE), and any other platform programs are not supported by Upack. Upack is only for compression, not for protection mainly. 4 | -------------------------------------------------------------------------------- /info/html/ISO 9660.html: -------------------------------------------------------------------------------- 1 | ISO 9660 (also known as ECMA-119), also referred to as CDFS (Compact Disc File System) by some hardware and software providers, is a file system standard published by the International Organization for Standardization (ISO) for optical disc media. It aims at supporting different computer operating systems such as Windows, classic Mac OS, and Unix-like systems, so that data may be exchanged. 2 | -------------------------------------------------------------------------------- /xinfodbtransfer.pri: -------------------------------------------------------------------------------- 1 | INCLUDEPATH += $$PWD 2 | DEPENDPATH += $$PWD 3 | 4 | HEADERS += \ 5 | $$PWD/xinfodbtransfer.h 6 | 7 | SOURCES += \ 8 | $$PWD/xinfodbtransfer.cpp 9 | 10 | !contains(XCONFIG, xinfodb) { 11 | XCONFIG += xinfodb 12 | include($$PWD/xinfodb.pri) 13 | } 14 | 15 | # mb TODO cmake 16 | 17 | DISTFILES += \ 18 | $$PWD/LICENSE \ 19 | $$PWD/README.md 20 | -------------------------------------------------------------------------------- /info/html/Borland Delphi.html: -------------------------------------------------------------------------------- 1 | Delphi was originally developed by Borland as a rapid application development tool for Windows, and as the successor of Borland Pascal. Delphi and its C++ counterpart, C++Builder, shared many core components, notably the IDE and VCL, but remained separate until the release of RAD Studio 2007. RAD Studio is a shared host for Delphi, C++Builder, and others. 2 | 3 | Site: http://borland.com/ 4 | -------------------------------------------------------------------------------- /info/html/gcc.html: -------------------------------------------------------------------------------- 1 | The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, Ada, and Go, as well as libraries for these languages (libstdc++, libgcj, ...). 2 | 3 | GCC was originally written as the compiler for the GNU operating system. 4 | 5 | The GNU system was developed to be 100% free software, free in the sense that it respects the user's freedom. 6 | 7 | Site: http://gcc.gnu.org/ 8 | -------------------------------------------------------------------------------- /info/html/Enigma Virtual Box.html: -------------------------------------------------------------------------------- 1 | Application virtualization system for Windows. 2 | 3 | Enigma Virtual Box enables application files and registry to be consolidated in a single executable file, without loss of efficiency and without virtualized files having to be extracted to the HDD. Enigma Virtual Box is a free application that supports both x86 and x64 binaries. 4 | 5 | Site: http://enigmaprotector.com/en/aboutvb.html 6 | -------------------------------------------------------------------------------- /info/html/MFC.html: -------------------------------------------------------------------------------- 1 | The Microsoft Foundation Class Library (also Microsoft Foundation Classes or MFC) is a library that wraps portions of the Windows API in C++ classes, including functionality that enables them to use a default application framework. Classes are defined for many of the handle-managed Windows objects and also for predefined windows and common controls. 2 | 3 | Site: http://msdn.microsoft.com/en-us/library/d06h2x6e(v=VS.100).aspx 4 | -------------------------------------------------------------------------------- /info/html/GNU linker ld (GNU Binutils).html: -------------------------------------------------------------------------------- 1 | GNU linker (or GNU ld) is the GNU Project's implementation of the Unix command ld. GNU ld runs the linker, which creates an executable file (or a library) from object files created during compilation of a software project. A linker script may be passed to GNU ld to exercise greater control over the linking process. The GNU linker is part of the GNU Binary Utilities (binutils). 2 | 3 | Site: https://www.gnu.org/software/binutils/ 4 | -------------------------------------------------------------------------------- /info/html/Agile .NET.html: -------------------------------------------------------------------------------- 1 | Agile.NET code protection solution offers better protection for your .NET code by providing a protection that goes beyond standard obfuscation methods. Our advanced code protection technology delivers a layered protection approach that combines our patented code virtualization technology, code encryption, obfuscation, and anti-reverse engineering countermeasures embedded into existing application code. 2 | 3 | Site: http://secureteam.net/.NET-Obfuscator.aspx 4 | -------------------------------------------------------------------------------- /info/html/MASM32.html: -------------------------------------------------------------------------------- 1 | The MASM32 SDK is targeted at experienced programmers who are familiar with writing software in 32 bit versions of Windows using the API interface and who are familiar with at least some direct mnemonic programming in assembler. It is not well suited for beginner programmers due to the advanced technical nature of programming in assembler and beginners are advised to start with a compiler first to learn basic concepts like addressing, programming logic, control flow and similar. 2 | 3 | Site: http://masm32.com 4 | -------------------------------------------------------------------------------- /info/html/Free Pascal.html: -------------------------------------------------------------------------------- 1 | Free Pascal is a 32, 64 and 16 bit professional Pascal compiler. It can target multiple processor architectures: Intel x86, AMD64/x86-64, PowerPC, PowerPC64, SPARC, and ARM. Supported operating systems include Linux, FreeBSD, Haiku, Mac OS X/iOS/Darwin, DOS, Win32, Win64, WinCE, OS/2, MorphOS, Nintendo GBA, Nintendo DS, and Nintendo Wii. Additionally, JVM, MIPS (big and little endian variants), i8086 and Motorola 68k architecture targets are available in the development versions. 2 | 3 | Site: http://www.freepascal.org/ 4 | -------------------------------------------------------------------------------- /info/html/pdb.html: -------------------------------------------------------------------------------- 1 | PDB stands for Program Database, a proprietary file format (developed by Microsoft) for storing debugging information about a program (or, commonly, program modules such as a DLL or EXE). PDB files commonly have a .pdb extension. A PDB file is typically created from source files during compilation. It stores a list of all symbols in a module with their addresses and possibly the name of the file and the line on which the symbol was declared. This symbol information is not stored in the module itself, because it takes up a lot of space. 2 | -------------------------------------------------------------------------------- /info/html/FASM.html: -------------------------------------------------------------------------------- 1 | The flat assembler is a fast and efficient self-assembling x86 assembler for DOS, Windows and Linux operating systems. 2 | 3 | Currently it supports x86 and x86-64 instructions sets with MMX, 3DNow!, SSE up to SSE4, AVX, AVX2 and XOP extensions, can produce output in plain binary, MZ, PE, COFF or ELF format. 4 | 5 | It includes the powerful but easy to use macroinstruction support and does multiple passes to optimize the instruction codes for size. 6 | 7 | The flat assembler is self-compilable and the complete source code is included. 8 | 9 | Site: http://flatassembler.net 10 | -------------------------------------------------------------------------------- /info/html/Visual Basic.html: -------------------------------------------------------------------------------- 1 | Visual Basic is a third-generation event-driven programming language and integrated development environment (IDE) from Microsoft for its COM programming model first released in 1991. Microsoft intended Visual Basic to be relatively easy to learn and use. Visual Basic was derived from BASIC and enables the rapid application development (RAD) of graphical user interface (GUI) applications, access to databases using Data Access Objects, Remote Data Objects, or ActiveX Data Objects, and creation of ActiveX controls and objects. 2 | 3 | Site: http://msdn.microsoft.com/en-us/vstudio/ms788229.aspx 4 | -------------------------------------------------------------------------------- /info/html/GLIBC.html: -------------------------------------------------------------------------------- 1 | Overview 2 | 3 | Any Unix-like operating system needs a C library: the library which defines the "system calls" and other basic facilities such as open, malloc, printf, exit... 4 | 5 | The GNU C Library is used as the C library in the GNU systems and most systems with the Linux kernel. 6 | 7 | Project Goals 8 | 9 | The GNU C Library is primarily designed to be a portable and high performance C library. It follows all relevant standards including ISO C11 and POSIX.1-2008. It is also internationalized and has one of the most complete internationalization interfaces known. 10 | 11 | Site: http://www.gnu.org/software/libc/ 12 | -------------------------------------------------------------------------------- /info/html/IntelliProtector.html: -------------------------------------------------------------------------------- 1 | IntelliProtector is a comprehensive multifunctional software protection solution providing a robust foundation for the monetization, protection, and license control of your intellectual property. With IntelliProtector, you can easily set up a secure software licensing system with a uniform interface for managing the activations, registrations, and renewals of your software. The main advantage of our solution is a compact yet functional design that easily allows you to control the licensing cycle of the product and track down the usage of the trial and licensed software copies. 2 | 3 | Site: http://www.intelliprotector.com/ 4 | -------------------------------------------------------------------------------- /info/html/DeepSea.html: -------------------------------------------------------------------------------- 1 | Obfuscation is critical for the protection of your Intellectual Property in .NET applications. Because of the nature of the .NET framework, your applications will show a lot of your Intellectual Property. Obfuscation will change the name of your classes and members to unreadable characters. This make understanding your code much more complicated. 2 | 3 | DeepSea Obfuscator will automatically detect code that cannot be obfuscated using its Smart Protection rules. You can also exclude classes and/or members from obfuscation using standard Obfuscation attributes or an External Configuration file. 4 | 5 | Site: http://www.deepseaobfuscator.com/ 6 | -------------------------------------------------------------------------------- /info/html/_NET.html: -------------------------------------------------------------------------------- 1 | .NET Framework (pronounced dot net) is a software framework developed by Microsoft that runs primarily on Microsoft Windows. It includes a large class library known as Framework Class Library (FCL) and provides language interoperability (each language can use code written in other languages) across several programming languages. Programs written for .NET Framework execute in a software environment (as contrasted to hardware environment), known as Common Language Runtime (CLR), an application virtual machine that provides services such as security, memory management, and exception handling. FCL and CLR together constitute .NET Framework. 2 | 3 | Site: http://microsoft.com/net 4 | -------------------------------------------------------------------------------- /info/html/Microsoft Compiled HTML Help.html: -------------------------------------------------------------------------------- 1 | Microsoft Compiled HTML Help is a Microsoft proprietary online help format, consisting of a collection of HTML pages, an index and other navigation tools. The files are compressed and deployed in a binary format with the extension .CHM, for Compiled HTML. The format is often used for software documentation. 2 | 3 | It was introduced as the successor to Microsoft WinHelp with the release of Windows 98 and is still supported in Windows 7. Although the format was designed by Microsoft, it has been successfully reverse-engineered and is now supported in many document viewer applications. 4 | 5 | Site: http://en.wikipedia.org/wiki/Microsoft_Compiled_HTML_Help 6 | -------------------------------------------------------------------------------- /info/html/Cocoa.html: -------------------------------------------------------------------------------- 1 | Cocoa is Apple's native object-oriented application programming interface (API) for the OS X operating system. 2 | 3 | For iOS, there is a similar API called Cocoa Touch which includes gesture recognition, animation, and a different user interface library, and is for applications for the iOS operating system, used on Apple devices such as the iPhone, the iPod Touch, and the iPad. 4 | 5 | Cocoa consists of the Foundation Kit, Application Kit, and Core Data frameworks, as included by Cocoa.h header file, as well as the libraries and frameworks included by those, such as the C standard library and the Objective-C runtime. 6 | 7 | Site: http://developer.apple.com/technologies/mac/cocoa.html 8 | -------------------------------------------------------------------------------- /info/html/Obsidium.html: -------------------------------------------------------------------------------- 1 | Obsidium is a feature-rich professional software protection and licensing system that was designed as a cost effective and easy to implement, yet reliable and non-invasive way to protect your 32- and 64-bit Windows software applications and games from reverse engineering, unauthorized modifications ("cracking") and redistribution ("software piracy") while providing a secure and flexible licensing/registration system. 2 | 3 | It is primarily aimed at software companies and individual developers who would like to provide feature- or time-limited evaluation versions of their software products, but also allows for the implementation of a wide range of custom licensing scenarios. 4 | 5 | Site: http://www.obsidium.de/ 6 | -------------------------------------------------------------------------------- /info/html/Oracle Solaris Studio.html: -------------------------------------------------------------------------------- 1 | The Oracle Solaris Studio, formerly named Sun Studio, Sun WorkShop, Forte Developer, and SunPro Compilers, is a compiler suite which is Oracle Corporation's flagship software development product for the operating systems Solaris and Linux. 2 | 3 | The Oracle Solaris Studio software delivers optimizing compilers for C, C++, and Fortran, libraries, and performance analysis, and debugging tools for Solaris on SPARC, and both Solaris and Linux on x86/x64 platforms, including multi-core systems. 4 | 5 | There are many security and functionality patch updates which are only available with a support contract from Oracle. 6 | 7 | Site: http://www.oracle.com/technetwork/server-storage/solarisstudio/overview/ 8 | -------------------------------------------------------------------------------- /dialogxinfodbtransferprocess.pri: -------------------------------------------------------------------------------- 1 | INCLUDEPATH += $$PWD 2 | DEPENDPATH += $$PWD 3 | 4 | HEADERS += \ 5 | $$PWD/xinfodboptionswidget.h \ 6 | $$PWD/xinfomenu.h 7 | 8 | SOURCES += \ 9 | $$PWD/xinfodboptionswidget.cpp \ 10 | $$PWD/xinfomenu.cpp 11 | 12 | FORMS += \ 13 | $$PWD/xinfodboptionswidget.ui 14 | 15 | !contains(XCONFIG, xinfodbtransfer) { 16 | XCONFIG += xinfodbtransfer 17 | include($$PWD/xinfodbtransfer.pri) 18 | } 19 | 20 | !contains(XCONFIG, xdialogprocess) { 21 | XCONFIG += xdialogprocess 22 | include($$PWD/../FormatDialogs/xdialogprocess.pri) 23 | } 24 | 25 | DISTFILES += \ 26 | $$PWD/LICENSE \ 27 | $$PWD/README.md \ 28 | $$PWD/dialogxinfodbtransferprocess.cmake 29 | -------------------------------------------------------------------------------- /info/html/RosASM.html: -------------------------------------------------------------------------------- 1 | RosAsm is a 32-bit Win32 x86 assembler developed by an independent group of programmers and contributors. It is the continuation of an assembler called SpAsm, always under the direction of its original author René Tournois. 2 | 3 | The name stands for ReactOS Assembler, meaning that it was designed to run on that platform as a primary operating system, although both projects are developed by an independent group of developers, not related to each other. ReactOS package does not include RosAsm assembler, and uses itself to assemble part of their sources. 4 | 5 | RosAsm is an assembler with full integration of an IDE, resource editor, debugger and disassembler. The syntax is inspired by NASM's. 6 | 7 | Site: http://rosasm.freeforums.org 8 | -------------------------------------------------------------------------------- /info/html/Xojo.html: -------------------------------------------------------------------------------- 1 | Xojo is an integrated software developer tool and programming language that is the easiest way to make desktop, web and iOS apps. With Xojo you can create desktop apps for Windows, Mac and Linux (including Raspberry Pi), web apps for all popular web browsers and iOS apps for iPhones, iPads and other iOS devices. 2 | 3 | Xojo is a rapid application development (RAD) tool with a user interface (UI) builder that lets you create your app's user interface with little to no programming required. If you know how to drag and drop, you can build the UI using the wide variety of built-in controls, making it easy to create powerful, multi-platform desktop, web and iOS applications faster than you ever thought possible. 4 | 5 | Site: https://www.xojo.com 6 | -------------------------------------------------------------------------------- /info/html/aPACK.html: -------------------------------------------------------------------------------- 1 | aPACK v1.00 - 16-bit DOS executable compressor 2 | 3 | Copyright © 1997-2012 Jørgen Ibsen. All Rights Reserved. 4 | 5 | aPACK is a compressor for 16-bit DOS executables -- it can compress .exe and .com programs while keeping them executable. 6 | 7 | Most DOS executable compressors use a standard depacker for every file, however parts of the depacker are not required or can be optimized for certain executables. aPACK produces a specifically optimized depacker for every executable it compresses. 8 | 9 | aPACK has ranked as one of the best 16-bit DOS executable compressors for years. 10 | 11 | aPACK is free to use even for commercial use, please check the included license for details. 12 | 13 | Site: http://www.ibsensoftware.com/products_aPACK.html 14 | -------------------------------------------------------------------------------- /info/html/SDL.html: -------------------------------------------------------------------------------- 1 | Simple DirectMedia Layer (SDL) is a cross-platform development library designed to provide low level access to audio, input devices, and graphics hardware via OpenGL and Direct3D (i.e. not DirectX). SDL is written in C and is free and open-source software subject to the requirements of the zlib License since version 2.0 and GNU Lesser General Public License prior versions. 2 | 3 | Over 700 games, 180 applications, and 120 demos have been posted on its website. 4 | 5 | Software developers use it to write computer games and other multimedia applications that can run on many operating systems: Android, iOS, Linux, Mac OS X, Windows and other platforms. It manages video, events, digital audio, CD-ROM, threads, shared object loading, networking and timers. 6 | 7 | Site: http://www.libsdl.org/ 8 | -------------------------------------------------------------------------------- /xinfodb.cmake: -------------------------------------------------------------------------------- 1 | include_directories(${CMAKE_CURRENT_LIST_DIR}) 2 | 3 | if (NOT DEFINED XSCANENGINE_SOURCES) 4 | include(${CMAKE_CURRENT_LIST_DIR}/../XScanEngine/xscanengine.cmake) 5 | set(XINFODB_SOURCES ${XINFODB_SOURCES} ${XSCANENGINE_SOURCES}) 6 | endif() 7 | if (NOT DEFINED XDISASMCORE_SOURCES) 8 | include(${CMAKE_CURRENT_LIST_DIR}/../XDisasmCore/xdisasmcore.cmake) 9 | set(XINFODB_SOURCES ${XINFODB_SOURCES} ${XDISASMCORE_SOURCES}) 10 | endif() 11 | 12 | # mb TODO XCapstone 13 | set(XINFODB_SOURCES 14 | ${XINFODB_SOURCES} 15 | ${CMAKE_CURRENT_LIST_DIR}/xinfodb.cpp 16 | ${CMAKE_CURRENT_LIST_DIR}/xinfodb.h 17 | ) 18 | 19 | if (DEFINED X_RESOURCES) 20 | install (DIRECTORY ${CMAKE_CURRENT_LIST_DIR}/info DESTINATION ${X_RESOURCES} OPTIONAL) 21 | endif() 22 | -------------------------------------------------------------------------------- /info/html/RTF.html: -------------------------------------------------------------------------------- 1 | The Rich Text Format (often abbreviated RTF) is a proprietary document file format with published specification developed by Microsoft Corporation since 1987 for Microsoft products and for cross-platform document interchange. 2 | 3 | Most word processors are able to read and write some versions of RTF. There are several different revisions of RTF specification and portability of files will depend on what version of RTF is being used. RTF specifications are changed and published with major Microsoft Word and Office versions. 4 | 5 | It should not be confused with enriched text (mimetype "text/enriched" of RFC 1896) or its predecessor Rich Text (mimetype "text/richtext" of RFC 1341 and 1521); nor with IBM's RFT-DCA (Revisable Format Text-Document Content Architecture) which are completely different specifications. 6 | -------------------------------------------------------------------------------- /info/html/Microsoft Visual C++.html: -------------------------------------------------------------------------------- 1 | Microsoft Visual C++ (often abbreviated as MSVC or VC++) is a commercial (free version available), integrated development environment (IDE) product from Microsoft for the C, C++, and C++/CLI programming languages. It features tools for developing and debugging C++ code, especially code written for the Microsoft Windows API, the DirectX API, and the Microsoft .NET Framework. 2 | 3 | Many applications require redistributable Visual C++ packages to function correctly. These packages are often installed independently of applications, allowing multiple applications to make use of the package while only having to install it once. These Visual C++ redistributable and runtime packages are mostly installed for standard libraries that many applications use. 4 | 5 | Site: http://msdn.microsoft.com/en-us/vstudio/hh386302.aspx 6 | -------------------------------------------------------------------------------- /info/html/python.html: -------------------------------------------------------------------------------- 1 | Python is a widely used general-purpose, high-level programming language. Its design philosophy emphasizes code readability, and its syntax allows programmers to express concepts in fewer lines of code than would be possible in languages such as C. The language provides constructs intended to enable clear programs on both a small and large scale. 2 | 3 | Python supports multiple programming paradigms, including object-oriented, imperative and functional programming or procedural styles. It features a dynamic type system and automatic memory management and has a large and comprehensive standard library. 4 | 5 | Using third-party tools, such as Py2exe or Pyinstaller, Python code can be packaged into standalone executable programs. Python interpreters are available for many operating systems. 6 | 7 | Site: https://www.python.org/ 8 | -------------------------------------------------------------------------------- /info/html/Microsoft Visual C_C++.html: -------------------------------------------------------------------------------- 1 | Microsoft Visual C++ (often abbreviated as MSVC or VC++) is a commercial (free version available), integrated development environment (IDE) product from Microsoft for the C, C++, and C++/CLI programming languages. It features tools for developing and debugging C++ code, especially code written for the Microsoft Windows API, the DirectX API, and the Microsoft .NET Framework. 2 | 3 | Many applications require redistributable Visual C++ packages to function correctly. These packages are often installed independently of applications, allowing multiple applications to make use of the package while only having to install it once. These Visual C++ redistributable and runtime packages are mostly installed for standard libraries that many applications use. 4 | 5 | Site: http://msdn.microsoft.com/en-us/vstudio/hh386302.aspx 6 | -------------------------------------------------------------------------------- /info/html/Nullsoft Scriptable Install System.html: -------------------------------------------------------------------------------- 1 | NSIS (Nullsoft Scriptable Install System) is a professional open source system to create Windows installers. It is designed to be as small and flexible as possible and is therefore very suitable for internet distribution. 2 | 3 | Being a user's first experience with your product, a stable and reliable installer is an important component of succesful software. With NSIS you can create such installers that are capable of doing everything that is needed to setup your software. 4 | 5 | NSIS is script-based and allows you to create the logic to handle even the most complex installation tasks. Many plug-ins and scripts are already available you can create web installers, communicate with Windows and other software components, install or update shared components and more. 6 | 7 | Site: http://nsis.sourceforge.net 8 | -------------------------------------------------------------------------------- /xinfodb.pri: -------------------------------------------------------------------------------- 1 | INCLUDEPATH += $$PWD 2 | DEPENDPATH += $$PWD 3 | 4 | !contains(XCONFIG, use_dex) { 5 | XCONFIG += use_dex 6 | } 7 | 8 | !contains(XCONFIG, use_pdf) { 9 | XCONFIG += use_pdf 10 | } 11 | 12 | !contains(XCONFIG, use_archive) { 13 | XCONFIG += use_archive 14 | } 15 | 16 | !contains(XCONFIG, xscanengine) { 17 | XCONFIG += xscanengine 18 | include($$PWD/../XScanEngine/xscanengine.pri) 19 | } 20 | 21 | !contains(XCONFIG, xdisasmcore) { 22 | XCONFIG += xdisasmcore 23 | include($$PWD/../XDisasmCore/xdisasmcore.pri) 24 | } 25 | 26 | HEADERS += \ 27 | $$PWD/xinfodb.h 28 | 29 | SOURCES += \ 30 | $$PWD/xinfodb.cpp 31 | 32 | DISTFILES += \ 33 | $$PWD/LICENSE \ 34 | $$PWD/README.md \ 35 | $$PWD/info/PE.sections.txt \ 36 | $$PWD/info/ELF.sections.txt \ 37 | $$PWD/xinfodb.cmake 38 | -------------------------------------------------------------------------------- /info/html/SafeNet Sentinel LDK.html: -------------------------------------------------------------------------------- 1 | Sentinel License Development Kit (LDK) is a comprehensive software monetization solution that pairs the company's award-winning software copy and intellectual property (IP) protection features with the web-based, license management capabilities of Sentinel EMS, SafeNet's entitlement management system. Sentinel EMS can be hosted on premise or on Sentinel Managed Application Hosting Services for improved delivery, reliability and security. 2 | 3 | Sentinel LDK also features three best of class protection types i.e. Sentinel HL, Sentinel SL and Sentinel CL. Whether you ship physical boxes, embed your software into high-tech devices, offer electronic delivery, or deliver your product as a service in the cloud, our various protection types have you covered. Featuring SafeNet's innovative and unique Cross-Locking technology 4 | 5 | Site: https://cpl.thalesgroup.com/software-monetization/license-development-kit-ldk 6 | -------------------------------------------------------------------------------- /dialogxinfodbtransferprocess.cmake: -------------------------------------------------------------------------------- 1 | include_directories(${CMAKE_CURRENT_LIST_DIR}) 2 | 3 | if (NOT DEFINED XDIALOGPROCESS_SOURCES) 4 | include(${CMAKE_CURRENT_LIST_DIR}/../FormatDialogs/xdialogprocess.cmake) 5 | set(DIALOGXINFODBTRANSFERPROCESS_SOURCES ${DIALOGXINFODBTRANSFERPROCESS_SOURCES} ${XDIALOGPROCESS_SOURCES}) 6 | endif() 7 | 8 | # TODO Check includes 9 | set(DIALOGXINFODBTRANSFERPROCESS_SOURCES 10 | ${DIALOGXINFODBTRANSFERPROCESS_SOURCES} 11 | ${CMAKE_CURRENT_LIST_DIR}/xinfodbtransfer.cpp 12 | ${CMAKE_CURRENT_LIST_DIR}/xinfodbtransfer.h 13 | ${CMAKE_CURRENT_LIST_DIR}/xinfodb.cpp 14 | ${CMAKE_CURRENT_LIST_DIR}/xinfodb.h 15 | ${CMAKE_CURRENT_LIST_DIR}/xinfodboptionswidget.cpp 16 | ${CMAKE_CURRENT_LIST_DIR}/xinfodboptionswidget.h 17 | ${CMAKE_CURRENT_LIST_DIR}/xinfodboptionswidget.ui 18 | ${CMAKE_CURRENT_LIST_DIR}/xinfomenu.cpp 19 | ${CMAKE_CURRENT_LIST_DIR}/xinfomenu.h 20 | ) 21 | -------------------------------------------------------------------------------- /info/html/Carbon.html: -------------------------------------------------------------------------------- 1 | Carbon is one of Apple Inc.'s C-based application programming interfaces (APIs) for the Macintosh operating system. Carbon provides a good degree of backward compatibility for programs that ran on the now-obsolete Mac OS 8 and 9. Developers could use the Carbon APIs to port their "classic" Mac software to the Mac OS X platform with far less effort than a port to the entirely different Cocoa system which originated in OpenStep. 2 | 3 | Carbon was an important part of Apple's strategy for bringing Mac OS X to market, offering a path for quick porting of existing software applications. As the market has increasingly moved to the Cocoa-based frameworks, especially after the release of iOS, the need for a porting library was diluted. Apple did not create a 64-bit version of Carbon while updating their other frameworks in the 2007 time-frame, and eventually deprecated the entire system in OS X 10.8, which was released on July 24, 2012. 4 | 5 | Site: http://developer.apple.com/carbon/ 6 | -------------------------------------------------------------------------------- /info/html/Guitar Pro.html: -------------------------------------------------------------------------------- 1 | Arobas Music Guitar Pro is a multitrack editor of stringed instruments (especially fretboarded, like guitar and bass) tablature and musical scores, possessing a built-in MIDI-editor, a plotter of chords, a player, a metronome and other tools for guitarists and musicians. It has versions for Windows, Mac OS X (Intel processors only), Linux, iOS (iPhone, iPad), Android and BlackBerry. 2 | 3 | Guitar Pro from version 5.0 outputs sound by means of a library Realistic Sound Engine (RSE) which uses high quality recorded samples of guitars, basses, drums and from version 6.0 higher range of instruments for more realistic playback. 4 | 5 | Files composed using Guitar Pro are stored in the GPX, GP5, GP4 and GP3 format, corresponding to version 6.x, 5.x, 4.x, and 3.0 of the software. Guitar Pro from versions 1.x to 2.x used GTP format. Soundbanks are stored in GPBANK (6.x) and FSB (5.x) formats. Guitar Pro from version 6.0 supports also templates stored in files with GPT extension - technically this is GPX format. 6 | -------------------------------------------------------------------------------- /info/html/7-Zip.html: -------------------------------------------------------------------------------- 1 | 7-Zip is open source software. Most of the source code is under the GNU LGPL license. The unRAR code is under a mixed license: GNU LGPL + unRAR restrictions. 2 | 3 | You can use 7-Zip on any computer, including a computer in a commercial organization. You don't need to register or pay for 7-Zip. 4 | 5 | The main features of 7-Zip: 6 | 7 | High compression ratio in 7z format with LZMA and LZMA2 compression 8 | Supported formats: 9 | Packing / unpacking: 7z, XZ, BZIP2, GZIP, TAR, ZIP and WIM 10 | Unpacking only: ARJ, CAB, CHM, CPIO, CramFS, DEB, DMG, FAT, HFS, ISO, LZH, LZMA, MBR, MSI, NSIS, NTFS, RAR, RPM, SquashFS, UDF, VHD, WIM, XAR and Z. 11 | For ZIP and GZIP formats, 7-Zip provides a compression ratio that is 2-10 % better than the ratio provided by PKZip and WinZip 12 | Strong AES-256 encryption in 7z and ZIP formats 13 | Self-extracting capability for 7z format 14 | Integration with Windows Shell 15 | Powerful File Manager 16 | Powerful command line version 17 | Plugin for FAR Manager 18 | Localizations for 79 languages 19 | 20 | Site: http://www.7-zip.org/ 21 | -------------------------------------------------------------------------------- /info/html/Go.html: -------------------------------------------------------------------------------- 1 | The Go programming language is an open source project to make programmers more productive. 2 | 3 | Go is expressive, concise, clean, and efficient. Its concurrency mechanisms make it easy to write programs that get the most out of multicore and networked machines, while its novel type system enables flexible and modular program construction. Go compiles quickly to machine code yet has the convenience of garbage collection and the power of run-time reflection. It's a fast, statically typed, compiled language that feels like a dynamically typed, interpreted language. 4 | 5 | A summary of the changes between Go releases. Notes for the major releases: 6 | 7 | Go 1.14 (February 2020) 8 | Go 1.13 (September 2019) 9 | Go 1.12 (February 2019) 10 | Go 1.11 (August 2018) 11 | Go 1.10 (February 2018) 12 | Go 1.9 (August 2017) 13 | Go 1.8 (February 2017) 14 | Go 1.7 (August 2016) 15 | Go 1.6 (February 2016) 16 | Go 1.5 (August 2015) 17 | Go 1.4 (December 2014) 18 | Go 1.3 (June 2014) 19 | Go 1.2 (December 2013) 20 | Go 1.1 (May 2013) 21 | Go 1 (March 2012) 22 | 23 | Site: https://golang.org -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2022-2025 hors 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /info/html/PKLITE32.html: -------------------------------------------------------------------------------- 1 | PKLITE32 may be used to reduce the size of any Windows 32 bit Portable Executable (i.e. PE) "Image" file. The PE file format is based on the Common Object File Format (i.e. COFF) and is the primary Windows 32-bit executable file format. In addition to executable files, PKLITE32 will compress Dynamic Link Library (i.e. .DLL) files, OLE Custom Control (i.e. .OCX) files, or any PE based file type. 2 | 3 | Once PKLITE32 compresses the specified sections/resources, it inserts a small piece of code into the PE file that decompresses the compressed sections at file runtime. This all occurs seamlessly to the end user. In other words, the end user won't know the difference between a compressed file and an uncompressed one. 4 | 5 | PKLITE32 provides three interfaces for compressing PE files: 6 | 7 | the GUI provides a Windows based user-friendly method for compressing files; 8 | the Command Line is typically used when automating one or more file compression tasks with a batch file; 9 | the Scripting interface is used when automating compression, usually as a post processing operation during development. For example, MS Developers Studio may be configured to compress an image after it is compiled. 10 | -------------------------------------------------------------------------------- /info/html/HTML.html: -------------------------------------------------------------------------------- 1 | HTML or HyperText Markup Language is the standard markup language used to create web pages. 2 | 3 | HTML is written in the form of HTML elements consisting of tags enclosed in angle brackets (like ). HTML tags most commonly come in pairs like

and

, although some tags represent empty elements and so are unpaired, for example . The first tag in a pair is the start tag, and the second tag is the end tag (they are also called opening tags and closing tags). 4 | 5 | A web browser can read HTML files and compose them into visible or audible web pages. The browser does not display the HTML tags, but uses them to interpret the content of the page. HTML describes the structure of a website semantically along with cues for presentation, making it a markup language rather than a programming language. 6 | 7 | HTML elements form the building blocks of all websites. HTML allows images and objects to be embedded and can be used to create interactive forms. It provides a means to create structured documents by denoting structural semantics for text such as headings, paragraphs, lists, links, quotes and other items. It can embed scripts written in languages such as JavaScript which affect the behavior of HTML web pages. 8 | 9 | Site: http://www.w3.org/html/ 10 | -------------------------------------------------------------------------------- /info/html/Wine.html: -------------------------------------------------------------------------------- 1 | Wine (originally an acronym for "Wine Is Not an Emulator") is a compatibility layer capable of running Windows applications on several POSIX-compliant operating systems, such as Linux, Mac OSX, & BSD. Instead of simulating internal Windows logic like a virtual machine or emulator, Wine translates Windows API calls into POSIX calls on-the-fly, eliminating the performance and memory penalties of other methods and allowing you to cleanly integrate Windows applications into your desktop. 2 | 3 | Wine began in 1993 under the initial coordination of Bob Amstadt as a way to support running Windows 3.1 programs on Linux. Very early on, leadership over Wine's development passed to Alexandre Julliard, who has managed the project ever since. Over the years, as the Windows API and applications have evolved to take advantage of new hardware and software, Wine has adapted to support new features, all while being ported to other OSes, becoming more stable, and providing a better user-experience. 4 | 5 | An ambitious project by definition, work on Wine would steadily continue for 15 years before the program finally reached v1.0, the first stable release, in 2008. Several releases later, Wine is still under active development today, and although there is more work to be done, millions of people are estimated to use Wine to run their Windows software on the OS of their choice. 6 | 7 | Site: http://www.winehq.org/ 8 | -------------------------------------------------------------------------------- /info/ELF.sections.txt: -------------------------------------------------------------------------------- 1 | .bss|compiler|Uninitialized Data Section 2 | .comment|compiler|Version control information. 3 | .data1|compiler|Data Section 4 | .data|compiler|Data Section 5 | .debug_abbrev|compiler|DEBUG 6 | .debug_aranges|compiler|DEBUG 7 | .debug_frame|compiler|DEBUG 8 | .debug_info|compiler|DEBUG 9 | .debug_line|compiler|DEBUG 10 | .debug_loc|compiler|DEBUG 11 | .debug_macinfo|compiler|DEBUG 12 | .debug_pubnames|compiler|DEBUG 13 | .debug_ranges|compiler|DEBUG 14 | .debug_str|compiler|DEBUG 15 | .debug|compiler|Debug info Section. 16 | .dynamic|compiler|Dynamic linking information. 17 | .dynstr|compiler|Strings needed for dynamic linking. 18 | .dynsym|compiler|The dynamic linking symbol table. 19 | .fini|compiler|Executable instructions that contribute to the process termination code. 20 | .got|compiler|The global offset table. 21 | .hash|compiler|Hash Table. 22 | .init|compiler|Executable instructions that contribute to the process initialization code. 23 | .interp|compiler|The path name of a program interpreter. 24 | .line|compiler|Line number information for symbolic debugging. 25 | .note|compiler|Note Section. 26 | .plt|compiler|The procedure linkage table. 27 | .reginfo|compiler|Register usage information. 28 | .rodata|compiler|Read-only data. 29 | .rodata1|compiler|Read-only data. 30 | .shstrtab|compiler|Section names. 31 | .strtab|compiler|String table. 32 | .symtab|compiler|Symbol table. 33 | .text|compiler|Code Section. 34 | -------------------------------------------------------------------------------- /info/html/polink.html: -------------------------------------------------------------------------------- 1 | Pelles C is a complete development kit for Windows (and Windows Mobile, but this platform is fading away). It contains among other things an optimizing C compiler, a macro assembler, a linker, a resource compiler, a message compiler, a code signing utility, a make utility and an install builder. 2 | 3 | It also contains an integrated development environment (IDE) with project management, debugger, profiler, source code editor, and resource editors for dialogs, menus, string tables, accelerator tables, bitmaps, icons, cursors, animated cursors, animation videos (AVI's without sound), versions and XP manifests. 4 | 5 | The compiler is originally based on LCC (by Chris Fraser and David Hanson), but since then enhanced with support for C99 and C11, a global optimizer, a new register allocator, a function inliner, intrinsic functions, and many Microsoft C extensions. 6 | 7 | The install builder for Windows is originally based on NSIS from Nullsoft. 8 | 9 | Features: 10 | 11 | Support for 32-bit Windows (X86), 64-bit Windows (X64), and (deprecated) Windows Mobile (ARM). 12 | Support for the C99 and C11 standard. 13 | Support for most SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2, AES, and AVX(1) intrinsics (X64 only). 14 | Integrated source code editor with call tips and symbol browsing. 15 | Integrated source-level debugger. 16 | Integrated sampling profiler. 17 | Project management. 18 | Inline assembler for X86 and ARM. 19 | Integrated resource editor. 20 | Integrated bitmap, icon and cursor editor. 21 | Integrated animated cursor and video editor. 22 | Integrated hex-dump editor. 23 | Support for custom controls in the dialog editor. 24 | Support for custom project wizards. 25 | Pelles C is freeware. See terms of use. 26 | 27 | Site: http://www.smorgasbordet.com/pellesc/ 28 | -------------------------------------------------------------------------------- /info/html/QT.html: -------------------------------------------------------------------------------- 1 | Qt is a cross-platform application framework that is widely used for developing application software with a graphical user interface (GUI) (in which cases Qt is classified as a widget toolkit), and also used for developing non-GUI programs such as command-line tools and consoles for servers. 2 | 3 | Qt uses standard C++ but makes extensive use of a special code generator (called the Meta Object Compiler, or moc) together with several macros to enrich the language. Qt can also be used in several other programming languages via language bindings. It runs on the major desktop platforms and some of the mobile platforms. It has extensive internationalization support. Non-GUI features include SQL database access, XML parsing, thread management, network support, and a unified cross-platform application programming interface (API) for file handling. 4 | 5 | Qt is available under a commercial license, GPL v3 and LGPL v2. All editions support many compilers, including the GCC C++ compiler and the Visual Studio suite. 6 | 7 | Qt is developed by Digia, who owns the Qt trademark, and the Qt Project under open governance, involving individual developers and firms working to advance Qt. Before the launch of the Qt Project, it was produced by Nokia's Qt Development Frameworks division, which came into existence after Nokia's acquisition of the Norwegian company Trolltech, the original producer of Qt. In February 2011, Nokia announced its decision to drop Symbian technologies and base their future smartphones on Microsoft platform instead. One month later, Nokia announced the sale of Qt's commercial licensing and professional services to Digia, with the immediate goal of taking Qt support to Android, iOS and Windows 8 platforms, and to continue focusing on desktop and embedded development, although Nokia was to remain the main development force behind the framework at that time. 8 | 9 | Site: https://qt-project.org/ 10 | -------------------------------------------------------------------------------- /info/html/MPRESS.html: -------------------------------------------------------------------------------- 1 | MPRESS is a free, high-performance executable packer for PE32/PE32+/.NET/MAC-DARWIN executable formats! 2 | 3 | MPRESS makes programs and libraries smaller, and decrease start time when the application loaded from a slow removable media or from the network. It uses in-place decompression technique, which allows to decompress the executable without memory overhead or other drawbacks; it also protects programs against reverse engineering by non-professional hackers. Programs compressed with MPRESS run exactly as before, with no runtime performance penalties. 4 | 5 | MPRESS is absolutely free of charge software. 6 | 7 | MPRESS uses own LZMAT - extremely fast data compression library. 8 | 9 | Version 2.00 of the MATCODE Compressor has been released on 21st March 2009, now MPRESS has an optional LZMA compression. In March 2011 Mr. DonDD has created and published his MPRESS GUI, see link below. 10 | 11 | MPRESS Features: 12 | 13 | Advanced compression of .NET executable files (anyCPU,x86,AMD64,IA64 EXE) 14 | Support for MS Framework 1.1/2.0/3.0/4.0 15 | Does not require .NET Framework to be installed 16 | Advanced compression of PE32/PE32+ (AMD64) executable files (EXE, DLL, OCX, etc.) 17 | Optional LZMA compression 18 | In-place decompression 19 | Static TLS support 20 | Support for mac-darwin-i386, mac-darwin-x86_64 and mac-darwin-ub applications 21 | Very fast decompression: ~210 MB/sec on an AMD 2500+ 22 | Strip sensitive information (relocation, debug information, exceptions, etc.) 23 | Compression of program code, data, and resources 24 | Completely transparent, self-contained operation with UNICODE support 25 | Command line interface allows to use MPRESS from a batch or from a make file 26 | Full Windows 9x/NT/2000/XP/2003/Vista/2008/Windows8 compatibility 27 | Operating Systems: Windows 9x/NT/2000/XP/2003/Vista/2008/Windows7, MAC-OS 10.3/10.4 28 | Platforms: x86(PE32), x64(PE32+,AMD64), .NET 29 | 30 | Site: http://www.matcode.com/mpress.htm 31 | -------------------------------------------------------------------------------- /xinfodboptionswidget.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2022-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in 11 | * all copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef XINFODBOPTIONSWIDGET_H 22 | #define XINFODBOPTIONSWIDGET_H 23 | 24 | #include "xshortcutswidget.h" 25 | #include "xbinary.h" 26 | #include "xoptions.h" 27 | 28 | namespace Ui { 29 | class XInfoDBOptionsWidget; 30 | } 31 | 32 | class XInfoDBOptionsWidget : public XShortcutsWidget { 33 | Q_OBJECT 34 | 35 | public: 36 | explicit XInfoDBOptionsWidget(QWidget *pParent = nullptr); 37 | ~XInfoDBOptionsWidget(); 38 | 39 | virtual void adjustView(); 40 | 41 | void setOptions(XOptions *pOptions); 42 | 43 | static void setDefaultValues(XOptions *pOptions); 44 | virtual void reloadData(bool bSaveSelection); 45 | 46 | public slots: 47 | void save(); 48 | void reload(); 49 | 50 | private slots: 51 | void on_toolButtonInfoPath_clicked(); 52 | 53 | protected: 54 | virtual void registerShortcuts(bool bState); 55 | 56 | private: 57 | Ui::XInfoDBOptionsWidget *ui; 58 | XOptions *m_pOptions; 59 | }; 60 | 61 | #endif // XINFODBOPTIONSWIDGET_H 62 | -------------------------------------------------------------------------------- /xinfomenu.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2022-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in 11 | * all copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef XINFOMENU_H 22 | #define XINFOMENU_H 23 | 24 | #include 25 | #include "xdialogprocess.h" 26 | #include "xinfodbtransfer.h" 27 | 28 | class XInfoMenu : public QObject { 29 | Q_OBJECT 30 | public: 31 | explicit XInfoMenu(XShortcuts *pShortcuts, XOptions *pXOptions); 32 | 33 | QMenu *createMenu(QWidget *pParent); 34 | void setData(XInfoDB *pXInfoDB); 35 | void setData(XInfoDB *pXInfoDB, QIODevice *pDevice, const QString &sDatabaseFileName); 36 | void tryToSave(); 37 | void tryToLoad(); 38 | void reset(); 39 | QString getDatabaseFileName(); 40 | 41 | private slots: 42 | void updateMenu(); 43 | // void actionAnalyze(); 44 | void actionExport(); 45 | void actionImport(); 46 | void save(const QString &sFileName); 47 | void load(const QString &sFileName); 48 | 49 | private: 50 | XShortcuts *m_pShortcuts; 51 | XOptions *m_pXOptions; 52 | QWidget *m_pParent; 53 | QMenu *m_pMenu; 54 | // QAction *m_pActionAnalyze; 55 | QAction *m_pActionExport; 56 | QAction *m_pActionImport; 57 | XInfoDB *m_pXInfoDB; 58 | QIODevice *m_pDevice; 59 | QString m_sDatabaseFileName; 60 | }; 61 | 62 | #endif // XINFOMENU_H 63 | -------------------------------------------------------------------------------- /xinfodbtransfer.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2022-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in 11 | * all copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef XINFODBTRANSFER_H 22 | #define XINFODBTRANSFER_H 23 | 24 | #include "xformats.h" 25 | #include "xinfodb.h" 26 | #include "xthreadobject.h" 27 | 28 | class XInfoDBTransfer : public XThreadObject { 29 | Q_OBJECT 30 | public: 31 | explicit XInfoDBTransfer(QObject *pParent = nullptr); 32 | 33 | enum COMMAND { 34 | COMMAND_UNKNOWN = 0, 35 | COMMAND_ANALYZEALL, 36 | COMMAND_ANALYZE, 37 | COMMAND_EXPORT, 38 | COMMAND_IMPORT, 39 | }; 40 | 41 | struct OPTIONS { 42 | XBinary::FT fileType; 43 | QString sDatabaseFileName; 44 | QIODevice *pDevice; 45 | #ifdef USE_XPROCESS 46 | X_ID nProcessID; 47 | #endif 48 | }; 49 | 50 | struct RESULT { 51 | XADDR nAddress; 52 | qint64 nSize; 53 | }; 54 | 55 | void setData(XInfoDB *pXInfoDB, COMMAND transferType, const OPTIONS &options, XBinary::PDSTRUCT *pPdStruct); 56 | void setData(COMMAND transferType, const OPTIONS &options, RESULT *pResult, XBinary::PDSTRUCT *pPdStruct); 57 | #ifdef USE_XPROCESS 58 | #ifdef Q_OS_WIN 59 | void setData(COMMAND transferType, const OPTIONS &options, QList *pListImports, XBinary::PDSTRUCT *pPdStruct); 60 | #endif 61 | #endif 62 | // bool loadFromFile(const QString &sFileName,XBinary::FT fileType); 63 | 64 | virtual void process(); 65 | 66 | private: 67 | XInfoDB *m_pXInfoDB; 68 | COMMAND m_transferType; 69 | OPTIONS m_options; 70 | RESULT *m_pResult; 71 | XBinary::PDSTRUCT *m_pPdStruct; 72 | #ifdef USE_XPROCESS 73 | #ifdef Q_OS_WIN 74 | QList *m_pListImports; 75 | #endif 76 | #endif 77 | }; 78 | 79 | #endif // XINFODBTRANSFER_H 80 | -------------------------------------------------------------------------------- /xinfodboptionswidget.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2022-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in 11 | * all copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "xinfodboptionswidget.h" 22 | 23 | #include "ui_xinfodboptionswidget.h" 24 | 25 | XInfoDBOptionsWidget::XInfoDBOptionsWidget(QWidget *pParent) : XShortcutsWidget(pParent), ui(new Ui::XInfoDBOptionsWidget) 26 | { 27 | ui->setupUi(this); 28 | 29 | m_pOptions = nullptr; 30 | 31 | setProperty("GROUPID", XOptions::GROUPID_INFO); 32 | } 33 | 34 | XInfoDBOptionsWidget::~XInfoDBOptionsWidget() 35 | { 36 | delete ui; 37 | } 38 | 39 | void XInfoDBOptionsWidget::adjustView() 40 | { 41 | // TODO 42 | } 43 | 44 | void XInfoDBOptionsWidget::setOptions(XOptions *pOptions) 45 | { 46 | m_pOptions = pOptions; 47 | 48 | reload(); 49 | } 50 | 51 | void XInfoDBOptionsWidget::save() 52 | { 53 | m_pOptions->getLineEdit(ui->lineEditInfoPath, XOptions::ID_INFO_PATH); 54 | } 55 | 56 | void XInfoDBOptionsWidget::setDefaultValues(XOptions *pOptions) 57 | { 58 | pOptions->addID(XOptions::ID_INFO_PATH, "$data/info"); 59 | } 60 | 61 | void XInfoDBOptionsWidget::reloadData(bool bSaveSelection) 62 | { 63 | Q_UNUSED(bSaveSelection) 64 | reload(); 65 | } 66 | 67 | void XInfoDBOptionsWidget::reload() 68 | { 69 | m_pOptions->setLineEdit(ui->lineEditInfoPath, XOptions::ID_INFO_PATH); 70 | } 71 | 72 | void XInfoDBOptionsWidget::on_toolButtonInfoPath_clicked() 73 | { 74 | QString sText = ui->lineEditInfoPath->text(); 75 | QString sInitDirectory = XBinary::convertPathName(sText); 76 | 77 | QString sDirectoryName = QFileDialog::getExistingDirectory(this, tr("Open directory") + QString("..."), sInitDirectory, QFileDialog::ShowDirsOnly); 78 | 79 | if (!sDirectoryName.isEmpty()) { 80 | ui->lineEditInfoPath->setText(sDirectoryName); 81 | } 82 | } 83 | 84 | void XInfoDBOptionsWidget::registerShortcuts(bool bState) 85 | { 86 | Q_UNUSED(bState) 87 | } 88 | -------------------------------------------------------------------------------- /xinfodboptionswidget.ui: -------------------------------------------------------------------------------- 1 | 2 | 3 | XInfoDBOptionsWidget 4 | 5 | 6 | 7 | 0 8 | 0 9 | 364 10 | 191 11 | 12 | 13 | 14 | Info 15 | 16 | 17 | 18 | 0 19 | 20 | 21 | 0 22 | 23 | 24 | 0 25 | 26 | 27 | 0 28 | 29 | 30 | 31 | 32 | QFrame::NoFrame 33 | 34 | 35 | QFrame::Plain 36 | 37 | 38 | true 39 | 40 | 41 | 42 | 43 | 0 44 | 0 45 | 364 46 | 191 47 | 48 | 49 | 50 | 51 | 0 52 | 53 | 54 | 0 55 | 56 | 57 | 0 58 | 59 | 60 | 0 61 | 62 | 63 | 64 | 65 | Info 66 | 67 | 68 | 69 | 0 70 | 71 | 72 | 0 73 | 74 | 75 | 0 76 | 77 | 78 | 0 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | ... 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | Qt::Vertical 97 | 98 | 99 | 100 | 20 101 | 149 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | -------------------------------------------------------------------------------- /xinfodbtransfer.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2022-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in 11 | * all copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "xinfodbtransfer.h" 22 | 23 | XInfoDBTransfer::XInfoDBTransfer(QObject *pParent) : XThreadObject(pParent) 24 | { 25 | m_pXInfoDB = nullptr; 26 | m_transferType = COMMAND_ANALYZEALL; 27 | m_options = {}; 28 | m_pResult = nullptr; 29 | m_pPdStruct = nullptr; 30 | #ifdef USE_XPROCESS 31 | #ifdef Q_OS_WIN 32 | m_pListImports = nullptr; 33 | #endif 34 | #endif 35 | } 36 | 37 | void XInfoDBTransfer::setData(XInfoDB *pXInfoDB, COMMAND transferType, const OPTIONS &options, XBinary::PDSTRUCT *pPdStruct) 38 | { 39 | m_pXInfoDB = pXInfoDB; 40 | m_transferType = transferType; 41 | m_options = options; 42 | m_pPdStruct = pPdStruct; 43 | } 44 | 45 | void XInfoDBTransfer::setData(COMMAND transferType, const OPTIONS &options, RESULT *pResult, XBinary::PDSTRUCT *pPdStruct) 46 | { 47 | m_transferType = transferType; 48 | m_options = options; 49 | m_pResult = pResult; 50 | m_pPdStruct = pPdStruct; 51 | } 52 | #ifdef USE_XPROCESS 53 | #ifdef Q_OS_WIN 54 | void XInfoDBTransfer::setData(COMMAND transferType, const OPTIONS &options, QList *pListImports, XBinary::PDSTRUCT *pPdStruct) 55 | { 56 | m_transferType = transferType; 57 | m_options = options; 58 | m_pListImports = pListImports; 59 | m_pPdStruct = pPdStruct; 60 | } 61 | #endif 62 | #endif 63 | void XInfoDBTransfer::process() 64 | { 65 | #ifdef QT_DEBUG 66 | qDebug("bool XInfoDBTransfer::process()"); 67 | #endif 68 | // TODO get string are not in code 69 | 70 | qint32 _nFreeIndex = XBinary::getFreeIndex(m_pPdStruct); 71 | XBinary::setPdStructInit(m_pPdStruct, _nFreeIndex, 0); 72 | 73 | if (m_pXInfoDB) { 74 | if ((m_transferType == COMMAND_ANALYZEALL) || (m_transferType == COMMAND_ANALYZE)) { 75 | bool bFile = false; 76 | QIODevice *pDevice = m_options.pDevice; 77 | 78 | if ((!m_options.pDevice) && (m_options.sDatabaseFileName != "")) { 79 | bFile = true; 80 | 81 | QFile *pFile = new QFile; 82 | 83 | pFile->setFileName(m_options.sDatabaseFileName); 84 | 85 | if (pFile->open(QIODevice::ReadOnly)) { 86 | pDevice = pFile; 87 | } else { 88 | delete pFile; 89 | } 90 | } 91 | 92 | if ((m_transferType == COMMAND_ANALYZEALL) || (m_transferType == COMMAND_ANALYZE)) { 93 | if (pDevice) { 94 | m_pXInfoDB->addMode(m_options.pDevice, m_options.fileType); 95 | m_pXInfoDB->_analyze(m_options.fileType, m_pPdStruct); 96 | } 97 | } 98 | 99 | if (bFile && pDevice) { 100 | QFile *pFile = static_cast(pDevice); 101 | 102 | pFile->close(); 103 | 104 | delete pFile; 105 | } 106 | } else if (m_transferType == COMMAND_IMPORT) { 107 | m_pXInfoDB->saveDbToFile(m_options.sDatabaseFileName, m_pPdStruct); 108 | } else if (m_transferType == COMMAND_EXPORT) { 109 | m_pXInfoDB->loadDbFromFile(m_options.pDevice, m_options.sDatabaseFileName, m_pPdStruct); 110 | } 111 | } 112 | 113 | XBinary::setPdStructFinished(m_pPdStruct, _nFreeIndex); 114 | } 115 | -------------------------------------------------------------------------------- /xinfomenu.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2022-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in 11 | * all copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "xinfomenu.h" 22 | 23 | XInfoMenu::XInfoMenu(XShortcuts *pShortcuts, XOptions *pXOptions) 24 | { 25 | m_pShortcuts = pShortcuts; 26 | m_pXOptions = pXOptions; 27 | m_pParent = nullptr; 28 | m_pMenu = nullptr; 29 | // m_pActionAnalyze = nullptr; 30 | m_pActionExport = nullptr; 31 | m_pActionImport = nullptr; 32 | m_pXInfoDB = nullptr; 33 | m_pDevice = nullptr; 34 | } 35 | 36 | QMenu *XInfoMenu::createMenu(QWidget *pParent) 37 | { 38 | m_pParent = pParent; 39 | 40 | m_pMenu = new QMenu(tr("Database"), pParent); 41 | 42 | // m_pActionAnalyze = new QAction(tr("Analyze"), pParent); 43 | m_pActionImport = new QAction(tr("Import"), pParent); 44 | m_pActionExport = new QAction(tr("Export"), pParent); 45 | 46 | // m_pMenu->addAction(m_pActionAnalyze); 47 | m_pMenu->addAction(m_pActionExport); 48 | m_pMenu->addAction(m_pActionImport); 49 | 50 | // connect(m_pActionAnalyze, SIGNAL(triggered()), this, SLOT(actionAnalyze())); 51 | connect(m_pActionExport, SIGNAL(triggered()), this, SLOT(actionExport())); 52 | connect(m_pActionImport, SIGNAL(triggered()), this, SLOT(actionImport())); 53 | 54 | updateMenu(); 55 | 56 | return m_pMenu; 57 | } 58 | 59 | void XInfoMenu::setData(XInfoDB *pXInfoDB) 60 | { 61 | m_pXInfoDB = pXInfoDB; 62 | 63 | if (pXInfoDB) { 64 | connect(pXInfoDB, SIGNAL(reloadViewSignal()), this, SLOT(updateMenu())); 65 | pXInfoDB->reloadView(); 66 | } 67 | } 68 | 69 | void XInfoMenu::setData(XInfoDB *pXInfoDB, QIODevice *pDevice, const QString &sDatabaseFileName) 70 | { 71 | setData(pXInfoDB); 72 | m_pDevice = pDevice; 73 | m_sDatabaseFileName = sDatabaseFileName; 74 | } 75 | 76 | void XInfoMenu::tryToSave() 77 | { 78 | if (m_pXInfoDB->isDatabaseChanged()) { 79 | QString _sFileName = getDatabaseFileName(); 80 | QString _sString = QString("%1 \"%2\"?").arg(tr("Save"), _sFileName); 81 | 82 | if (QMessageBox::question(m_pParent, tr("Database"), _sString) == QMessageBox::Yes) { 83 | save(_sFileName); 84 | } 85 | } 86 | } 87 | 88 | void XInfoMenu::tryToLoad() 89 | { 90 | QString _sFileName = getDatabaseFileName(); 91 | 92 | if (XBinary::isFileExists(_sFileName)) { 93 | QString _sString = QString("%1 \"%2\"?").arg(tr("Load"), _sFileName); 94 | 95 | if (QMessageBox::question(m_pParent, tr("Database"), _sString) == QMessageBox::Yes) { 96 | load(_sFileName); 97 | } 98 | } 99 | } 100 | 101 | void XInfoMenu::reset() 102 | { 103 | setData(nullptr); 104 | } 105 | 106 | QString XInfoMenu::getDatabaseFileName() 107 | { 108 | return m_sDatabaseFileName; 109 | } 110 | 111 | void XInfoMenu::updateMenu() 112 | { 113 | if (m_pXInfoDB) { 114 | bool bIsDatabasePresent = m_pXInfoDB->isDbPresent(); 115 | 116 | m_pActionExport->setEnabled(bIsDatabasePresent); 117 | m_pActionImport->setEnabled(true); 118 | } else { 119 | m_pActionExport->setEnabled(false); 120 | m_pActionImport->setEnabled(false); 121 | } 122 | } 123 | 124 | // void XInfoMenu::actionAnalyze() 125 | //{ 126 | // #ifdef QT_MENU 127 | // qDebug("void XInfoMenu::actionAnalyze()"); 128 | // #endif 129 | // } 130 | 131 | void XInfoMenu::actionExport() 132 | { 133 | if (m_pXInfoDB) { 134 | QString _sFileName = getDatabaseFileName(); 135 | _sFileName = QFileDialog::getSaveFileName(m_pParent, tr("Save"), _sFileName, QString("%1 (*.db);;%2 (*)").arg(tr("Database"), tr("All files"))); 136 | 137 | if (!_sFileName.isEmpty()) { 138 | load(_sFileName); 139 | } 140 | } 141 | } 142 | 143 | void XInfoMenu::actionImport() 144 | { 145 | if (m_pXInfoDB) { 146 | QString _sFileName; 147 | //= XBinary::getDeviceDirectory(m_pXInfoDB->getDevice()); 148 | _sFileName = QFileDialog::getOpenFileName(m_pParent, tr("Open file") + QString("..."), _sFileName, tr("Database") + QString(" (*.db)")); 149 | 150 | if (!_sFileName.isEmpty()) { 151 | save(_sFileName); 152 | } 153 | } 154 | } 155 | 156 | void XInfoMenu::save(const QString &sFileName) 157 | { 158 | XInfoDBTransfer::OPTIONS options = {}; 159 | options.sDatabaseFileName = sFileName; 160 | // options.nModuleAddress = -1; 161 | 162 | XInfoDBTransfer infoTransfer; 163 | XDialogProcess dialogTransfer(m_pParent, &infoTransfer); 164 | dialogTransfer.setGlobal(m_pShortcuts, m_pXOptions); 165 | infoTransfer.setData(m_pXInfoDB, XInfoDBTransfer::COMMAND_IMPORT, options, dialogTransfer.getPdStruct()); 166 | dialogTransfer.start(); 167 | dialogTransfer.showDialogDelay(); 168 | m_pXInfoDB->reloadView(); 169 | } 170 | 171 | void XInfoMenu::load(const QString &sFileName) 172 | { 173 | XInfoDBTransfer::OPTIONS options = {}; 174 | options.sDatabaseFileName = sFileName; 175 | options.pDevice = m_pDevice; 176 | // options.nModuleAddress = -1; 177 | 178 | XInfoDBTransfer infoTransfer; 179 | XDialogProcess dialogTransfer(m_pParent, &infoTransfer); 180 | dialogTransfer.setGlobal(m_pShortcuts, m_pXOptions); 181 | infoTransfer.setData(m_pXInfoDB, XInfoDBTransfer::COMMAND_EXPORT, options, dialogTransfer.getPdStruct()); 182 | dialogTransfer.start(); 183 | dialogTransfer.showDialogDelay(); 184 | m_pXInfoDB->reloadView(); 185 | } 186 | -------------------------------------------------------------------------------- /info/PE.sections.txt: -------------------------------------------------------------------------------- 1 | !EPack|packer|!EP(EXE Pack) 2 | !eprot|protector|!EProt 3 | "_!_!_!_|protector|Krypton 4 | .!ep|packer|!EP(EXE Pack) 5 | .00cfg|compiler|Control Flow Guard (CFG) section (added by newer versions of Visual Studio) 6 | .AAWEBS|compiler|Section used by Amiti Antivirus DLLs webspam.dll and webspamwow64.dll 7 | .ASPack|packer|Aspack 8 | .BCPack|protector|Backdoor PE Compress Protector 9 | .BSS|compiler|Uninitialized Data Section 10 | .ByDwing|packer|(Win)Upack 11 | .CLR_UEF|compiler|.CLR Unhandled Exception Handler section 12 | .CRT|compiler|Initialized Data Section (C RunTime) 13 | .CRT|compiler|mingw/cygwin 14 | .DATA|compiler|Data Section 15 | .DalKiT|protector|DalKrypt 16 | .De-vir |packer|NoodleCrypt 17 | .FISHPEP|packer|Fish PE Packer 18 | .FishPE|protector|FishPE Shield 19 | .HOODLUM|pe tool|HOODLUM 20 | .Kaos12|protector|KaOs PE-DLL eXecutable Undetecter 21 | .Kaos2 |protector|KaOs PE-DLL eXecutable Undetecter 22 | .LARP|protector|lARP64 23 | .MPRESS1|packer|MPRESS 24 | .MPRESS2|packer|MPRESS 25 | .MaskPE|packer|MaskPE 26 | .Ncryo |packer|NoodleCrypt 27 | .Np|packer|TTP Pack 28 | .PEDATA|packer|Fish PE Packer 29 | .RLPack|packer|RLPack 30 | .RPCrypt|protector|RPCrypt 31 | .Razor|demo|Razor 32 | .Stone|protector|Stone's PE Encryptor 33 | .TTP|protector|TTprotect 34 | .Themida|protector|Themida 35 | .UPX0|packer|UPX 36 | .UPX1|packer|UPX 37 | .UPX2|packer|UPX 38 | .Upack|packer|(Win)Upack 39 | .WISE|installer|Wise 40 | .WWP32|packer|WWPack32 41 | .WWPACK|packer|WWPACK 42 | .aBc |protector|ABC Cryptor 43 | .adata|packer|Aspack 44 | .adata|protector|ASProtect 45 | .adata|protector|Armadillo 46 | .alex|protector|Alex Protector 47 | .alien|protector|Alienyze 48 | .alloy32|protector|Alloy 49 | .apiset|compiler|a section present inside the apisetschema.dll 50 | .arch|compiler|Alpha-architecture section 51 | .aspack|packer|Aspack 52 | .autoload_text|compiler|cygwin/gcc; the Cygwin DLL uses a section to avoid copying certain data on fork. 53 | .avc|protector|AverCryptor 54 | .bedrock|packer|bambam 55 | .bindat|compiler|Binary data (also used by one of the downware installers based on LUA) 56 | .boom|builder|The Boomerang List Builder (config+exe xored with a single byte key 0x77) 57 | .bootdat|compiler|Section that can be found inside Visual Studio files; contains palette entries 58 | .boot|protector|Themida/Winlicense 59 | .bss|compiler|Uninitialized Data Section 60 | .buildid|compiler|gcc/cygwin; Contains debug information (if overlaps with debug directory) 61 | .ccg|protector|PE-Armor 62 | .ccg|packer|CCG Packer (Chinese Packer) 63 | .ccp3p|protector|CrypToCrack Pe Protector 64 | .charmve|tool|Added by the PIN tool 65 | .cms_t|protector|SecuROM code entry 66 | .cms_d|protector|SecuROM data entry 67 | .code|compiler|Code Section 68 | .complua|compiler|Most likely compiled LUA (also used by one of the downware installers based on LUA) 69 | .cormeta|compiler|.CLR Metadata Section 70 | .crtemui|demo| 71 | .cygheap|compiler|mingw/cygwin DEBUG 72 | .cygwin_dll_common|compiler|cygwin section containing flags representing Cygwin’s capabilities; refer to cygwin.sc and wincap.cc inside Cygwin run-time 73 | .data1|compiler|Data Section 74 | .data2|compiler|Data Section 75 | .data3|compiler|Data Section 76 | .data_cygwin_nocopy|compiler|cygwin 77 | .data|compiler|Data Section 78 | .debug$F|compiler|Debug info Section (Visual C++ version < 7.0) 79 | .debug$F|compiler|mingw/cygwin 80 | .debug$P|compiler|Debug info Section (Visual C++ debug information/compiler/precompiled information) 81 | .debug$S|compiler|Debug info Section (Visual C++ debug information/compiler/precompiled information) 82 | .debug$S|compiler|mingw/cygwin 83 | .debug$T|compiler|Debug info Section (Visual C++ debug information/compiler/precompiled information) 84 | .debug$T|compiler|mingw/cygwin 85 | .debug_abbrev|compiler|mingw/cygwin DEBUG 86 | .debug_aranges|compiler|mingw/cygwin DEBUG 87 | .debug_frame|compiler|mingw/cygwin DEBUG 88 | .debug_info|compiler|mingw/cygwin DEBUG 89 | .debug_line|compiler|mingw/cygwin DEBUG 90 | .debug_loc|compiler|mingw/cygwin DEBUG 91 | .debug_macinfo|compiler|mingw/cygwin DEBUG 92 | .debug_pubnames|compiler|mingw/cygwin DEBUG 93 | .debug_ranges|compiler|mingw/cygwin DEBUG 94 | .debug_str|compiler|mingw/cygwin DEBUG 95 | .debug|compiler|Debug info Section 96 | .decode|packer|MEW10 97 | ._deh|compiler|DMD Dlang structured exception handling 98 | .delete|demo| 99 | .depack|packer|dePack 100 | .didata|compiler|Delay Import Section 101 | .didat|compiler|Delay Import Section 102 | .dotfix|protector|DotFix Nice Protect 103 | .dp|compiler|DMD 104 | .drectve|compiler|Directive section (temporary|demo|linker removes it after processing it 105 | .drectve|compiler|mingw/cygwin 106 | .dswlab|pe tool|VMUnpacker 107 | .dyamarC|protector|DYAMAR 108 | .dyamarD|protector|DYAMAR 109 | .ecode|compiler|Built with EPL 110 | .edata|compiler|Built with EPL 111 | .edata|compiler|Export Data Section 112 | .edata|compiler|mingw/cygwin 113 | .eh_frame|compiler|mingw/cygwin 114 | .eh_fram|compiler|gcc/cygwin; Exception Handler Frame section 115 | .endjunk|compiler|mingw/cygwin 116 | .enigma1|protector|Enigma Virtual Box 117 | .enigma2|protector|Enigma Virtual Box 118 | .ex_cod|protector|eXPressor 119 | .ex_rsc|protector|eXPressor 120 | .exc|demo| 121 | .export|compiler|Alternative Export Data Section 122 | .fasm|compiler|FASM flat Section 123 | .ficken|protector|PECRYPT32 124 | .fini|compiler|mingw/cygwin 125 | .flat|compiler|FASM flat Section 126 | .g4kcod2|demo| 127 | .g4kcod3|demo| 128 | .g4kcod4|demo| 129 | .g4kcoda|demo| 130 | .g4kcodb|demo| 131 | .g4kcodc|demo| 132 | .g4kcodd|demo| 133 | .g4kcodf|demo| 134 | .g4kcodg|demo| 135 | .g4kcodh|demo| 136 | .g4kcodi|demo| 137 | .g4kcodj|demo| 138 | .g4kcodk|demo| 139 | .g4kcodl|demo| 140 | .g4kcodp|demo| 141 | .g4kcods|demo| 142 | .g4kcodw|demo| 143 | .g4kcodx|demo| 144 | .g4kcody|demo| 145 | .g4kcodz|demo| 146 | .g4kdat1|demo| 147 | .g4kdat2|demo| 148 | .g4kmuc1|demo| 149 | .g4kmuc2|demo| 150 | .g4kmuc3|demo| 151 | .g4kmuc4|demo| 152 | .g4kmuc5|demo| 153 | .gcc_except_table|compiler|mingw/cygwin 154 | .gcc_exc|compiler|mingw/cygwin 155 | .gentee|installer|Gentee Installer 156 | .gfids|compiler|section added by new Visual Studio (14.0) 157 | .giats|compiler|section added by new Visual Studio (14.0) 158 | .gljmp|compiler|section added by new Visual Studio (14.0) 159 | .glue_7t|compiler|ARMv7 core glue functions (thumb mode) 160 | .glue_7t|compiler|mingw/cygwin 161 | .glue_7|compiler|ARMv7 core glue functions (32-bit ARM mode) 162 | .glue_7|compiler|mingw/cygwin 163 | .guruX|protector|G!X Protector 164 | .icon|demo|possibly an icon resource 165 | .idata |protector|Xtreme-Protector 166 | .idata$2|compiler|mingw/cygwin 167 | .idata$3|compiler|mingw/cygwin 168 | .idata$4|compiler|mingw/cygwin 169 | .idata$5|compiler|mingw/cygwin 170 | .idata$6|compiler|mingw/cygwin 171 | .idata$7|compiler|mingw/cygwin 172 | .idata|compiler|Initialized Data Section (Borland) 173 | .idata|compiler|mingw/cygwin 174 | .idlsym|compiler|IDL Attributes (registered SEH) 175 | .impdata|compiler|Alternative Import data section 176 | .imports|protector|Themida/Winlicense 177 | .import|compiler|Alternative Import data section 178 | .imrsiv|tool|special section used for applications that can be loaded to OS desktop bands. 179 | .inq|protector|Inquartos Obfuscator 180 | .intro|demo| 181 | .itext|compiler|Code Section (Borland) 182 | .jdpack|packer|JDPack 183 | .jedata|compiler|Excelsior JET 184 | .jidata|compiler|Excelsior JET 185 | .loadcon|protector|Themida/Winlicense 186 | .load|demo| 187 | .mackt|tool|ImpRec-created section 188 | .minfo|compiler|DMD/ldc module info section 189 | .mnbvcx1|loader|Most likely associated with Firseria PUP downloaders 190 | .mnbvcx2|loader|Most likely associated with Firseria PUP downloaders 191 | .mslrh|protector|MSLRH 192 | .mydata|demo| 193 | .n-coder|protector|N-Code 194 | .nPack|packer|nPack 195 | .nah|protector|Morphnah 196 | .naked1|packer|NakedPacker 197 | .naked2|packer|NakedPacker 198 | .ndata|installer|Nullsoft Installer section 199 | .neolite|packer|NeoLite 200 | .neolit|packer|NeoLite 201 | .nos|packer|NOS Installer 202 | .nsp0|packer|NsPack 203 | .nsp1|packer|NsPack 204 | .nsp2|packer|NsPack 205 | .obfh|obfuscator|Macro-only library for compile-time obfuscating 206 | .orpc|compiler|Code section inside rpcrt4.dll 207 | .packed|packer|RLPack 208 | .packed|packer|Unknown Packer 209 | .pdata|compiler|Exception Handling Functions Section (PDATA records) 210 | .perplex|protector|ACProtect 211 | .perplex|protector|Perplex 212 | .petite|packer|Petite 213 | .pe|demo|possibly PE file 214 | .pinclie|tool|Added by the PIN tool 215 | .pklstb|demo| 216 | .profile|tool|NightHawk C2 framework (by MDSec) 217 | .ps4|protector|StarForce Version 4.X+ 218 | .qtmetad|library|Qt 219 | .rdata|compiler|Read-only initialized Data Section (MS and Borland) 220 | .reacto|protector|.NET Reactor 221 | .relo2|demo| 222 | .reloc|compiler|Relocations Section 223 | .rlp|packer|RLP 224 | .rmnet|virus|Ramnit virus marker 225 | .rodata|compiler|Read-only Data Section 226 | .rsrc A|demo|Possibly variant of resource section 227 | .rsrc|compiler|Resource section 228 | .sCe!05|demo|Scienide group 229 | .sbss|compiler|GP-relative Uninitialized Data Section 230 | .scpack|packer|SC Pack 231 | .script|compiler|Section containing script 232 | .sdata|compiler|GP-relative Initialized Data Section 233 | .sdata|protector|.NET Reactor 234 | .seau|sfx|SeauSFX 235 | .sedata|protector|Safengine Shielden 236 | .sforce3|protector|StarForce version 3.X 237 | .shared|compiler|Shared section 238 | .shoooo|packer|KByS 239 | .shrink0|protector|Shrinker 240 | .shrink1|protector|Shrinker 241 | .shrink2|protector|Shrinker 242 | .shrink3|protector|Shrinker 243 | .spack|packer|Simple Pack (by bagie) 244 | .srdata|compiler|GP-relative Read-only Data Section 245 | .sstb|protector|ElecKey 246 | .stabstr|compiler|Created by Haskell compiler (GHC) 247 | .stabstr|compiler|mingw/cygwin 248 | .stab|compiler|Created by Haskell compiler (GHC) 249 | .stab|compiler|mingw/cygwin 250 | .svkp |protector|SVK Protector 251 | .sxdata|compiler|Registered Exception Handlers Section 252 | .symtab|compiler|Go 253 | .taz|protector|Some version of PESpin 254 | .teraphy|protector|PE Diminisher 255 | .text0|compiler|Alternative Code Section 256 | .text1|compiler|Alternative Code Section 257 | .text2|compiler|Alternative Code Section 258 | .text3|compiler|Alternative Code Section 259 | .textbss|compiler|Section used by incremental linking 260 | .text|compiler|Code Section 261 | .themida|protector|Themida/Winlicense 262 | .tls$|compiler|Thread Local Storage Section 263 | .tls|compiler|Thread Local Storage Section 264 | .tp|compiler|DMD 265 | .trace|demo| 266 | .tsuarch|loader|TSULoader 267 | .tsustub|loader|TSULoader 268 | .udata|compiler|Uninitialized Data Section 269 | .ultra|protector|MoleBox Ultra 270 | .vlizer|protector|Oreans CodeVirtualizer 271 | .vmp0|protector|VMProtect 272 | .vmp1|protector|VMProtect 273 | .vmp2|protector|VMProtect 274 | .vmp3|protector|VMProtect 275 | .vsdata|compiler|GP-relative Initialized Data 276 | .wavefmt|demo| 277 | .wavehdr|demo| 278 | .winapi|tool|Added by API Override tool 279 | .winlice|protector|Themida/Winlicense 280 | .wixburn|installer|WiX Toolset 281 | .wkt0|protector|WinKript 282 | .wpp_sf |compiler|section that is most likely related to WPP (Windows software trace PreProcessor) 283 | .xcpad|protector|Xenocode 284 | .xdata|compiler|Exception Information Section 285 | .xlok|protector|Xtreamlok 286 | .xm|demo|possibly an XM module 287 | .xvlk|pe tool|XVolkolak 288 | .y0da|protector|Y0da's Protector 289 | .yP|protector|Yoda's Protector 290 | .yzpack|packer|YZPack 291 | ANAKIN2K|protector|PE-SHiELD 292 | ANDpakk2|packer|ANDpakk2 293 | ASMGUARD|protector|ASM Guard 294 | ASPack|packer|Aspack 295 | AUTO|demo| 296 | AZPR0001|protector|AZProtect 297 | Address|demo| 298 | BSS|compiler|Uninitialized Data Section (Borland) 299 | BitArts|protector|Crunch 2.0 300 | CLS|demo| 301 | CODE |protector|Xtreme-Protector 302 | CODE32|demo| 303 | CODE|compiler|Code Section (Borland) 304 | COMMON|compiler|mingw/cygwin 305 | CONFIG~|protector|NativeCryptor by DosX 306 | CONST32|demo| 307 | CPADinfo|library|Chromium Crashpad 308 | CPHb|demo|Coolphat group 309 | CR01|demo|Cro group 310 | CRO0|demo|Cro group 311 | CRYPT~|protector|NativeCryptor by DosX 312 | DAStub|protector|DragonArmor 313 | DATA|compiler|Data Section (Borland) 314 | DGROUP|compiler|Legacy data group section 315 | EPE0|protector|EncryptPE 316 | EPE1|protector|EncryptPE 317 | ExeS|protector|ExeStealth 318 | FCKCrypt|protector|Crypter 319 | Guy !|demo| 320 | INIT|compiler|INIT section (drivers) 321 | MEW|packer|MEW11 SE 322 | MYTH|demo| 323 | NATIVES~|protector|NativeCryptor by DosX 324 | Not War!|demo| 325 | PAGE|compiler|PAGE section (drivers) 326 | PEBundle|protector|PEBundle 327 | PEC2MO|packer|PECompact 328 | PEC2TO|packer|PECompact 329 | PEC2|packer|PECompact 330 | PELOCKnt|packer|PELOCKnt 331 | PEPACK!!|packer|Pepack 332 | PESHiELD|protector|PE-SHiELD 333 | PS|demo| 334 | PUNiSHER|packer|PUNiSHER 335 | Pingvin|protector|PEnguinCrypt 336 | ProCrypt|protector|ProCrypt 337 | RCryptor|protector|RCryptor(Russian Cryptor) 338 | SCRYPT|protector|Crypter 339 | SDPC|protector|Soft Defender 340 | SDPD|protector|Soft Defender 341 | SDPI|protector|Soft Defender 342 | STACK|demo| 343 | SVKP|protector|SVK Protector 344 | Scooopex|demo|Scoopex group 345 | Scoopex|demo|Scoopex group 346 | Shared|compiler|Shared section 347 | Signatur|demo| 348 | SoftComp|protector|Software Compresss 349 | Themida|protector|Themida 350 | UPX!|protector|tElock 351 | UPX0|packer|UPX 352 | UPX1|packer|UPX 353 | UPX2|packer|UPX 354 | UPX3|packer|UPX 355 | VProtect|protector|VirtualizeProtect 356 | WinLicen|protector|Themida/Winlicense 357 | XPROT |protector|Xtreme-Protector 358 | Xiao|protector|12311134 359 | YADO|protector|Krypton 360 | _RDATA|demo| 361 | _winzip_|sfx|WinZip Self-Extractor 362 | bero^fr |packer|BeRoEXEPacker 363 | edata|compiler|Export Data Section 364 | fuzzion|demo|Fuzzion group 365 | fzn03|demo|Fuzzion group 366 | g4kcodt|demo| 367 | hmimys|protector|Hmimys's Protector 368 | idata|compiler|Initialized Data Section (C RunTime) 369 | imports|demo| 370 | kkrunchy|packer|kkrunchy 371 | krypton|protector|Krypton 372 | lamecryp|protector|LameCrypt 373 | lz32.dll|packer|Crinkler 374 | minATL|compiler|Section that can be found inside some ARM PE files 375 | nsp0|packer|NsPack 376 | nsp1|packer|NsPack 377 | nsp2|packer|NsPack 378 | okpack|protector|pepack's Protect 379 | packer.|demo|Farbrausch group 380 | packerBY|packer|BeRoEXEPacker 381 | pcs1|protector|PCShrink 382 | pcs2|protector|PCShrink 383 | pcs3|protector|PCShrink 384 | pcs4|protector|PCShrink 385 | pcs5|protector|PCShrink 386 | pcs6|protector|PCShrink 387 | pcs7|protector|PCShrink 388 | pebundle|protector|PEBundle 389 | pebundle|protector|PEBundle 390 | pec1|packer|PECompact 391 | pec2|packer|PECompact 392 | pec3|packer|PECompact 393 | pec4|packer|PECompact 394 | pec5|packer|PECompact 395 | pec6|packer|PECompact 396 | pec|packer|PECompact 397 | petite|packer|Petite 398 | rdata|compiler|Read-only Data Section 399 | relocs|demo| 400 | resource|demo| 401 | resultat|demo| 402 | rsrr|protector|ExeStealth 403 | sdata|compiler|Initialized Data Section 404 | shared|compiler|Shared section 405 | testdata|compiler|section containing test data (can be found inside Visual Studio files) 406 | text|compiler|Alternative Code Section 407 | vcasm|protector|VCasm-Protector 408 | yC|protector|Yoda's Crypter 409 | yC|protector|Yoda's Protector 410 | -------------------------------------------------------------------------------- /xinfodb.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2022-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in 11 | * all copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef XINFODB_H 22 | #define XINFODB_H 23 | 24 | #include 25 | #ifdef QT_GUI_LIB 26 | #include 27 | #endif 28 | #include "xdisasmcore.h" 29 | #include "xformats.h" 30 | #include "xscanengine.h" 31 | #ifdef USE_XPROCESS 32 | #include "xprocess.h" 33 | #endif 34 | 35 | #ifdef QT_SQL_LIB 36 | #include 37 | #include 38 | #include 39 | #endif 40 | 41 | class XInfoDB : public QObject { 42 | Q_OBJECT 43 | 44 | public: 45 | enum SYMBOL_MODE { 46 | SYMBOL_MODE_UNKNOWN = 0, 47 | SYMBOL_MODE_ALL, 48 | }; 49 | 50 | enum XSYMBOL_FLAG { 51 | XSYMBOL_FLAG_UNKNOWN = 0, 52 | XSYMBOL_FLAG_FUNCTION = 1 << 0, 53 | XSYMBOL_FLAG_ENTRYPOINT = 1 << 1, 54 | XSYMBOL_FLAG_EXPORT = 1 << 2, 55 | XSYMBOL_FLAG_IMPORT = 1 << 3, 56 | XSYMBOL_FLAG_ADDRESS = 1 << 4, 57 | XSYMBOL_FLAG_DATA = 1 << 5, 58 | }; 59 | 60 | enum XRECORD_FLAG { 61 | XRECORD_FLAG_UNKNOWN = 0, 62 | XRECORD_FLAG_CODE = 1 << 0, 63 | XRECORD_FLAG_DATA = 1 << 1, 64 | XRECORD_FLAG_OPCODE = 1 << 2, 65 | XRECORD_FLAG_ARRAY = 1 << 3, 66 | XRECORD_FLAG_ADDRREF = 1 << 4, 67 | }; 68 | 69 | enum XREF_FLAG { 70 | XREF_FLAG_UNKNOWN = 0, 71 | XREF_FLAG_REL = 1 << 1, 72 | XREF_FLAG_MEMORY = 1 << 2, 73 | XREF_FLAG_CALL = 1 << 3, 74 | XREF_FLAG_JMP = 1 << 4, 75 | XREF_FLAG_JMP_COND = 1 << 4, 76 | XREF_FLAG_RET = 1 << 5, 77 | }; 78 | 79 | struct XRECORD { 80 | quint16 nRegionIndex; 81 | quint16 nFlags; 82 | quint16 nSize; 83 | quint16 nBranch; 84 | quint64 nRelOffset; 85 | }; 86 | 87 | struct XREFINFO { 88 | quint16 nRegionIndex; 89 | quint16 nRegionIndexRef; 90 | quint32 nSize; 91 | quint64 nRelOffset; 92 | quint64 nRelOffsetRef; 93 | quint16 nFlags; 94 | quint16 nBranch; 95 | }; 96 | 97 | struct XSYMBOL { 98 | quint16 nStringIndex; 99 | quint16 nBranch; 100 | quint16 nRegionIndex; 101 | quint16 nFlags; 102 | quint32 nSize; 103 | quint64 nRelOffset; 104 | }; 105 | 106 | struct STATE { 107 | QIODevice *pDevice; 108 | XADDR nModuleAddress; 109 | bool bIsImage; 110 | XBinary::_MEMORY_MAP memoryMap; 111 | XDisasmCore disasmCore; 112 | QVector listRecords; 113 | QVector listRefs; 114 | QVector listSymbols; 115 | QVector listStrings; 116 | QSet stCodeTemp; 117 | quint16 nCurrentBranch; 118 | bool bIsAnalyzed; 119 | }; 120 | 121 | struct BOOKMARKRECORD { 122 | QString sUUID; 123 | quint64 nLocation; 124 | XBinary::LT locationType; 125 | qint64 nSize; 126 | QString sColorText; 127 | QString sColorBackground; 128 | QString sTemplate; 129 | QString sComment; 130 | bool bIsUser; 131 | }; 132 | 133 | struct USER_NOTES { 134 | quint32 nDummy; 135 | }; 136 | 137 | #ifdef USE_XPROCESS 138 | struct XREG_OPTIONS { 139 | bool bGeneral; 140 | bool bIP; 141 | #ifdef Q_PROCESSOR_X86 142 | bool bFlags; 143 | bool bSegments; 144 | bool bDebug; 145 | bool bFloat; 146 | bool bXMM; 147 | bool bYMM; 148 | #endif 149 | }; 150 | 151 | struct XHARDWAREBPREG { 152 | XADDR nAddress; 153 | bool bLocal; 154 | bool bGlobal; 155 | qint32 nSize; 156 | bool bRead; 157 | bool bWrite; 158 | bool bExec; 159 | }; 160 | 161 | struct XHARDWAREBP { 162 | XHARDWAREBPREG regs[4]; 163 | bool bSuccess[4]; 164 | bool bSingleStep; 165 | // TODO Check more 166 | }; 167 | 168 | #ifdef Q_PROCESSOR_X86 169 | enum RFLAGS_BIT { 170 | RFLAGS_BIT_CF = 0, 171 | RFLAGS_BIT_PF = 2, 172 | RFLAGS_BIT_AF = 4, 173 | RFLAGS_BIT_ZF = 6, 174 | RFLAGS_BIT_SF = 7, 175 | RFLAGS_BIT_TF = 8, 176 | RFLAGS_BIT_IF = 9, 177 | RFLAGS_BIT_DF = 10, 178 | RFLAGS_BIT_OF = 11 179 | }; 180 | #endif 181 | 182 | enum XREG { 183 | XREG_UNKNOWN = 0, 184 | XREG_NONE, 185 | #ifdef Q_PROCESSOR_X86 186 | XREG_AX, 187 | XREG_CX, 188 | XREG_DX, 189 | XREG_BX, 190 | XREG_SP, 191 | XREG_BP, 192 | XREG_SI, 193 | XREG_DI, 194 | XREG_IP, 195 | XREG_FLAGS, 196 | XREG_EAX, 197 | XREG_ECX, 198 | XREG_EDX, 199 | XREG_EBX, 200 | XREG_ESP, 201 | XREG_EBP, 202 | XREG_ESI, 203 | XREG_EDI, 204 | XREG_EIP, 205 | XREG_EFLAGS, 206 | #ifdef Q_PROCESSOR_X86_64 207 | XREG_RAX, 208 | XREG_RCX, 209 | XREG_RDX, 210 | XREG_RBX, 211 | XREG_RSP, 212 | XREG_RBP, 213 | XREG_RSI, 214 | XREG_RDI, 215 | XREG_R8, 216 | XREG_R9, 217 | XREG_R10, 218 | XREG_R11, 219 | XREG_R12, 220 | XREG_R13, 221 | XREG_R14, 222 | XREG_R15, 223 | XREG_RIP, 224 | XREG_RFLAGS, 225 | #endif 226 | XREG_CS, 227 | XREG_DS, 228 | XREG_ES, 229 | XREG_FS, 230 | XREG_GS, 231 | XREG_SS, 232 | XREG_DR0, 233 | XREG_DR1, 234 | XREG_DR2, 235 | XREG_DR3, 236 | XREG_DR6, 237 | XREG_DR7, 238 | XREG_FLAGS_CF, 239 | XREG_FLAGS_PF, 240 | XREG_FLAGS_AF, 241 | XREG_FLAGS_ZF, 242 | XREG_FLAGS_SF, 243 | XREG_FLAGS_TF, 244 | XREG_FLAGS_IF, 245 | XREG_FLAGS_DF, 246 | XREG_FLAGS_OF, 247 | XREG_ST0, 248 | XREG_ST1, 249 | XREG_ST2, 250 | XREG_ST3, 251 | XREG_ST4, 252 | XREG_ST5, 253 | XREG_ST6, 254 | XREG_ST7, 255 | XREG_FPCR, // https://help.totalview.io/previous_releases/2019/html/index.html#page/Reference_Guide%2FIntelx86FloatingPointRegisters_2.html%23 256 | XREG_FPSR, 257 | XREG_FPTAG, 258 | // XREG_FPIOFF, 259 | // XREG_FPISEL, 260 | // XREG_FPDOFF, 261 | // XREG_FPDSEL, 262 | XREG_MXCSR, 263 | XREG_MXCSR_MASK, 264 | XREG_XMM0, 265 | XREG_XMM1, 266 | XREG_XMM2, 267 | XREG_XMM3, 268 | XREG_XMM4, 269 | XREG_XMM5, 270 | XREG_XMM6, 271 | XREG_XMM7, 272 | XREG_XMM8, 273 | XREG_XMM9, 274 | XREG_XMM10, 275 | XREG_XMM11, 276 | XREG_XMM12, 277 | XREG_XMM13, 278 | XREG_XMM14, 279 | XREG_XMM15, 280 | XREG_YMM0, 281 | XREG_YMM1, 282 | XREG_YMM2, 283 | XREG_YMM3, 284 | XREG_YMM4, 285 | XREG_YMM5, 286 | XREG_YMM6, 287 | XREG_YMM7, 288 | XREG_YMM8, 289 | XREG_YMM9, 290 | XREG_YMM10, 291 | XREG_YMM11, 292 | XREG_YMM12, 293 | XREG_YMM13, 294 | XREG_YMM14, 295 | XREG_YMM15, 296 | XREG_AH, 297 | XREG_CH, 298 | XREG_DH, 299 | XREG_BH, 300 | XREG_AL, 301 | XREG_CL, 302 | XREG_DL, 303 | XREG_BL, 304 | #ifdef Q_PROCESSOR_X86_64 305 | XREG_SPL, 306 | XREG_BPL, 307 | XREG_SIL, 308 | XREG_DIL, 309 | XREG_R8D, 310 | XREG_R9D, 311 | XREG_R10D, 312 | XREG_R11D, 313 | XREG_R12D, 314 | XREG_R13D, 315 | XREG_R14D, 316 | XREG_R15D, 317 | XREG_R8W, 318 | XREG_R9W, 319 | XREG_R10W, 320 | XREG_R11W, 321 | XREG_R12W, 322 | XREG_R13W, 323 | XREG_R14W, 324 | XREG_R15W, 325 | XREG_R8B, 326 | XREG_R9B, 327 | XREG_R10B, 328 | XREG_R11B, 329 | XREG_R12B, 330 | XREG_R13B, 331 | XREG_R14B, 332 | XREG_R15B, 333 | #endif 334 | #endif 335 | }; 336 | 337 | struct REG_RECORD { 338 | XREG reg; 339 | XBinary::XVARIANT value; 340 | }; 341 | 342 | enum BPT { 343 | BPT_UNKNOWN = 0, 344 | BPT_PROCESS_STOP, 345 | BPT_CODE_SYSTEM_EXCEPTION, 346 | BPT_CODE_STEP_FLAG, 347 | BPT_CODE_STEP_TO_RESTORE, 348 | BPT_CODE_SOFTWARE_DEFAULT, 349 | BPT_CODE_SOFTWARE_INT1, 350 | BPT_CODE_SOFTWARE_INT3, // for X86 0xCC Check for ARM Check invalid opcodes 351 | BPT_CODE_SOFTWARE_HLT, 352 | BPT_CODE_SOFTWARE_CLI, 353 | BPT_CODE_SOFTWARE_STI, 354 | BPT_CODE_SOFTWARE_INSB, 355 | BPT_CODE_SOFTWARE_INSD, 356 | BPT_CODE_SOFTWARE_OUTSB, 357 | BPT_CODE_SOFTWARE_OUTSD, 358 | BPT_CODE_SOFTWARE_INT1LONG, 359 | BPT_CODE_SOFTWARE_INT3LONG, 360 | BPT_CODE_SOFTWARE_UD0, 361 | BPT_CODE_SOFTWARE_UD2, 362 | BPT_CODE_HARDWARE_FREE, // Check free Debug register 363 | BPT_CODE_HARDWARE_DR0, 364 | BPT_CODE_HARDWARE_DR1, 365 | BPT_CODE_HARDWARE_DR2, 366 | BPT_CODE_HARDWARE_DR3, 367 | BPT_CODE_MEMORY 368 | }; 369 | 370 | enum BPM { 371 | BPM_EXECUTE = 0, 372 | BPM_MEMORY 373 | }; 374 | 375 | enum BPI { 376 | BPI_UNKNOWN = 0, 377 | BPI_SYSTEM, 378 | BPI_USER, 379 | BPI_TOGGLE, 380 | BPI_PROCESSENTRYPOINT, 381 | BPI_PROGRAMENTRYPOINT, 382 | BPI_TLSFUNCTION, // TODO 383 | BPI_FUNCTIONENTER, 384 | BPI_FUNCTIONLEAVE, 385 | BPI_STEPINTO, 386 | BPI_STEPOVER, 387 | BPI_TRACEINTO, 388 | BPI_TRACEOVER, 389 | BPI_STEPINTO_RESTOREBP 390 | }; 391 | 392 | struct BREAKPOINT { 393 | bool bIsEnable; // TODO 394 | XADDR nAddress; 395 | qint64 nSize; 396 | X_ID nThreadID; 397 | bool bOneShot; 398 | BPT bpType; 399 | BPM bpMode; 400 | BPI bpInfo; 401 | QVariant vInfo; // TODO rename 402 | qint32 nDataSize; 403 | char origData[4]; // TODO consts check 404 | char bpData[4]; 405 | QString sUUID; 406 | }; 407 | 408 | enum THREAD_STATUS { 409 | THREAD_STATUS_UNKNOWN = 0, 410 | THREAD_STATUS_CURRENT, 411 | THREAD_STATUS_PAUSED, 412 | THREAD_STATUS_RUNNING // TODO 413 | }; 414 | 415 | struct THREAD_INFO { 416 | X_ID nThreadID; 417 | qint64 nThreadLocalBase; 418 | XADDR nStartAddress; 419 | #ifdef Q_OS_WIN 420 | X_HANDLE hThread; 421 | #endif 422 | THREAD_STATUS threadStatus; 423 | }; 424 | 425 | struct EXITTHREAD_INFO { 426 | qint64 nThreadID; 427 | qint64 nExitCode; 428 | }; 429 | 430 | struct PROCESS_INFO { 431 | qint64 nProcessID; 432 | qint64 nMainThreadID; // TODO Check mb Remove 433 | QString sFileName; 434 | QString sBaseFileName; 435 | XADDR nImageBase; 436 | quint64 nImageSize; 437 | XADDR nStartAddress; 438 | XADDR nThreadLocalBase; 439 | #ifdef Q_OS_LINUX 440 | qint32 hProcessMemoryIO; 441 | void *hProcessMemoryQuery; 442 | #endif 443 | #ifdef Q_OS_WIN 444 | X_HANDLE hMainThread; 445 | X_HANDLE hProcess; 446 | #endif 447 | #ifdef Q_OS_MACOS 448 | X_HANDLE hProcess; 449 | #endif 450 | }; 451 | 452 | struct EXITPROCESS_INFO { 453 | qint64 nProcessID; 454 | qint64 nThreadID; 455 | qint64 nExitCode; 456 | QString sFileName; 457 | }; 458 | 459 | struct SHAREDOBJECT_INFO // DLL on Windows 460 | { 461 | QString sName; 462 | QString sFileName; 463 | XADDR nImageBase; 464 | quint64 nImageSize; 465 | }; 466 | 467 | struct DEBUGSTRING_INFO { 468 | qint64 nThreadID; 469 | QString sDebugString; 470 | }; 471 | 472 | struct BREAKPOINT_INFO { 473 | XADDR nAddress; 474 | XADDR nExceptionAddress; 475 | XInfoDB::BPT bpType; 476 | XInfoDB::BPI bpInfo; 477 | QVariant vInfo; 478 | X_ID nProcessID; 479 | #ifdef Q_OS_WIN 480 | X_HANDLE hProcess; 481 | #endif 482 | #ifdef Q_OS_LINUX 483 | X_HANDLE_IO pHProcessMemoryIO; // TODO rename 484 | X_HANDLE_MQ pHProcessMemoryQuery; // TODO rename 485 | #endif 486 | #ifdef Q_OS_MACOS 487 | X_HANDLE hProcess; 488 | #endif 489 | X_ID nThreadID; 490 | #ifdef Q_OS_WIN 491 | X_HANDLE hThread; 492 | #endif 493 | }; 494 | 495 | struct PROCESSENTRY_INFO { 496 | XADDR nAddress; 497 | }; 498 | 499 | struct FUNCTIONHOOK_INFO { 500 | QString sName; 501 | XADDR nAddress; 502 | }; 503 | 504 | struct FUNCTION_INFO { 505 | QString sName; 506 | XADDR nAddress; 507 | XADDR nRetAddress; 508 | quint64 nParameters[10]; // TODO const mb TODO number of parametrs 509 | }; 510 | #endif 511 | 512 | #ifdef QT_SQL_LIB 513 | enum DBTABLE { 514 | DBTABLE_BOOKMARKS = 0, 515 | DBTABLE_SYMBOLS, 516 | DBTABLE_REFINFO, 517 | DBTABLE_RECORDS, 518 | __DBTABLE_SIZE 519 | }; 520 | #endif 521 | 522 | struct IAT_RECORD { 523 | XADDR nAddress; 524 | XADDR nValue; 525 | QString sFunction; // Library#Function / Library#Ordinal 526 | }; 527 | 528 | explicit XInfoDB(QObject *pParent = nullptr); 529 | ~XInfoDB(); 530 | void initDB(); 531 | void reloadView(); 532 | void setEdited(qint64 nDeviceOffset, qint64 nDeviceSize); 533 | void _createTableNames(); 534 | #ifdef USE_XPROCESS 535 | quint32 read_uint32(XADDR nAddress, bool bIsBigEndian = false); 536 | quint64 read_uint64(XADDR nAddress, bool bIsBigEndian = false); 537 | qint64 read_array(XADDR nAddress, char *pData, quint64 nSize); 538 | qint64 write_array(XADDR nAddress, char *pData, quint64 nSize); 539 | QByteArray read_array(XADDR nAddress, quint64 nSize); 540 | QString read_ansiString(XADDR nAddress, quint64 nMaxSize = 256); 541 | QString read_unicodeString(XADDR nAddress, quint64 nMaxSize = 256); // TODO endian ?? 542 | QString read_utf8String(XADDR nAddress, quint64 nMaxSize = 256); 543 | // XDisasmAbstract::DISASM_RESULT disasm(XADDR nAddress); 544 | qint64 read_userData(X_ID nThreadId, qint64 nOffset, char *pData, qint64 nSize); 545 | qint64 write_userData(X_ID nThreadId, qint64 nOffset, char *pData, qint64 nSize); 546 | #endif 547 | 548 | enum STRDB { 549 | STRDB_UNKNOWN = 0, 550 | STRDB_LIBRARIES, 551 | STRDB_FUNCTIONS, 552 | STRDB_PESECTIONS, 553 | STRDB_ELFSECTIONS 554 | }; 555 | 556 | static QList getStringsFromFile(const QString &sFileName, XBinary::PDSTRUCT *pPdStruct = nullptr); 557 | 558 | struct STRRECORD { 559 | QString sString; 560 | QString sTags; 561 | QString sType; 562 | QString sDescription; 563 | }; 564 | 565 | static STRRECORD handleStringDB(QList *pListStrings, STRDB strDB, const QString &sString, bool bIsMulti, XBinary::PDSTRUCT *pPdStruct = nullptr); 566 | static QList loadStrDB(const QString &sPath, STRDB strDB, XBinary::PDSTRUCT *pPdStruct = nullptr); 567 | #ifdef USE_XPROCESS 568 | void setDefaultBreakpointType(BPT bpType); 569 | void setProcessInfo(PROCESS_INFO processInfo); 570 | PROCESS_INFO *getProcessInfo(); 571 | void setCurrentThreadId(X_ID nThreadId); 572 | void setCurrentThreadHandle(X_HANDLE hThread); 573 | X_ID getCurrentThreadId(); 574 | X_HANDLE getCurrentThreadHandle(); 575 | void updateRegsById(X_ID nThreadId, const XREG_OPTIONS ®Options); 576 | void updateRegsByHandle(X_HANDLE hThread, const XREG_OPTIONS ®Options); 577 | void updateMemoryRegionsList(); 578 | void updateModulesList(); 579 | void updateThreadsList(); 580 | QList *getCurrentMemoryRegionsList(); 581 | QList *getCurrentModulesList(); 582 | QList *getCurrentThreadsList(); 583 | bool addBreakPoint(const BREAKPOINT &breakPoint); 584 | bool removeBreakPoint(const QString &sUUID); 585 | bool isBreakPointPresent(const BREAKPOINT &breakPoint); 586 | bool enableBreakPoint(const QString &sUUID); 587 | bool disableBreakPoint(const QString &sUUID); 588 | BREAKPOINT findBreakPointByAddress(XADDR nAddress, BPT bpType); 589 | BREAKPOINT findBreakPointByExceptionAddress(XADDR nExceptionAddress, BPT bpType); // TODO try in *nix 590 | BREAKPOINT findBreakPointByThreadID(X_ID nThreadID, BPT bpType); 591 | BREAKPOINT findBreakPointByUUID(const QString &sUUID); 592 | BREAKPOINT findBreakPointByRegion(XADDR nAddress, qint64 nSize); 593 | qint32 getThreadBreakpointsCount(X_ID nThreadID); 594 | QList *getBreakpoints(); 595 | #ifdef Q_OS_LINUX 596 | QMap *getThreadBreakpoints(); 597 | #endif 598 | bool breakpointToggle(XADDR nAddress); 599 | bool breakpointRemove(XADDR nAddress); 600 | static QString bptToString(BPT bpType); 601 | static QString bpiToString(BPI bpInfo); 602 | 603 | void addSharedObjectInfo(XInfoDB::SHAREDOBJECT_INFO *pSharedObjectInfo); 604 | void removeSharedObjectInfo(XInfoDB::SHAREDOBJECT_INFO *pSharedObjectInfo); 605 | void addThreadInfo(XInfoDB::THREAD_INFO *pThreadInfo); 606 | void removeThreadInfo(X_ID nThreadID); 607 | bool setThreadStatus(X_ID nThreadID, THREAD_STATUS status); 608 | THREAD_STATUS getThreadStatus(X_ID nThreadID); 609 | bool setFunctionHook(const QString &sFunctionName); 610 | bool removeFunctionHook(const QString &sFunctionName); 611 | 612 | QMap *getSharedObjectInfos(); 613 | QList *getThreadInfos(); 614 | QMap *getFunctionHookInfos(); 615 | SHAREDOBJECT_INFO findSharedInfoByName(const QString &sName); 616 | SHAREDOBJECT_INFO findSharedInfoByAddress(XADDR nAddress); 617 | THREAD_INFO findThreadInfoByID(X_ID nThreadID); 618 | #ifdef Q_OS_WIN 619 | THREAD_INFO findThreadInfoByHandle(X_HANDLE hThread); 620 | #endif 621 | quint64 getFunctionAddress(const QString &sFunctionName); 622 | // bool stepInto(XProcess::HANDLEID handleThread); 623 | // bool resumeThread(XProcess::HANDLEID handleThread); 624 | XADDR getAddressNextInstructionAfterCall(XADDR nAddress); 625 | bool stepInto_Handle(X_HANDLE hThread, BPI bpInfo); 626 | bool stepInto_Id(X_ID nThreadId, BPI bpInfo); 627 | bool stepOver_Handle(X_HANDLE hThread, BPI bpInfo); 628 | bool stepOver_Id(X_ID nThreadId, BPI bpInfo); 629 | bool _setStep_Handle(X_HANDLE hThread); 630 | bool _setStep_Id(X_ID nThreadId); 631 | bool suspendThread_Id(X_ID nThreadId); 632 | bool suspendThread_Handle(X_HANDLE hThread); 633 | bool resumeThread_Id(X_ID nThreadId); 634 | bool resumeThread_Handle(X_HANDLE hThread); 635 | bool suspendAllThreads(); 636 | bool resumeAllThreads(); 637 | FUNCTION_INFO getFunctionInfo(X_HANDLE hThread, const QString &sName); 638 | 639 | XHARDWAREBP getHardwareBP_Handle(X_HANDLE hThread); 640 | // bool setHardwareBP_Handle(X_HANDLE hThread, XHARDWAREBP &hardwareBP); 641 | XHARDWAREBP getHardwareBP_Id(X_ID nThreadId); 642 | bool setHardwareBP_Id(X_ID nThreadId, XHARDWAREBP &hardwareBP); 643 | bool _regsToXHARDWAREBP(quint64 *pDebugRegs, XHARDWAREBP *pHardwareBP); 644 | XHARDWAREBPREG _bitsToXHARDWAREBP(quint64 nReg, bool bLocal, bool bGlobal, bool bCond0, bool bCond1, bool bSize0, bool bSize1); 645 | // bool _XHARDWAREBPToRegs(XHARDWAREBP *pHardwareBP, quint64 *pDebugRegs); // TODO Check 646 | 647 | // void _lockId(quint32 nId); 648 | // void _unlockID(quint32 nId); 649 | // void _waitID(quint32 nId); 650 | XBinary::XVARIANT getCurrentRegCache(XREG reg); 651 | void setCurrentRegCache(XREG reg, XBinary::XVARIANT variant); 652 | bool setCurrentRegByThread(X_HANDLE hThread, XREG reg, XBinary::XVARIANT variant); 653 | bool setCurrentRegById(X_ID nThreadId, XREG reg, XBinary::XVARIANT variant); 654 | bool setCurrentReg(XREG reg, XBinary::XVARIANT variant); 655 | bool isRegChanged(XREG reg); 656 | QList getCurrentRegs(); 657 | XADDR getCurrentStackPointerCache(); 658 | XADDR getCurrentInstructionPointerCache(); 659 | XADDR getCurrentInstructionPointer_Handle(X_HANDLE hThread); 660 | XADDR getCurrentInstructionPointer_Id(X_ID nThreadId); 661 | bool setCurrentIntructionPointer_Handle(X_HANDLE hThread, XADDR nValue); 662 | bool setCurrentIntructionPointer_Id(X_ID nThreadId, XADDR nValue); 663 | 664 | // XCapstone::OPCODE_ID getCurrentOpcode_Handle(X_HANDLE hThread); 665 | // XCapstone::OPCODE_ID getCurrentOpcode_Id(X_ID nThreadId); 666 | 667 | XADDR getCurrentStackPointer_Handle(X_HANDLE hThread); 668 | XADDR getCurrentStackPointer_Id(X_ID nThreadId); 669 | bool setCurrentStackPointer_Handle(X_HANDLE hThread, XADDR nValue); 670 | bool isFunctionReturnAddress(XADDR nAddress); 671 | 672 | bool isAddressValid(XADDR nAddress); 673 | 674 | static QString regIdToString(XREG reg); 675 | static XREG getSubReg32(XREG reg); 676 | static XREG getSubReg16(XREG reg); 677 | static XREG getSubReg8H(XREG reg); 678 | static XREG getSubReg8L(XREG reg); 679 | 680 | static XREG_OPTIONS getRegOptions(XREG reg); 681 | 682 | static char *allocateStringMemory(const QString &sFileName); 683 | static XBinary::XVARIANT getFlagFromReg(XBinary::XVARIANT variant, XREG reg); 684 | static XBinary::XVARIANT setFlagToReg(XBinary::XVARIANT variant, XREG reg, bool bValue); 685 | #endif 686 | struct XSTRING { 687 | QString sAnsiString; 688 | QString sUnicodeString; 689 | QString sUTFString; 690 | }; 691 | 692 | struct RECORD_INFO { 693 | bool bValid; 694 | XADDR nAddress; 695 | QString sModule; 696 | QByteArray baData; 697 | QString sSymbol; 698 | QString sInfo; 699 | }; 700 | 701 | enum RI_TYPE { 702 | RI_TYPE_UNKNOWN = 0, 703 | RI_TYPE_GENERAL, 704 | RI_TYPE_ADDRESS, 705 | RI_TYPE_DATA, 706 | RI_TYPE_ANSI, 707 | RI_TYPE_UNICODE, 708 | RI_TYPE_UTF8, 709 | RI_TYPE_SYMBOL, 710 | RI_TYPE_SYMBOLADDRESS 711 | }; 712 | 713 | RECORD_INFO getRecordInfo(quint64 nValue, RI_TYPE riType = RI_TYPE_GENERAL); 714 | static QString recordInfoToString(RECORD_INFO recordInfo, RI_TYPE riType = RI_TYPE_GENERAL); 715 | 716 | QList getMemoryReplaces(quint64 nBase = 0, quint64 nSize = 0xFFFFFFFFFFFFFFFF); 717 | 718 | enum RT { 719 | RT_UNKNOWN = 0, 720 | RT_CODE, 721 | RT_INTDATATYPE, 722 | RT_VIRTUAL 723 | }; 724 | 725 | enum DBSTATUS { 726 | DBSTATUS_NONE, 727 | DBSTATUS_PROCESS 728 | }; 729 | 730 | bool isSymbolPresent(XADDR nAddress); 731 | bool isFunctionPresent(XADDR nAddress); 732 | QString getSymbolStringByAddress(XADDR nAddress); 733 | #ifdef QT_SQL_LIB 734 | bool isTablePresent(QSqlDatabase *pDatabase, DBTABLE dbTable); 735 | bool isTableNotEmpty(QSqlDatabase *pDatabase, const QString &sTable); 736 | bool isTableNotEmpty(QSqlDatabase *pDatabase, DBTABLE dbTable); 737 | bool isTablePresentAndNotEmpty(QSqlDatabase *pDatabase, DBTABLE dbTable); 738 | void createTable(QSqlDatabase *pDatabase, DBTABLE dbTable); 739 | void removeTable(QSqlDatabase *pDatabase, const QString &sTable); 740 | void removeTable(QSqlDatabase *pDatabase, DBTABLE dbTable); 741 | void clearTable(QSqlDatabase *pDatabase, DBTABLE dbTable); 742 | QString getCreateSqlString(QSqlDatabase *pDatabase, const QString &sTable); 743 | QList getNotEmptyTables(QSqlDatabase *pDatabase); 744 | #endif 745 | bool isDbPresent(); 746 | void removeAllTables(); 747 | void clearAllTables(); 748 | void clearDb(); 749 | void vacuumDb(); 750 | void _addSymbolsFromFile(QIODevice *pDevice, bool bIsImage = false, XADDR nModuleAddress = -1, XBinary::FT fileType = XBinary::FT_UNKNOWN, 751 | XBinary::PDSTRUCT *pPdStruct = nullptr); 752 | void _addELFSymbols(XELF *pELF, XBinary::_MEMORY_MAP *pMemoryMap, qint64 nDataOffset, qint64 nDataSize, qint64 nStringsTableOffset, qint64 nStringsTableSize, 753 | XBinary::PDSTRUCT *pPdStruct); 754 | 755 | struct ANALYZEOPTIONS { 756 | QIODevice *pDevice; 757 | XBinary::_MEMORY_MAP *pMemoryMap; 758 | XADDR nStartAddress; 759 | quint32 nCount; 760 | bool bAll; 761 | }; 762 | 763 | bool _analyzeCode(const ANALYZEOPTIONS &analyzeOptions, XBinary::PDSTRUCT *pPdStruct = nullptr); 764 | bool _analyze(XBinary::FT fileType, XBinary::PDSTRUCT *pPdStruct); 765 | void _addCode(STATE *pState, XBinary::_MEMORY_RECORD *pMemoryRecord, char *pMemory, XADDR nRelOffset, qint64 nSize, quint16 nBranch, XBinary::PDSTRUCT *pPdStruct); 766 | bool _isCode(STATE *pState, XBinary::_MEMORY_RECORD *pMemoryRecord, char *pMemory, XADDR nRelOffset, qint64 nSize); 767 | bool addSymbol(STATE *pState, XADDR nAddress, quint32 nSize, quint16 nFlags, const QString &sSymbolName = QString(), quint16 nBranch = 0); 768 | bool addRefInfo(STATE *pState, XADDR nAddress, XADDR nAddressRef, quint32 nSize, quint16 nFlags, quint16 nBranch = 0); 769 | bool addRecord(STATE *pState, XADDR nAddress, quint16 nSize, quint16 nFlags, quint16 nBranch = 0); 770 | bool updateSymbolFlags(STATE *pState, XADDR nAddress, quint16 nFlags); 771 | bool addSymbolOrUpdateFlags(STATE *pState, XADDR nAddress, quint32 nSize, quint16 nFlags, const QString &sSymbolName = QString()); 772 | void dumpBookmarks(); 773 | void dumpSymbols(XBinary::FT fileType); 774 | void dumpRecords(XBinary::FT fileType); 775 | void dumpRefs(XBinary::FT fileType); 776 | void dumpShowRecords(XBinary::FT fileType); 777 | 778 | QString getShowString(STATE *pState, const XRECORD &record, const XDisasmAbstract::DISASM_OPTIONS &disasmOptions); 779 | QString _getSymbolStringBySegmentRelOffset(STATE *pState, quint16 nRegionIndex, XADDR nRelOffset); 780 | QString _getSymbolStringByAddress(STATE *pState, XADDR nAddress); 781 | 782 | void setData(QIODevice *pDevice, XBinary::FT fileType); 783 | XBinary::FT addMode(QIODevice *pDevice, XBinary::FT fileType); 784 | 785 | qint32 _searchXRecordBySegmentRelOffset(QVector *pListRecords, quint16 nRegionIndex, XADDR nRelOffset, bool bInRecord); 786 | bool _insertXRecord(QVector *pListSymbols, const XRECORD &record); 787 | qint32 _searchXRecordByAddress(XBinary::_MEMORY_MAP *pMemoryMap, QVector *pListRecords, XADDR nAddress, bool bInRecord); 788 | qint32 _searchXRecordByAddress(STATE *pState, XADDR nAddress, bool bInRecord); 789 | 790 | qint32 _searchXSymbolByAddress(XBinary::_MEMORY_MAP *pMemoryMap, QVector *pListSymbols, XADDR nAddress); 791 | qint32 _searchXSymbolBySegmentRelOffset(QVector *pListSymbols, quint16 nRegionIndex, XADDR nRelOffset); 792 | bool _insertXSymbol(QVector *pListSymbols, const XSYMBOL &symbol); 793 | 794 | qint32 _searchXRefinfoBySegmentRelOffset(QVector *pListRefs, quint16 nRegionIndex, XADDR nRelOffset); 795 | bool _insertXRefinfo(QVector *pListRefs, const XREFINFO &refinfo); 796 | 797 | static qint64 getOffset(STATE *pState, quint16 nRegionIndex, XADDR nRelOffset); 798 | static XADDR getAddress(STATE *pState, quint16 nRegionIndex, XADDR nRelOffset); 799 | 800 | void _completeDbAnalyze(); 801 | #ifdef QT_SQL_LIB 802 | bool _addShowRecord_prepare(QSqlQuery *pQuery); 803 | bool _isShowRecordPresent_prepare1(QSqlQuery *pQuery); 804 | bool _isShowRecordPresent_prepare2(QSqlQuery *pQuery); 805 | bool _isShowRecordPresent_bind1(QSqlQuery *pQuery, XADDR nAddress); 806 | bool _isShowRecordPresent_bind(QSqlQuery *pQuery1, QSqlQuery *pQuery2, XADDR nAddress, qint64 nSize); 807 | bool _addRelRecord_prepare(QSqlQuery *pQuery); 808 | bool _isShowRecordPresent(QSqlQuery *pQuery, XADDR nAddress, qint64 nSize); 809 | quint64 _getBranchNumber(); 810 | #endif 811 | bool _incShowRecordRefFrom(XADDR nAddress); 812 | bool _removeAnalyze(XADDR nAddress, qint64 nSize); 813 | void _clearAnalyze(); 814 | bool _setArray(XADDR nAddress, qint64 nSize); 815 | bool _addFunction(XADDR nAddress, qint64 nSize, const QString &sName); 816 | void updateFunctionSize(XADDR nAddress, qint64 nSize); 817 | QString _addBookmarkRecord(const BOOKMARKRECORD &record); 818 | bool _removeBookmarkRecord(const QString &sUUID); 819 | QVector *getBookmarkRecords(); 820 | QVector getBookmarkRecords(quint64 nLocation, XBinary::LT locationType, qint64 nSize, XBinary::PDSTRUCT *pPdStruct = nullptr); 821 | QString addBookmarkRecord(const BOOKMARKRECORD &record); 822 | bool removeBookmarkRecord(const QString &sUUID); 823 | void updateBookmarkRecord(BOOKMARKRECORD &record); 824 | void updateBookmarkRecordColorBackground(const QString &sUUID, const QString &sColorBackground); 825 | void updateBookmarkRecordComment(const QString &sUUID, const QString &sComment); 826 | 827 | // XInfoDB::XRECORD getRecordByAddress(XBinary::FT fileType, XADDR nAddress, bool bInRecord); 828 | // XADDR segmentRelOffsetToAddress(XBinary::FT fileType, quint16 nSegment, XADDR nRelOffset); 829 | 830 | qint64 getShowRecordOffsetByAddress(XADDR nAddress); 831 | qint64 getShowRecordPrevOffsetByAddress(XADDR nAddress); 832 | qint64 getShowRecordOffsetByLine(qint64 nLine); 833 | XADDR getShowRecordAddressByOffset(qint64 nOffset); 834 | XADDR getShowRecordAddressByLine(qint64 nLine); 835 | qint64 getRecordsCount(XBinary::FT fileType); 836 | qint64 getShowRecordLineByAddress(XADDR nAddress); 837 | qint64 getShowRecordLineByOffset(qint64 nOffset); 838 | void updateShowRecordLine(XADDR nAddress, qint64 nLine); 839 | QList getShowRecordRelAddresses(XDisasmAbstract::RELTYPE relType, DBSTATUS dbstatus, XBinary::PDSTRUCT *pPdStruct); 840 | QList getShowRecordMemoryVariables(DBSTATUS dbstatus, XBinary::PDSTRUCT *pPdStruct); 841 | QList getBranches(DBSTATUS dbstatus, XBinary::PDSTRUCT *pPdStruct); 842 | 843 | QList getExportSymbolAddresses(XBinary::PDSTRUCT *pPdStruct); 844 | QList getImportSymbolAddresses(XBinary::PDSTRUCT *pPdStruct); 845 | QList getTLSSymbolAddresses(XBinary::PDSTRUCT *pPdStruct); 846 | QList getFunctionAddresses(XBinary::PDSTRUCT *pPdStruct); 847 | 848 | bool isAddressHasRefFrom(XADDR nAddress); 849 | bool isAnalyzedRegionVirtual(XADDR nAddress, qint64 nSize); 850 | 851 | bool loadDbFromFile(QIODevice *pDevice, const QString &sDBFileName, XBinary::PDSTRUCT *pPdStruct = nullptr); 852 | bool saveDbToFile(const QString &sDBFileName, XBinary::PDSTRUCT *pPdStruct = nullptr); 853 | #ifdef USE_XPROCESS 854 | static QString threadStatusToString(THREAD_STATUS threadStatus); 855 | #endif 856 | #ifdef QT_SQL_LIB 857 | bool querySQL(QSqlQuery *pSqlQuery, const QString &sSQL, bool bWrite); 858 | bool querySQL(QSqlQuery *pSqlQuery, bool bWrite); 859 | QString convertStringSQLTableName(const QString &sSQL); 860 | QString convertStringSQLValue(const QString &sSQL); 861 | #endif 862 | void testFunction(); 863 | void setDebuggerState(bool bState); 864 | bool isDebugger(); 865 | QString convertOpcodeString(XDisasmAbstract::DISASM_RESULT disasmResult, const XInfoDB::RI_TYPE &riType, const XDisasmAbstract::DISASM_OPTIONS &disasmOptions); 866 | QString _convertOpcodeString(const QString &sString, XADDR nAddress, const XInfoDB::RI_TYPE &riType, const XDisasmAbstract::DISASM_OPTIONS &disasmOptions); 867 | void setDatabaseChanged(bool bState); 868 | bool isDatabaseChanged(); 869 | 870 | STATE *getState(XBinary::FT fileType); 871 | bool isAnalyzed(XBinary::FT fileType); 872 | bool isStatePresent(XBinary::FT fileType); 873 | 874 | public slots: 875 | void readDataSlot(quint64 nOffset, char *pData, qint64 nSize); 876 | void writeDataSlot(quint64 nOffset, char *pData, qint64 nSize); 877 | 878 | private: 879 | void replaceMemory(quint64 nOffset, char *pData, qint64 nSize); 880 | 881 | signals: 882 | void dataChanged(qint64 nDeviceOffset, qint64 nDeviceSize); 883 | void reloadViewSignal(); 884 | void memoryRegionsListChanged(); 885 | void modulesListChanged(); 886 | void threadsListChanged(); 887 | void registersListChanged(); 888 | // void analyzeStateChanged(); 889 | 890 | private: 891 | struct _ENTRY { 892 | XADDR nAddress; 893 | quint32 nBranch; 894 | }; 895 | #ifdef USE_XPROCESS 896 | struct STATUS { 897 | quint32 nRegistersHash; 898 | QList listRegs; 899 | QList listRegsPrev; // mb TODO move to prev 900 | X_ID nThreadId; 901 | X_HANDLE hThread; 902 | quint32 nMemoryRegionsHash; 903 | QList listMemoryRegions; // TODO prev 904 | quint32 nModulesHash; 905 | QList listModules; // TODO prev 906 | quint32 nThreadsHash; 907 | QList listThreads; // TODO prev 908 | }; 909 | XBinary::XVARIANT _getRegCache(QList *pListRegs, XREG reg); 910 | void _setRegCache(QList *pListRegs, XREG reg, XBinary::XVARIANT variant); 911 | void _addCurrentRegRecord(XREG reg, XBinary::XVARIANT value); 912 | #endif 913 | private: 914 | #ifdef USE_XPROCESS 915 | XInfoDB::PROCESS_INFO m_processInfo; 916 | QList m_listBreakpoints; 917 | BPT m_bpTypeDefault; 918 | #ifdef Q_OS_LINUX 919 | QMap m_mapThreadBreakpoints; // STEPS, ThreadID/BP TODO QList TODO remove 920 | #endif 921 | // QMap g_mapThreadBreakpoints; // STEPS, 922 | // ThreadID/BP TODO QList 923 | QMap m_mapSharedObjectInfos; // TODO QList 924 | QList m_listThreadInfos; 925 | QMap m_mapFunctionHookInfos; // TODO QList 926 | #endif 927 | // MODE m_mode; // TODO remove 928 | // MODE g_defaultMode; 929 | #ifdef USE_XPROCESS 930 | STATUS m_statusCurrent; 931 | // STATUS g_statusPrev; 932 | #endif 933 | QMutex *m_pMutexSQL; 934 | QMutex *m_pMutexThread; 935 | #ifdef QT_SQL_LIB 936 | QString s_sql_tableName[__DBTABLE_SIZE]; 937 | #endif 938 | bool m_bIsDatabaseChanged; 939 | bool m_bIsDebugger; 940 | QMap m_mapProfiles; 941 | QVector m_listBookmarks; 942 | }; 943 | 944 | #endif // XINFODB_H 945 | -------------------------------------------------------------------------------- /info/Functions.txt: -------------------------------------------------------------------------------- 1 | kernel32.CloseHandle 2 | kernel32.GetProcAddress 3 | kernel32.Sleep 4 | kernel32.GetTickCount 5 | kernel32.ExitProcess 6 | kernel32.GetCurrentProcess 7 | kernel32.GetCurrentThreadId 8 | kernel32.GetModuleFileNameA 9 | kernel32.UnhandledExceptionFilter 10 | kernel32.TerminateProcess 11 | kernel32.SetUnhandledExceptionFilter 12 | kernel32.GetModuleHandleA 13 | kernel32.QueryPerformanceCounter 14 | kernel32.GetCurrentProcessId 15 | kernel32.LoadLibraryA 16 | kernel32.GetSystemTimeAsFileTime 17 | kernel32.WriteFile 18 | kernel32.IsDebuggerPresent 19 | kernel32.GetLastError 20 | kernel32.ReadFile 21 | kernel32.DecodePointer 22 | advapi32.RegCloseKey 23 | kernel32.EncodePointer 24 | kernel32.HeapSetInformation 25 | kernel32.SetFilePointer 26 | kernel32.RtlUnwind 27 | kernel32.GetTempPathA 28 | kernel32.HeapAlloc 29 | kernel32.CreateProcessA 30 | kernel32.HeapFree 31 | kernel32.GetFileSize 32 | kernel32.WideCharToMultiByte 33 | kernel32.LeaveCriticalSection 34 | kernel32.GetStdHandle 35 | kernel32.EnterCriticalSection 36 | kernel32.MultiByteToWideChar 37 | kernel32.InterlockedExchange 38 | kernel32.VirtualProtect 39 | shell32.ShellExecuteA 40 | kernel32.TlsGetValue 41 | kernel32.TlsSetValue 42 | kernel32.GetFileType 43 | kernel32.DeleteCriticalSection 44 | kernel32.CreateFileA 45 | kernel32.GetACP 46 | kernel32.GetTempFileNameA 47 | kernel32.GetCPInfo 48 | kernel32.SetLastError 49 | kernel32.HeapReAlloc 50 | kernel32.GetCommandLineA 51 | ws2_32.23 52 | kernel32.InterlockedCompareExchange 53 | kernel32.RaiseException 54 | ws2_32.115 55 | ws2_32.9 56 | ws2_32.4 57 | ws2_32.19 58 | ws2_32.11 59 | ws2_32.16 60 | kernel32.InterlockedIncrement 61 | kernel32.SetEndOfFile 62 | ws2_32.111 63 | ws2_32.116 64 | kernel32.VirtualAlloc 65 | msvcr100._invoke_watson 66 | msvcr100._cexit 67 | msvcr100.memset 68 | msvcr100._exit 69 | kernel32.HeapCreate 70 | kernel32.TlsAlloc 71 | msvcr100._fmode 72 | msvcr100._initterm 73 | msvcr100._initterm_e 74 | msvcr100.__set_app_type 75 | msvcr100.__dllonexit 76 | msvcr100._lock 77 | msvcr100._onexit 78 | msvcr100._terminate@@YAXXZ 79 | msvcr100._except_handler4_common 80 | msvcr100._crt_debugger_hook 81 | msvcr100.malloc 82 | kernel32.GetModuleHandleW 83 | msvcr100.exit 84 | msvcr100._unlock 85 | msvcr100._amsg_exit 86 | msvcr100._controlfp_s 87 | msvcr100._commode 88 | msvcr100.__setusermatherr 89 | msvcr100._XcptFilter 90 | kernel32.GetOEMCP 91 | msvcr100._configthreadlocale 92 | kernel32.GetModuleFileNameW 93 | kernel32.VirtualFree 94 | msvcr100.fclose 95 | msvcr100.rand 96 | msvcr100.srand 97 | msvcr100._time64 98 | kernel32.GetStringTypeW 99 | msvcr100.__initenv 100 | msvcr100.fseek 101 | kernel32.FreeEnvironmentStringsW 102 | msvcr100.fread 103 | msvcr100.ftell 104 | kernel32.FreeLibrary 105 | kernel32.LCMapStringW 106 | msvcr100.fopen 107 | kernel32.InterlockedDecrement 108 | msvcr100.fwrite 109 | kernel32.SetStdHandle 110 | msvcr100._snprintf 111 | msvcr100.__getmainargs 112 | msvcr100.printf 113 | msvcr100.atoi 114 | kernel32.DeleteFileA 115 | kernel32.GetEnvironmentStringsW 116 | kernel32.TlsFree 117 | kernel32.LoadLibraryW 118 | kernel32.GetProcessHeap 119 | kernel32.HeapDestroy 120 | kernel32.CreateThread 121 | kernel32.FlushFileBuffers 122 | kernel32.FindClose 123 | kernel32.GetStartupInfoW 124 | kernel32.SetHandleCount 125 | user32.MessageBoxA 126 | kernel32.lstrlenW 127 | kernel32.WaitForSingleObject 128 | kernel32.GetStartupInfoA 129 | kernel32.HeapSize 130 | kernel32.CreateFileW 131 | kernel32.GetSystemTime 132 | kernel32.IsProcessorFeaturePresent 133 | advapi32.RegSetValueExA 134 | kernel32.InitializeCriticalSectionAndSpinCount 135 | kernel32.CopyFileA 136 | kernel32.LoadResource 137 | advapi32.RegOpenKeyExA 138 | kernel32.WriteConsoleW 139 | advapi32.RegQueryValueExA 140 | kernel32.FindFirstFileA 141 | kernel32.GetConsoleMode 142 | kernel32.GetConsoleCP 143 | kernel32.GetVersion 144 | kernel32.IsValidCodePage 145 | kernel32.GetCommandLineW 146 | kernel32.SizeofResource 147 | kernel32.LocalAlloc 148 | kernel32.LockResource 149 | kernel32.LocalFree 150 | kernel32.FindNextFileA 151 | kernel32.GetWindowsDirectoryA 152 | kernel32.SetFileAttributesA 153 | kernel32.lstrlenA 154 | kernel32.GetVersionExA 155 | kernel32.GlobalAlloc 156 | kernel32.WinExec 157 | kernel32.InitializeCriticalSection 158 | advapi32.RegQueryValueExW 159 | advapi32.RegOpenKeyExW 160 | advapi32.RegSetValueExW 161 | kernel32.FindResourceW 162 | kernel32.DeleteFileW 163 | advapi32.RegCreateKeyExW 164 | advapi32.RegCreateKeyExA 165 | msvbvm60._CIcos 166 | kernel32.CreateProcessW 167 | kernel32.GetSystemDirectoryA 168 | kernel32.GetTempPathW 169 | shell32.ShellExecuteW 170 | user32.GetDC 171 | kernel32.GlobalFree 172 | advapi32.GetUserNameA 173 | oleaut32.SysFreeString 174 | user32.GetSystemMetrics 175 | kernel32.GetComputerNameA 176 | msvbvm60._adj_fpatan 177 | msvbvm60.__vbaFreeVar 178 | msvbvm60.EVENT_SINK_AddRef 179 | msvbvm60.100 180 | msvbvm60._adj_fdivr_m16i 181 | msvbvm60._adj_fdiv_m64 182 | msvbvm60.__vbaFileClose 183 | msvbvm60.__vbaAryDestruct 184 | msvbvm60._adj_fdiv_m16i 185 | msvbvm60.__vbaChkstk 186 | msvbvm60._adj_fptan 187 | msvbvm60._CIsin 188 | advapi32.CloseServiceHandle 189 | kernel32.SetFileAttributesW 190 | kernel32.IsBadReadPtr 191 | advapi32.CryptAcquireContextW 192 | kernel32.SystemTimeToFileTime 193 | kernel32.GetTempFileNameW 194 | msvbvm60.__vbaStrCat 195 | msvbvm60.__vbaObjSet 196 | msvbvm60._adj_fdiv_r 197 | msvbvm60.__vbaFreeObjList 198 | msvbvm60._adj_fdiv_m32i 199 | msvbvm60.__vbaFreeObj 200 | shell32.SHGetSpecialFolderPathW 201 | advapi32.FreeSid 202 | msvbvm60._adj_fdivr_m64 203 | msvbvm60._adj_fdivr_m32 204 | kernel32.MoveFileW 205 | msvbvm60.EVENT_SINK_QueryInterface 206 | msvbvm60._adj_fdiv_m32 207 | msvbvm60.__vbaStrMove 208 | msvbvm60.__vbaVarMove 209 | kernel32.GlobalLock 210 | msvbvm60.__vbaFileOpen 211 | kernel32.GetFileAttributesA 212 | msvbvm60.__vbaNew2 213 | msvbvm60._CIatan 214 | msvbvm60.__vbaFreeStr 215 | msvbvm60._allmul 216 | msvbvm60._CItan 217 | msvbvm60.__vbaFreeVarList 218 | msvbvm60.__vbaFreeStrList 219 | msvbvm60._CIlog 220 | msvbvm60._adj_fprem 221 | msvbvm60.__vbaOnError 222 | gdi32.SetBkColor 223 | shlwapi.PathRemoveExtensionW 224 | shlwapi.PathFileExistsW 225 | kernel32.MoveFileExW 226 | advapi32.OpenServiceW 227 | advapi32.OpenSCManagerW 228 | msvbvm60.__vbaFPException 229 | shlwapi.PathIsRootW 230 | user32.CharNextA 231 | msvbvm60.__vbaEnd 232 | gdi32.DeleteObject 233 | msvbvm60._CIsqrt 234 | advapi32.AllocateAndInitializeSid 235 | advapi32.CryptReleaseContext 236 | kernel32.FindResourceExW 237 | advapi32.CreateServiceW 238 | kernel32.LoadLibraryExA 239 | msvbvm60.__vbaPutOwner3 240 | advapi32.CheckTokenMembership 241 | advapi32.GetUserNameW 242 | shlwapi.PathAddExtensionW 243 | advapi32.ChangeServiceConfigW 244 | user32.FlashWindow 245 | msvbvm60.EVENT_SINK_Release 246 | kernel32.VirtualQuery 247 | user32.SendMessageA 248 | msvbvm60._adj_fprem1 249 | advapi32.QueryServiceConfigW 250 | shlwapi.PathAppendW 251 | kernel32.CreateDirectoryA 252 | kernel32.GlobalUnlock 253 | kernel32.CreateMutexA 254 | advapi32.StartServiceW 255 | msvbvm60.__vbaVarCat 256 | kernel32.LCMapStringA 257 | gdi32.SelectObject 258 | user32.ShowWindow 259 | kernel32.LoadLibraryExW 260 | kernel32.GetDriveTypeA 261 | gdi32.SetTextColor 262 | user32.wsprintfA 263 | user32.DestroyWindow 264 | kernel32.GetLocaleInfoA 265 | gdi32.GetStockObject 266 | msvcrt.memset 267 | kernel32.FreeEnvironmentStringsA 268 | gdi32.GetDeviceCaps 269 | msvbvm60._adj_fdivr_m32i 270 | msvbvm60.593 271 | kernel32.GetLocalTime 272 | kernel32.CreateSemaphoreA 273 | msvcrt.memcpy 274 | msvbvm60.__vbaRedim 275 | msvbvm60.DllFunctionCall 276 | kernel32.MulDiv 277 | msvbvm60.__vbaSetSystemError 278 | msvbvm60.__vbaExceptHandler 279 | ole32.CoCreateInstance 280 | user32.LoadIconA 281 | kernel32.GetDiskFreeSpaceA 282 | msvbvm60.594 283 | msvbvm60.__vbaStrR8 284 | msvbvm60.570 285 | msvbvm60.588 286 | kernel32.lstrcpynA 287 | kernel32.MoveFileA 288 | user32.GetClientRect 289 | user32.CreateWindowExA 290 | ole32.CoInitialize 291 | msvbvm60.__vbaI4Var 292 | msvbvm60.600 293 | user32.PostQuitMessage 294 | msvbvm60.__vbaR8Str 295 | kernel32.GetThreadLocale 296 | msvbvm60.__vbaGetOwner3 297 | msvbvm60._CIexp 298 | user32.TranslateMessage 299 | kernel32.GetStringTypeA 300 | msvbvm60.__vbaFPInt 301 | msvbvm60.__vbaVarMod 302 | msvbvm60.__vbaUI1Var 303 | user32.DispatchMessageA 304 | user32.EnableWindow 305 | user32.GetDlgItem 306 | msvbvm60.__vbaStrVarVal 307 | user32.GetSysColor 308 | kernel32.SetEvent 309 | user32.GetWindowRect 310 | kernel32.FileTimeToLocalFileTime 311 | kernel32.CompareStringA 312 | kernel32.GetCurrentThread 313 | user32.LoadCursorA 314 | user32.EndDialog 315 | msvcrt.malloc 316 | user32.DefWindowProcA 317 | kernel32.SetEnvironmentVariableA 318 | kernel32.GetCurrentDirectoryA 319 | msvcrt.strlen 320 | gdi32.SetBkMode 321 | gdi32.CreateCompatibleBitmap 322 | gdi32.CreateCompatibleDC 323 | user32.SetWindowPos 324 | kernel32.lstrcmpiA 325 | kernel32.lstrcpyA 326 | kernel32.GetEnvironmentStrings 327 | user32.ReleaseDC 328 | kernel32.ExitThread 329 | msvcrt.__set_app_type 330 | kernel32.GetTimeZoneInformation 331 | kernel32.IsBadWritePtr 332 | kernel32.ResetEvent 333 | msvcrt.__p__fmode 334 | oleaut32.9 335 | msvbvm60.__vbaHresultCheckObj 336 | user32.GetKeyboardType 337 | gdi32.DeleteDC 338 | wininet.InternetOpenA 339 | msvcrt.free 340 | kernel32.lstrcmpA 341 | user32.SetWindowLongA 342 | user32.SetTimer 343 | msvcrt.exit 344 | kernel32.TerminateThread 345 | kernel32.SetErrorMode 346 | user32.FillRect 347 | user32.FindWindowA 348 | user32.SetFocus 349 | ole32.CoUninitialize 350 | gdi32.CreateBitmap 351 | kernel32.ResumeThread 352 | gdi32.CreateFontIndirectA 353 | user32.GetWindowLongA 354 | kernel32.lstrcatA 355 | kernel32.SetCurrentDirectoryA 356 | user32.RegisterClassA 357 | gdi32.BitBlt 358 | user32.CallWindowProcA 359 | user32.SetWindowTextA 360 | kernel32.CompareStringW 361 | user32.DestroyIcon 362 | kernel32.FindResourceA 363 | kernel32.DuplicateHandle 364 | kernel32.OutputDebugStringA 365 | user32.GetWindow 366 | user32.PostMessageA 367 | user32.BeginPaint 368 | gdi32.SelectPalette 369 | kernel32.FindNextFileW 370 | ole32.CoTaskMemFree 371 | ntdll.NtClose 372 | gdi32.GetDIBits 373 | msvcrt.memmove 374 | user32.IsWindowVisible 375 | user32.GetMessageA 376 | kernel32.GlobalHandle 377 | gdi32.CreateBrushIndirect 378 | gdi32.RealizePalette 379 | gdi32.CreateSolidBrush 380 | gdi32.GetObjectA 381 | msvcrt.__getmainargs 382 | kernel32.MapViewOfFile 383 | user32.wsprintfW 384 | kernel32.WritePrivateProfileStringA 385 | user32.GetSystemMenu 386 | msvcrt._controlfp 387 | msvcrt._exit 388 | kernel32.OpenMutexA 389 | gdi32.StretchBlt 390 | gdi32.MoveToEx 391 | msvcrt.__setusermatherr 392 | msvcrt.strcat 393 | user32.GetForegroundWindow 394 | msvcrt.__p__commode 395 | kernel32.ExpandEnvironmentStringsA 396 | msvcrt._XcptFilter 397 | user32.PeekMessageA 398 | msvcrt.fclose 399 | kernel32.GetExitCodeProcess 400 | user32.AppendMenuA 401 | kernel32.GetPrivateProfileStringA 402 | msvcrt.strcmp 403 | user32.IsWindowEnabled 404 | user32.IsWindow 405 | user32.EndPaint 406 | msvcrt._initterm 407 | kernel32.UnmapViewOfFile 408 | advapi32.RegOpenKeyA 409 | user32.InvalidateRect 410 | gdi32.SetROP2 411 | kernel32.InitializeSListHead 412 | kernel32.GetSystemInfo 413 | user32.ScreenToClient 414 | kernel32.CreateEventA 415 | kernel32.GlobalReAlloc 416 | ole32.OleUninitialize 417 | user32.GetParent 418 | msvcrt.strcpy 419 | oleaut32.2 420 | ole32.OleInitialize 421 | crtdll.raise 422 | user32.LoadStringA 423 | user32.SetForegroundWindow 424 | user32.GetWindowTextA 425 | kernel32.RemoveDirectoryA 426 | kernel32.SetFileTime 427 | kernel32.FileTimeToDosDateTime 428 | kernel32.FileTimeToSystemTime 429 | msvbvm60.__vbaHr?sultCheckObj 430 | user32.SetCursor 431 | gdi32.CreateDIBitmap 432 | kernel32.GetEnvironmentVariableA 433 | kernel32.CallNamedPipeW 434 | user32.EnableMenuItem 435 | user32.DrawIconEx 436 | user32.DrawTextA 437 | msvbvm60.__vbaUbound 438 | msvcrt._cexit 439 | kernel32.IsBadCodePtr 440 | kernel32.GetFullPathNameA 441 | kernel32.GetModuleHandleExW 442 | kernel32.CreateEventW 443 | kernel32.FormatMessageA 444 | gdi32.GetTextMetricsA 445 | shell32.DragFinish 446 | kernel32.GetShortPathNameA 447 | user32.GetClassNameA 448 | user32.DialogBoxParamA 449 | kernel32.FindFirstFileW 450 | kernel32.CreatePipe 451 | gdi32.GetSystemPaletteEntries 452 | msimg32.AlphaBlend 453 | msvcrt.fopen 454 | oleaut32.8 455 | msvcrt._onexit 456 | msvcrt.strncpy 457 | comctl32.ImageList_Create 458 | kernel32.SuspendThread 459 | kernel32.OpenProcess 460 | kernel32.OutputDebugStringW 461 | ole32.CLSIDFromString 462 | user32.MessageBoxW 463 | wininet.InternetReadFile 464 | wsock32.send 465 | crtdll.printf 466 | comctl32.17 467 | user32.IsIconic 468 | kernel32.WaitForMultipleObjects 469 | user32.MoveWindow 470 | msvcrt.sprintf 471 | gdi32.CreatePalette 472 | advapi32.OpenProcessToken 473 | kernel32.ReleaseSemaphore 474 | comctl32.ImageList_Destroy 475 | user32.SetClipboardData 476 | gdi32.CreateFontA 477 | msvcrt.realloc 478 | msvcrt.time 479 | gdi32.UnrealizeObject 480 | oleaut32.SafeArrayPtrOfIndex 481 | user32.UpdateWindow 482 | gdi32.LineTo 483 | gdi32.Rectangle 484 | oleaut32.SysAllocStringLen 485 | oleaut32.SysReAllocStringLen 486 | user32.EmptyClipboard 487 | crtdll.strcat 488 | ws2_32.57 489 | advapi32.RegEnumKeyA 490 | ws2_32.3 491 | user32.GetFocus 492 | user32.ExitWindowsEx 493 | user32.OpenClipboard 494 | kernel32.CreateDirectoryW 495 | ole32.OleRun 496 | wininet.InternetGetConnectedState 497 | user32.CharUpperA 498 | kernel32.CreateFileMappingA 499 | user32.CloseClipboard 500 | user32.LoadStringW 501 | msvbvm60.598 502 | user32.CreatePopupMenu 503 | advapi32.AdjustTokenPrivileges 504 | user32.CharNextW 505 | wsock32.closesocket 506 | crtdll.signal 507 | kernel32.CallNamedPipeA 508 | ws2_32.52 509 | gdiplus.GdiplusStartup 510 | user32.SetWindowLongW 511 | kernel32.SetFilePointerEx 512 | kernel32.GetFileAttributesW 513 | wsock32.connect 514 | wsock32.bind 515 | crtdll.strchr 516 | kernel32.AllocConsole 517 | wsock32.WSAStartup 518 | wsock32.gethostbyname 519 | crtdll.memset 520 | user32.CopyIcon 521 | user32.SystemParametersInfoA 522 | wsock32.select 523 | user32.MsgWaitForMultipleObjects 524 | kernel32.GetLocaleInfoW 525 | wsock32.ioctlsocket 526 | kernel32.FindAtomA 527 | wsock32.inet_addr 528 | wsock32.htons 529 | kernel32.SetThreadPriority 530 | kernel32.VirtualLock 531 | crtdll.exit 532 | user32.RedrawWindow 533 | msvbvm60._C?exp 534 | crtdll.memcpy 535 | shell32.SHGetSpecialFolderLocation 536 | wsock32.socket 537 | user32.SetRect 538 | kernel32.HeapValidate 539 | kernel32.GetUserDefaultLCID 540 | msvbvm60.617 541 | user32.GetMessagePos 542 | msvcrt.fwrite 543 | msvcrt.tolower 544 | oleaut32.6 545 | advapi32.RegDeleteValueA 546 | oleaut32.VariantClear 547 | oleaut32.SafeArrayGetUBound 548 | version.VerQueryValueA 549 | msvbvm60.619 550 | user32.GetWindowThreadProcessId 551 | user32.GetDesktopWindow 552 | kernel32.GlobalSize 553 | oleaut32.SafeArrayGetLBound 554 | user32.SetActiveWindow 555 | oleaut32.SafeArrayCreate 556 | oleaut32.VariantCopy 557 | oleaut32.VariantInit 558 | msvbvm60.__vba?bound 559 | kernel32.GetVersionExW 560 | advapi32.RegEnumValueA 561 | crtdll.__GetMainArgs 562 | user32.LoadBitmapA 563 | user32.GetActiveWindow 564 | user32.GetIconInfo 565 | user32.KillTimer 566 | msvcrt.fread 567 | msvbvm60.__vbaErrorOverflow 568 | advapi32.RegFlushKey 569 | msvcrt._acmdln 570 | msvbvm60.__vbaStrV?rVal 571 | gdi32.GetTextExtentPoint32A 572 | kernel32.GlobalDeleteAtom 573 | api-ms-win-crt-runtime-l1-1-0._initterm_e 574 | kernel32.GetVolumeInformationA 575 | api-ms-win-crt-runtime-l1-1-0._initterm 576 | api-ms-win-crt-runtime-l1-1-0._initialize_onexit_table 577 | ws2_32.18 578 | ws2_32.20 579 | ws2_32.2 580 | msvbvm60.__vbaStrCopy 581 | ws2_32.15 582 | ws2_32.13 583 | msvcrt.__CxxFrameHandler 584 | kernel32.BeginUpdateResourceA 585 | kernel32.Beep 586 | msvbvm60.__vbaStrVarMove 587 | ws2_32.1 588 | oleaut32.16 589 | user32.AdjustWindowRectEx 590 | oleaut32.161 591 | wsock32.sendto 592 | vcruntime140._except_handler4_common 593 | api-ms-win-crt-runtime-l1-1-0._cexit 594 | kernel32.EnumCalendarInfoA 595 | kernel32.IsDBCSLeadByte 596 | kernel32.GetLogicalDrives 597 | advapi32.RegCreateKeyA 598 | vcruntime140.memset 599 | kernel32.GetFullPathNameW 600 | kernel32.GetFileTime 601 | msvbvm60.__vbaI2I4 602 | advapi32.LookupPrivilegeValueA 603 | ws2_32.8 604 | advapi32.RegDeleteKeyA 605 | msvcrt._strnicmp 606 | oleaut32.VariantChangeTypeEx 607 | kernel32.GetProfileStringW 608 | msvbvm60.__vbaLenBstr 609 | kernel32.GetStringTypeExA 610 | version.GetFileVersionInfoA 611 | version.GetFileVersionInfoSizeA 612 | user32.TrackPopupMenu 613 | wsock32.gethostname 614 | wsock32.getpeername 615 | wsock32.getsockname 616 | api-ms-win-crt-runtime-l1-1-0.terminate 617 | wsock32.inet_ntoa 618 | msvbvm60.__vbaObjSetAddref 619 | msvbvm60.__vbaObjVar 620 | oleaut32.7 621 | wsock32.recvfrom 622 | kernel32.EndUpdateResourceA 623 | msvbvm60.__vbaVarDup 624 | kernel32.UpdateResourceA 625 | msvbvm60.595 626 | msvbvm60.580 627 | msvbvm60.531 628 | msvcrt.strchr 629 | user32.DestroyAcceleratorTable 630 | crtdll.sprintf 631 | user32.IsChild 632 | gdi32.RectVisible 633 | gdi32.RestoreDC 634 | gdi32.SaveDC 635 | msvcrt.rand 636 | msvcrt._except_handler3 637 | gdi32.GetBitmapBits 638 | user32.SetDlgItemTextA 639 | msvbvm60.576 640 | gdi32.SetStretchBltMode 641 | user32.RegisterWindowMessageA 642 | msvbvm60.716 643 | msvcrt._adjust_fdiv 644 | gdi32.GetCurrentPositionEx 645 | user32.CreateWindowExW 646 | user32.GetClassInfoA 647 | msvbvm60.__vbaExitProc 648 | msvcrt.strstr 649 | gdi32.CreatePen 650 | user32.DrawIcon 651 | user32.ClientToScreen 652 | user32.ReleaseCapture 653 | user32.LoadImageA 654 | gdi32.GetWindowOrgEx 655 | user32.CharUpperBuffA 656 | user32.GetKeyState 657 | msvcrt.strncmp 658 | wininet.InternetConnectA 659 | user32.GetWindowTextLengthA 660 | msvbvm60.529 661 | winspool.OpenPrinterW 662 | oleaut32.15 663 | api-ms-win-crt-locale-l1-1-0._configthreadlocale 664 | user32.UnregisterClassA 665 | msvbvm60.__vbaCastObj 666 | oleaut32.12 667 | msvcrt._amsg_exit 668 | kernel32.Process32First 669 | api-ms-win-crt-heap-l1-1-0._set_new_mode 670 | user32.GetSubMenu 671 | advapi32.SetSecurityInfo 672 | user32.GetSysColorBrush 673 | kernel32.PeekNamedPipe 674 | api-ms-win-crt-heap-l1-1-0.malloc 675 | kernel32.GetExitCodeThread 676 | wininet.HttpQueryInfoA 677 | gdi32.Escape 678 | api-ms-win-crt-heap-l1-1-0.free 679 | gdi32.ExcludeClipRect 680 | user32.wvsprintfA 681 | user32.RemovePropA 682 | kernel32.GetCPInfoExW 683 | gdi32.Ellipse 684 | winspool.OpenPrinterA 685 | kernel32.GetDriveTypeW 686 | msvcrt.__dllonexit 687 | user32.GetWindowLongW 688 | kernel32.lstrcpyW 689 | msvcrt.atoi 690 | gdi32.FillRgn 691 | mfc42.800 692 | msvbvm60.578 693 | msvbvm60.__vbaVar2Vec 694 | wininet.HttpOpenRequestA 695 | msvbvm60.__vbaVarTstLt 696 | oleaut32.SafeArrayGetElement 697 | kernel32.GetSystemWow64DirectoryW 698 | user32.SetClassLongA 699 | msvbvm60.__vbaNextEachCollObj 700 | wininet.DeleteUrlCacheEntry 701 | kernel32.GetThreadContext 702 | user32.GetDlgItemTextA 703 | gdi32.LPtoDP 704 | msvbvm60.518 705 | user32.GetMenuState 706 | user32.GetMenuItemID 707 | kernel32.HeapQueryInformation 708 | wininet.InternetCloseHandle 709 | msvbvm60.__vbaPutOwner4 710 | oleaut32.24 711 | oleaut32.23 712 | msvbvm60.__vbaPrintFile 713 | user32.GetMenuItemCount 714 | user32.SetCapture 715 | kernel32.GetSystemWindowsDirectoryA 716 | msvbvm60.__vbaVarTstNe 717 | gdi32.PatBlt 718 | msvbvm60.567 719 | winmm.waveOutOpen 720 | msvbvm60.__vbaVarSetVar 721 | vcruntime140._CxxThrowException 722 | msvcrt._terminate@@YAXXZ 723 | rasapi32.RasHangUpA 724 | kernel32.Process32Next 725 | kernel32.GetPrivateProfileIntA 726 | kernel32.GetPrivateProfileIntW 727 | msvbvm60.__vbaLateMemCall 728 | version.VerQueryValueW 729 | oleaut32.VariantCopyInd 730 | vcruntime140.__CxxFrameHandler3 731 | user32.GetPropA 732 | mfc42.941 733 | vcruntime140.__std_exception_copy 734 | vcruntime140.__std_exception_destroy 735 | oleaut32.SafeArrayRedim 736 | msvcrt.system 737 | oleaut32.SafeArrayPutElement 738 | user32.CallNextHookEx 739 | gdi32.SelectClipRgn 740 | api-ms-win-crt-math-l1-1-0.__setusermatherr 741 | api-ms-win-crt-runtime-l1-1-0._exit 742 | user32.UnhookWindowsHookEx 743 | api-ms-win-crt-runtime-l1-1-0._register_onexit_function 744 | user32.CreateDialogParamA 745 | shell32.SHGetPathFromIDListA 746 | user32.CreateIcon 747 | kernel32.CreateToolhelp32Snapshot 748 | kernel32.WritePrivateProfileStringW 749 | shell32.SHGetFileInfoA 750 | api-ms-win-crt-runtime-l1-1-0._initialize_narrow_environment 751 | user32.SetWindowTextW 752 | msvcrt.memcmp 753 | msvbvm60.__vbaAryMove 754 | comctl32.ImageList_AddMasked 755 | shell32.SHFileOperationA 756 | user32.IsZoomed 757 | ole32.CLSIDFromProgID 758 | api-ms-win-crt-runtime-l1-1-0._c_exit 759 | api-ms-win-crt-runtime-l1-1-0._crt_atexit 760 | api-ms-win-crt-runtime-l1-1-0._register_thread_local_exe_atexit_callback 761 | api-ms-win-crt-runtime-l1-1-0._controlfp_s 762 | kernel32.CreateIoCompletionPort 763 | ntdll.RtlAllocateHeap 764 | comctl32.ImageList_Add 765 | ntdll.RtlFreeHeap 766 | comdlg32.ChooseColorA 767 | kernel32.AddAtomA 768 | user32.CharPrevA 769 | ntdll.RtlNtStatusToDosError 770 | user32.PostMessageW 771 | user32.CheckDlgButton 772 | user32.CheckMenuItem 773 | kernel32.CompareFileTime 774 | api-ms-win-crt-stdio-l1-1-0.__p__commode 775 | api-ms-win-crt-stdio-l1-1-0._set_fmode 776 | kernel32.CopyFileExW 777 | api-ms-win-crt-runtime-l1-1-0._set_app_type 778 | user32.CreateAcceleratorTableA 779 | api-ms-win-crt-runtime-l1-1-0._seh_filter_exe 780 | crtdll.srand 781 | msvbvm60.__vbaForEachCollObj 782 | shell32.SHBrowseForFolderA 783 | user32.GetMenu 784 | ole32.CoTaskMemAlloc 785 | kernel32.FormatMessageW 786 | gdi32.CreateRectRgn 787 | api-ms-win-crt-runtime-l1-1-0._configure_narrow_argv 788 | kernel32.FindAtomW 789 | user32.TranslateAcceleratorA 790 | user32.DestroyCursor 791 | shell32.ExtractIconExA 792 | user32.DrawEdge 793 | user32.DispatchMessageW 794 | user32.DestroyMenu 795 | kernel32.SearchPathA 796 | gdi32.CombineRgn 797 | gdi32.CreatePenIndirect 798 | api-ms-win-crt-runtime-l1-1-0.exit 799 | advapi32.RegDeleteValueW 800 | user32.GetWindowPlacement 801 | mfc42.1727 802 | mfc42.2379 803 | user32.PtInRect 804 | mfc42.1089 805 | crtdll.rand 806 | gdi32.DPtoLP 807 | comdlg32.GetSaveFileNameA 808 | oleaut32.17 809 | kernel32.SetThreadLocale 810 | atl.42 811 | ntdll.RtlReleaseSRWLockExclusive 812 | crtdll.atoi 813 | comdlg32.GetSaveFileNameW 814 | advapi32.RegEnumKeyExW 815 | user32.PostThreadMessageW 816 | mfc42.1576 817 | gdi32.GetROP2 818 | kernel32.UnlockFile 819 | api-ms-win-core-processthreads-l1-1-0.GetCurrentThreadId 820 | kernel32.GlobalMemoryStatus 821 | mfc42.1146 822 | user32.MessageBoxIndirectA 823 | user32.MapWindowPoints 824 | gdi32.GetTextColor 825 | msvcrt.isspace 826 | api-ms-win-core-processthreads-l1-1-0.GetCurrentProcessId 827 | gdi32.CreatePolygonRgn 828 | api-ms-win-core-processthreads-l1-1-0.GetCurrentProcess 829 | msvbvm60.__v;aExceptHandler 830 | comctl32.InitCommonControls 831 | mfc42.1168 832 | msvcrt.isdigit 833 | kernel32.VerifyVersionInfoW 834 | user32.PeekMessageW 835 | mfc42.1134 836 | wininet.InternetOpenUrlA 837 | mfc42.1775 838 | mfc42.2385 839 | ntdll.EtwEventRegister 840 | crtdll.sscanf 841 | api-ms-win-core-heap-l1-1-0.HeapSetInformation 842 | gdi32.ExtTextOutA 843 | crtdll._stricmp 844 | kernel32.SetEnvironmentVariableW 845 | ws2_32.14 846 | user32.SendDlgItemMessageA 847 | advapi32.RegDeleteKeyW 848 | winspool.ClosePrinter 849 | ntdll.RtlAcquireSRWLockExclusive 850 | gdi32.GetClipRgn 851 | crtdll._sleep 852 | gdi32.GetClipBox 853 | mfc42.2124 854 | kernel32.lstrcpynW 855 | user32.IsClipboardFormatAvailable 856 | advapi32.SetEntriesInAclA 857 | msvbvm60.57914 858 | gdi32.GetBkColor 859 | ntdll.EtwEventWrite 860 | kernel32.lstrcmpiW 861 | kernel32.lstrcmpW 862 | msvcrt.printf 863 | oleaut32.162 864 | kernel32.IsValidLocale 865 | user32.LoadCursorW 866 | msvcrt.signal 867 | mfc42.2055 868 | user32.GetMessageW 869 | user32.RegisterClassExA 870 | advapi32.GetSecurityInfo 871 | msvcrt.isalnum 872 | kernel32.RemoveDirectoryW 873 | user32.SendMessageW 874 | oleaut32.163 875 | gdi32.CreateDIBSection 876 | crtdll.strncmp 877 | api-ms-win-service-core-l1-1-0.StartServiceCtrlDispatcherW 878 | msvcrt.srand 879 | api-ms-win-core-errorhandling-l1-1-0.UnhandledExceptionFilter 880 | user32.SendMessageTimeoutA 881 | api-ms-win-service-core-l1-1-0.SetServiceStatus 882 | api-ms-win-core-errorhandling-l1-1-0.SetUnhandledExceptionFilter 883 | user32.GetTopWindow 884 | user32.IntersectRect 885 | user32.GetThreadDesktop 886 | gdi32.CreateRoundRectRgn 887 | msvcrt.__p__environ 888 | api-ms-win-core-errorhandling-l1-1-0.GetLastError 889 | user32.GetClassNameW 890 | user32.SetPropA 891 | mfc42.6375 892 | mfc42.6374 893 | mfc42.4234 894 | mfc42.4274 895 | mfc42.4353 896 | user32.DeleteMenu 897 | mfc42.4376 898 | mfc42.6052 899 | mfc42.4407 900 | mfc42.4424 901 | shell32.ShellExecuteExW 902 | kernel32.EnumResourceLanguagesA 903 | mfc42.4425 904 | user32.CreateMenu 905 | kernel32.DosDateTimeToFileTime 906 | mfc42.6376 907 | shell32.DragAcceptFiles 908 | mfc42.2396 909 | mfc42.4080 910 | mfc42.641 911 | mfc42.3738 912 | kernel32.GetCompressedFileSizeA 913 | mfc42.3749 914 | rpcrt4.RpcServerUnregisterIf 915 | oleaut32.19 916 | mfc42.3825 917 | kernel32.DisableThreadLibraryCalls 918 | mfc42.3830 919 | kernel32.GetAtomNameA 920 | kernel32.FreeResource 921 | user32.DrawFocusRect 922 | mfc42.3922 923 | msvcrt._iob 924 | mfc42.4078 925 | mfc42.4079 926 | mfc42.3831 927 | mfc42.4441 928 | msvcrt._except_handler4_common 929 | mfc42.5731 930 | mfc42.5302 931 | mfc42.5300 932 | mfc42.5289 933 | mfc42.4998 934 | user32.SetScrollPos 935 | mfc42.5065 936 | mfc42.5163 937 | mfc42.4853 938 | user32.SetThreadDesktop 939 | mfc42.5241 940 | user32.SetScrollRange 941 | mfc42.5261 942 | mfc42.5265 943 | mfc42.5280 944 | user32.CharLowerA 945 | mfc42.5277 946 | mfc42.5199 947 | api-ms-win-crt-heap-l1-1-0._callnewh 948 | mfc42.4837 949 | user32.SetWindowRgn 950 | mfc42.4465 951 | mfc42.4486 952 | mfc42.4622 953 | mfc42.4627 954 | mfc42.5714 955 | user32.CreateDialogIndirectParamA 956 | mfc42.4673 957 | mfc42.5307 958 | mfc42.4698 959 | mfc42.4710 960 | user32.CreateDesktopA 961 | mfc42.561 962 | user32.CopyRect 963 | mfc42.540 964 | shell32.SHGetSpecialFolderPathA 965 | kernel32.CopyFileW 966 | mfc42.470 967 | mfc42.3597 968 | mfc42.3798 969 | user32.ValidateRect 970 | gdi32.ScaleWindowExtEx 971 | api-ms-win-core-synch-l1-1-0.InitializeSRWLock 972 | user32.GetCapture 973 | kernel32.GetPrivateProfileStringW 974 | user32.FindWindowExA 975 | mfc42.2648 976 | msvcrt.abort 977 | mfc42.2725 978 | gdi32.SetMapMode 979 | api-ms-win-core-sysinfo-l1-1-0.GetSystemTimeAsFileTime 980 | api-ms-win-core-sysinfo-l1-1-0.GetTickCount 981 | msvcrt._setmbcp 982 | mfc42.2976 983 | mfc42.2982 984 | user32.EnumWindows 985 | mfc42.939 986 | msvcrt.atexit 987 | oleaut32.SysAllocString 988 | user32.SetCursorPos 989 | oleaut32.20 990 | mfc42.2446 991 | user32.GetLastActivePopup 992 | mfc42.2512 993 | api-ms-win-core-processthreads-l1-1-0.TerminateProcess 994 | mfc42.2514 995 | mfc42.2554 996 | gdi32.GetViewportExtEx 997 | api-ms-win-core-profile-l1-1-0.QueryPerformanceCounter 998 | oleaut32.4 999 | gdi32.GetViewportOrgEx 1000 | gdi32.GetWindowExtEx 1001 | wininet.FindNextUrlCacheEntryA 1002 | wininet.FindFirstUrlCacheEntryA 1003 | user32.GetCursorPos 1004 | vcruntime140.__std_terminate 1005 | mfc42.825 1006 | mfc42.2915 1007 | mfc42.3147 1008 | mfc42.3081 1009 | mfc42.3136 1010 | user32.SetMenu 1011 | mfc42.324 1012 | user32.SetParent 1013 | gdi32.SetViewportExtEx 1014 | kernel32.GetEnvironmentVariableW 1015 | gdi32.SetViewportOrgEx 1016 | mfc42.3259 1017 | mfc42.815 1018 | gdi32.SetWindowOrgEx 1019 | mfc42.3262 1020 | mfc42.755 1021 | gdi32.TextOutA 1022 | kernel32.GetCurrentDirectoryW 1023 | mfc42.3346 1024 | msvcrt._setmode 1025 | mfc42.823 1026 | mfc42.3079 1027 | user32.CallWindowProcW 1028 | vcruntime140.memmove 1029 | mfc42.2985 1030 | gdi32.SetPixel 1031 | vcruntime140.memcpy 1032 | gdi32.SetPolyFillMode 1033 | kernel32.WriteConsoleA 1034 | kernel32.VerSetConditionMask 1035 | msvcrt.fprintf 1036 | msvcrt.atol 1037 | msvcrt._vsnwprintf 1038 | msvcrt._strdup 1039 | msvcrt._stricmp 1040 | msvcrt._errno 1041 | msvbvm60._adj_fprem? 1042 | msvcrt.floor 1043 | ntdll.NtQuerySystemInformation 1044 | msvcrt._wcsicmp 1045 | msvcrt.__wgetmainargs 1046 | msvbvm60.14877242 1047 | mfc42.2645 1048 | msvbvm60.645 1049 | msvbvm60.EVEN 1050 | mfc42.4160 1051 | msvcrt._vsnprintf 1052 | mfc42.2621 1053 | msvcrt.__1type_info@@UAE@XZ 1054 | msvcrt._CxxThrowException 1055 | msvcrt.fflush 1056 | msvcrt.memchr 1057 | msvcrt.strtod 1058 | mfc42.2614 1059 | msvcrt.__3@YAXPAX@Z 1060 | msvcrt.__2@YAPAXI@Z 1061 | mfc42.2863 1062 | kernel32.VirtualProtectEx 1063 | ntdll.NtOpenThreadToken 1064 | kernel32.FindResourceExA 1065 | user32.SetMenuItemBitmaps 1066 | gdi32.GetStretchBltMode 1067 | user32.DefWindowProcW 1068 | api-ms-win-crt-runtime-l1-1-0._get_narrow_winmain_command_line 1069 | api-ms-win-crt-runtime-l1-1-0._invalid_parameter_noinfo_noreturn 1070 | user32.DrawFrameControl 1071 | gdi32.TranslateCharsetInfo 1072 | gdi32.StartPage 1073 | user32.DrawMenuBar 1074 | user32.SetWindowsHookExW 1075 | gdi32.SetWindowExtEx 1076 | user32.EnumChildWindows 1077 | user32.SetRectEmpty 1078 | user32.EqualRect 1079 | user32.GetAsyncKeyState 1080 | gdi32.ScaleViewportExtEx 1081 | gdi32.RoundRect 1082 | gdi32.PtVisible 1083 | user32.GetClassLongA 1084 | gdi32.Polygon 1085 | user32.GetClipboardData 1086 | gdi32.Pie 1087 | user32.SetDlgItemTextW 1088 | user32.GetDlgCtrlID 1089 | user32.UnregisterHotKey 1090 | gdi32.OffsetViewportOrgEx 1091 | user32.WaitForInputIdle 1092 | user32.CharUpperW 1093 | shell32.CommandLineToArgvW 1094 | msvcp140.__Xlength_error@std@@YAXPBD@Z 1095 | kernel32.FindFirstFileExW 1096 | shell32.DragQueryFileA 1097 | kernel32.FindFirstChangeNotificationW 1098 | api-ms-win-core-registry-l1-1-0.RegOpenKeyExW 1099 | api-ms-win-core-registry-l1-1-0.RegQueryValueExW 1100 | kernel32.ExpandEnvironmentStringsW 1101 | shell32.ShellExecuteExA 1102 | shell32.Shell_NotifyIconA 1103 | shell32.SHGetFileInfoW 1104 | shell32.SHGetFolderPathA 1105 | vcruntime140.__current_exception_context 1106 | shell32.SHGetPathFromIDListW 1107 | kernel32.CreateNamedPipeA 1108 | kernel32.CreateMutexW 1109 | kernel32.CreateFileMappingW 1110 | kernel32.CancelWaitableTimer 1111 | vcruntime140.__current_exception 1112 | shlwapi.PathFindExtensionW 1113 | shlwapi.StrToIntExA 1114 | gdiplus.GdiplusShutdown 1115 | user32.CharUpperBuffW 1116 | user32.WindowFromPoint 1117 | user32.GetDlgItemTextW 1118 | user32.GetKeyboardLayout 1119 | user32.SendDlgItemMessageW 1120 | user32.IsRectEmpty 1121 | dbghelp.MakeSureDirectoryPathExists 1122 | crtdll._open_osfhandle 1123 | crtdll._fdopen 1124 | crtdll._cexit 1125 | crtdll.vsprintf 1126 | crtdll.strncpy 1127 | crtdll.strlen 1128 | crtdll.strcpy 1129 | crtdll.setbuf 1130 | crtdll.malloc 1131 | crtdll.fclose 1132 | comdlg32.GetOpenFileNameA 1133 | user32.LoadIconW 1134 | comdlg32.GetFileTitleA 1135 | comctl32.ImageList_BeginDrag 1136 | comctl32.PropertySheetA 1137 | comctl32.ImageList_DragEnter 1138 | comctl32.InitCommonControlsEx 1139 | comctl32.ImageList_DragLeave 1140 | comctl32.ImageList_ReplaceIcon 1141 | comctl32.ImageList_Remove 1142 | comctl32.ImageList_DragMove 1143 | user32.IsDialogMessageA 1144 | user32.InflateRect 1145 | user32.OemToCharA 1146 | user32.OffsetRect 1147 | user32.GetMenuCheckMarkDimensions 1148 | user32.ScrollWindowEx 1149 | user32.RegisterWindowMessageW 1150 | gdi32.GetPolyFillMode 1151 | user32.GetMessageTime 1152 | gdi32.GetObjectW 1153 | gdi32.GetObjectType 1154 | user32.GetNextDlgTabItem 1155 | user32.GetScrollPos 1156 | user32.GetScrollRange 1157 | gdi32.GetCurrentObject 1158 | kernel32.FlushInstructionCache 1159 | gdi32.GetBkMode 1160 | gdi32.ExtSelectClipRgn 1161 | user32.GetWindowDC 1162 | gdi32.EndPath 1163 | gdi32.EndPage 1164 | gdi32.EndDoc 1165 | gdi32.CreateRectRgnIndirect 1166 | gdi32.CreatePatternBrush 1167 | user32.RegisterClassW 1168 | user32.GetWindowTextW 1169 | user32.RegisterClassExW 1170 | gdi32.CreateEllipticRgn 1171 | user32.RegisterHotKey 1172 | kernel32.FlushViewOfFile 1173 | shell32.SHGetDesktopFolder 1174 | wininet.HttpAddRequestHeadersA 1175 | kernel32.OpenEventW 1176 | ole32.RevokeDragDrop 1177 | ole32.StringFromGUID2 1178 | kernel32.lstrcatW 1179 | kernel32.LockFile 1180 | kernel32.LocalReAlloc 1181 | kernel32.LocalFileTimeToFileTime 1182 | oleaut32.165 1183 | kernel32.GlobalFlags 1184 | api-ms-win-core-registry-l1-1-0.RegCloseKey 1185 | kernel32.GlobalFindAtomA 1186 | kernel32.GlobalAddAtomA 1187 | oleaut32.25 1188 | oleaut32.26 1189 | kernel32.GetVolumeInformationW 1190 | winmm.waveOutReset 1191 | kernel32.PostQueuedCompletionStatus 1192 | ole32.IsEqualGUID 1193 | ole32.CreateStreamOnHGlobal 1194 | advapi32.CryptGenRandom 1195 | advapi32.DeregisterEventSource 1196 | wsock32.4 1197 | advapi32.GetTokenInformation 1198 | advapi32.RegCreateKeyW 1199 | advapi32.RegisterEventSourceW 1200 | ole32.CoAddRefServerProcess 1201 | kernel32.GetSystemDirectoryW 1202 | advapi32.RegQueryInfoKeyW 1203 | kernel32.SetConsoleCursorPosition 1204 | advapi32.SetServiceStatus 1205 | kernel32.SearchPathW 1206 | ole32.CoReleaseServerProcess 1207 | kernel32.ReleaseMutex 1208 | ole32.CoTaskMemRealloc 1209 | kernel32.QueryPerformanceFrequency 1210 | advapi32.ReportEventW 1211 | kernel32.GetLogicalDriveStringsW 1212 | winmm.timeBeginPeriod 1213 | api-ms-win-core-libraryloader-l1-2-0.FreeLibrary 1214 | kernel32.GetCommState 1215 | api-ms-win-core-libraryloader-l1-2-0.LoadLibraryExW 1216 | api-ms-win-core-libraryloader-l1-2-0.GetProcAddress 1217 | kernel32.GetConsoleOutputCP 1218 | kernel32.GetFileSizeEx 1219 | kernel32.GetDateFormatA 1220 | kernel32.GetDiskFreeSpaceW 1221 | kernel32.GetEnvironmentStringsA 1222 | kernel32.GetFileInformationByHandle 1223 | comctl32.ImageList_EndDrag 1224 | user32.TranslateMDISysAccel 1225 | wininet.FtpOpenFileW 1226 | user32.ModifyMenuW 1227 | user32.mouse_event 1228 | ws2_32.17 1229 | ws2_32.151 1230 | msvcr100._CxxThrowException 1231 | wininet.InternetConnectW 1232 | userenv.CreateEnvironmentBlock 1233 | ws2_32.12 1234 | user32.ModifyMenuA 1235 | wininet.InternetCrackUrlA 1236 | ws2_32.101 1237 | ws2_32.10 1238 | winhttp.WinHttpOpen 1239 | winspool.DocumentPropertiesW 1240 | msvcr100.__type_info_dtor_internal_method@type_info@@QAEXXZ 1241 | winspool.DocumentPropertiesA 1242 | user32.RegisterClipboardFormatA 1243 | winmm.waveOutWrite 1244 | msvcr100.__wgetmainargs 1245 | msvcrt.ceil 1246 | user32.WinHelpA 1247 | ws2_32.22 1248 | ws2_32.5 1249 | wininet.HttpOpenRequestW 1250 | wininet.HttpQueryInfoW 1251 | wsock32.9 1252 | wsock32.52 1253 | wininet.HttpSendRequestA 1254 | msvcr100.free 1255 | wsock32.3 1256 | wsock32.23 1257 | wininet.HttpSendRequestW 1258 | wininet.InternetCanonicalizeUrlA 1259 | wsock32.19 1260 | msvcr100.memcpy_s 1261 | wsock32.16 1262 | user32.MessageBeep 1263 | wsock32.116 1264 | wsock32.115 1265 | ws2_32.6 1266 | msvcr100.wcscpy_s 1267 | msvcr100.wcslen 1268 | msvcr100.wcsncpy_s 1269 | msvcr100.memcmp 1270 | msvcrt.fabs 1271 | winmm.waveOutUnprepareHeader 1272 | vcruntime140.__std_type_info_destroy_list 1273 | vcruntime140.memcmp 1274 | wininet.InternetSetOptionW 1275 | uxtheme.IsThemeActive 1276 | userenv.UnloadUserProfile 1277 | winmm.PlaySoundW 1278 | user32.UnionRect 1279 | user32.SetWindowPlacement 1280 | user32.SetWindowsHookExA 1281 | winmm.joyGetDevCapsW 1282 | user32.SetPropW 1283 | winmm.midiStreamStop 1284 | winmm.midiStreamProperty 1285 | winmm.midiStreamOut 1286 | winmm.midiStreamOpen 1287 | winmm.midiStreamClose 1288 | winmm.midiOutUnprepareHeader 1289 | user32.ShowCursor 1290 | user32.SystemParametersInfoW 1291 | winmm.midiOutReset 1292 | user32.TabbedTextOutA 1293 | winmm.midiStreamRestart 1294 | winmm.midiOutPrepareHeader 1295 | vcruntime140.wcsrchr 1296 | winmm.timeGetTime 1297 | msvcrt.ftell 1298 | user32.MapVirtualKeyW 1299 | msvcr100.__CxxFrameHandler3 1300 | msvcr100._wcmdln 1301 | wininet.InternetOpenW 1302 | msvcrt.fseek 1303 | msvcr100.__3@YAXPAX@Z 1304 | msvcr100._recalloc 1305 | user32.RemovePropW 1306 | vcruntime140.wcsstr 1307 | user32.VkKeyScanExA 1308 | winmm.waveOutPrepareHeader 1309 | msvcr100.__2@YAPAXI@Z 1310 | msvcr100.___V@YAXPAX@Z 1311 | winmm.waveOutPause 1312 | user32.UpdateLayeredWindow 1313 | userenv.LoadUserProfileW 1314 | wininet.InternetSetOptionA 1315 | winmm.waveOutGetNumDevs 1316 | winmm.waveOutClose 1317 | wininet.InternetQueryOptionW 1318 | userenv.DestroyEnvironmentBlock 1319 | ntdll.RtlImageNtHeader 1320 | user32.LockWindowUpdate 1321 | ole32.CoRevokeClassObject 1322 | ole32.OleLockRunning 1323 | msvcrt.__mb_cur_max 1324 | oleaut32.11 1325 | oleaut32.146 1326 | msvcrt._write 1327 | oleaut32.18 1328 | oleaut32.186 1329 | msvcrt._wgetcwd 1330 | oleaut32.277 1331 | oleaut32.VariantChangeType 1332 | psapi.GetProcessMemoryInfo 1333 | rasapi32.RasGetConnectStatusA 1334 | rpcrt4.I_RpcMapWin32Status 1335 | ole32.CoRegisterClassObject 1336 | rpcrt4.I_RpcServerDisableExceptionFilter 1337 | rpcrt4.RpcBindingInqAuthClientW 1338 | rpcrt4.RpcBindingToStringBindingW 1339 | rpcrt4.RpcBindingVectorFree 1340 | rpcrt4.RpcEpRegisterW 1341 | rpcrt4.RpcEpUnregister 1342 | rpcrt4.RpcImpersonateClient 1343 | rpcrt4.RpcMgmtSetServerStackSize 1344 | rpcrt4.RpcMgmtStopServerListening 1345 | rpcrt4.RpcMgmtWaitServerListen 1346 | rpcrt4.RpcRevertToSelf 1347 | rpcrt4.RpcServerInqBindings 1348 | rpcrt4.RpcServerListen 1349 | msvcrt._read 1350 | msvcrt._pctype 1351 | rpcrt4.NdrServerCall2 1352 | ole32.CoInitializeEx 1353 | ntdll.EtwEventEnabled 1354 | ole32.CoGetMalloc 1355 | ntdll.RtlInitializeCriticalSection 1356 | ntdll.RtlInitializeSid 1357 | ntdll.RtlLengthRequiredSid 1358 | ntdll.RtlNtStatusToDosErrorNoTeb 1359 | ntdll.RtlExpandEnvironmentStrings 1360 | ntdll.RtlQueryHeapInformation 1361 | ntdll.RtlReleaseSRWLockShared 1362 | ntdll.RtlRunOnceExecuteOnce 1363 | ntdll.RtlSetProcessIsCritical 1364 | ntdll.RtlSubAuthorityCountSid 1365 | ntdll.RtlDeriveCapabilitySidsFromName 1366 | ntdll.RtlSubAuthoritySid 1367 | ntdll.RtlUnhandledExceptionFilter 1368 | ntdll.RtlCopySid 1369 | ntdll.TpAllocTimer 1370 | ntdll.RtlAdjustPrivilege 1371 | ntdll.TpAllocWait 1372 | ntdll.EtwEventUnregister 1373 | ole32.CoGetClassObject 1374 | ntdll.NtDelayExecution 1375 | ole32.CoCreateGuid 1376 | ntdll.NtQueryInformationToken 1377 | ntdll.NtSetInformationProcess 1378 | rpcrt4.RpcServerRegisterIf 1379 | ntdll._vsnwprintf 1380 | ntdll.TpWaitForTimer 1381 | ntdll.TpSetWait 1382 | ntdll.TpSetTimerEx 1383 | ntdll.TpSetTimer 1384 | ntdll.TpReleaseWait 1385 | ntdll.TpReleaseTimer 1386 | ntdll.RtlAcquireSRWLockShared 1387 | user32.MapDialogRect 1388 | rpcrt4.RpcServerRegisterIfEx 1389 | rpcrt4.RpcServerUseProtseqEpW 1390 | msvcrt._ctype 1391 | user32.DialogBoxIndirectParamA 1392 | user32.DialogBoxIndirectParamW 1393 | user32.DialogBoxParamW 1394 | user32.DrawTextW 1395 | msvcrt._assert 1396 | user32.EndDeferWindowPos 1397 | user32.EnumDisplaySettingsA 1398 | user32.GetClassInfoExW 1399 | msvcrt.strxfrm 1400 | msvcrt.strrchr 1401 | user32.GetKeyboardState 1402 | msvcrt.strftime 1403 | ntdll.RtlGetDeviceFamilyInfoEnum 1404 | user32.DefMDIChildProcW 1405 | user32.GetMenuStringW 1406 | user32.GetPropW 1407 | user32.GetTabbedTextExtentW 1408 | user32.GetUpdateRect 1409 | user32.GetWindowTextLengthW 1410 | msvcrt.setvbuf 1411 | msvcrt.setlocale 1412 | user32.GrayStringA 1413 | msvcrt.modf 1414 | user32.IsDialogMessageW 1415 | user32.keybd_event 1416 | msvcrt.localeconv 1417 | user32.LoadImageW 1418 | user32.LoadMenuA 1419 | user32.LoadMenuW 1420 | msvcrt.strcoll 1421 | user32.DefFrameProcA 1422 | user32.DeferWindowPos 1423 | user32.CreateIconFromResourceEx 1424 | rpcrt4.RpcServerUseProtseqW 1425 | rpcrt4.RpcStringBindingParseW 1426 | msvcrt._lseeki64 1427 | rpcrt4.RpcStringFreeW 1428 | msvcrt._ismbblead 1429 | msvcrt._isctype 1430 | msvcrt._fullpath 1431 | shell32.DragQueryFileW 1432 | shell32.ExtractIconW 1433 | msvcrt._fstati64 1434 | msvcrt._findnext 1435 | shell32.SHBrowseForFolderW 1436 | shell32.SHFileOperationW 1437 | shell32.SHGetMalloc 1438 | shlwapi.PathAddBackslashA 1439 | shlwapi.PathFileExistsA 1440 | shlwapi.PathGetArgsA 1441 | user32.CreateIconFromResource 1442 | user32.CreateDialogParamW 1443 | user32.CreateDialogIndirectParamW 1444 | user32.CreateAcceleratorTableW 1445 | user32.CopyImage 1446 | msvcrt._fdopen 1447 | rpcrt4.RpcServerUnregisterIfEx 1448 | msvcrt._findclose 1449 | user32.ChildWindowFromPointEx 1450 | msvcrt._findfirst 1451 | user32.BeginDeferWindowPos 1452 | urlmon.URLDownloadToFileA 1453 | shlwapi.PathRemoveArgsA 1454 | shlwapi.PathQuoteSpacesA 1455 | user32.CopyAcceleratorTableA 1456 | msvcp140.__Xbad_alloc@std@@YAXXZ 1457 | advapi32.AbortSystemShutdownA 1458 | api-ms-win-security-base-l1-1-0.SetSecurityDescriptorDacl 1459 | api-ms-win-core-synch-l1-1-0.AcquireSRWLockExclusive 1460 | api-ms-win-core-synch-l1-1-0.AcquireSRWLockShared 1461 | api-ms-win-core-synch-l1-1-0.EnterCriticalSection 1462 | api-ms-win-core-synch-l1-1-0.LeaveCriticalSection 1463 | api-ms-win-core-synch-l1-1-0.ReleaseSRWLockExclusive 1464 | kernel32.GetStringTypeExW 1465 | api-ms-win-core-synch-l1-1-0.ReleaseSRWLockShared 1466 | api-ms-win-core-sysinfo-l1-1-0.GetTickCount64 1467 | gdi32.TextOutW 1468 | gdi32.StretchDIBits 1469 | kernel32.GetSystemWindowsDirectoryW 1470 | gdi32.StartDocA 1471 | kernel32.GetTimeFormatA 1472 | kernel32.GetUserDefaultLangID 1473 | api-ms-win-core-threadpool-private-l1-1-0.RegisterWaitForSingleObjectEx 1474 | gdi32.SetTextAlign 1475 | gdi32.SetRectRgn 1476 | gdi32.PtInRegion 1477 | gdi32.SetAbortProc 1478 | kernel32.HeapCompact 1479 | gdi32.SetBrushOrgEx 1480 | kernel32.GlobalGetAtomNameA 1481 | api-ms-win-crt-multibyte-l1-1-0._mbschr 1482 | kernel32.RtlMoveMemory 1483 | api-ms-win-crt-math-l1-1-0.floor 1484 | kernel32.GlobalAddAtomW 1485 | gdi32.SetDIBColorTable 1486 | gdi32.SetDIBits 1487 | gdi32.SetEnhMetaFileBits 1488 | api-ms-win-crt-filesystem-l1-1-0._splitpath_s 1489 | gdi32.SetMapperFlags 1490 | api-ms-win-crt-locale-l1-1-0.__initialize_lconv_for_unsigned_char 1491 | api-ms-win-crt-runtime-l1-1-0._configure_wide_argv 1492 | api-ms-win-core-string-l1-1-0.MultiByteToWideChar 1493 | kernel32.GetProfileStringA 1494 | kernel32.GetFileAttributesExA 1495 | kernel32.GetFileAttributesExW 1496 | kernel32.GetLogicalDriveStringsA 1497 | msimg32.TransparentBlt 1498 | mpr.WNetUseConnectionW 1499 | kernel32.GetLongPathNameW 1500 | kernel32.GetNativeSystemInfo 1501 | kernel32.GetNumberFormatA 1502 | mpr.WNetAddConnection2A 1503 | kernel32.GetOverlappedResult 1504 | api-ms-win-core-localization-l1-2-0.LCMapStringW 1505 | gdiplus.GdipCreateBitmapFromStreamICM 1506 | gdiplus.GdipCreateBitmapFromStream 1507 | gdiplus.GdipCreateBitmapFromScan0 1508 | api-ms-win-core-processenvironment-l1-1-0.ExpandEnvironmentStringsW 1509 | api-ms-win-core-processenvironment-l1-1-0.GetCommandLineW 1510 | api-ms-win-core-processthreads-l1-1-0.ExitProcess 1511 | api-ms-win-core-string-l1-1-0.CompareStringOrdinal 1512 | api-ms-win-core-sidebyside-l1-1-0.ReleaseActCtx 1513 | api-ms-win-core-sidebyside-l1-1-0.DeactivateActCtx 1514 | api-ms-win-core-sidebyside-l1-1-0.CreateActCtxW 1515 | mfc42.535 1516 | api-ms-win-core-sidebyside-l1-1-0.ActivateActCtx 1517 | kernel32.GetQueuedCompletionStatus 1518 | kernel32.GetProcessVersion 1519 | api-ms-win-core-registry-l1-1-0.RegEnumKeyExW 1520 | api-ms-win-core-registry-l1-1-0.RegDisablePredefinedCacheEx 1521 | api-ms-win-core-processthreads-l1-1-2.SetProtectedPolicy 1522 | api-ms-win-core-processthreads-l1-1-1.SetProcessMitigationPolicy 1523 | api-ms-win-core-processthreads-l1-1-0.SetProcessAffinityUpdateMode 1524 | api-ms-win-core-processthreads-l1-1-0.OpenProcessToken 1525 | api-ms-win-core-registry-l1-1-0.RegGetValueW 1526 | kernel32.GetDateFormatW 1527 | api-ms-win-crt-runtime-l1-1-0._execute_onexit_table 1528 | api-ms-win-crt-runtime-l1-1-0._initialize_wide_environment 1529 | api-ms-win-security-base-l1-1-0.InitializeAcl 1530 | kernel32.SetPriorityClass 1531 | api-ms-win-security-base-l1-1-0.InitializeSecurityDescriptor 1532 | kernel32.SetInformationJobObject 1533 | gdi32.GetNearestPaletteIndex 1534 | api-ms-win-security-base-l1-1-0.SetSecurityDescriptorGroup 1535 | api-ms-win-security-base-l1-1-0.SetSecurityDescriptorOwner 1536 | kernel32.SetFileShortNameA 1537 | kernel32.SetCurrentDirectoryW 1538 | api-ms-win-service-core-l1-1-0.RegisterServiceCtrlHandlerExW 1539 | api-ms-win-service-private-l1-1-3.I_RegisterSvchostNotificationCallback 1540 | api-ms-win-service-winsvc-l1-1-0.RegisterServiceCtrlHandlerW 1541 | appvisvsubsystems32.1 1542 | gdi32.GetNearestColor 1543 | avicap32.capGetDriverDescriptionA 1544 | kernel32.OpenFileMappingW 1545 | gdi32.GetCharWidthW 1546 | gdi32.BeginPath 1547 | kernel32.SetCommState 1548 | kernel32.SetConsoleCtrlHandler 1549 | kernel32.ReadConsoleW 1550 | gdi32.CreateDCA 1551 | kernel32.SetConsoleWindowInfo 1552 | gdi32.GetPaletteEntries 1553 | kernel32.ReadConsoleA 1554 | comdlg32.CommDlgExtendedError 1555 | gdi32.CreateFontIndirectW 1556 | kernel32.QueryMemoryResourceNotification 1557 | gdi32.CreateHatchBrush 1558 | comctl32.ImageList_DragShowNolock 1559 | gdi32.FrameRgn 1560 | comdlg32.GetOpenFileNameW 1561 | api-ms-win-crt-runtime-l1-1-0._get_wide_winmain_command_line 1562 | api-ms-win-security-base-l1-1-0.GetTokenInformation 1563 | api-ms-win-security-base-l1-1-0.GetLengthSid 1564 | api-ms-win-crt-runtime-l1-1-0._seh_filter_dll 1565 | api-ms-win-crt-stdio-l1-1-0.__acrt_iob_func 1566 | api-ms-win-crt-stdio-l1-1-0.__stdio_common_vfprintf 1567 | kernel32.LocalSize 1568 | api-ms-win-crt-stdio-l1-1-0.__stdio_common_vswprintf_s 1569 | gdi32.PathToRegion 1570 | gdi32.OffsetWindowOrgEx 1571 | gdi32.OffsetRgn 1572 | kernel32.WriteProcessMemory 1573 | kernel32.WerRegisterMemoryBlock 1574 | gdi32.IntersectClipRect 1575 | gdi32.GetTextMetricsW 1576 | api-ms-win-crt-string-l1-1-0.wcscpy_s 1577 | api-ms-win-crt-string-l1-1-0.wcslen 1578 | kernel32.VerifyVersionInfoA 1579 | api-ms-win-crt-string-l1-1-0.wcsncat_s 1580 | kernel32.UnregisterWaitEx 1581 | kernel32.SetSystemTime 1582 | api-ms-win-security-base-l1-1-0.AddAccessAllowedAce 1583 | gdi32.GetPixel 1584 | api-ms-win-eventing-provider-l1-1-0.EventWriteTransfer 1585 | api-ms-win-eventing-provider-l1-1-0.EventSetInformation 1586 | kernel32.SetVolumeLabelA 1587 | kernel32.SetSystemPowerState 1588 | api-ms-win-eventing-provider-l1-1-0.EventRegister 1589 | kernel32.SignalObjectAndWait 1590 | api-ms-win-crt-utility-l1-1-0.bsearch_s 1591 | gdi32.GetRgnBox 1592 | gdi32.GetTextAlign 1593 | gdi32.GetTextExtentPointA 1594 | api-ms-win-crt-string-l1-1-0.wcsncpy_s 1595 | kernel32.SetWaitableTimer 1596 | gdiplus.GdipDeleteGraphics 1597 | api-ms-win-core-string-l1-1-0.WideCharToMultiByte 1598 | kernel32.GetCPInfoExA 1599 | kernel32.EnumCalendarInfoW 1600 | msvcp140.__1_$basic_ios@DU_$char_traits@D@std@@@std@@UAE@XZ 1601 | kernel32.EnumResourceLanguagesW 1602 | advapi32.RegOpenKeyW 1603 | gdiplus.GdipGetImageHeight 1604 | advapi32.CreateServiceA 1605 | advapi32.RegQueryValueA 1606 | kernel32.EnumSystemLocalesA 1607 | advapi32.DeleteService 1608 | msvbvm60.__vbaStrCmp 1609 | gdiplus.GdipGetImageGraphicsContext 1610 | msvcp140._showmanyc@_$basic_streambuf@DU_$char_traits@D@std@@@std@@MAE_JXZ 1611 | msvcp140.__1_$basic_streambuf@DU_$char_traits@D@std@@@std@@UAE@XZ 1612 | kernel32.FindFirstChangeNotificationA 1613 | advapi32.StartServiceA 1614 | advapi32.StartServiceCtrlDispatcherA 1615 | msvbvm60.__vbaGenerateBoundsError 1616 | msvbvm60.__vbaFpI4 1617 | kernel32.EnumSystemLocalesW 1618 | advapi32.RegisterServiceCtrlHandlerA 1619 | msvcp140.__0_$basic_streambuf@DU_$char_traits@D@std@@@std@@IAE@XZ 1620 | advapi32.RegEnumValueW 1621 | msvcp140.__Unlock@_$basic_streambuf@DU_$char_traits@D@std@@@std@@UAEXXZ 1622 | msvcp140._setbuf@_$basic_streambuf@DU_$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z 1623 | kernel32.CreateNamedPipeW 1624 | msvcp140._sync@_$basic_streambuf@DU_$char_traits@D@std@@@std@@MAEHXZ 1625 | msvcp140._uflow@_$basic_streambuf@DU_$char_traits@D@std@@@std@@MAEHXZ 1626 | msvcp140._imbue@_$basic_streambuf@DU_$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z 1627 | kernel32.AttachConsole 1628 | msvcp140._xsgetn@_$basic_streambuf@DU_$char_traits@D@std@@@std@@MAE_JPAD_J@Z 1629 | api-ms-win-core-heap-l2-1-0.LocalFree 1630 | msvcp140._xsputn@_$basic_streambuf@DU_$char_traits@D@std@@@std@@MAE_JPBD_J@Z 1631 | advapi32.InitiateSystemShutdownA 1632 | kernel32.DebugBreak 1633 | advapi32.LookupPrivilegeValueW 1634 | iphlpapi.IcmpSendEcho 1635 | advapi32.OpenSCManagerA 1636 | advapi32.OpenServiceA 1637 | msvcp140.__0_$basic_ios@DU_$char_traits@D@std@@@std@@IAE@XZ 1638 | gdiplus.GdipGetImageWidth 1639 | advapi32.DuplicateTokenEx 1640 | api-ms-win-core-crt-l1-1-0.memcpy 1641 | api-ms-win-core-crt-l1-1-0.memset 1642 | kernel32.CreateActCtxA 1643 | msvbvm60.__vbaEx_eptHandler 1644 | api-ms-win-core-crt-l1-1-0.qsort_s 1645 | api-ms-win-core-delayload-l1-1-0.DelayLoadFailureHook 1646 | api-ms-win-core-delayload-l1-1-1.ResolveDelayLoadedAPI 1647 | api-ms-win-core-crt-l2-1-0.__wgetmainargs 1648 | api-ms-win-core-errorhandling-l1-1-0.SetErrorMode 1649 | kernel32.GetBinaryTypeW 1650 | api-ms-win-core-crt-l2-1-0._initterm_e 1651 | api-ms-win-core-handle-l1-1-0.CloseHandle 1652 | api-ms-win-core-heap-l1-1-0.GetProcessHeap 1653 | msvbvm60.__vbaAryConstruct2 1654 | msvcp140.__Lock@_$basic_streambuf@DU_$char_traits@D@std@@@std@@UAEXXZ 1655 | kernel32.FreeConsole 1656 | api-ms-win-core-crt-l2-1-0._initterm 1657 | api-ms-win-core-heap-l1-1-0.HeapAlloc 1658 | api-ms-win-core-heap-l1-1-0.HeapFree 1659 | gdiplus.GdipDisposeImage 1660 | msvbvm60.648 1661 | api-ms-win-core-crt-l1-1-0._wcsicmp 1662 | advapi32.ControlService 1663 | msvbvm60.608 1664 | msvcp140.__Pninc@_$basic_streambuf@DU_$char_traits@D@std@@@std@@IAEPADXZ 1665 | api-ms-win-core-heap-l2-1-0.LocalAlloc 1666 | sqlite.sqlite3_prepare_v2 1667 | user32.BringWindowToTop 1668 | sqlite.sqlite3_reset 1669 | sqlite.sqlite3_result_error 1670 | gdi32.GetPath 1671 | sqlite.sqlite3_result_value 1672 | sqlite.sqlite3_open_v2 1673 | sqlite.sqlite3_step 1674 | sqlite.sqlite3_changes 1675 | gdi32.GetTextFaceA 1676 | sqlite.sqlite3_last_insert_rowid 1677 | gdi32.ColorCorrectPalette 1678 | sqlite.sqlite3_value_int 1679 | user32.InvalidateRgn 1680 | user32.InvertRect 1681 | user32.GetMenuItemInfoW 1682 | gdi32.GetTextCharsetInfo 1683 | gdiplus.GdipSetWorldTransform 1684 | user32.AppendMenuW 1685 | hal.HalMakeBeep 1686 | hal.KfReleaseSpinLock 1687 | sqlite.sqlite3_busy_handler 1688 | urlmon.URLOpenBlockingStreamA 1689 | gdi32.GetTextExtentPoint32W 1690 | imm32.ImmGetCompositionStringW 1691 | user32.GetMenuDefaultItem 1692 | sqlite.sqlite3_get_autocommit 1693 | gdiplus.GdipSetTextRenderingHint 1694 | user32.GetMenuBarInfo 1695 | gdi32.GetTextExtentPointW 1696 | user32.IsCharLowerW 1697 | sqlite.sqlite3_value_type 1698 | sqlite.sqlite3_bind_text 1699 | gdi32.CopyEnhMetaFileW 1700 | sqlite.sqlite3_column_bytes 1701 | sqlite.sqlite3_free 1702 | gdi32.ExtTextOutW 1703 | gdi32.ExtFloodFill 1704 | gdi32.ExtCreateRegion 1705 | gdi32.ExtCreatePen 1706 | gdi32.EnumMetaFile 1707 | gdi32.EnumFontsW 1708 | gdi32.EnumFontFamiliesW 1709 | sqlite.sqlite3_column_text 1710 | gdi32.EnumFontFamiliesExW 1711 | gdi32.CreateDIBPatternBrushPt 1712 | sqlite.sqlite3_column_double 1713 | gdi32.EngCheckAbort 1714 | gdi32.DeleteMetaFile 1715 | user32.GetWindowRgn 1716 | gdi32.CreateMetaFileW 1717 | gdi32.CreateFontW 1718 | gdi32.CreateICA 1719 | sqlite.sqlite3_column_int64 1720 | sqlite.sqlite3_column_int 1721 | user32.GetTabbedTextExtentA 1722 | gdi32.FillPath 1723 | sqlite.sqlite3_column_type 1724 | gdi32.GetBoundsRect 1725 | sqlite.sqlite3_close 1726 | user32.GetMonitorInfoW 1727 | sqlite.sqlite3_column_blob 1728 | user32.InsertMenuW 1729 | user32.InsertMenuItemW 1730 | sqlite.sqlite3_finalize 1731 | sqlite.sqlite3_exec 1732 | sqlite.sqlite3_errmsg 1733 | user32.InSendMessage 1734 | gdi32.CopyMetaFileW 1735 | user32.GetNextDlgGroupItem 1736 | gdi32.GetMetaFileBitsEx 1737 | gdi32.GetMapMode 1738 | gdi32.GetEnhMetaFileHeader 1739 | user32.GrayStringW 1740 | user32.GetScrollInfo 1741 | sqlite.sqlite3_errcode 1742 | sqlite.sqlite3_create_function 1743 | gdi32.GetDCOrgEx 1744 | gdi32.GetCharWidthA 1745 | gdi32.CreateDCW 1746 | gdi32.GetEnhMetaFileBits 1747 | gdiplus.GdipGetTextRenderingHint 1748 | user32.GetKeyNameTextW 1749 | gdiplus.GdipDrawString 1750 | gdiplus.GdipFillRectangle 1751 | gdiplus.GdipFree 1752 | gdiplus.GdipBitmapLockBits 1753 | user32.CreateCursor 1754 | gdiplus.GdipGetFontHeight 1755 | gdiplus.GdipGetFontSize 1756 | gdiplus.GdipGetFontStyle 1757 | gdiplus.GdipGetFontUnit 1758 | gdiplus.GdipAlloc 1759 | gdiplus.GdipGetImageDimension 1760 | gdi32.UpdateColors 1761 | user32.CopyAcceleratorTableW 1762 | gdiplus.GdipGetImageEncoders 1763 | user32.CloseWindow 1764 | gdi32.StartDocW 1765 | user32.DrawStateW 1766 | gdiplus.GdipGetImageEncodersSize 1767 | user32.DrawTextExA 1768 | user32.DrawTextExW 1769 | gdi32.SetWorldTransform 1770 | user32.DragDetect 1771 | gdi32.SetWinMetaFileBits 1772 | gdiplus.GdipBitmapUnlockBits 1773 | gdiplus.GdipDrawRectangleI 1774 | gdiplus.GdipDeleteFontFamily 1775 | gdiplus.GdipDeleteFont 1776 | user32.DefFrameProcW 1777 | user32.DefMDIChildProcA 1778 | gdiplus.GdipDeleteBrush 1779 | gdiplus.GdipCreateStringFormat 1780 | gdiplus.GdipCreateSolidFill 1781 | gdiplus.GdipCreatePen1 1782 | gdiplus.GdipDeletePen 1783 | gdiplus.GdipCreateFromHDC 1784 | gdiplus.GdipCreateFontFromDC 1785 | gdiplus.GdipDrawImageI 1786 | gdiplus.GdipCreateFontFamilyFromName 1787 | gdiplus.GdipCreateFont 1788 | user32.CreateIconIndirect 1789 | gdiplus.GdipDrawImagePointRect 1790 | gdiplus.GdipCreateBitmapFromFileICM 1791 | gdiplus.GdipDrawImageRect 1792 | gdiplus.GdipDrawLine 1793 | gdiplus.GdipCreateBitmapFromFile 1794 | gdiplus.GdipDrawRectangle 1795 | gdiplus.GdipCloneImage 1796 | gdi32.SetTextJustification 1797 | user32.EnableScrollBar 1798 | gdi32.SetTextCharacterExtra 1799 | gdi32.PlayMetaFileRecord 1800 | user32.CharPrevW 1801 | gdi32.PlayMetaFile 1802 | gdiplus.GdipImageSelectActiveFrame 1803 | gdiplus.GdipLoadImageFromStream 1804 | gdiplus.GdipSaveImageToStream 1805 | user32.GetDCEx 1806 | gdi32.PlayEnhMetaFile 1807 | user32.GetDialogBaseUnits 1808 | user32.ChangeWindowMessageFilterEx 1809 | gdiplus.GdipSetSmoothingMode 1810 | user32.GetDlgItemInt 1811 | gdi32.OffsetClipRgn 1812 | user32.GetDoubleClickTime 1813 | gdi32.ModifyWorldTransform 1814 | gdi32.MaskBlt 1815 | gdi32.InvertRgn 1816 | gdiplus.GdipSetStringFormatAlign 1817 | user32.GetInputState 1818 | gdi32.GetWinMetaFileBits 1819 | gdiplus.GdipSetStringFormatLineAlign 1820 | gdi32.PolyBezierTo 1821 | gdi32.PolyDraw 1822 | gdi32.Polyline 1823 | gdi32.PolylineTo 1824 | gdi32.SetPixelV 1825 | gdi32.SetPaletteEntries 1826 | gdi32.SetMetaFileBitsEx 1827 | user32.EnumThreadWindows 1828 | gdi32.SetGraphicsMode 1829 | gdi32.SetDIBitsToDevice 1830 | user32.CheckRadioButton 1831 | gdiplus.GdipGetImagePalette 1832 | user32.FindWindowExW 1833 | user32.FindWindowW 1834 | gdi32.GetTextFaceW 1835 | gdi32.SetColorAdjustment 1836 | user32.FrameRect 1837 | gdiplus.GdipGetImagePixelFormat 1838 | gdiplus.GdipGetImageRawFormat 1839 | user32.GetAncestor 1840 | gdi32.SetArcDirection 1841 | gdiplus.GdipGetSmoothingMode 1842 | gdi32.SelectClipPath 1843 | gdi32.RectInRegion 1844 | user32.GetClassInfoW 1845 | user32.GetClassLongW 1846 | gdiplus.GdipGetImagePaletteSize 1847 | gdi32.CloseMetaFile 1848 | msvcp140.__W_Getdays@_Locinfo@std@@QBEPBGXZ 1849 | user32.IsDlgButtonChecked 1850 | winmm.mciGetCreatorTask 1851 | winmm.mciSendStringW 1852 | winmm.midiInMessage 1853 | api-ms-win-core-interlocked-l1-1-0.InterlockedCompareExchange 1854 | winmm.midiOutSetVolume 1855 | winmm.mixerGetLineControlsW 1856 | winmm.mmioOpenA 1857 | winmm.mmioRead 1858 | winmm.mmioSetBuffer 1859 | winmm.mmioWrite 1860 | winmm.timeEndPeriod 1861 | winmm.timeSetEvent 1862 | winmm.waveInGetErrorTextA 1863 | winmm.joySetThreshold 1864 | winmm.waveInGetPosition 1865 | winmm.waveOutGetErrorTextW 1866 | advapi32.TraceMessage 1867 | winmm.waveOutSetVolume 1868 | advapi32.StartTraceW 1869 | advapi32.StartServiceCtrlDispatcherW 1870 | advapi32.SetTokenInformation 1871 | winspool.GetJobW 1872 | advapi32.SetThreadToken 1873 | advapi32.SetKernelObjectSecurity 1874 | advapi32.SetFileSecurityW 1875 | advapi32.SetFileSecurityA 1876 | advapi32.RevertToSelf 1877 | advapi32.RegUnLoadKeyW 1878 | winmm.waveOutGetDevCapsA 1879 | advapi32.RegSetValueW 1880 | winmm.joyGetPosEx 1881 | winmm.GetDriverModuleHandle 1882 | api-ms-win-core-threadpool-l1-1-0.CloseThreadpoolWork 1883 | api-ms-win-core-synch-l1-2-0.Sleep 1884 | vcruntime140._setjmp3 1885 | vcruntime140.__telemetry_main_invoke_trigger 1886 | vcruntime140.__telemetry_main_return_trigger 1887 | vcruntime140.__vcrt_InitializeCriticalSectionEx 1888 | version.GetFileVersionInfoSizeW 1889 | version.GetFileVersionInfoW 1890 | winhttp.WinHttpReadData 1891 | api-ms-win-core-registry-l1-1-0.RegQueryValueExA 1892 | wininet.FtpGetFileSize 1893 | api-ms-win-core-misc-l1-1-0.Sleep 1894 | api-ms-win-core-localregistry-l1-1-0.RegQueryValueExW 1895 | api-ms-win-core-interlocked-l1-1-0.InterlockedDecrement 1896 | api-ms-win-core-localregistry-l1-1-0.RegQueryValueExA 1897 | api-ms-win-core-localregistry-l1-1-0.RegCloseKey 1898 | wininet.InternetCrackUrlW 1899 | api-ms-win-core-libraryloader-l1-2-0.GetModuleHandleW 1900 | api-ms-win-core-libraryloader-l1-1-0.LoadLibraryExW 1901 | wininet.InternetOpenUrlW 1902 | api-ms-win-core-libraryloader-l1-1-0.GetProcAddress 1903 | wininet.InternetQueryDataAvailable 1904 | api-ms-win-core-libraryloader-l1-1-0.GetModuleHandleA 1905 | api-ms-win-core-libraryloader-l1-1-0.FreeLibrary 1906 | api-ms-win-core-interlocked-l1-1-0.InterlockedIncrement 1907 | api-ms-win-core-interlocked-l1-1-0.InterlockedExchange 1908 | winmm.DefDriverProc 1909 | winmm.DrvGetModuleHandle 1910 | api-ms-win-core-localregistry-l1-1-0.RegOpenKeyExW 1911 | advapi32.RegSaveKeyW 1912 | advapi32.RegRestoreKeyW 1913 | advapi32.RegReplaceKeyW 1914 | wsock32.21 1915 | wsock32.22 1916 | advapi32.GetSecurityDescriptorLength 1917 | advapi32.GetSecurityDescriptorControl 1918 | advapi32.GetKernelObjectSecurity 1919 | advapi32.GetFileSecurityW 1920 | wsock32.57 1921 | advapi32.GetAce 1922 | wsock32.accept 1923 | advapi32.EqualSid 1924 | advapi32.EnableTrace 1925 | advapi32.DuplicateToken 1926 | advapi32.CryptHashData 1927 | wsock32.20 1928 | advapi32.CreateWellKnownSid 1929 | advapi32.CreateProcessAsUserW 1930 | advapi32.CreateProcessAsUserA 1931 | advapi32.ConvertStringSecurityDescriptorToSecurityDescriptorW 1932 | wsock32.listen 1933 | wsock32.recv 1934 | advapi32.ControlTraceW 1935 | advapi32.CloseTrace 1936 | advapi32.ChangeServiceConfigA 1937 | advapi32.ChangeServiceConfig2W 1938 | wsock32.WSAGetLastError 1939 | advapi32.ChangeServiceConfig2A 1940 | wsock32.__WSAFDIsSet 1941 | wtsapi32.WTSEnumerateSessionsW 1942 | wsock32.htonl 1943 | wsock32.2 1944 | advapi32.GetTraceEnableFlags 1945 | wsock32.18 1946 | advapi32.RegQueryValueW 1947 | advapi32.RegQueryInfoKeyA 1948 | advapi32.RegNotifyChangeKeyValue 1949 | advapi32.RegLoadKeyW 1950 | advapi32.RegisterTraceGuidsW 1951 | advapi32.RegisterServiceCtrlHandlerW 1952 | advapi32.RegGetValueW 1953 | advapi32.RegEnumKeyW 1954 | advapi32.RegConnectRegistryW 1955 | advapi32.QueryServiceStatus 1956 | advapi32.OpenThreadToken 1957 | advapi32.IsValidSecurityDescriptor 1958 | ws2_32.WSAConnect 1959 | ws2_32.WSAIoctl 1960 | ws2_32.WSARecv 1961 | ws2_32.WSASend 1962 | ws2_32.WSASocketA 1963 | wsock32.1 1964 | wsock32.10 1965 | wsock32.11 1966 | wsock32.111 1967 | advapi32.ImpersonateLoggedOnUser 1968 | advapi32.GetTraceLoggerHandle 1969 | wsock32.12 1970 | wsock32.13 1971 | wsock32.15 1972 | wsock32.151 1973 | advapi32.GetTraceEnableLevel 1974 | wsock32.17 1975 | vcruntime140.wcschr 1976 | gdi32.ChoosePixelFormat 1977 | vcruntime140.strrchr 1978 | api-ms-win-core-threadpool-l1-1-0.CreateThreadpoolWork 1979 | avifil32.AVIStreamRelease 1980 | avifil32.AVIStreamOpenFromFileA 1981 | user32.NotifyWinEvent 1982 | avifil32.AVIStreamGetFrameClose 1983 | avifil32.AVIStreamGetFrame 1984 | avifil32.AVIFileInit 1985 | avicap32.videoThunk32 1986 | avicap32.capGetDriverDescriptionW 1987 | avicap32.capCreateCaptureWindowW 1988 | avicap32.capCreateCaptureWindowA 1989 | avicap32.AppCleanup 1990 | atl.47 1991 | atl.11 1992 | cabinet.20 1993 | atl.10 1994 | sqlite.sqlite3_bind_parameter_count 1995 | user32.RemoveMenu 1996 | user32.ReuseDDElParam 1997 | user32.ScrollWindow 1998 | api-ms-win-crt-time-l1-1-0._time64 1999 | api-ms-win-crt-time-l1-1-0._localtime64_s 2000 | user32.SendNotifyMessageW 2001 | api-ms-win-crt-string-l1-1-0._wcsnicmp 2002 | api-ms-win-crt-string-l1-1-0._wcslwr 2003 | api-ms-win-crt-string-l1-1-0._wcsicmp 2004 | user32.SetClassLongW 2005 | api-ms-win-crt-string-l1-1-0._memicmp 2006 | api-ms-win-crt-string-l1-1-0.wcspbrk 2007 | user32.RegisterClipboardFormatW 2008 | user32.SetDlgItemInt 2009 | user32.MonitorFromWindow 2010 | cabinet.22 2011 | user32.IsMenu 2012 | gdi32.ArcTo 2013 | gdi32.AddFontResourceA 2014 | gdi32.AbortDoc 2015 | fltmgr.FltReleaseFileNameInformation 2016 | dnsapi.DnsRecordListFree 2017 | dnsapi.DnsQuery_A 2018 | dbghelp.ImageDirectoryEntryToData 2019 | user32.LoadAcceleratorsW 2020 | cryptdll.CDLocateRng 2021 | user32.LoadBitmapW 2022 | crtdll._strcmpi 2023 | crtdll._itoa 2024 | cabinet.21 2025 | comdlg32.GetFileTitleW 2026 | comctl32.MenuHelp 2027 | user32.LoadMenuIndirectW 2028 | comctl32.ImageList_SetIconSize 2029 | comctl32.ImageList_SetDragCursorImage 2030 | comctl32.ImageList_GetImageCount 2031 | comctl32.ImageList_GetIconSize 2032 | comctl32.ImageList_GetIcon 2033 | user32.MapVirtualKeyExW 2034 | comctl32.ImageList_DrawEx 2035 | comctl32.CreateMappedBitmap 2036 | comctl32.345 2037 | comctl32.344 2038 | cabinet.23 2039 | comdlg32.ChooseFontA 2040 | api-ms-win-crt-string-l1-1-0.wcscmp 2041 | user32.SetLastErrorEx 2042 | user32.SetLayeredWindowAttributes 2043 | user32.UnpackDDElParam 2044 | user32.UnregisterClassW 2045 | api-ms-win-crt-heap-l1-1-0._get_heap_handle 2046 | api-ms-win-crt-heap-l1-1-0._aligned_malloc 2047 | api-ms-win-crt-heap-l1-1-0._aligned_free 2048 | api-ms-win-crt-heap-l1-1-0.calloc 2049 | api-ms-win-crt-filesystem-l1-1-0._wfullpath 2050 | user32.WaitMessage 2051 | user32.WindowFromDC 2052 | api-ms-win-crt-filesystem-l1-1-0._makepath_s 2053 | user32.WinHelpW 2054 | api-ms-win-crt-filesystem-l1-1-0._fullpath 2055 | api-ms-win-crt-filesystem-l1-1-0.remove 2056 | api-ms-win-crt-multibyte-l1-1-0._mbscspn 2057 | api-ms-win-crt-convert-l1-1-0.wcstoul 2058 | api-ms-win-crt-convert-l1-1-0.atoi 2059 | api-ms-win-crt-convert-l1-1-0.atof 2060 | uxtheme.GetThemeFont 2061 | uxtheme.GetThemePartSize 2062 | uxtheme.GetThemeTextExtent 2063 | uxtheme.HitTestThemeBackground 2064 | api-ms-win-core-threadpool-l1-2-0.SubmitThreadpoolWork 2065 | uxtheme.OpenThemeData 2066 | vcruntime140.longjmp 2067 | vcruntime140.memchr 2068 | api-ms-win-core-threadpool-l1-2-0.CreateThreadpoolWork 2069 | api-ms-win-core-threadpool-l1-2-0.CloseThreadpoolWork 2070 | api-ms-win-core-threadpool-l1-1-0.SubmitThreadpoolWork 2071 | api-ms-win-crt-convert-l1-1-0.atol 2072 | api-ms-win-crt-multibyte-l1-1-0._mbslwr 2073 | api-ms-win-crt-multibyte-l1-1-0._mbsnbcmp 2074 | user32.TranslateAcceleratorW 2075 | api-ms-win-crt-string-l1-1-0.wcscat_s 2076 | user32.SetMenuDefaultItem 2077 | api-ms-win-crt-string-l1-1-0.toupper 2078 | api-ms-win-crt-string-l1-1-0.tolower 2079 | api-ms-win-crt-string-l1-1-0.strncpy 2080 | api-ms-win-crt-string-l1-1-0.strlen 2081 | api-ms-win-crt-string-l1-1-0.strcpy_s 2082 | api-ms-win-crt-string-l1-1-0.isspace 2083 | user32.SetScrollInfo 2084 | api-ms-win-crt-string-l1-1-0.isdigit 2085 | api-ms-win-crt-string-l1-1-0.iscntrl 2086 | api-ms-win-crt-string-l1-1-0.isalpha 2087 | api-ms-win-crt-string-l1-1-0.isalnum 2088 | user32.SetWindowContextHelpId 2089 | api-ms-win-crt-stdio-l1-1-0.__stdio_common_vswscanf 2090 | api-ms-win-crt-stdio-l1-1-0.__stdio_common_vswprintf 2091 | api-ms-win-crt-stdio-l1-1-0._getcwd 2092 | user32.ShowOwnedPopups 2093 | user32.ShowScrollBar 2094 | api-ms-win-crt-runtime-l1-1-0._crt_at_quick_exit 2095 | user32.SubtractRect 2096 | api-ms-win-crt-multibyte-l1-1-0._mbsstr 2097 | api-ms-win-crt-multibyte-l1-1-0._mbsrchr 2098 | user32.TabbedTextOutW 2099 | user32.ToUnicodeEx 2100 | user32.TrackMouseEvent 2101 | api-ms-win-crt-multibyte-l1-1-0._mbspbrk 2102 | user32.TrackPopupMenuEx 2103 | api-ms-win-crt-multibyte-l1-1-0._mbsnbicmp 2104 | vcruntime140.strchr 2105 | sqlite.sqlite3_bind_null 2106 | shell32.SHParseDisplayName 2107 | sqlite.sqlite3_bind_int 2108 | msvcrt._snwscanf_s 2109 | msvcrt._stat 2110 | mfc42.3317 2111 | mfc42.3301 2112 | msvcrt._strlwr 2113 | mfc42.3286 2114 | mfc42.2818 2115 | msvcrt._ultow_s 2116 | msvcrt._vscwprintf 2117 | mfc42.2688 2118 | mfc42.2582 2119 | msvcrt._wcmdln 2120 | mfc42.2578 2121 | msvcrt._wcslwr 2122 | msvcrt._wcsnicmp 2123 | msvcrt._wcsupr 2124 | mfc42.2411 2125 | mapi32.MAPIFreeBuffer@4 2126 | msvcrt.__p___initenv 2127 | mapi32.ScBinFromHexBounded@12 2128 | mapi32.UNKOBJ_ScAllocate@12 2129 | mapi32.UNKOBJ_ScAllocateMore@16 2130 | mfc42.1776 2131 | msvcrt._snprintf 2132 | mfc42.1949 2133 | mfc42.2086 2134 | mfc42.2135 2135 | mfc42.2301 2136 | mfc42.2302 2137 | mfc42.2362 2138 | mfc42.2370 2139 | mfc42.2023 2140 | mfc42.3370 2141 | mfc42.3402 2142 | mfc42.3582 2143 | mfc42.567 2144 | mfc42.6007 2145 | mfc42.6055 2146 | mfc42.616 2147 | mfc42.6215 2148 | mfc42.6334 2149 | mfc42.537 2150 | mfc42.6907 2151 | mfc42.693 2152 | msvcrt._beginthreadex 2153 | mfc42.818 2154 | mfc42.858 2155 | mfc42.860 2156 | mfc42.924 2157 | msvcrt._CIfmod 2158 | mapi32.HrThisThreadAdviseSink@8 2159 | msvcrt._fileno 2160 | mfc42.4402 2161 | mfc42.3626 2162 | mfc42.3640 2163 | msvcrt._mbsicmp 2164 | msvcrt._mbscmp 2165 | mfc42.3874 2166 | msvcrt._itoa 2167 | mfc42.5290 2168 | mfc42.3996 2169 | mfc42.4034 2170 | mfc42.4218 2171 | mfc42.4224 2172 | msvcrt._ftol 2173 | mfc42.4398 2174 | msvcrt._fmode 2175 | mfc42.3998 2176 | mapi32.HrSetOneProp@8 2177 | msvcrt.___U@YAPAXI@Z 2178 | msvcrt.___V@YAXPAX@Z 2179 | ntdll.RtlFreeSid 2180 | kernel32.VirtualAllocEx 2181 | kernel32.VirtualQueryEx 2182 | ntdll.RtlCreateSecurityDescriptor 2183 | ntdll.RtlCreateAcl 2184 | kernel32.WaitForSingleObjectEx 2185 | ntdll.RtlFreeUnicodeString 2186 | kernel32.WakeAllConditionVariable 2187 | ntdll.RtlAddAccessAllowedAceEx 2188 | kernel32.WriteProfileSectionA 2189 | ntdll.NtWaitForSingleObject 2190 | ntdll.NtUnloadKey 2191 | ntdll.NtSetValueKey 2192 | ntdll.NtSetSecurityObject 2193 | ntdll.RtlAllocateAndInitializeSid 2194 | kernel32.WriteProfileStringA 2195 | ntdll.RtlGetLastNtStatus 2196 | ntdll.RtlGUIDFromString 2197 | ntdll.RtlSetOwnerSecurityDescriptor 2198 | ntdll.RtlSetDaclSecurityDescriptor 2199 | kernel32.SetTapeParameters 2200 | kernel32.SetThreadContext 2201 | kernel32.SetThreadIdealProcessor 2202 | ntdll.RtlOemToUnicodeN 2203 | ntdll.RtlGetVersion 2204 | ntdll.RtlLengthSid 2205 | kernel32.SleepEx 2206 | ntdll.RtlInitUnicodeString 2207 | kernel32.SwitchToThread 2208 | kernel32.TerminateJobObject 2209 | ntdll.RtlInitAnsiString 2210 | kernel32.UnregisterWait 2211 | ntdll.RtlLengthSecurityDescriptor 2212 | msvcrt.wcstoul 2213 | ntdll.NtSetInformationFile 2214 | ntdll.NtQueryValueKey 2215 | ntdll.NtCreateEvent 2216 | kernel32._lcreat 2217 | ntdll.NtAllocateVirtualMemory 2218 | ntdll.NtAllocateUuids 2219 | ntdll.NtAdjustPrivilegesToken 2220 | ntdll.LdrGetProcedureAddress 2221 | ntdll.NtCreateKey 2222 | ntdll.LdrGetDllHandle 2223 | kernel32._llseek 2224 | kernel32._lopen 2225 | mapi32.FtAddFt@16 2226 | mapi32.HrDecomposeEID@28 2227 | mswsock.GetAcceptExSockaddrs 2228 | mswsock.AcceptEx 2229 | ntdll.EtwTraceMessage 2230 | ntdll.NtResetEvent 2231 | kernel32._lclose 2232 | ntdll.NtDeleteValueKey 2233 | kernel32.WriteProfileStringW 2234 | ntdll.NtQuerySymbolicLinkObject 2235 | ntdll.NtQueryKey 2236 | kernel32.WTSGetActiveConsoleSessionId 2237 | ntdll.NtQueryInformationFile 2238 | ntdll.NtQueryAttributesFile 2239 | ntdll.NtDeleteKey 2240 | kernel32._hread 2241 | ntdll.NtOpenProcessToken 2242 | ntdll.NtOpenKey 2243 | ntdll.NtOpenFile 2244 | ntdll.NtLoadKey 2245 | ntdll.NtEnumerateKey 2246 | ntdll.NtDeviceIoControlFile 2247 | ntdll.NtOpenSymbolicLinkObject 2248 | ntdll.RtlStringFromGUID 2249 | msvcrt.wcsstr 2250 | msvcrt.wcsnlen 2251 | msvcr100.wcsrchr 2252 | msvcr100.wcsstr 2253 | msvcr100.wcstok_s 2254 | msvcp140._uncaught_exception@std@@YA_NXZ 2255 | msvcp140._sputn@_$basic_streambuf@DU_$char_traits@D@std@@@std@@QAE_JPBD_J@Z 2256 | msvcp140._sputc@_$basic_streambuf@DU_$char_traits@D@std@@@std@@QAEHD@Z 2257 | msvcp140._setw@std@@YA_AU_$_Smanip@_J@1@_J@Z 2258 | msvcp140._setstate@_$basic_ios@DU_$char_traits@D@std@@@std@@QAEXH_N@Z 2259 | msvcp140._read@_$basic_istream@DU_$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z 2260 | msvcp140._Mbrtowc 2261 | msvcp140._flush@_$basic_ostream@DU_$char_traits@D@std@@@std@@QAEAAV12@XZ 2262 | msvcp100.__Xout_of_range@std@@YAXPBD@Z 2263 | msvcp100.__Xlength_error@std@@YAXPBD@Z 2264 | msvcr100._purecall 2265 | msvbvm60.__vbaVarTstGt 2266 | msvcr100._set_invalid_parameter_handler 2267 | msvbvm60.__vbaVarTstEq 2268 | msvcr100._wsplitpath_s 2269 | msvcr100._wsplitpath 2270 | msvcr100._wrename 2271 | msvcr100._what@exception@std@@UBEPBDXZ 2272 | msvcr100._wfopen 2273 | msvcr100._wcsnicmp 2274 | msvcr100.wcsnlen 2275 | msvcr100._wcsicmp 2276 | msvcr100._vswprintf_c_l 2277 | msvcr100._vsnwprintf 2278 | msvbvm60.__vbaStrToUnicode 2279 | msvbvm60.__vbaVarAdd 2280 | msvbvm60.__vbaVarSub 2281 | msvcr100._strdup 2282 | msvbvm60.__vbaStrToAnsi 2283 | msvcp140._write@_$basic_ostream@DU_$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z 2284 | msvcr100.wcsncmp 2285 | msvcr100.wcscspn 2286 | msvcr100.fwprintf 2287 | msvcp140.__1_$basic_ostream@DU_$char_traits@D@std@@@std@@UAE@XZ 2288 | msvcp140.__6_$basic_ostream@DU_$char_traits@D@std@@@std@@QAEAAV01@K@Z 2289 | msvcp140.__6_$basic_ostream@DU_$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 2290 | msvcp140.__Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z 2291 | msvcp140.__Getcvt@_Locinfo@std@@QBE_AU_Cvtvec@@XZ 2292 | msvcp140.__1_$basic_istream@DU_$char_traits@D@std@@@std@@UAE@XZ 2293 | msvcp140.__Init@_$basic_streambuf@DU_$char_traits@D@std@@@std@@IAEXXZ 2294 | msvcp60.__1_Winit@std@@QAE@XZ 2295 | msvcp60.__1Init@ios_base@std@@QAE@XZ 2296 | msvcp60.__0_Winit@std@@QAE@XZ 2297 | msvcp60.__0Init@ios_base@std@@QAE@XZ 2298 | msvcp140.__Osfx@_$basic_ostream@DU_$char_traits@D@std@@@std@@QAEXXZ 2299 | msvcp140.__W_Getmonths@_Locinfo@std@@QBEPBGXZ 2300 | msvcr100.calloc 2301 | msvcr100._wtoi 2302 | msvcr100.iswalpha 2303 | msvcr100.memchr 2304 | msvcr100.wcscat_s 2305 | msvcr100.vsprintf 2306 | msvcr100.tolower 2307 | msvcr100.swprintf_s 2308 | msvcr100.strtok_s 2309 | msvcr100.strncpy_s 2310 | msvcp140.__1_$basic_iostream@DU_$char_traits@D@std@@@std@@UAE@XZ 2311 | msvcr100.strlen 2312 | msvcr100.realloc 2313 | msvcp140.__0_$basic_iostream@DU_$char_traits@D@std@@@std@@QAE@PAV_$basic_streambuf@DU_$char_traits@D@std@@@1@@Z 2314 | msvcp140.__0_$basic_istream@DU_$char_traits@D@std@@@std@@QAE@PAV_$basic_streambuf@DU_$char_traits@D@std@@@1@_N@Z 2315 | msvcp140.__0_$basic_ostream@DU_$char_traits@D@std@@@std@@QAE@PAV_$basic_streambuf@DU_$char_traits@D@std@@@1@_N@Z 2316 | msvcr100.memmove 2317 | msvcr100.memcpy 2318 | msvcr100.strcat_s 2319 | msvcr100._wtoi64 2320 | msvbvm60.__vbaStrI4 2321 | msvcr100.__0exception@std@@QAE@ABQBD@Z 2322 | msvbvm60.546 2323 | msvbvm60.568 2324 | msvbvm60.571 2325 | msvbvm60.607 2326 | msvbvm60.632 2327 | msvcrt.rewind 2328 | msvbvm60.544 2329 | msvbvm60.666 2330 | msvcrt.puts 2331 | msvbvm60.685 2332 | msvbvm60.689 2333 | msvbvm60.690 2334 | msvbvm60.709 2335 | msvcrt.memcpy_s 2336 | msvbvm60.677 2337 | msvbvm60.711 2338 | msvbvm60.536 2339 | msvbvm60.526 2340 | msvcrt.wcscpy_s 2341 | msvcrt.wcschr 2342 | msvcrt.wcscat_s 2343 | msvcrt.toupper 2344 | mpr.WNetAddConnection2W 2345 | mpr.WNetCancelConnection2W 2346 | msvbvm60.528 2347 | msvcrt.swprintf_s 2348 | mpr.WNetGetConnectionW 2349 | msvcrt.strtoul 2350 | mscoree._CorExeMain 2351 | msvbvm60.1275245022 2352 | msvbvm60.516 2353 | msvbvm60.525 2354 | msvcrt.swprintf 2355 | msvcrt.wcsrchr 2356 | msvbvm60.713 2357 | msvbvm60.DllFunctionCa?l 2358 | msvbvm60.__vbaInStr 2359 | msvbvm60.__vbaLateIdCallLd 2360 | msvcr100.___U@YAPAXI@Z 2361 | msvbvm60.__vbaLineInputStr 2362 | msvbvm60.__vbaLsetFixstr 2363 | msvbvm60.__vbaPut3 2364 | msvbvm60.__vbaI4Str 2365 | msvbvm60.__vbaR8IntI4 2366 | msvbvm60.__vbaRecDestruct 2367 | msvbvm60.__vbaRecDestructAnsi 2368 | msvbvm60.__vbaRecUniToAnsi 2369 | msvbvm60.__vbaStrBool 2370 | msvcr100.__1exception@std@@UAE@XZ 2371 | msvcr100.__0exception@std@@QAE@ABV01@@Z 2372 | msvbvm60.__vbaRecAnsiToUni 2373 | msvbvm60.805482844 2374 | msvbvm60.__vbaHres?ltCheckObj 2375 | msvbvm60.__vbaFreeVar?ist 2376 | msvbvm60.MethCallEngine 2377 | msvcrt.iswspace 2378 | msvbvm60.__v0aOnError 2379 | msvbvm60.__vbaAryCopy 2380 | msvbvm60.__vbaAryLock 2381 | msvbvm60.__vbaAryUnlock 2382 | msvbvm60.__vbaGet3 2383 | msvbvm60.__vbaAryVar 2384 | wtsapi32.WTSFreeMemory 2385 | msvbvm60.__vbaFpCDblR4 2386 | msvbvm60.__vbaFPExceptio} 2387 | msvbvm60.__vbaFpI2 2388 | msvcrt.feof 2389 | msvbvm60.__vbaFpR8 2390 | msvbvm60.__vbaDateVar 2391 | sqlite.sqlite3_bind_int64 2392 | kernel32.SetProcessWorkingSetSize 2393 | kernel32.SetProcessDEPPolicy 2394 | kernel32.GetTapeParameters 2395 | kernel32.GetSystemTimes 2396 | kernel32.GetSystemDEPPolicy 2397 | kernel32.GetSystemDefaultUILanguage 2398 | kernel32.GetSystemDefaultLangID 2399 | kernel32.GetShortPathNameW 2400 | kernel32.GetProfileSectionW 2401 | kernel32.GetProfileSectionA 2402 | kernel32.GetProfileIntW 2403 | kernel32.GetProcessShutdownParameters 2404 | kernel32.GetProcessIdOfThread 2405 | kernel32.GetPrivateProfileStructA 2406 | oledlg.OleUIBusyW 2407 | psapi.EnumProcesses 2408 | psapi.EnumProcessModules 2409 | psapi.GetModuleBaseNameA 2410 | kernel32.GetPrivateProfileSectionW 2411 | kernel32.GetCommMask 2412 | kernel32.GetCompressedFileSizeW 2413 | kernel32.GetConsoleAliasExesLengthW 2414 | kernel32.GetConsoleScreenBufferInfo 2415 | kernel32.GetCurrencyFormatW 2416 | kernel32.GetDiskFreeSpaceExW 2417 | oleaut32.GetErrorInfo 2418 | rpcrt4.RpcMgmtEpUnregister 2419 | kernel32.GetHandleInformation 2420 | kernel32.GetLongPathNameA 2421 | kernel32.GetNamedPipeHandleStateA 2422 | reagent.WinReGetConfig 2423 | kernel32.GetNumberFormatW 2424 | query.LoadIFilter 2425 | kernel32.GetFileMUIPath 2426 | oleaut32.94 2427 | kernel32.GetThreadId 2428 | oleaut32.86 2429 | oleaut32.22 2430 | oleaut32.21 2431 | kernel32.GlobalFindAtomW 2432 | oleaut32.197 2433 | kernel32.GlobalGetAtomNameW 2434 | oleaut32.185 2435 | oleaut32.232 2436 | oleaut32.184 2437 | kernel32.InitializeCriticalSectionEx 2438 | kernel32.InterlockedPopEntrySList 2439 | kernel32.InterlockedPushEntrySList 2440 | kernel32.IsWow64Process 2441 | kernel32.LocaleNameToLCID 2442 | kernel32.LocalFlags 2443 | kernel32.InitializeConditionVariable 2444 | kernel32.GetCalendarInfoW 2445 | kernel32.GetWindowsDirectoryW 2446 | kernel32.GetVolumePathNamesForVolumeNameW 2447 | oleaut32.82 2448 | kernel32.GetThreadPriority 2449 | oleaut32.5 2450 | oleaut32.420 2451 | oleaut32.418 2452 | oleaut32.411 2453 | kernel32.GetVolumePathNameW 2454 | oleaut32.40 2455 | oleaut32.39 2456 | oleaut32.38 2457 | oleaut32.37 2458 | oleaut32.36 2459 | kernel32.GetVolumeNameForVolumeMountPointW 2460 | oleaut32.27 2461 | kernel32.GetUserDefaultUILanguage 2462 | kernel32.GetBinaryTypeA 2463 | kernel32.GetAtomNameW 2464 | shell32.155 2465 | imm32.ImmReleaseContext 2466 | imm32.ImmSetCompositionFontA 2467 | shlwapi.PathIsUNCW 2468 | shlwapi.PathIsUNCServerA 2469 | iphlpapi.IcmpCloseHandle 2470 | shlwapi.PathIsRelativeW 2471 | shlwapi.PathRemoveBackslashW 2472 | shlwapi.PathIsDirectoryW 2473 | shlwapi.PathFindFileNameW 2474 | kernel32.ActivateActCtx 2475 | kernel32.AddConsoleAliasW 2476 | shlwapi.PathCanonicalizeW 2477 | kernel32.BeginUpdateResourceW 2478 | shlwapi.PathAddBackslashW 2479 | iphlpapi.IcmpCreateFile 2480 | kernel32.CompareStringEx 2481 | imm32.ImmGetOpenStatus 2482 | shlwapi.PathStripToRootW 2483 | sqlite.sqlite3_bind_double 2484 | sqlite.sqlite3_bind_blob 2485 | spp.SxTracerShouldTrackFailure 2486 | spp.SxTracerGetThreadContextRetail 2487 | spp.SxTracerDebuggerBreak 2488 | shlwapi.UrlHashW 2489 | shlwapi.PathRemoveFileSpecW 2490 | imm32.ImmGetContext 2491 | shlwapi.StrFromTimeIntervalA 2492 | shlwapi.SHStrDupA 2493 | shlwapi.SHEnumKeyExA 2494 | shlwapi.SHCreateStreamOnFileW 2495 | shlwapi.SHCreateStreamOnFileEx 2496 | shlwapi.PathUndecorateW 2497 | shlwapi.StrRetToBufW 2498 | oleaut32.150 2499 | shlwapi.AssocQueryStringW 2500 | kernel32.ConvertDefaultLocale 2501 | shell32.ShellAboutA 2502 | shell32.SHDefExtractIconA 2503 | shell32.SHChangeNotify 2504 | kernel32.EraseTape 2505 | kernel32.FatalAppExitA 2506 | shell32.SHAppBarMessage 2507 | shell32.ShellAboutW 2508 | kernel32.FillConsoleOutputCharacterA 2509 | shell32.ExtractAssociatedIconExW 2510 | kernel32.FindFirstFileExA 2511 | kernel32.FindNextVolumeA 2512 | kernel32.FindNextVolumeW 2513 | kernel32.FlsFree 2514 | shell32.680 2515 | kernel32.FindActCtxSectionStringW 2516 | shell32.StrChrIA 2517 | kernel32.EnumResourceNamesA 2518 | shell32.ShellMessageBoxW 2519 | kernel32.CreateActCtxW 2520 | kernel32.CreateRemoteThread 2521 | shell32.SHGetNewLinkInfoA 2522 | kernel32.CreateSemaphoreW 2523 | shell32.SHGetKnownFolderPath 2524 | shell32.SHGetFolderPathW 2525 | shell32.ShellHookProc 2526 | kernel32.CreateTimerQueue 2527 | kernel32.DeactivateActCtx 2528 | shell32.SHGetDataFromIDListW 2529 | shell32.SHFree 2530 | kernel32.DeviceIoControl 2531 | kernel32.EndUpdateResourceW 2532 | shell32.Shell_NotifyIconW 2533 | kernel32.CreateWaitableTimerA 2534 | kernel32.SetProcessPriorityBoost 2535 | kernel32.LocalLock 2536 | oleaut32.148 2537 | odbc32.5 2538 | odbc32.50 2539 | odbc32.51 2540 | odbc32.52 2541 | odbc32.54 2542 | odbc32.57 2543 | odbc32.58 2544 | odbc32.6 2545 | odbc32.63 2546 | odbc32.66 2547 | odbc32.67 2548 | odbc32.71 2549 | odbc32.72 2550 | odbc32.8 2551 | odbc32.9 2552 | ole32.BindMoniker 2553 | kernel32.SetConsoleTitleW 2554 | kernel32.RegisterApplicationRestart 2555 | kernel32.RequestWakeupLatency 2556 | ole32.CoRegisterMessageFilter 2557 | kernel32.ResetWriteWatch 2558 | ole32.CoLockObjectExternal 2559 | ole32.CoIsOle1Class 2560 | odbc32.47 2561 | kernel32.SetCalendarInfoA 2562 | ole32.CoFreeUnusedLibraries 2563 | ole32.CoDisconnectObject 2564 | ole32.CoCreateInstanceEx 2565 | kernel32.SetConsoleDisplayMode 2566 | kernel32.SetConsoleScreenBufferSize 2567 | kernel32.SetConsoleTitleA 2568 | ole32.CoGetObject 2569 | odbc32.45 2570 | odbc32.44 2571 | odbc32.42 2572 | ntoskrnl.RtlQueryRegistryValues 2573 | ntoskrnl.NtQuerySystemInformation 2574 | ntoskrnl.MmUnlockPages 2575 | ntoskrnl.MmProbeAndLockPages 2576 | ntoskrnl.MmMapLockedPagesSpecifyCache 2577 | ntoskrnl.IoFreeMdl 2578 | odbc32.1 2579 | ntoskrnl.IoAllocateMdl 2580 | ntoskrnl.ExAllocatePool 2581 | ntdll.WinSqmAddToStream 2582 | kernel32.SetFileShortNameW 2583 | kernel32.SetFirmwareEnvironmentVariableW 2584 | kernel32.SetHandleInformation 2585 | kernel32.SetLocalTime 2586 | ntoskrnl.ExFreePool 2587 | kernel32.ReadProcessMemory 2588 | odbc32.10 2589 | odbc32.12 2590 | odbc32.41 2591 | odbc32.40 2592 | odbc32.4 2593 | odbc32.3 2594 | odbc32.23 2595 | odbc32.22 2596 | odbc32.11 2597 | odbc32.20 2598 | odbc32.19 2599 | odbc32.18 2600 | odbc32.16 2601 | odbc32.15 2602 | odbc32.14 2603 | odbc32.13 2604 | odbc32.2 2605 | kernel32.ReadConsoleInputA 2606 | ole32.CoTreatAsClass 2607 | ole32.CoWaitForMultipleHandles 2608 | ole32.StgCreateDocfile 2609 | ole32.SetConvertStg 2610 | kernel32.Module32First 2611 | ole32.ReleaseStgMedium 2612 | ole32.RegisterDragDrop 2613 | ole32.ReadFmtUserTypeStg 2614 | ole32.StgCreateDocfileOnILockBytes 2615 | ole32.ReadClassStg 2616 | kernel32.MoveFileExA 2617 | ole32.OleTranslateAccelerator 2618 | ole32.OleSetMenuDescriptor 2619 | ole32.OleSetContainedObject 2620 | ole32.OleSetClipboard 2621 | ole32.OleSaveToStream 2622 | ole32.ProgIDFromCLSID 2623 | ole32.OleSave 2624 | ole32.StgIsStorageFile 2625 | ole32.StgOpenStorageOnILockBytes 2626 | kernel32.LocalUnlock 2627 | oleaut32.114 2628 | oleaut32.113 2629 | kernel32.lstrcpyn 2630 | oleaut32.104 2631 | oleaut32.10 2632 | ole32.StgOpenStorage 2633 | oleacc.LresultFromObject 2634 | oleacc.AccessibleObjectFromWindow 2635 | ole32.WriteFmtUserTypeStg 2636 | ole32.WriteClassStm 2637 | ole32.WriteClassStg 2638 | kernel32.lstrlen 2639 | ole32.StringFromCLSID 2640 | oleacc.CreateStdAccessibleObject 2641 | oleaut32.149 2642 | kernel32.OpenFile 2643 | ole32.OleRegGetMiscStatus 2644 | ole32.OleCreate 2645 | kernel32.ProcessIdToSessionId 2646 | ole32.IsAccelerator 2647 | ole32.GetRunningObjectTable 2648 | ole32.GetHGlobalFromStream 2649 | ole32.GetHGlobalFromILockBytes 2650 | ole32.OleCreateFromData 2651 | ole32.DoDragDrop 2652 | ole32.CreateItemMoniker 2653 | ole32.CreateILockBytesOnHGlobal 2654 | ole32.CreateGenericComposite 2655 | ole32.CreateFileMoniker 2656 | ole32.CreateDataAdviseHolder 2657 | ole32.CreateBindCtx 2658 | ole32.CreateOleAdviseHolder 2659 | ole32.OleRegGetUserType 2660 | ole32.OleCreateFromFile 2661 | ole32.OleCreateLinkToFile 2662 | ole32.OleRegEnumVerbs 2663 | ole32.OleQueryLinkFromData 2664 | ole32.OleQueryCreateFromData 2665 | ole32.OleLoad 2666 | ole32.OleIsRunning 2667 | ole32.OleIsCurrentClipboard 2668 | ole32.OleCreateLinkFromData 2669 | kernel32.OpenMutexW 2670 | ole32.OleGetClipboard 2671 | ole32.OleFlushClipboard 2672 | ole32.OleDuplicateData 2673 | ole32.OleDestroyMenuDescriptor 2674 | ole32.OleCreateStaticFromData 2675 | ole32.OleCreateMenuDescriptor 2676 | ole32.OleGetIconOfClass 2677 | wtsapi32.WTSQueryUserToken --------------------------------------------------------------------------------