d00ee0e6...12a6

Remarks

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Master Boot Record Changes

Sector Number	Sector Size	Actions
2063	512 bytes	... Actions Show Code Modification

Filters:

Filename	Category	Type	Severity	Actions

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\out.exe

Sample File

Binary

Blacklisted

Mime Type	application/x-dosexec
File Size	2.36 MB
MD5	7f87db33980c0099739de40d1b725500
SHA1	f0626999b7f730f9003ac1389d3060c50068da5a
SHA256	d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6
SSDeep	49152:tzlhgyBIjVpPZHZlPpLPk0vglJIAc/8KYBsxdO0G7x+dP1Y+:zy9jRZlFknvzcEKY8dOD7x8NY
ImpHash	9586355d3c001552543f5fa27b1cb240

File Reputation Information

Severity	Blacklisted
First Seen	2018-10-14 19:53 (UTC+2)
Last Seen	2018-10-16 10:52 (UTC+2)
Names	Win32.Trojan.Equationdrug
Families	Equationdrug
Classification	Trojan

PE Information

Image Base	0x400000
Entry Point	0x6f919d
Size Of Code	0x8f400
Size Of Initialized Data	0x264800
File Type	executable
Subsystem	windows_cui
Machine Type	i386
Compile Timestamp	2018-10-14 15:23:06+00:00

Sections (3)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.MPRESS1	0x401000	0x2f8000	0x25b800	0x200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	8.0
.MPRESS2	0x6f9000	0xd28	0xe00	0x25ba00	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	5.81
.rsrc	0x6fa000	0x258	0x400	0x25c800	cnt_initialized_data, mem_read, mem_write	3.25

Imports (7)

KERNEL32.DLL (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x6f90a0	0x2f90a0	0x25baa0	0x0
GetProcAddress	0x0	0x6f90a4	0x2f90a4	0x25baa4	0x0

WS2_32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
listen	0xd	0x6f90ac	0x2f90ac	0x25baac	-

USER32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
wsprintfA	0x0	0x6f90b4	0x2f90b4	0x25bab4	0x0

ADVAPI32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CryptEncrypt	0x0	0x6f90bc	0x2f90bc	0x25babc	0x0

SHELL32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteA	0x0	0x6f90c4	0x2f90c4	0x25bac4	0x0

IPHLPAPI.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetIpAddrTable	0x0	0x6f90cc	0x2f90cc	0x25bacc	0x0

WLDAP32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
(by ordinal)	0x20	0x6f90d4	0x2f90d4	0x25bad4	-

c:/windows/temp/zkts.exe

Created File

Binary

Blacklisted

Mime Type	application/x-dosexec
File Size	1.85 MB
MD5	5d74e736c5c4224b813bea351093c27f
SHA1	740e59ec36ebec339f9245071f366cf601edbad7
SHA256	7f5f134fd3ec2c14956acd7362c76e66759b8ecc51f986ef80bbf9f7f94b89fe
SSDeep	49152:O5+hFyflCspsAaGAafcQgZ6eLSCQ6SjQBts5Euxn0k:O5aFzsaVRZ6eL+6Fs5xn0k
ImpHash	a1a66d588dcf1394354ebf6ec400c223

File Reputation Information

Severity	Blacklisted
First Seen	2018-10-15 05:06 (UTC+2)
Last Seen	2018-10-15 05:15 (UTC+2)
Names	Win32.Trojan.Equation
Families	Equation
Classification	Trojan

PE Information

Image Base	0x400000
Entry Point	0x41c35f
Size Of Code	0x1be00
Size Of Initialized Data	0xda00
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2016-04-02 22:14:34+00:00
Packer	Armadillo v1.71

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x1bd4a	0x1be00	0x200	cnt_code, mem_execute, mem_read	6.71
.rdata	0x41d000	0x41a8	0x4200	0x1c000	cnt_initialized_data, mem_read	5.75
.data	0x422000	0x4c90	0x800	0x20200	cnt_initialized_data, mem_read, mem_write	3.7
.rsrc	0x427000	0x4901	0x4a00	0x20a00	cnt_initialized_data, mem_read	3.26

Imports (9)

COMCTL32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
(by ordinal)	0x11	0x41d010	0x1ff84	0x1ef84	-

SHELL32.dll (7)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteExW	0x0	0x41d274	0x201e8	0x1f1e8	0x1b5
ShellExecuteW	0x0	0x41d278	0x201ec	0x1f1ec	0x1b6
SHGetMalloc	0x0	0x41d27c	0x201f0	0x1f1f0	0x163
SHGetPathFromIDListW	0x0	0x41d280	0x201f4	0x1f1f4	0x16b
SHBrowseForFolderW	0x0	0x41d284	0x201f8	0x1f1f8	0x87
SHGetFileInfoW	0x0	0x41d288	0x201fc	0x1f1fc	0x151
SHGetSpecialFolderPathW	0x0	0x41d28c	0x20200	0x1f200	0x175

GDI32.dll (11)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateCompatibleDC	0x0	0x41d018	0x1ff8c	0x1ef8c	0x31
CreateFontIndirectW	0x0	0x41d01c	0x1ff90	0x1ef90	0x41
DeleteObject	0x0	0x41d020	0x1ff94	0x1ef94	0x140
DeleteDC	0x0	0x41d024	0x1ff98	0x1ef98	0x13d
GetCurrentObject	0x0	0x41d028	0x1ff9c	0x1ef9c	0x224
StretchBlt	0x0	0x41d02c	0x1ffa0	0x1efa0	0x345
GetDeviceCaps	0x0	0x41d030	0x1ffa4	0x1efa4	0x22b
CreateCompatibleBitmap	0x0	0x41d034	0x1ffa8	0x1efa8	0x30
SelectObject	0x0	0x41d038	0x1ffac	0x1efac	0x309
SetStretchBltMode	0x0	0x41d03c	0x1ffb0	0x1efb0	0x334
GetObjectW	0x0	0x41d040	0x1ffb4	0x1efb4	0x25d

ADVAPI32.dll (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FreeSid	0x0	0x41d000	0x1ff74	0x1ef74	0x133
AllocateAndInitializeSid	0x0	0x41d004	0x1ff78	0x1ef78	0x20
CheckTokenMembership	0x0	0x41d008	0x1ff7c	0x1ef7c	0x5f

USER32.dll (58)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetParent	0x0	0x41d294	0x20208	0x1f208	0x17d
ScreenToClient	0x0	0x41d298	0x2020c	0x1f20c	0x2d2
CreateWindowExW	0x0	0x41d29c	0x20210	0x1f210	0x71
GetDesktopWindow	0x0	0x41d2a0	0x20214	0x1f214	0x139
GetWindowTextLengthW	0x0	0x41d2a4	0x20218	0x1f218	0x1d6
SetWindowPos	0x0	0x41d2a8	0x2021c	0x1f21c	0x335
SetTimer	0x0	0x41d2ac	0x20220	0x1f220	0x327
GetMessageW	0x0	0x41d2b0	0x20224	0x1f224	0x176
CopyImage	0x0	0x41d2b4	0x20228	0x1f228	0x56
KillTimer	0x0	0x41d2b8	0x2022c	0x1f22c	0x228
CharUpperW	0x0	0x41d2bc	0x20230	0x1f230	0x3c
SendMessageW	0x0	0x41d2c0	0x20234	0x1f234	0x2e1
ShowWindow	0x0	0x41d2c4	0x20238	0x1f238	0x346
BringWindowToTop	0x0	0x41d2c8	0x2023c	0x1f23c	0x10
wsprintfW	0x0	0x41d2cc	0x20240	0x1f240	0x3a2
MessageBoxW	0x0	0x41d2d0	0x20244	0x1f244	0x25c
EndDialog	0x0	0x41d2d4	0x20248	0x1f248	0xe9
ReleaseDC	0x0	0x41d2d8	0x2024c	0x1f24c	0x2c8
GetWindowDC	0x0	0x41d2dc	0x20250	0x1f250	0x1c4
GetMenu	0x0	0x41d2e0	0x20254	0x1f254	0x164
GetWindowLongW	0x0	0x41d2e4	0x20258	0x1f258	0x1ca
GetClassNameA	0x0	0x41d2e8	0x2025c	0x1f25c	0x124
wsprintfA	0x0	0x41d2ec	0x20260	0x1f260	0x3a1
DispatchMessageW	0x0	0x41d2f0	0x20264	0x1f264	0xb6
SetWindowTextW	0x0	0x41d2f4	0x20268	0x1f268	0x33a
GetSysColor	0x0	0x41d2f8	0x2026c	0x1f26c	0x1ab
DestroyWindow	0x0	0x41d2fc	0x20270	0x1f270	0xae
MessageBoxA	0x0	0x41d300	0x20274	0x1f274	0x255
GetKeyState	0x0	0x41d304	0x20278	0x1f278	0x156
IsWindow	0x0	0x41d308	0x2027c	0x1f27c	0x21e
GetDlgItem	0x0	0x41d30c	0x20280	0x1f280	0x13e
GetClientRect	0x0	0x41d310	0x20284	0x1f284	0x127
GetSystemMetrics	0x0	0x41d314	0x20288	0x1f288	0x1ae
SetWindowLongW	0x0	0x41d318	0x2028c	0x1f28c	0x333
UnhookWindowsHookEx	0x0	0x41d31c	0x20290	0x1f290	0x369
SetFocus	0x0	0x41d320	0x20294	0x1f294	0x2fa
SystemParametersInfoW	0x0	0x41d324	0x20298	0x1f298	0x355
DrawTextW	0x0	0x41d328	0x2029c	0x1f29c	0xd7
GetDC	0x0	0x41d32c	0x202a0	0x1f2a0	0x136
ClientToScreen	0x0	0x41d330	0x202a4	0x1f2a4	0x49
GetWindow	0x0	0x41d334	0x202a8	0x1f2a8	0x1bf
DialogBoxIndirectParamW	0x0	0x41d338	0x202ac	0x1f2ac	0xb1
DrawIconEx	0x0	0x41d33c	0x202b0	0x1f2b0	0xcf
CallWindowProcW	0x0	0x41d340	0x202b4	0x1f2b4	0x1e
DefWindowProcW	0x0	0x41d344	0x202b8	0x1f2b8	0xa2
CallNextHookEx	0x0	0x41d348	0x202bc	0x1f2bc	0x1c
PtInRect	0x0	0x41d34c	0x202c0	0x1f2c0	0x289
SetWindowsHookExW	0x0	0x41d350	0x202c4	0x1f2c4	0x33e
LoadImageW	0x0	0x41d354	0x202c8	0x1f2c8	0x234
LoadIconW	0x0	0x41d358	0x202cc	0x1f2cc	0x232
MessageBeep	0x0	0x41d35c	0x202d0	0x1f2d0	0x254
EnableWindow	0x0	0x41d360	0x202d4	0x1f2d4	0xe6
EnableMenuItem	0x0	0x41d364	0x202d8	0x1f2d8	0xe2
GetSystemMenu	0x0	0x41d368	0x202dc	0x1f2dc	0x1ad
CreateWindowExA	0x0	0x41d36c	0x202e0	0x1f2e0	0x70
wvsprintfW	0x0	0x41d370	0x202e4	0x1f2e4	0x3a4
GetWindowTextW	0x0	0x41d374	0x202e8	0x1f2e8	0x1d7
GetWindowRect	0x0	0x41d378	0x202ec	0x1f2ec	0x1d0

ole32.dll (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateStreamOnHGlobal	0x0	0x41d380	0x202f4	0x1f2f4	0xa8
CoCreateInstance	0x0	0x41d384	0x202f8	0x1f2f8	0x28
CoInitialize	0x0	0x41d388	0x202fc	0x1f2fc	0x5d

OLEAUT32.dll (5)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysAllocStringLen	0x4	0x41d25c	0x201d0	0x1f1d0	-
VariantClear	0x9	0x41d260	0x201d4	0x1f1d4	-
SysFreeString	0x6	0x41d264	0x201d8	0x1f1d8	-
OleLoadPicture	0x1a2	0x41d268	0x201dc	0x1f1dc	-
SysAllocString	0x2	0x41d26c	0x201e0	0x1f1e0	-

KERNEL32.dll (95)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetFileTime	0x0	0x41d048	0x1ffbc	0x1efbc	0x50d
SetEndOfFile	0x0	0x41d04c	0x1ffc0	0x1efc0	0x4f7
GetFileInformationByHandle	0x0	0x41d050	0x1ffc4	0x1efc4	0x238
VirtualFree	0x0	0x41d054	0x1ffc8	0x1efc8	0x5ae
GetModuleHandleA	0x0	0x41d058	0x1ffcc	0x1efcc	0x265
WaitForMultipleObjects	0x0	0x41d05c	0x1ffd0	0x1efd0	0x5ba
VirtualAlloc	0x0	0x41d060	0x1ffd4	0x1efd4	0x5ab
ReadFile	0x0	0x41d064	0x1ffd8	0x1efd8	0x45b
SetFilePointer	0x0	0x41d068	0x1ffdc	0x1efdc	0x509
GetFileSize	0x0	0x41d06c	0x1ffe0	0x1efe0	0x23c
LeaveCriticalSection	0x0	0x41d070	0x1ffe4	0x1efe4	0x3a8
EnterCriticalSection	0x0	0x41d074	0x1ffe8	0x1efe8	0x125
DeleteCriticalSection	0x0	0x41d078	0x1ffec	0x1efec	0x104
FormatMessageW	0x0	0x41d07c	0x1fff0	0x1eff0	0x19a
lstrcpyW	0x0	0x41d080	0x1fff4	0x1eff4	0x618
LocalFree	0x0	0x41d084	0x1fff8	0x1eff8	0x3b9
IsBadReadPtr	0x0	0x41d088	0x1fffc	0x1effc	0x363
GetSystemDirectoryW	0x0	0x41d08c	0x20000	0x1f000	0x2d0
GetCurrentThreadId	0x0	0x41d090	0x20004	0x1f004	0x20f
SuspendThread	0x0	0x41d094	0x20008	0x1f008	0x56a
TerminateThread	0x0	0x41d098	0x2000c	0x1f00c	0x572
InitializeCriticalSection	0x0	0x41d09c	0x20010	0x1f010	0x34b
ResetEvent	0x0	0x41d0a0	0x20014	0x1f014	0x4ae
SetEvent	0x0	0x41d0a4	0x20018	0x1f018	0x4fd
CreateEventW	0x0	0x41d0a8	0x2001c	0x1f01c	0xb4
GetVersionExW	0x0	0x41d0ac	0x20020	0x1f020	0x309
GetModuleFileNameW	0x0	0x41d0b0	0x20024	0x1f024	0x264
GetCurrentProcess	0x0	0x41d0b4	0x20028	0x1f028	0x20a
SetProcessWorkingSetSize	0x0	0x41d0b8	0x2002c	0x1f02c	0x52d
SetEnvironmentVariableW	0x0	0x41d0bc	0x20030	0x1f030	0x4fb
GetDriveTypeW	0x0	0x41d0c0	0x20034	0x1f034	0x220
CreateFileW	0x0	0x41d0c4	0x20038	0x1f038	0xc0
LoadLibraryA	0x0	0x41d0c8	0x2003c	0x1f03c	0x3ac
SetThreadLocale	0x0	0x41d0cc	0x20040	0x1f040	0x542
GetSystemTimeAsFileTime	0x0	0x41d0d0	0x20044	0x1f044	0x2d9
ExpandEnvironmentStringsW	0x0	0x41d0d4	0x20048	0x1f048	0x155
CompareFileTime	0x0	0x41d0d8	0x2004c	0x1f04c	0x8c
WideCharToMultiByte	0x0	0x41d0dc	0x20050	0x1f050	0x5e0
GetTempPathW	0x0	0x41d0e0	0x20054	0x1f054	0x2e6
GetCurrentDirectoryW	0x0	0x41d0e4	0x20058	0x1f058	0x204
GetEnvironmentVariableW	0x0	0x41d0e8	0x2005c	0x1f05c	0x22a
lstrcmpiW	0x0	0x41d0ec	0x20060	0x1f060	0x615
GetLocaleInfoW	0x0	0x41d0f0	0x20064	0x1f064	0x255
MultiByteToWideChar	0x0	0x41d0f4	0x20068	0x1f068	0x3d8
GetUserDefaultUILanguage	0x0	0x41d0f8	0x2006c	0x1f06c	0x303
GetSystemDefaultUILanguage	0x0	0x41d0fc	0x20070	0x1f070	0x2ce
GetSystemDefaultLCID	0x0	0x41d100	0x20074	0x1f074	0x2cb
lstrcmpiA	0x0	0x41d104	0x20078	0x1f078	0x614
GlobalAlloc	0x0	0x41d108	0x2007c	0x1f07c	0x31b
GlobalFree	0x0	0x41d10c	0x20080	0x1f080	0x322
MulDiv	0x0	0x41d110	0x20084	0x1f084	0x3d7
FindResourceExA	0x0	0x41d114	0x20088	0x1f088	0x187
SizeofResource	0x0	0x41d118	0x2008c	0x1f08c	0x561
LoadResource	0x0	0x41d11c	0x20090	0x1f090	0x3b2
LockResource	0x0	0x41d120	0x20094	0x1f094	0x3c4
GetModuleHandleW	0x0	0x41d124	0x20098	0x1f098	0x268
FindFirstFileW	0x0	0x41d128	0x2009c	0x1f09c	0x173
lstrcmpW	0x0	0x41d12c	0x200a0	0x1f0a0	0x612
DeleteFileW	0x0	0x41d130	0x200a4	0x1f0a4	0x109
FindNextFileW	0x0	0x41d134	0x200a8	0x1f0a8	0x17f
FindClose	0x0	0x41d138	0x200ac	0x1f0ac	0x168
RemoveDirectoryW	0x0	0x41d13c	0x200b0	0x1f0b0	0x4a1
GetStdHandle	0x0	0x41d140	0x200b4	0x1f0b4	0x2c2
WriteFile	0x0	0x41d144	0x200b8	0x1f0b8	0x5f4
lstrlenA	0x0	0x41d148	0x200bc	0x1f0bc	0x61d
CreateDirectoryW	0x0	0x41d14c	0x200c0	0x1f0c0	0xaf
GetFileAttributesW	0x0	0x41d150	0x200c4	0x1f0c4	0x236
SetCurrentDirectoryW	0x0	0x41d154	0x200c8	0x1f0c8	0x4f0
GetLocalTime	0x0	0x41d158	0x200cc	0x1f0cc	0x252
SystemTimeToFileTime	0x0	0x41d15c	0x200d0	0x1f0d0	0x56d
CreateThread	0x0	0x41d160	0x200d4	0x1f0d4	0xe7
GetExitCodeThread	0x0	0x41d164	0x200d8	0x1f0d8	0x22e
Sleep	0x0	0x41d168	0x200dc	0x1f0dc	0x562
SetFileAttributesW	0x0	0x41d16c	0x200e0	0x1f0e0	0x504
GetDiskFreeSpaceExW	0x0	0x41d170	0x200e4	0x1f0e4	0x21b
SetLastError	0x0	0x41d174	0x200e8	0x1f0e8	0x519
GetTickCount	0x0	0x41d178	0x200ec	0x1f0ec	0x2f6
lstrlenW	0x0	0x41d17c	0x200f0	0x1f0f0	0x61e
ExitProcess	0x0	0x41d180	0x200f4	0x1f0f4	0x151
lstrcatW	0x0	0x41d184	0x200f8	0x1f0f8	0x60f
GetProcAddress	0x0	0x41d188	0x200fc	0x1f0fc	0x29e
CloseHandle	0x0	0x41d18c	0x20100	0x1f100	0x7c
WaitForSingleObject	0x0	0x41d190	0x20104	0x1f104	0x5bc
GetExitCodeProcess	0x0	0x41d194	0x20108	0x1f108	0x22d
GetQueuedCompletionStatus	0x0	0x41d198	0x2010c	0x1f10c	0x2ba
ResumeThread	0x0	0x41d19c	0x20110	0x1f110	0x4b4
SetInformationJobObject	0x0	0x41d1a0	0x20114	0x1f114	0x516
CreateIoCompletionPort	0x0	0x41d1a4	0x20118	0x1f118	0xc5
AssignProcessToJobObject	0x0	0x41d1a8	0x2011c	0x1f11c	0x1c
CreateJobObjectW	0x0	0x41d1ac	0x20120	0x1f120	0xc7
GetLastError	0x0	0x41d1b0	0x20124	0x1f124	0x251
CreateProcessW	0x0	0x41d1b4	0x20128	0x1f128	0xda
GetStartupInfoW	0x0	0x41d1b8	0x2012c	0x1f12c	0x2c0
GetCommandLineW	0x0	0x41d1bc	0x20130	0x1f130	0x1ca
GetStartupInfoA	0x0	0x41d1c0	0x20134	0x1f134	0x2bf

MSVCRT.dll (36)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_purecall	0x0	0x41d1c8	0x2013c	0x1f13c	0x192
??2@YAPAXI@Z	0x0	0x41d1cc	0x20140	0x1f140	0xf
_wtol	0x0	0x41d1d0	0x20144	0x1f144	0x22e
memset	0x0	0x41d1d4	0x20148	0x1f148	0x299
memmove	0x0	0x41d1d8	0x2014c	0x1f14c	0x298
memcpy	0x0	0x41d1dc	0x20150	0x1f150	0x297
_wcsnicmp	0x0	0x41d1e0	0x20154	0x1f154	0x1ee
_controlfp	0x0	0x41d1e4	0x20158	0x1f158	0xb7
_except_handler3	0x0	0x41d1e8	0x2015c	0x1f15c	0xca
__set_app_type	0x0	0x41d1ec	0x20160	0x1f160	0x81
__p__fmode	0x0	0x41d1f0	0x20164	0x1f164	0x6f
__p__commode	0x0	0x41d1f4	0x20168	0x1f168	0x6a
_adjust_fdiv	0x0	0x41d1f8	0x2016c	0x1f16c	0x9d
__setusermatherr	0x0	0x41d1fc	0x20170	0x1f170	0x83
_initterm	0x0	0x41d200	0x20174	0x1f174	0x10f
__getmainargs	0x0	0x41d204	0x20178	0x1f178	0x58
_acmdln	0x0	0x41d208	0x2017c	0x1f17c	0x8f
exit	0x0	0x41d20c	0x20180	0x1f180	0x249
_XcptFilter	0x0	0x41d210	0x20184	0x1f184	0x48
_exit	0x0	0x41d214	0x20188	0x1f188	0xd3
??1type_info@@UAE@XZ	0x0	0x41d218	0x2018c	0x1f18c	0xe
_onexit	0x0	0x41d21c	0x20190	0x1f190	0x186
__dllonexit	0x0	0x41d220	0x20194	0x1f194	0x55
malloc	0x0	0x41d224	0x20198	0x1f198	0x291
realloc	0x0	0x41d228	0x2019c	0x1f19c	0x2a7
free	0x0	0x41d22c	0x201a0	0x1f1a0	0x25e
wcsstr	0x0	0x41d230	0x201a4	0x1f1a4	0x2ed
_CxxThrowException	0x0	0x41d234	0x201a8	0x1f1a8	0x41
_beginthreadex	0x0	0x41d238	0x201ac	0x1f1ac	0xa6
_EH_prolog	0x0	0x41d23c	0x201b0	0x1f1b0	0x42
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z	0x0	0x41d240	0x201b4	0x1f1b4	0x25
strncmp	0x0	0x41d244	0x201b8	0x1f1b8	0x2c0
wcsncmp	0x0	0x41d248	0x201bc	0x1f1bc	0x2e8
wcsncpy	0x0	0x41d24c	0x201c0	0x1f1c0	0x2e9
strncpy	0x0	0x41d250	0x201c4	0x1f1c4	0x2c1
??3@YAXPAX@Z	0x0	0x41d254	0x201c8	0x1f1c8	0x10

Icons (1)

c:\windows\temp\svchostb.exe

Created File

Binary

Blacklisted

Mime Type	application/x-dosexec
File Size	60.00 KB
MD5	292c31454d142fce23f6dfaf921fbd08
SHA1	733728393a10686b4a6c463231f8e34ec40a38d5
SHA256	22501da84c7604912d730681de696f9d60c04e81c12f3641f306449474c299ea
SSDeep	1536:M4a+klCorZsVWmAi2dqux+ZjsTAAcNWbTCe:U+uRZ+3AJEvwVTJ
ImpHash	998e0909960714ffabfebcd27b14c863

File Reputation Information

Severity	Blacklisted
First Seen	2018-10-15 04:35 (UTC+2)
Last Seen	2018-10-15 04:42 (UTC+2)
Names	Win32.Exploit.Shadowbrokers
Families	Shadowbrokers
Classification	Exploit

PE Information

Image Base	0x400000
Entry Point	0x423164
Size Of Code	0x17800
Size Of Initialized Data	0x8400
File Type	executable
Subsystem	windows_cui
Machine Type	i386
Compile Timestamp	2013-05-28 14:14:33+00:00

Sections (2)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.MPRESS1	0x401000	0x22000	0xe000	0x200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	8.0
.MPRESS2	0x423000	0xcce	0xe00	0xe200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	5.72

Imports (6)

KERNEL32.DLL (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x42308c	0x2308c	0xe28c	0x0
GetProcAddress	0x0	0x423090	0x23090	0xe290	0x0

trch-1.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Parameter_hasValue	0x0	0x423098	0x23098	0xe298	0x0

tucl-1.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TcLog	0x0	0x4230a0	0x230a0	0xe2a0	0x0

WS2_32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
inet_ntoa	0xc	0x4230a8	0x230a8	0xe2a8	-

coli-0.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
coli_setID	0x0	0x4230b0	0x230b0	0xe2b0	0x0

msvcrt.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
pow	0x0	0x4230b8	0x230b8	0xe2b8	0x0

c:\windows\temp\trch-1.dll

Created File

Binary

Blacklisted

Mime Type	application/x-dosexec
File Size	58.50 KB
MD5	838ceb02081ac27de43da56bec20fc76
SHA1	972ab587cdb63c8263eb977f10977fd7d27ecf7b
SHA256	0259d41720f7084716a3b2bbe34ac6d3021224420f81a4e839b0b3401e5ef29f
SSDeep	768:9fo4XJn+xrNRFydS3allJVAI5az6oL5BsterNpGEi1Yt4KH8va:9DurNRFoS38lJD+B4te5pGjY+da
ImpHash	e566b5e1afbaca6e9905feda4cf65fa9

File Reputation Information

Severity	Blacklisted
First Seen	2017-04-15 03:00 (UTC+2)
Last Seen	2018-10-16 03:17 (UTC+2)
Names	Win32.Trojan.Shadowbrokers
Families	Shadowbrokers
Classification	Trojan

PE Information

Image Base	0x10000000
Entry Point	0x1000ae66
Size Of Code	0xa400
Size Of Initialized Data	0x4600
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:52:13+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0xa272	0xa400	0x400	cnt_code, mem_execute, mem_read	6.28
.rdata	0x1000c000	0x2e1c	0x3000	0xa800	cnt_initialized_data, mem_read	5.22
.data	0x1000f000	0x6ac	0x400	0xd800	cnt_initialized_data, mem_read, mem_write	6.1
.reloc	0x10010000	0xd48	0xe00	0xdc00	cnt_initialized_data, mem_discardable, mem_read	5.23

Imports (4)

KERNEL32.dll (14)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x1000c000	0xc6a8	0xaea8	0x10e
GetCurrentThreadId	0x0	0x1000c004	0xc6ac	0xaeac	0x110
GetTickCount	0x0	0x1000c008	0xc6b0	0xaeb0	0x18a
QueryPerformanceCounter	0x0	0x1000c00c	0xc6b4	0xaeb4	0x22f
SetUnhandledExceptionFilter	0x0	0x1000c010	0xc6b8	0xaeb8	0x2bc
UnhandledExceptionFilter	0x0	0x1000c014	0xc6bc	0xaebc	0x2df
GetCurrentProcess	0x0	0x1000c018	0xc6c0	0xaec0	0x10d
TerminateProcess	0x0	0x1000c01c	0xc6c4	0xaec4	0x2cf
InterlockedCompareExchange	0x0	0x1000c020	0xc6c8	0xaec8	0x1cb
Sleep	0x0	0x1000c024	0xc6cc	0xaecc	0x2c7
InterlockedExchange	0x0	0x1000c028	0xc6d0	0xaed0	0x1cd
RtlUnwind	0x0	0x1000c02c	0xc6d4	0xaed4	0x25b
OutputDebugStringA	0x0	0x1000c030	0xc6d8	0xaed8	0x21c
GetSystemTimeAsFileTime	0x0	0x1000c034	0xc6dc	0xaedc	0x17a

libxml2.dll (31)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
xmlNewNs	0x0	0x1000c03c	0xc6e4	0xaee4	0x292
xmlNewDoc	0x0	0x1000c040	0xc6e8	0xaee8	0x27c
xmlSaveToBuffer	0x0	0x1000c044	0xc6ec	0xaeec	0x3b1
xmlBufferCreate	0x0	0x1000c048	0xc6f0	0xaef0	0xca
xmlCleanupParser	0x0	0x1000c04c	0xc6f4	0xaef4	0x108
xmlFreeMutex	0x0	0x1000c050	0xc6f8	0xaef8	0x193
xmlNewMutex	0x0	0x1000c054	0xc6fc	0xaefc	0x28f
xmlInitParser	0x0	0x1000c058	0xc700	0xaf00	0x1f2
xmlStrcmp	0x0	0x1000c05c	0xc704	0xaf04	0x42c
xmlFree	0x0	0x1000c060	0xc708	0xaf08	0x186
xmlNodeGetContent	0x0	0x1000c064	0xc70c	0xaf0c	0x2b0
xmlGetProp	0x0	0x1000c068	0xc710	0xaf10	0x1c4
xmlMutexUnlock	0x0	0x1000c06c	0xc714	0xaf14	0x24a
xmlSearchNsByHref	0x0	0x1000c070	0xc718	0xaf18	0x400
xmlDocGetRootElement	0x0	0x1000c074	0xc71c	0xaf1c	0x15e
xmlParseMemory	0x0	0x1000c078	0xc720	0xaf20	0x2f2
xmlMutexLock	0x0	0x1000c07c	0xc724	0xaf24	0x249
xmlFreeNode	0x0	0x1000c080	0xc728	0xaf28	0x194
xmlNodeSetContent	0x0	0x1000c084	0xc72c	0xaf2c	0x2b7
xmlNewProp	0x0	0x1000c088	0xc730	0xaf30	0x297
xmlNewNode	0x0	0x1000c08c	0xc734	0xaf34	0x290
xmlFreeDoc	0x0	0x1000c090	0xc738	0xaf38	0x18a
xmlBufferFree	0x0	0x1000c094	0xc73c	0xaf3c	0xcf
xmlSaveClose	0x0	0x1000c098	0xc740	0xaf40	0x3a6
xmlFreeNs	0x0	0x1000c09c	0xc744	0xaf44	0x197
xmlBufferContent	0x0	0x1000c0a0	0xc748	0xaf48	0xc9
xmlBufferLength	0x0	0x1000c0a4	0xc74c	0xaf4c	0xd1
xmlSaveFlush	0x0	0x1000c0a8	0xc750	0xaf50	0x3ab
xmlSaveDoc	0x0	0x1000c0ac	0xc754	0xaf54	0x3a7
xmlAddChild	0x0	0x1000c0b0	0xc758	0xaf58	0xa4
xmlReconciliateNs	0x0	0x1000c0b4	0xc75c	0xaf5c	0x346

tucl-1.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TcLog	0x0	0x1000c128	0xc7d0	0xafd0	0x1

msvcrt.dll (26)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
strchr	0x0	0x1000c0bc	0xc764	0xaf64	0x513
strcmp	0x0	0x1000c0c0	0xc768	0xaf68	0x514
strcat	0x0	0x1000c0c4	0xc76c	0xaf6c	0x511
sprintf	0x0	0x1000c0c8	0xc770	0xaf70	0x50b
calloc	0x0	0x1000c0cc	0xc774	0xaf74	0x485
free	0x0	0x1000c0d0	0xc778	0xaf78	0x4a6
strlen	0x0	0x1000c0d4	0xc77c	0xaf7c	0x51c
strncpy	0x0	0x1000c0d8	0xc780	0xaf80	0x520
tolower	0x0	0x1000c0dc	0xc784	0xaf84	0x539
memset	0x0	0x1000c0e0	0xc788	0xaf88	0x4ee
strspn	0x0	0x1000c0e4	0xc78c	0xaf8c	0x525
_access	0x0	0x1000c0e8	0xc790	0xaf90	0xe5
memmove	0x0	0x1000c0ec	0xc794	0xaf94	0x4ec
realloc	0x0	0x1000c0f0	0xc798	0xaf98	0x4ff
malloc	0x0	0x1000c0f4	0xc79c	0xaf9c	0x4de
strncmp	0x0	0x1000c0f8	0xc7a0	0xafa0	0x51f
strtol	0x0	0x1000c0fc	0xc7a4	0xafa4	0x52a
isspace	0x0	0x1000c100	0xc7a8	0xafa8	0x4c6
strtoul	0x0	0x1000c104	0xc7ac	0xafac	0x52b
strcpy	0x0	0x1000c108	0xc7b0	0xafb0	0x516
_XcptFilter	0x0	0x1000c10c	0xc7b4	0xafb4	0x6a
_initterm	0x0	0x1000c110	0xc7b8	0xafb8	0x1d5
_amsg_exit	0x0	0x1000c114	0xc7bc	0xafbc	0x101
_adjust_fdiv	0x0	0x1000c118	0xc7c0	0xafc0	0xf5
_errno	0x0	0x1000c11c	0xc7c4	0xafc4	0x156
strcspn	0x0	0x1000c120	0xc7c8	0xafc8	0x518

Exports (265)

Api name	EAT Address	Ordinal
Boolean_List_marshal	0x617e	0x1
Boolean_marshal	0x1013	0x2
Boolean_type	0x1037	0x3
Buffer_List_marshal	0x1541	0x4
Buffer_marshal	0x10d2	0x5
Buffer_type	0x1133	0x6
Config_create	0x21f9	0x7
Config_delete	0x200a	0x8
Config_duplicate	0x22e6	0x9
Config_getConfigVersion	0x2059	0xa
Config_getConstants	0x2066	0xb
Config_getID	0x2082	0xc
Config_getInputParams	0x208f	0xd
Config_getName	0x20ab	0xe
Config_getNamespaceUri	0x20b8	0xf
Config_getOutputParams	0x20c4	0x10
Config_getSchemaVersion	0x20e0	0x11
Config_getVersion	0x20ed	0x12
Config_marshal	0x3103	0x13
Config_printUsage	0x20fa	0x14
Config_setConstants	0x2184	0x15
Config_setInputParams	0x21ab	0x16
Config_setOutputParams	0x21d2	0x17
Config_unmarshal	0x92e4	0x18
FinalizeXMLUnmarshal	0x8b3a	0x19
IPv4_List_marshal	0x77e0	0x1a
IPv4_marshal	0x2823	0x1b
IPv4_type	0x23be	0x1c
IPv6_List_marshal	0x77e0	0x1d
IPv6_marshal	0x2823	0x1e
IPv6_type	0x2545	0x1f
InitializeXMLUnmarshal	0x8b56	0x20
List_format	0x254b	0x21
LocalFile_List_marshal	0x77e0	0x22
LocalFile_marshal	0x2823	0x23
LocalFile_type	0x2828	0x24
Paramchoice_addParamgroup	0x3304	0x25
Paramchoice_create	0x3680	0x26
Paramchoice_delete	0x34b0	0x27
Paramchoice_getDefaultValue	0x38f2	0x28
Paramchoice_getDescription	0x390e	0x29
Paramchoice_getName	0x396a	0x2a
Paramchoice_getNumParamgroups	0x2059	0x2b
Paramchoice_getParamgroup	0x3372	0x2c
Paramchoice_getValue	0x3985	0x2d
Paramchoice_hasValidValue	0x338d	0x2e
Paramchoice_hasValue	0x33a8	0x2f
Paramchoice_isValid	0x3553	0x30
Paramchoice_matchName	0x4181	0x31
Paramchoice_setValue	0x3631	0x32
Parameter_Boolean_List_create	0x5ff0	0x33
Parameter_Boolean_List_getSize	0x5d94	0x34
Parameter_Boolean_List_getValue	0x5dac	0x35
Parameter_Boolean_List_setValue	0x5dca	0x36
Parameter_Boolean_create	0x5cdc	0x37
Parameter_Boolean_getValue	0x5b0b	0x38
Parameter_Boolean_setValue	0x5b23	0x39
Parameter_Buffer_List_create	0x1f14	0x3a
Parameter_Buffer_List_getSize	0x1bdf	0x3b
Parameter_Buffer_List_getValue	0x1bf7	0x3c
Parameter_Buffer_List_setValue	0x1c1a	0x3d
Parameter_Buffer_create	0x1937	0x3e
Parameter_Buffer_getValue	0x16ae	0x3f
Parameter_Buffer_setValue	0x16cc	0x40
Parameter_IPv4_List_create	0x7297	0x41
Parameter_IPv4_List_getSize	0x6e9d	0x42
Parameter_IPv4_List_getValue	0x6eb5	0x43
Parameter_IPv4_List_setValue	0x6ed3	0x44
Parameter_IPv4_create	0x6be3	0x45
Parameter_IPv4_getValue	0x6827	0x46
Parameter_IPv4_setValue	0x683f	0x47
Parameter_IPv6_List_create	0x7311	0x48
Parameter_IPv6_List_getSize	0x6ef1	0x49
Parameter_IPv6_List_getValue	0x6f09	0x4a
Parameter_IPv6_List_setValue	0x6f27	0x4b
Parameter_IPv6_create	0x6c5d	0x4c
Parameter_IPv6_getValue	0x6859	0x4d
Parameter_IPv6_setValue	0x6871	0x4e
Parameter_LocalFile_List_create	0x738b	0x4f
Parameter_LocalFile_List_getSize	0x6f45	0x50
Parameter_LocalFile_List_getValue	0x6f5d	0x51
Parameter_LocalFile_List_setValue	0x6f7b	0x52
Parameter_LocalFile_create	0x6cd7	0x53
Parameter_LocalFile_getValue	0x688b	0x54
Parameter_LocalFile_setValue	0x68a3	0x55
Parameter_Port_List_getSize	0x8355	0x56
Parameter_Port_List_getValue	0x836d	0x57
Parameter_Port_List_setValue	0x838b	0x58
Parameter_Port_getValue	0x7f65	0x59
Parameter_Port_setValue	0x7f7d	0x5a
Parameter_S16_List_create	0x58c5	0x5b
Parameter_S16_List_getSize	0x56a6	0x5c
Parameter_S16_List_getValue	0x56be	0x5d
Parameter_S16_List_setValue	0x56dc	0x5e
Parameter_S16_create	0x55b1	0x5f
Parameter_S16_getValue	0x549a	0x60
Parameter_S16_setValue	0x54b2	0x61
Parameter_S32_List_create	0x5f76	0x62
Parameter_S32_List_getSize	0x5d3e	0x63
Parameter_S32_List_getValue	0x5d56	0x64
Parameter_S32_List_setValue	0x5d74	0x65
Parameter_S32_create	0x5c62	0x66
Parameter_S32_getValue	0x5adb	0x67
Parameter_S32_setValue	0x5af3	0x68
Parameter_S64_List_create	0x9a6c	0x69
Parameter_S64_List_getSize	0x986f	0x6a
Parameter_S64_List_getValue	0x9887	0x6b
Parameter_S64_List_setValue	0x98a5	0x6c
Parameter_S64_create	0x976f	0x6d
Parameter_S64_getValue	0x9549	0x6e
Parameter_S64_setValue	0x9561	0x6f
Parameter_S8_List_create	0x533d	0x70
Parameter_S8_List_getSize	0x51fb	0x71
Parameter_S8_List_getValue	0x5213	0x72
Parameter_S8_List_setValue	0x5231	0x73
Parameter_S8_create	0x518b	0x74
Parameter_S8_getValue	0x4f77	0x75
Parameter_S8_setValue	0x4f8f	0x76
Parameter_Socket_List_create	0x6684	0x77
Parameter_Socket_List_getSize	0x64e3	0x78
Parameter_Socket_List_getValue	0x64fb	0x79
Parameter_Socket_List_setValue	0x6519	0x7a
Parameter_Socket_create	0x63fd	0x7b
Parameter_Socket_getValue	0x6233	0x7c
Parameter_Socket_setValue	0x624b	0x7d
Parameter_String_List_create	0x721d	0x7e
Parameter_String_List_getSize	0x6e49	0x7f
Parameter_String_List_getValue	0x6e61	0x80
Parameter_String_List_setValue	0x6e7f	0x81
Parameter_String_create	0x6b69	0x82
Parameter_String_getValue	0x67f5	0x83
Parameter_String_setValue	0x680d	0x84
Parameter_TcpPort_List_create	0x8550	0x85
Parameter_TcpPort_create	0x8233	0x86
Parameter_U16_List_create	0x84d6	0x87
Parameter_U16_List_getSize	0x82de	0x88
Parameter_U16_List_getValue	0x82f6	0x89
Parameter_U16_List_setValue	0x8314	0x8a
Parameter_U16_create	0x81b9	0x8b
Parameter_U16_getValue	0x7f14	0x8c
Parameter_U16_setValue	0x7f2c	0x8d
Parameter_U32_List_create	0x899b	0x8e
Parameter_U32_List_getSize	0x8859	0x8f
Parameter_U32_List_getValue	0x8871	0x90
Parameter_U32_List_setValue	0x888f	0x91
Parameter_U32_create	0x8810	0x92
Parameter_U32_getValue	0x86f9	0x93
Parameter_U32_setValue	0x8711	0x94
Parameter_U64_List_create	0xa0a3	0x95
Parameter_U64_List_getSize	0x9ea6	0x96
Parameter_U64_List_getValue	0x9ebe	0x97
Parameter_U64_List_setValue	0x9edc	0x98
Parameter_U64_create	0x9da4	0x99
Parameter_U64_getValue	0x9c89	0x9a
Parameter_U64_setValue	0x9ca1	0x9b
Parameter_U8_List_create	0x7cf6	0x9c
Parameter_U8_List_getSize	0x7a9c	0x9d
Parameter_U8_List_getValue	0x7ab4	0x9e
Parameter_U8_List_setValue	0x7ad2	0x9f
Parameter_U8_create	0x79bb	0xa0
Parameter_U8_getValue	0x78a4	0xa1
Parameter_U8_setValue	0x78bc	0xa2
Parameter_UString_List_create	0x1fab	0xa3
Parameter_UString_List_getSize	0x1c3a	0xa4
Parameter_UString_List_getValue	0x1c52	0xa5
Parameter_UString_List_setValue	0x1c75	0xa6
Parameter_UString_create	0x19ce	0xa7
Parameter_UString_getValue	0x16ea	0xa8
Parameter_UString_setValue	0x1708	0xa9
Parameter_UdpPort_List_create	0x8580	0xaa
Parameter_UdpPort_create	0x8263	0xab
Parameter_delete	0x38a1	0xac
Parameter_getDescription	0x38f2	0xad
Parameter_getFormat	0x390e	0xae
Parameter_getInvalidReason	0x20c4	0xaf
Parameter_getMarshalledDefault	0x392a	0xb0
Parameter_getMarshalledValue	0x3946	0xb1
Parameter_getName	0x396a	0xb2
Parameter_getType	0x3985	0xb3
Parameter_hasValidValue	0x39b6	0xb4
Parameter_hasValue	0x39a1	0xb5
Parameter_hide	0x39d4	0xb6
Parameter_isHidden	0x39e4	0xb7
Parameter_isRequired	0x39f8	0xb8
Parameter_isValid	0x3a0c	0xb9
Parameter_markInvalid	0x3a35	0xba
Parameter_markInvalidWithReason	0x3a42	0xbb
Parameter_matchFormat	0x3a62	0xbc
Parameter_matchFormatAndType	0x3e30	0xbd
Parameter_matchName	0x3a83	0xbe
Parameter_matchType	0x3aa3	0xbf
Parameter_resetValue	0x409d	0xc0
Parameter_setMarshalledValue	0x3e81	0xc1
Paramgroup_addParamchoice	0x465b	0xc2
Paramgroup_addParameter	0x40bf	0xc3
Paramgroup_create	0x447c	0xc4
Paramgroup_delete	0x4358	0xc5
Paramgroup_getDescription	0x390e	0xc6
Paramgroup_getName	0x396a	0xc7
Paramgroup_getNumParamchoices	0x2082	0xc8
Paramgroup_getNumParameters	0x20ab	0xc9
Paramgroup_getParamchoice	0x46c3	0xca
Paramgroup_getParameter	0x410c	0xcb
Paramgroup_isValid	0x4127	0xcc
Paramgroup_matchName	0x4181	0xcd
Paramgroup_removeParameter	0x42e2	0xce
Params_addParamchoice	0x460e	0xcf
Params_addParameter	0x465b	0xd0
Params_create	0x4bbd	0xd1
Params_delete	0x48e1	0xd2
Params_duplicate	0x4c8a	0xd3
Params_findParamchoice	0x495d	0xd4
Params_findParameter	0x4999	0xd5
Params_getCallbackIPv4Values	0x4d35	0xd6
Params_getCallbackIPv6Values	0x4da7	0xd7
Params_getCallbackPortValues	0x4e19	0xd8
Params_getName	0x396a	0xd9
Params_getNumParamchoices	0x20e0	0xda
Params_getNumParameters	0x2082	0xdb
Params_getParamchoice	0x46a8	0xdc
Params_getParameter	0x46c3	0xdd
Params_isValid	0x46de	0xde
Params_parseCommandLine	0x4a00	0xdf
Params_printInvalid	0x4738	0xe0
Params_removeParameter	0x4818	0xe1
Params_validateCallbackPorts	0x4e94	0xe2
Port_List_marshal	0x867a	0xe3
Port_marshal	0x4f1b	0xe4
S16_List_marshal	0x5a3d	0xe5
S16_marshal	0x58f9	0xe6
S16_type	0x5906	0xe7
S32_List_marshal	0x61af	0xe8
S32_marshal	0x6020	0xe9
S32_type	0x604c	0xea
S64_List_marshal	0x9bc5	0xeb
S64_marshal	0x9a9c	0xec
S64_type	0x9acc	0xed
S8_List_marshal	0x53eb	0xee
S8_marshal	0x536d	0xef
S8_type	0x537a	0xf0
Scalar_format	0x4f31	0xf1
Socket_List_marshal	0x6705	0xf2
Socket_marshal	0x66bf	0xf3
Socket_type	0x66c4	0xf4
String_List_marshal	0x780c	0xf5
String_marshal	0x73bb	0xf6
String_type	0x746a	0xf7
TcpPort_type	0x4f25	0xf8
U16_List_marshal	0x86ad	0xf9
U16_marshal	0x85b0	0xfa
U16_type	0x85bd	0xfb
U32_List_marshal	0x8b09	0xfc
U32_marshal	0x89cb	0xfd
U32_type	0x89f7	0xfe
U64_List_marshal	0xa280	0xff
U64_marshal	0xa0d3	0x100
U64_type	0xa103	0x101
U8_List_marshal	0x7e96	0x102
U8_marshal	0x7d26	0x103
U8_type	0x7d33	0x104
UString_List_marshal	0x1593	0x105
UString_marshal	0x7842	0x106
UString_type	0x7847	0x107
UdpPort_type	0x4f2b	0x108
freeMarshalledValue	0x2395	0x109

c:\windows\temp\ssleay32.dll

Created File

Binary

Blacklisted

Mime Type	application/x-dosexec
File Size	180.00 KB
MD5	5e8ecdc3e70e2ecb0893cbda2c18906f
SHA1	43f92d0e47b1371c0442c6cc8af3685c2119f82c
SHA256	be8eb97d8171b8c91c6bc420346f7a6d2d2f76809a667ade03c990feffadaad5
SSDeep	3072:mLTO9u7hG/sRtbvSRvkFKSmxuMy2n+WztW56X3AdGa1XW3VL7uGLnPhanJE+hX:eyg7hztbvSRvkWxuMlndzouWnmPLcnJ
ImpHash	97a700de1687fd1cc15ee2d6e2e3a134

File Reputation Information

Severity	Blacklisted
First Seen	2017-04-15 11:40 (UTC+2)
Last Seen	2018-10-09 17:34 (UTC+2)
Names	Win32.Trojan.Shadowbrokers
Families	Shadowbrokers
Classification	Trojan

PE Information

Image Base	0x10000000
Entry Point	0x10020b3c
Size Of Code	0x20000
Size Of Initialized Data	0xd000
File Type	dll
Subsystem	windows_cui
Machine Type	i386
Compile Timestamp	2012-02-28 13:53:59+00:00

Version Information (8)

LegalCopyright	Copyright © 1998-2007 The OpenSSL Project. Copyright © 1995-1998 Eric A. Young, Tim J. Hudson. All rights reserved.
InternalName	ssleay32
FileVersion	0.9.8r
CompanyName	The OpenSSL Project, http://www.openssl.org/
ProductName	The OpenSSL Toolkit
ProductVersion	0.9.8r
FileDescription	OpenSSL Shared Library
OriginalFilename	ssleay32.dll

Sections (5)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x1ff56	0x20000	0x400	cnt_code, mem_execute, mem_read	6.41
.rdata	0x10021000	0x81b1	0x8200	0x20400	cnt_initialized_data, mem_read	5.47
.data	0x1002a000	0x2b54	0x2800	0x28600	cnt_initialized_data, mem_read, mem_write	5.17
.rsrc	0x1002d000	0x440	0x600	0x2ae00	cnt_initialized_data, mem_read	2.61
.reloc	0x1002e000	0x1b98	0x1c00	0x2b400	cnt_initialized_data, mem_discardable, mem_read	6.08

Imports (3)

LIBEAY32.dll (278)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
(by ordinal)	0x34	0x10021040	0x26ea4	0x262a4	-
(by ordinal)	0x899	0x10021044	0x26ea8	0x262a8	-
(by ordinal)	0x121	0x10021048	0x26eac	0x262ac	-
(by ordinal)	0x1ed	0x1002104c	0x26eb0	0x262b0	-
(by ordinal)	0x38f	0x10021050	0x26eb4	0x262b4	-
(by ordinal)	0x1d0	0x10021054	0x26eb8	0x262b8	-
(by ordinal)	0xefc	0x10021058	0x26ebc	0x262bc	-
(by ordinal)	0xcad	0x1002105c	0x26ec0	0x262c0	-
(by ordinal)	0x162	0x10021060	0x26ec4	0x262c4	-
(by ordinal)	0xb78	0x10021064	0x26ec8	0x262c8	-
(by ordinal)	0xcac	0x10021068	0x26ecc	0x262cc	-
(by ordinal)	0xf04	0x1002106c	0x26ed0	0x262d0	-
(by ordinal)	0x143	0x10021070	0x26ed4	0x262d4	-
(by ordinal)	0xbfb	0x10021074	0x26ed8	0x262d8	-
(by ordinal)	0xb4e	0x10021078	0x26edc	0x262dc	-
(by ordinal)	0x3c1	0x1002107c	0x26ee0	0x262e0	-
(by ordinal)	0xf22	0x10021080	0x26ee4	0x262e4	-
(by ordinal)	0xf01	0x10021084	0x26ee8	0x262e8	-
(by ordinal)	0x59	0x10021088	0x26eec	0x262ec	-
(by ordinal)	0x6d	0x1002108c	0x26ef0	0x262f0	-
(by ordinal)	0xf27	0x10021090	0x26ef4	0x262f4	-
(by ordinal)	0xca	0x10021094	0x26ef8	0x262f8	-
(by ordinal)	0xca7	0x10021098	0x26efc	0x262fc	-
(by ordinal)	0x362	0x1002109c	0x26f00	0x26300	-
(by ordinal)	0x6e	0x100210a0	0x26f04	0x26304	-
(by ordinal)	0xd5e	0x100210a4	0x26f08	0x26308	-
(by ordinal)	0xb71	0x100210a8	0x26f0c	0x2630c	-
(by ordinal)	0xe3c	0x100210ac	0x26f10	0x26310	-
(by ordinal)	0xdf2	0x100210b0	0x26f14	0x26314	-
(by ordinal)	0xa12	0x100210b4	0x26f18	0x26318	-
(by ordinal)	0x6f	0x100210b8	0x26f1c	0x2631c	-
(by ordinal)	0xbc2	0x100210bc	0x26f20	0x26320	-
(by ordinal)	0xd98	0x100210c0	0x26f24	0x26324	-
(by ordinal)	0xb6c	0x100210c4	0x26f28	0x26328	-
(by ordinal)	0xd83	0x100210c8	0x26f2c	0x2632c	-
(by ordinal)	0xdb8	0x100210cc	0x26f30	0x26330	-
(by ordinal)	0xe18	0x100210d0	0x26f34	0x26334	-
(by ordinal)	0xdf7	0x100210d4	0x26f38	0x26338	-
(by ordinal)	0xe4f	0x100210d8	0x26f3c	0x2633c	-
(by ordinal)	0x7b	0x100210dc	0x26f40	0x26340	-
(by ordinal)	0xc9	0x100210e0	0x26f44	0x26344	-
(by ordinal)	0x76	0x100210e4	0x26f48	0x26348	-
(by ordinal)	0xe52	0x100210e8	0x26f4c	0x2634c	-
(by ordinal)	0xdb	0x100210ec	0x26f50	0x26350	-
(by ordinal)	0x1f2	0x100210f0	0x26f54	0x26354	-
(by ordinal)	0x11d	0x100210f4	0x26f58	0x26358	-
(by ordinal)	0x27b	0x100210f8	0x26f5c	0x2635c	-
(by ordinal)	0x38d	0x100210fc	0x26f60	0x26360	-
(by ordinal)	0x390	0x10021100	0x26f64	0x26364	-
(by ordinal)	0xae0	0x10021104	0x26f68	0x26368	-
(by ordinal)	0x3c5	0x10021108	0x26f6c	0x2636c	-
(by ordinal)	0x3c4	0x1002110c	0x26f70	0x26370	-
(by ordinal)	0x100	0x10021110	0x26f74	0x26374	-
(by ordinal)	0x112	0x10021114	0x26f78	0x26378	-
(by ordinal)	0x114	0x10021118	0x26f7c	0x2637c	-
(by ordinal)	0xf3b	0x1002111c	0x26f80	0x26380	-
(by ordinal)	0xa0c	0x10021120	0x26f84	0x26384	-
(by ordinal)	0xcf3	0x10021124	0x26f88	0x26388	-
(by ordinal)	0xb6f	0x10021128	0x26f8c	0x2638c	-
(by ordinal)	0xabb	0x1002112c	0x26f90	0x26390	-
(by ordinal)	0xe8c	0x10021130	0x26f94	0x26394	-
(by ordinal)	0x139	0x10021134	0x26f98	0x26398	-
(by ordinal)	0x1ef	0x10021138	0x26f9c	0x2639c	-
(by ordinal)	0xf2b	0x1002113c	0x26fa0	0x263a0	-
(by ordinal)	0x78	0x10021140	0x26fa4	0x263a4	-
(by ordinal)	0x97	0x10021144	0x26fa8	0x263a8	-
(by ordinal)	0xc6a	0x10021148	0x26fac	0x263ac	-
(by ordinal)	0xe6f	0x1002114c	0x26fb0	0x263b0	-
(by ordinal)	0xdde	0x10021150	0x26fb4	0x263b4	-
(by ordinal)	0xd5a	0x10021154	0x26fb8	0x263b8	-
(by ordinal)	0xcb	0x10021158	0x26fbc	0x263bc	-
(by ordinal)	0x80	0x1002115c	0x26fc0	0x263c0	-
(by ordinal)	0x1f	0x10021160	0x26fc4	0x263c4	-
(by ordinal)	0x33e	0x10021164	0x26fc8	0x263c8	-
(by ordinal)	0x2d7	0x10021168	0x26fcc	0x263cc	-
(by ordinal)	0xac8	0x1002116c	0x26fd0	0x263d0	-
(by ordinal)	0x11a	0x10021170	0x26fd4	0x263d4	-
(by ordinal)	0x23c	0x10021174	0x26fd8	0x263d8	-
(by ordinal)	0xc5d	0x10021178	0x26fdc	0x263dc	-
(by ordinal)	0xda1	0x1002117c	0x26fe0	0x263e0	-
(by ordinal)	0xe87	0x10021180	0x26fe4	0x263e4	-
(by ordinal)	0xd8	0x10021184	0x26fe8	0x263e8	-
(by ordinal)	0xce	0x10021188	0x26fec	0x263ec	-
(by ordinal)	0x1f1	0x1002118c	0x26ff0	0x263f0	-
(by ordinal)	0xfce	0x10021190	0x26ff4	0x263f4	-
(by ordinal)	0xe62	0x10021194	0x26ff8	0x263f8	-
(by ordinal)	0xb3d	0x10021198	0x26ffc	0x263fc	-
(by ordinal)	0xe7f	0x1002119c	0x27000	0x26400	-
(by ordinal)	0xcd	0x100211a0	0x27004	0x26404	-
(by ordinal)	0x1e6	0x100211a4	0x27008	0x26408	-
(by ordinal)	0x1e4	0x100211a8	0x2700c	0x2640c	-
(by ordinal)	0x2fb	0x100211ac	0x27010	0x26410	-
(by ordinal)	0x241	0x100211b0	0x27014	0x26414	-
(by ordinal)	0x38b	0x100211b4	0x27018	0x26418	-
(by ordinal)	0x57	0x100211b8	0x2701c	0x2641c	-
(by ordinal)	0xaa	0x100211bc	0x27020	0x26420	-
(by ordinal)	0x1e1	0x100211c0	0x27024	0x26424	-
(by ordinal)	0xe91	0x100211c4	0x27028	0x26428	-
(by ordinal)	0x14d	0x100211c8	0x2702c	0x2642c	-
(by ordinal)	0xb63	0x100211cc	0x27030	0x26430	-
(by ordinal)	0x448	0x100211d0	0x27034	0x26434	-
(by ordinal)	0x449	0x100211d4	0x27038	0x26438	-
(by ordinal)	0xee8	0x100211d8	0x2703c	0x2643c	-
(by ordinal)	0xf30	0x100211dc	0x27040	0x26440	-
(by ordinal)	0xf38	0x100211e0	0x27044	0x26444	-
(by ordinal)	0xa1d	0x100211e4	0x27048	0x26448	-
(by ordinal)	0x479	0x100211e8	0x2704c	0x2644c	-
(by ordinal)	0x478	0x100211ec	0x27050	0x26450	-
(by ordinal)	0x439	0x100211f0	0x27054	0x26454	-
(by ordinal)	0x8f4	0x100211f4	0x27058	0x26458	-
(by ordinal)	0xeef	0x100211f8	0x2705c	0x2645c	-
(by ordinal)	0xf06	0x100211fc	0x27060	0x26460	-
(by ordinal)	0x26e	0x10021200	0x27064	0x26464	-
(by ordinal)	0x2a7	0x10021204	0x27068	0x26468	-
(by ordinal)	0x26f	0x10021208	0x2706c	0x2646c	-
(by ordinal)	0xf52	0x1002120c	0x27070	0x26470	-
(by ordinal)	0xb52	0x10021210	0x27074	0x26474	-
(by ordinal)	0xc34	0x10021214	0x27078	0x26478	-
(by ordinal)	0xf55	0x10021218	0x2707c	0x2647c	-
(by ordinal)	0xa8e	0x1002121c	0x27080	0x26480	-
(by ordinal)	0x108	0x10021220	0x27084	0x26484	-
(by ordinal)	0x10a	0x10021224	0x27088	0x26488	-
(by ordinal)	0xcd8	0x10021228	0x2708c	0x2648c	-
(by ordinal)	0xe78	0x1002122c	0x27090	0x26490	-
(by ordinal)	0x55	0x10021230	0x27094	0x26494	-
(by ordinal)	0xeb7	0x10021234	0x27098	0x26498	-
(by ordinal)	0xe3f	0x10021238	0x2709c	0x2649c	-
(by ordinal)	0xeb6	0x1002123c	0x270a0	0x264a0	-
(by ordinal)	0xd25	0x10021240	0x270a4	0x264a4	-
(by ordinal)	0x1012	0x10021244	0x270a8	0x264a8	-
(by ordinal)	0xf11	0x10021248	0x270ac	0x264ac	-
(by ordinal)	0xd84	0x1002124c	0x270b0	0x264b0	-
(by ordinal)	0xd7e	0x10021250	0x270b4	0x264b4	-
(by ordinal)	0xeaa	0x10021254	0x270b8	0x264b8	-
(by ordinal)	0xd42	0x10021258	0x270bc	0x264bc	-
(by ordinal)	0xbb	0x1002125c	0x270c0	0x264c0	-
(by ordinal)	0x381	0x10021260	0x270c4	0x264c4	-
(by ordinal)	0xd56	0x10021264	0x270c8	0x264c8	-
(by ordinal)	0xda7	0x10021268	0x270cc	0x264cc	-
(by ordinal)	0x43	0x1002126c	0x270d0	0x264d0	-
(by ordinal)	0x41	0x10021270	0x270d4	0x264d4	-
(by ordinal)	0x35	0x10021274	0x270d8	0x264d8	-
(by ordinal)	0x4e	0x10021278	0x270dc	0x264dc	-
(by ordinal)	0x62	0x1002127c	0x270e0	0x264e0	-
(by ordinal)	0xef2	0x10021280	0x270e4	0x264e4	-
(by ordinal)	0xde7	0x10021284	0x270e8	0x264e8	-
(by ordinal)	0xd47	0x10021288	0x270ec	0x264ec	-
(by ordinal)	0x27c	0x1002128c	0x270f0	0x264f0	-
(by ordinal)	0x392	0x10021290	0x270f4	0x264f4	-
(by ordinal)	0x9ae	0x10021294	0x270f8	0x264f8	-
(by ordinal)	0x272	0x10021298	0x270fc	0x264fc	-
(by ordinal)	0x37a	0x1002129c	0x27100	0x26500	-
(by ordinal)	0x3ec	0x100212a0	0x27104	0x26504	-
(by ordinal)	0xdc7	0x100212a4	0x27108	0x26508	-
(by ordinal)	0x16c	0x100212a8	0x2710c	0x2650c	-
(by ordinal)	0x3f2	0x100212ac	0x27110	0x26510	-
(by ordinal)	0x803	0x100212b0	0x27114	0x26514	-
(by ordinal)	0x3a	0x100212b4	0x27118	0x26518	-
(by ordinal)	0x42	0x100212b8	0x2711c	0x2651c	-
(by ordinal)	0x276	0x100212bc	0x27120	0x26520	-
(by ordinal)	0x274	0x100212c0	0x27124	0x26524	-
(by ordinal)	0x411	0x100212c4	0x27128	0x26528	-
(by ordinal)	0x3ef	0x100212c8	0x2712c	0x2652c	-
(by ordinal)	0x3ed	0x100212cc	0x27130	0x26530	-
(by ordinal)	0x403	0x100212d0	0x27134	0x26534	-
(by ordinal)	0xd32	0x100212d4	0x27138	0x26538	-
(by ordinal)	0xd6d	0x100212d8	0x2713c	0x2653c	-
(by ordinal)	0x21d	0x100212dc	0x27140	0x26540	-
(by ordinal)	0x13c	0x100212e0	0x27144	0x26544	-
(by ordinal)	0x275	0x100212e4	0x27148	0x26548	-
(by ordinal)	0x37c	0x100212e8	0x2714c	0x2654c	-
(by ordinal)	0x4a	0x100212ec	0x27150	0x26550	-
(by ordinal)	0xf1a	0x100212f0	0x27154	0x26554	-
(by ordinal)	0xf8	0x100212f4	0x27158	0x26558	-
(by ordinal)	0x677	0x100212f8	0x2715c	0x2655c	-
(by ordinal)	0x23f	0x100212fc	0x27160	0x26560	-
(by ordinal)	0x401	0x10021300	0x27164	0x26564	-
(by ordinal)	0xf6	0x10021304	0x27168	0x26568	-
(by ordinal)	0x44c	0x10021308	0x2716c	0x2656c	-
(by ordinal)	0x9dc	0x1002130c	0x27170	0x26570	-
(by ordinal)	0xe1a	0x10021310	0x27174	0x26574	-
(by ordinal)	0xdb1	0x10021314	0x27178	0x26578	-
(by ordinal)	0xe0b	0x10021318	0x2717c	0x2657c	-
(by ordinal)	0x3ff	0x1002131c	0x27180	0x26580	-
(by ordinal)	0x291	0x10021320	0x27184	0x26584	-
(by ordinal)	0x191	0x10021324	0x27188	0x26588	-
(by ordinal)	0x5d	0x10021328	0x2718c	0x2658c	-
(by ordinal)	0xd44	0x1002132c	0x27190	0x26590	-
(by ordinal)	0xe49	0x10021330	0x27194	0x26594	-
(by ordinal)	0xfcd	0x10021334	0x27198	0x26598	-
(by ordinal)	0x9ab	0x10021338	0x2719c	0x2659c	-
(by ordinal)	0x377	0x1002133c	0x271a0	0x265a0	-
(by ordinal)	0x379	0x10021340	0x271a4	0x265a4	-
(by ordinal)	0x37b	0x10021344	0x271a8	0x265a8	-
(by ordinal)	0x13b	0x10021348	0x271ac	0x265ac	-
(by ordinal)	0x47b	0x1002134c	0x271b0	0x265b0	-
(by ordinal)	0xbd	0x10021350	0x271b4	0x265b4	-
(by ordinal)	0x13a	0x10021354	0x271b8	0x265b8	-
(by ordinal)	0x687	0x10021358	0x271bc	0x265bc	-
(by ordinal)	0x3bc	0x1002135c	0x271c0	0x265c0	-
(by ordinal)	0x118	0x10021360	0x271c4	0x265c4	-
(by ordinal)	0x885	0x10021364	0x271c8	0x265c8	-
(by ordinal)	0x18f	0x10021368	0x271cc	0x265cc	-
(by ordinal)	0x2ec	0x1002136c	0x271d0	0x265d0	-
(by ordinal)	0x117	0x10021370	0x271d4	0x265d4	-
(by ordinal)	0x11b	0x10021374	0x271d8	0x265d8	-
(by ordinal)	0x190	0x10021378	0x271dc	0x265dc	-
(by ordinal)	0x2ef	0x1002137c	0x271e0	0x265e0	-
(by ordinal)	0x2ee	0x10021380	0x271e4	0x265e4	-
(by ordinal)	0x306	0x10021384	0x271e8	0x265e8	-
(by ordinal)	0xc85	0x10021388	0x271ec	0x265ec	-
(by ordinal)	0x7a7	0x1002138c	0x271f0	0x265f0	-
(by ordinal)	0x25	0x10021390	0x271f4	0x265f4	-
(by ordinal)	0x23	0x10021394	0x271f8	0x265f8	-
(by ordinal)	0x338	0x10021398	0x271fc	0x265fc	-
(by ordinal)	0x336	0x1002139c	0x27200	0x26600	-
(by ordinal)	0x8	0x100213a0	0x27204	0x26604	-
(by ordinal)	0x443	0x100213a4	0x27208	0x26608	-
(by ordinal)	0xe74	0x100213a8	0x2720c	0x2660c	-
(by ordinal)	0xdb9	0x100213ac	0x27210	0x26610	-
(by ordinal)	0xe27	0x100213b0	0x27214	0x26614	-
(by ordinal)	0x20	0x100213b4	0x27218	0x26618	-
(by ordinal)	0x2ce	0x100213b8	0x2721c	0x2661c	-
(by ordinal)	0x7	0x100213bc	0x27220	0x26620	-
(by ordinal)	0x2cc	0x100213c0	0x27224	0x26624	-
(by ordinal)	0x2bf	0x100213c4	0x27228	0x26628	-
(by ordinal)	0x2a8	0x100213c8	0x2722c	0x2662c	-
(by ordinal)	0x97a	0x100213cc	0x27230	0x26630	-
(by ordinal)	0x56	0x100213d0	0x27234	0x26634	-
(by ordinal)	0x58	0x100213d4	0x27238	0x26638	-
(by ordinal)	0xcf1	0x100213d8	0x2723c	0x2663c	-
(by ordinal)	0xcf0	0x100213dc	0x27240	0x26640	-
(by ordinal)	0xcf2	0x100213e0	0x27244	0x26644	-
(by ordinal)	0x44d	0x100213e4	0x27248	0x26648	-
(by ordinal)	0x125	0x100213e8	0x2724c	0x2664c	-
(by ordinal)	0xbb4	0x100213ec	0x27250	0x26650	-
(by ordinal)	0xc53	0x100213f0	0x27254	0x26654	-
(by ordinal)	0x145	0x100213f4	0x27258	0x26658	-
(by ordinal)	0x149	0x100213f8	0x2725c	0x2665c	-
(by ordinal)	0x13e	0x100213fc	0x27260	0x26660	-
(by ordinal)	0x130	0x10021400	0x27264	0x26664	-
(by ordinal)	0x124	0x10021404	0x27268	0x26668	-
(by ordinal)	0x12b	0x10021408	0x2726c	0x2666c	-
(by ordinal)	0x3bb	0x1002140c	0x27270	0x26670	-
(by ordinal)	0x8cc	0x10021410	0x27274	0x26674	-
(by ordinal)	0x5b	0x10021414	0x27278	0x26678	-
(by ordinal)	0xf7	0x10021418	0x2727c	0x2667c	-
(by ordinal)	0xe1	0x1002141c	0x27280	0x26680	-
(by ordinal)	0xa9	0x10021420	0x27284	0x26684	-
(by ordinal)	0xa8	0x10021424	0x27288	0x26688	-
(by ordinal)	0xa7	0x10021428	0x2728c	0x2668c	-
(by ordinal)	0xf21	0x1002142c	0x27290	0x26690	-
(by ordinal)	0xde	0x10021430	0x27294	0x26694	-
(by ordinal)	0x1ea	0x10021434	0x27298	0x26698	-
(by ordinal)	0x2f2	0x10021438	0x2729c	0x2669c	-
(by ordinal)	0x96b	0x1002143c	0x272a0	0x266a0	-
(by ordinal)	0x38e	0x10021440	0x272a4	0x266a4	-
(by ordinal)	0xa46	0x10021444	0x272a8	0x266a8	-
(by ordinal)	0xc25	0x10021448	0x272ac	0x266ac	-
(by ordinal)	0x10d	0x1002144c	0x272b0	0x266b0	-
(by ordinal)	0xbc	0x10021450	0x272b4	0x266b4	-
(by ordinal)	0xb5	0x10021454	0x272b8	0x266b8	-
(by ordinal)	0x28e	0x10021458	0x272bc	0x266bc	-
(by ordinal)	0x122	0x1002145c	0x272c0	0x266c0	-
(by ordinal)	0x119	0x10021460	0x272c4	0x266c4	-
(by ordinal)	0xb05	0x10021464	0x272c8	0x266c8	-
(by ordinal)	0x281	0x10021468	0x272cc	0x266cc	-
(by ordinal)	0xb0	0x1002146c	0x272d0	0x266d0	-
(by ordinal)	0x359	0x10021470	0x272d4	0x266d4	-
(by ordinal)	0x89e	0x10021474	0x272d8	0x266d8	-
(by ordinal)	0xfc	0x10021478	0x272dc	0x266dc	-
(by ordinal)	0x387	0x1002147c	0x272e0	0x266e0	-
(by ordinal)	0x676	0x10021480	0x272e4	0x266e4	-
(by ordinal)	0x675	0x10021484	0x272e8	0x266e8	-
(by ordinal)	0x388	0x10021488	0x272ec	0x266ec	-
(by ordinal)	0x385	0x1002148c	0x272f0	0x266f0	-
(by ordinal)	0xeae	0x10021490	0x272f4	0x266f4	-
(by ordinal)	0x389	0x10021494	0x272f8	0x266f8	-

msvcrt.dll (18)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
fprintf	0x0	0x1002149c	0x27300	0x26700	0x49f
strcpy	0x0	0x100214a0	0x27304	0x26704	0x516
malloc	0x0	0x100214a4	0x27308	0x26708	0x4de
free	0x0	0x100214a8	0x2730c	0x2670c	0x4a6
_XcptFilter	0x0	0x100214ac	0x27310	0x26710	0x6a
_initterm	0x0	0x100214b0	0x27314	0x26714	0x1d5
_amsg_exit	0x0	0x100214b4	0x27318	0x26718	0x101
_adjust_fdiv	0x0	0x100214b8	0x2731c	0x2671c	0xf5
strncmp	0x0	0x100214bc	0x27320	0x26720	0x51f
strlen	0x0	0x100214c0	0x27324	0x26724	0x51c
memmove	0x0	0x100214c4	0x27328	0x26728	0x4ec
memset	0x0	0x100214c8	0x2732c	0x2672c	0x4ee
time	0x0	0x100214cc	0x27330	0x26730	0x534
memcmp	0x0	0x100214d0	0x27334	0x26734	0x4e9
memcpy	0x0	0x100214d4	0x27338	0x26738	0x4ea
_iob	0x0	0x100214d8	0x2733c	0x2673c	0x1db
_errno	0x0	0x100214dc	0x27340	0x26740	0x156
_ftime	0x0	0x100214e0	0x27344	0x26744	0x18e

KERNEL32.dll (15)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetLastError	0x0	0x10021000	0x26e64	0x26264	0x2a0
GetLastError	0x0	0x10021004	0x26e68	0x26268	0x131
RtlUnwind	0x0	0x10021008	0x26e6c	0x2626c	0x25b
InterlockedExchange	0x0	0x1002100c	0x26e70	0x26270	0x1cd
Sleep	0x0	0x10021010	0x26e74	0x26274	0x2c7
InterlockedCompareExchange	0x0	0x10021014	0x26e78	0x26278	0x1cb
TerminateProcess	0x0	0x10021018	0x26e7c	0x2627c	0x2cf
GetCurrentProcess	0x0	0x1002101c	0x26e80	0x26280	0x10d
UnhandledExceptionFilter	0x0	0x10021020	0x26e84	0x26284	0x2df
SetUnhandledExceptionFilter	0x0	0x10021024	0x26e88	0x26288	0x2bc
QueryPerformanceCounter	0x0	0x10021028	0x26e8c	0x2628c	0x22f
GetTickCount	0x0	0x1002102c	0x26e90	0x26290	0x18a
GetCurrentThreadId	0x0	0x10021030	0x26e94	0x26294	0x110
GetCurrentProcessId	0x0	0x10021034	0x26e98	0x26298	0x10e
GetSystemTimeAsFileTime	0x0	0x10021038	0x26e9c	0x2629c	0x17a

Exports (222)

Api name	EAT Address	Ordinal
BIO_f_ssl	0x1f155	0x79
BIO_new_buffer_ssl_connect	0x1f92e	0xad
BIO_new_ssl	0x1f817	0x7a
BIO_new_ssl_connect	0x1f8e1	0xae
BIO_ssl_copy_session_id	0x1f870	0x7c
BIO_ssl_shutdown	0x1f8bd	0x83
DTLSv1_client_method	0x13642	0x10c
DTLSv1_method	0x10d4c	0x111
DTLSv1_server_method	0x124d7	0x113
ERR_load_SSL_strings	0x1f978	0x1
SSL_CIPHER_description	0x1b920	0x2
SSL_CIPHER_get_bits	0x1bd46	0x80
SSL_CIPHER_get_name	0x1bd34	0x82
SSL_CIPHER_get_version	0x1bd07	0x81
SSL_COMP_add_compression_method	0x1bdaa	0xb8
SSL_COMP_get_compression_methods	0x1bd9f	0x114
SSL_COMP_get_name	0x1be9b	0x10f
SSL_CTX_add_client_CA	0x19bc0	0x3
SSL_CTX_add_session	0x1a89a	0x4
SSL_CTX_callback_ctrl	0x1756e	0xf3
SSL_CTX_check_private_key	0x1717e	0x5
SSL_CTX_ctrl	0x173b6	0x6
SSL_CTX_flush_sessions	0x1a82c	0x7
SSL_CTX_free	0x17a4f	0x8
SSL_CTX_get_cert_store	0x185b4	0xb4
SSL_CTX_get_client_CA_list	0x19b0b	0x9
SSL_CTX_get_client_cert_cb	0x1a468	0x120
SSL_CTX_get_ex_data	0x1859c	0x8a
SSL_CTX_get_ex_new_index	0x18565	0xa7
SSL_CTX_get_info_callback	0x1a451	0x11a
SSL_CTX_get_quiet_shutdown	0x18403	0x8c
SSL_CTX_get_timeout	0x1a347	0xb3
SSL_CTX_get_verify_callback	0x17026	0xa
SSL_CTX_get_verify_depth	0x17015	0xe4
SSL_CTX_get_verify_mode	0x1700a	0xb
SSL_CTX_load_verify_locations	0x184c2	0x8d
SSL_CTX_new	0x18cfb	0xc
SSL_CTX_remove_session	0x1a975	0xd
SSL_CTX_sess_get_get_cb	0x18422	0x117
SSL_CTX_sess_get_new_cb	0x1a42e	0x11f
SSL_CTX_sess_get_remove_cb	0x1840e	0x121
SSL_CTX_sess_set_get_cb	0x18416	0x118
SSL_CTX_sess_set_new_cb	0x1a422	0x116
SSL_CTX_sess_set_remove_cb	0x1a436	0x11d
SSL_CTX_sessions	0x173ae	0xf5
SSL_CTX_set_cert_store	0x185bc	0xb5
SSL_CTX_set_cert_verify_callback	0x17b61	0xe8
SSL_CTX_set_cipher_list	0x17665	0xf
SSL_CTX_set_client_CA_list	0x19af4	0x10
SSL_CTX_set_client_cert_cb	0x1a45c	0x11c
SSL_CTX_set_client_cert_engine	0x1a470	0x125
SSL_CTX_set_cookie_generate_cb	0x1a4df	0x11b
SSL_CTX_set_cookie_verify_cb	0x1a4eb	0x119
SSL_CTX_set_default_passwd_cb	0x17b49	0x11
SSL_CTX_set_default_passwd_cb_userdata	0x17b55	0xeb
SSL_CTX_set_default_verify_paths	0x184b4	0x8e
SSL_CTX_set_ex_data	0x18583	0x8f
SSL_CTX_set_generate_session_id	0x16b83	0x108
SSL_CTX_set_info_callback	0x1a442	0x11e
SSL_CTX_set_msg_callback	0x18652	0x10a
SSL_CTX_set_purpose	0x16cb3	0xee
SSL_CTX_set_quiet_shutdown	0x183f4	0x91
SSL_CTX_set_session_id_context	0x16aed	0xe7
SSL_CTX_set_ssl_version	0x16a99	0x13
SSL_CTX_set_timeout	0x1a331	0xb2
SSL_CTX_set_tmp_dh_callback	0x18606	0xb0
SSL_CTX_set_tmp_ecdh_callback	0x1862c	0x10d
SSL_CTX_set_tmp_rsa_callback	0x185e0	0xb1
SSL_CTX_set_trust	0x16cdc	0xed
SSL_CTX_set_verify	0x17b74	0x15
SSL_CTX_set_verify_depth	0x17b8d	0xe1
SSL_CTX_use_PrivateKey	0x1d236	0x16
SSL_CTX_use_PrivateKey_ASN1	0x1d39d	0x17
SSL_CTX_use_PrivateKey_file	0x1d29f	0x18
SSL_CTX_use_RSAPrivateKey	0x1d02a	0x19
SSL_CTX_use_RSAPrivateKey_ASN1	0x1d1db	0x1a
SSL_CTX_use_RSAPrivateKey_file	0x1d0dd	0x1b
SSL_CTX_use_certificate	0x1d7d6	0x1c
SSL_CTX_use_certificate_ASN1	0x1d957	0x1d
SSL_CTX_use_certificate_chain_file	0x1d9ab	0xde
SSL_CTX_use_certificate_file	0x1d840	0x1e
SSL_SESSION_cmp	0x17a19	0x84
SSL_SESSION_free	0x1a112	0x1f
SSL_SESSION_get_ex_data	0x1a00a	0x92
SSL_SESSION_get_ex_new_index	0x19fd1	0xa8
SSL_SESSION_get_id	0x1a0b9	0x115
SSL_SESSION_get_time	0x1a30b	0x86
SSL_SESSION_get_timeout	0x1a2fb	0x88
SSL_SESSION_hash	0x179f5	0x85
SSL_SESSION_new	0x1a020	0x20
SSL_SESSION_print	0x1ec97	0x21
SSL_SESSION_print_fp	0x1efc7	0x22
SSL_SESSION_set_ex_data	0x19fef	0x94
SSL_SESSION_set_time	0x1a31b	0x87
SSL_SESSION_set_timeout	0x1a2e4	0x89
SSL_accept	0x1945d	0x23
SSL_add_client_CA	0x19ba9	0x24
SSL_add_dir_cert_subjects_to_stack	0x19e0e	0xbc
SSL_add_file_cert_subjects_to_stack	0x19d16	0xb9
SSL_alert_desc_string	0x1ca27	0x25
SSL_alert_desc_string_long	0x1cb36	0x26
SSL_alert_type_string	0x1ca05	0x27
SSL_alert_type_string_long	0x1c9e3	0x28
SSL_callback_ctrl	0x17382	0xf4
SSL_check_private_key	0x171e4	0x29
SSL_clear	0x18678	0x2a
SSL_connect	0x19479	0x2b
SSL_copy_session_id	0x170e7	0x2c
SSL_ctrl	0x18bdb	0x2d
SSL_do_handshake	0x1911e	0x7d
SSL_dup	0x191ce	0x2e
SSL_dup_CA_list	0x19a7e	0x2f
SSL_free	0x189f9	0x30
SSL_get1_session	0x19f93	0xf2
SSL_get_SSL_CTX	0x18431	0x96
SSL_get_certificate	0x182b6	0x31
SSL_get_cipher_list	0x17624	0x34
SSL_get_ciphers	0x175de	0x37
SSL_get_client_CA_list	0x19b16	0x38
SSL_get_current_cipher	0x182e3	0x7f
SSL_get_current_compression	0x182fe	0x110
SSL_get_current_expansion	0x18312	0x112
SSL_get_default_timeout	0x1725f	0x39
SSL_get_error	0x18ff4	0x3a
SSL_get_ex_data	0x1854f	0x97
SSL_get_ex_data_X509_STORE_CTX_idx	0x1949f	0xaf
SSL_get_ex_new_index	0x18516	0xa9
SSL_get_fd	0x18b8d	0x3b
SSL_get_finished	0x16f78	0xf0
SSL_get_info_callback	0x184e9	0xa5
SSL_get_peer_cert_chain	0x170c5	0x3c
SSL_get_peer_certificate	0x17082	0x3d
SSL_get_peer_finished	0x16faf	0xf1
SSL_get_privatekey	0x182cc	0x7e
SSL_get_quiet_shutdown	0x1840e	0x99
SSL_get_rbio	0x185b4	0x3f
SSL_get_read_ahead	0x1706d	0x40
SSL_get_rfd	0x16d5f	0xf6
SSL_get_servername	0x1799d	0x123
SSL_get_servername_type	0x179cc	0x124
SSL_get_session	0x19f88	0x9a
SSL_get_shared_ciphers	0x1770b	0x41
SSL_get_shutdown	0x18422	0x9b
SSL_get_ssl_method	0x18141	0x42
SSL_get_verify_callback	0x16fff	0x45
SSL_get_verify_depth	0x16ff1	0xe5
SSL_get_verify_mode	0x16fe6	0x46
SSL_get_verify_result	0x1850b	0x9d
SSL_get_version	0x18218	0x47
SSL_get_wbio	0x173ae	0x48
SSL_get_wfd	0x16d9f	0xf7
SSL_has_matching_session_id	0x16bf7	0xf9
SSL_library_init	0x1f01f	0xb7
SSL_load_client_CA_file	0x19bd7	0x49
SSL_load_error_strings	0x19495	0x4a
SSL_new	0x18790	0x4b
SSL_peek	0x172b8	0x4c
SSL_pending	0x17075	0x4d
SSL_read	0x17269	0x4e
SSL_renegotiate	0x1735b	0x4f
SSL_renegotiate_pending	0x17375	0x109
SSL_rstate_string	0x1cc45	0x50
SSL_rstate_string_long	0x1c46f	0x51
SSL_set_SSL_CTX	0x1843c	0x122
SSL_set_accept_state	0x19183	0x52
SSL_set_bio	0x16d05	0x53
SSL_set_cipher_list	0x176b5	0x54
SSL_set_client_CA_list	0x19add	0x55
SSL_set_connect_state	0x191aa	0x56
SSL_set_ex_data	0x18534	0x9e
SSL_set_fd	0x16ddf	0x57
SSL_set_generate_session_id	0x16bbd	0x102
SSL_set_info_callback	0x184da	0xa0
SSL_set_msg_callback	0x18665	0x10b
SSL_set_purpose	0x16cc9	0xec
SSL_set_quiet_shutdown	0x1a436	0xa1
SSL_set_read_ahead	0x17061	0x58
SSL_set_rfd	0x16ed0	0x59
SSL_set_session	0x1a1e2	0x5a
SSL_set_session_id_context	0x16b38	0xbd
SSL_set_shutdown	0x18416	0xa2
SSL_set_ssl_method	0x18149	0x5b
SSL_set_tmp_dh_callback	0x18619	0xbb
SSL_set_tmp_ecdh_callback	0x1863f	0x10e
SSL_set_tmp_rsa_callback	0x185f3	0xba
SSL_set_trust	0x16cf2	0xef
SSL_set_verify	0x17031	0x5e
SSL_set_verify_depth	0x1704e	0xe2
SSL_set_verify_result	0x184fc	0xa3
SSL_set_wfd	0x16e35	0x5f
SSL_shutdown	0x18b92	0x60
SSL_state	0x184f4	0xa6
SSL_state_string	0x1c49b	0x61
SSL_state_string_long	0x1beaa	0x62
SSL_use_PrivateKey	0x1cd4b	0x63
SSL_use_PrivateKey_ASN1	0x1ceb8	0x64
SSL_use_PrivateKey_file	0x1cdb4	0x65
SSL_use_RSAPrivateKey	0x1d5c4	0x66
SSL_use_RSAPrivateKey_ASN1	0x1d77b	0x67
SSL_use_RSAPrivateKey_file	0x1d677	0x68
SSL_use_certificate	0x1d3fb	0x69
SSL_use_certificate_ASN1	0x1d570	0x6a
SSL_use_certificate_file	0x1d45f	0x6b
SSL_version	0x1842a	0xa4
SSL_want	0x185d8	0xb6
SSL_write	0x17300	0x6c
SSLv23_client_method	0xe99a	0x6e
SSLv23_method	0xd96b	0x6f
SSLv23_server_method	0xe070	0x70
SSLv2_client_method	0x3809	0x71
SSLv2_method	0x100f	0x72
SSLv2_server_method	0x243c	0x73
SSLv3_client_method	0xa064	0x74
SSLv3_method	0x4845	0x75
SSLv3_server_method	0x7460	0x76
TLSv1_client_method	0xec3d	0xac
TLSv1_method	0xec0d	0xaa
TLSv1_server_method	0xec25	0xab
d2i_SSL_SESSION	0x1e157	0x77
i2d_SSL_SESSION	0x1db18	0x78
ssl2_ciphers	0x2a168	0xe
ssl3_ciphers	0x2a4c8	0x12

c:\windows\temp\svchostbs.exe

Created File

Binary

Malicious

Mime Type	application/x-dosexec
File Size	25.00 KB
MD5	ae802629233bc39c66c7f136cb10a939
SHA1	13c5c6918063c31691caf1522d3e09bc2d1bdd85
SHA256	c8af5abb931257aec0f33ecbe8cb1731dbc1695369c800810cad2fb1cc004b08
SSDeep	384:YvLBWDRL//PoBncRA0YaQ7rsgi8ZM4oLZDI4owY6KmjCezMbgOlMcMIdU7vvxlL:Y9WD1TC0YaQ/3i8+LWfIEbLlI2U7D
ImpHash	bebfdb050c71e8e1aa8af4cf61a8fb52

File Reputation Information

Severity	Blacklisted
First Seen	2018-10-15 03:56 (UTC+2)
Last Seen	2018-10-16 09:15 (UTC+2)
Names	Win32.Trojan.Shadowbrokers
Families	Shadowbrokers
Classification	Trojan

PE Information

Image Base	0x400000
Entry Point	0x40f262
Size Of Code	0x3400
Size Of Initialized Data	0x7a00
File Type	executable
Subsystem	windows_cui
Machine Type	i386
Compile Timestamp	2013-01-02 20:03:18+00:00

Sections (3)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.MPRESS1	0x401000	0xe000	0x5200	0x200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	7.99
.MPRESS2	0x40f000	0xdcc	0xe00	0x5400	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	5.91
.rsrc	0x410000	0x1b4	0x200	0x6200	cnt_initialized_data, mem_read, mem_write	4.44

Imports (11)

KERNEL32.DLL (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x40f0f0	0xf0f0	0x54f0	0x0
GetProcAddress	0x0	0x40f0f4	0xf0f4	0x54f4	0x0

trfo-2.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TfFree	0x0	0x40f0fc	0xf0fc	0x54fc	0x0

trch-1.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Params_findParameter	0x0	0x40f104	0xf104	0x5504	0x0

tucl-1.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TcLog	0x0	0x40f10c	0xf10c	0x550c	0x0

WS2_32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
inet_addr	0xb	0x40f114	0xf114	0x5514	-

coli-0.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
coli_setID	0x0	0x40f11c	0xf11c	0x551c	0x0

tibe-2.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TbPutLong	0x0	0x40f124	0xf124	0x5524	0x0

cnli-1.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
byteSwapLong	0x0	0x40f12c	0xf12c	0x552c	0x0

xdvl-0.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
XDevLib_xorMask	0x0	0x40f134	0xf134	0x5534	0x0

SSLEAY32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
(by ordinal)	0x60	0x40f13c	0xf13c	0x553c	-

msvcrt.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
exit	0x0	0x40f144	0xf144	0x5544	0x0

YARA Matches

Rule Name	Rule Description	Classification	Severity	Actions
EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1	EquationGroup Tool - April Leak	-	5/5	... YARA Actions Show Ruleset Show Match

c:\windows\temp\libeay32.dll

Created File

Binary

Blacklisted

Mime Type	application/x-dosexec
File Size	882.00 KB
MD5	f01f09fe90d0f810c44dce4e94785227
SHA1	036f327417b7e1c6e0b91831440992972bc7802e
SHA256	5f30aa2fe338191b972705412b8043b0a134cdb287d754771fc225f2309e82ee
SSDeep	12288:G8Vbf1xLg6nelYgv1GZzd6qNvFBMhLG/SV2qvteuhNJspc4z84mbKeV4gbU:bo1v1GZFNvDya/SVQuhN2p9z84m3e+U
ImpHash	ab3711ec11b2005ba9f89a2f4ae2937b

File Reputation Information

Severity	Blacklisted
First Seen	2017-04-14 22:10 (UTC+2)
Last Seen	2018-10-15 08:41 (UTC+2)
Names	Win32.Trojan.Shadowbrokers
Families	Shadowbrokers
Classification	Trojan

PE Information

Image Base	0x10000000
Entry Point	0x10086047
Size Of Code	0x85600
Size Of Initialized Data	0x59c00
File Type	dll
Subsystem	windows_cui
Machine Type	i386
Compile Timestamp	2012-02-28 13:53:37+00:00

Version Information (8)

LegalCopyright	Copyright © 1998-2007 The OpenSSL Project. Copyright © 1995-1998 Eric A. Young, Tim J. Hudson. All rights reserved.
InternalName	libeay32
FileVersion	0.9.8r
CompanyName	The OpenSSL Project, http://www.openssl.org/
ProductName	The OpenSSL Toolkit
ProductVersion	0.9.8r
FileDescription	OpenSSL Shared Library
OriginalFilename	libeay32.dll

Sections (5)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x85418	0x85600	0x400	cnt_code, mem_execute, mem_read	6.72
.rdata	0x10087000	0x3e1b6	0x3e200	0x85a00	cnt_initialized_data, mem_read	6.24
.data	0x100c6000	0x11eec	0xf200	0xc3c00	cnt_initialized_data, mem_read, mem_write	5.36
.rsrc	0x100d8000	0x440	0x600	0xd2e00	cnt_initialized_data, mem_read	2.61
.reloc	0x100d9000	0x931c	0x9400	0xd3400	cnt_initialized_data, mem_discardable, mem_read	6.44

Imports (7)

WSOCK32.dll (25)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
sendto	0x14	0x100870d4	0xae068	0xaca68	-
recvfrom	0x11	0x100870d8	0xae06c	0xaca6c	-
bind	0x2	0x100870dc	0xae070	0xaca70	-
listen	0xd	0x100870e0	0xae074	0xaca74	-
accept	0x1	0x100870e4	0xae078	0xaca78	-
ntohl	0xe	0x100870e8	0xae07c	0xaca7c	-
inet_ntoa	0xc	0x100870ec	0xae080	0xaca80	-
WSACancelBlockingCall	0x71	0x100870f0	0xae084	0xaca84	-
WSACleanup	0x74	0x100870f4	0xae088	0xaca88	-
WSAStartup	0x73	0x100870f8	0xae08c	0xaca8c	-
getsockopt	0x7	0x100870fc	0xae090	0xaca90	-
getservbyname	0x37	0x10087100	0xae094	0xaca94	-
ntohs	0xf	0x10087104	0xae098	0xaca98	-
htons	0x9	0x10087108	0xae09c	0xaca9c	-
htonl	0x8	0x1008710c	0xae0a0	0xacaa0	-
socket	0x17	0x10087110	0xae0a4	0xacaa4	-
setsockopt	0x15	0x10087114	0xae0a8	0xacaa8	-
connect	0x4	0x10087118	0xae0ac	0xacaac	-
send	0x13	0x1008711c	0xae0b0	0xacab0	-
WSASetLastError	0x70	0x10087120	0xae0b4	0xacab4	-
recv	0x10	0x10087124	0xae0b8	0xacab8	-
WSAGetLastError	0x6f	0x10087128	0xae0bc	0xacabc	-
shutdown	0x16	0x1008712c	0xae0c0	0xacac0	-
gethostbyname	0x34	0x10087130	0xae0c4	0xacac4	-
closesocket	0x3	0x10087134	0xae0c8	0xacac8	-

GDI32.dll (10)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateCompatibleDC	0x0	0x10087010	0xadfa4	0xac9a4	0x2b
GetDeviceCaps	0x0	0x10087014	0xadfa8	0xac9a8	0x12d
CreateCompatibleBitmap	0x0	0x10087018	0xadfac	0xac9ac	0x2a
SelectObject	0x0	0x1008701c	0xadfb0	0xac9b0	0x1ce
GetObjectA	0x0	0x10087020	0xadfb4	0xac9b4	0x157
BitBlt	0x0	0x10087024	0xadfb8	0xac9b8	0x12
GetBitmapBits	0x0	0x10087028	0xadfbc	0xac9bc	0x10d
DeleteObject	0x0	0x1008702c	0xadfc0	0xac9c0	0x54
DeleteDC	0x0	0x10087030	0xadfc4	0xac9c4	0x51
CreateDCA	0x0	0x10087034	0xadfc8	0xac9c8	0x2c

ADVAPI32.dll (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ReportEventA	0x0	0x10087000	0xadf94	0xac994	0x1c8
DeregisterEventSource	0x0	0x10087004	0xadf98	0xac998	0x8a
RegisterEventSourceA	0x0	0x10087008	0xadf9c	0xac99c	0x1be

USER32.dll (4)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
MessageBoxA	0x0	0x100870c0	0xae054	0xaca54	0x1c3
GetDesktopWindow	0x0	0x100870c4	0xae058	0xaca58	0x102
GetProcessWindowStation	0x0	0x100870c8	0xae05c	0xaca5c	0x13b
GetUserObjectInformationW	0x0	0x100870cc	0xae060	0xaca60	0x153

zlib1.dll (7)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
zError	0x0	0x10087258	0xae1ec	0xacbec	0x3e
inflate	0x0	0x1008725c	0xae1f0	0xacbf0	0x2c
deflate	0x0	0x10087260	0xae1f4	0xacbf4	0x7
inflateEnd	0x0	0x10087264	0xae1f8	0xacbf8	0x31
deflateEnd	0x0	0x10087268	0xae1fc	0xacbfc	0xa
inflateInit_	0x0	0x1008726c	0xae200	0xacc00	0x34
deflateInit_	0x0	0x10087270	0xae204	0xacc04	0xc

msvcrt.dll (70)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
localtime	0x0	0x1008713c	0xae0d0	0xacad0	0x4da
gmtime	0x0	0x10087140	0xae0d4	0xacad4	0x4bb
strncpy	0x0	0x10087144	0xae0d8	0xacad8	0x520
_lrotl	0x0	0x10087148	0xae0dc	0xacadc	0x246
memcmp	0x0	0x1008714c	0xae0e0	0xacae0	0x4e9
_lrotr	0x0	0x10087150	0xae0e4	0xacae4	0x247
memmove	0x0	0x10087154	0xae0e8	0xacae8	0x4ec
_read	0x0	0x10087158	0xae0ec	0xacaec	0x304
_write	0x0	0x1008715c	0xae0f0	0xacaf0	0x448
isxdigit	0x0	0x10087160	0xae0f4	0xacaf4	0x4d5
isdigit	0x0	0x10087164	0xae0f8	0xacaf8	0x4c0
fprintf	0x0	0x10087168	0xae0fc	0xacafc	0x49f
strlen	0x0	0x1008716c	0xae100	0xacb00	0x51c
fputs	0x0	0x10087170	0xae104	0xacb04	0x4a2
fclose	0x0	0x10087174	0xae108	0xacb08	0x492
ferror	0x0	0x10087178	0xae10c	0xacb0c	0x494
fread	0x0	0x1008717c	0xae110	0xacb10	0x4a5
fwrite	0x0	0x10087180	0xae114	0xacb14	0x4b1
_setmode	0x0	0x10087184	0xae118	0xacb18	0x32c
_fileno	0x0	0x10087188	0xae11c	0xacb1c	0x16f
fopen	0x0	0x1008718c	0xae120	0xacb20	0x49d
strcat	0x0	0x10087190	0xae124	0xacb24	0x511
fseek	0x0	0x10087194	0xae128	0xacb28	0x4ac
ftell	0x0	0x10087198	0xae12c	0xacb2c	0x4ae
feof	0x0	0x1008719c	0xae130	0xacb30	0x493
fflush	0x0	0x100871a0	0xae134	0xacb34	0x495
fgets	0x0	0x100871a4	0xae138	0xacb38	0x498
strcmp	0x0	0x100871a8	0xae13c	0xacb3c	0x514
atoi	0x0	0x100871ac	0xae140	0xacb40	0x480
perror	0x0	0x100871b0	0xae144	0xacb44	0x4f1
_ftime	0x0	0x100871b4	0xae148	0xacb48	0x18e
qsort	0x0	0x100871b8	0xae14c	0xacb4c	0x4fa
_stat	0x0	0x100871bc	0xae150	0xacb50	0x352
_chmod	0x0	0x100871c0	0xae154	0xacb54	0x11d
strerror	0x0	0x100871c4	0xae158	0xacb58	0x519
isalnum	0x0	0x100871c8	0xae15c	0xacb5c	0x4bd
isspace	0x0	0x100871cc	0xae160	0xacb60	0x4c6
strncmp	0x0	0x100871d0	0xae164	0xacb64	0x51f
tolower	0x0	0x100871d4	0xae168	0xacb68	0x539
isupper	0x0	0x100871d8	0xae16c	0xacb6c	0x4c7
strrchr	0x0	0x100871dc	0xae170	0xacb70	0x524
sscanf	0x0	0x100871e0	0xae174	0xacb74	0x50f
exit	0x0	0x100871e4	0xae178	0xacb78	0x48f
strtol	0x0	0x100871e8	0xae17c	0xacb7c	0x52a
signal	0x0	0x100871ec	0xae180	0xacb80	0x508
_getch	0x0	0x100871f0	0xae184	0xacb84	0x1b5
printf	0x0	0x100871f4	0xae188	0xacb88	0x4f3
_XcptFilter	0x0	0x100871f8	0xae18c	0xacb8c	0x6a
_initterm	0x0	0x100871fc	0xae190	0xacb90	0x1d5
_amsg_exit	0x0	0x10087200	0xae194	0xacb94	0x101
_adjust_fdiv	0x0	0x10087204	0xae198	0xacb98	0xf5
memset	0x0	0x10087208	0xae19c	0xacb9c	0x4ee
time	0x0	0x1008720c	0xae1a0	0xacba0	0x534
memchr	0x0	0x10087210	0xae1a4	0xacba4	0x4e8
memcpy	0x0	0x10087214	0xae1a8	0xacba8	0x4ea
malloc	0x0	0x10087218	0xae1ac	0xacbac	0x4de
realloc	0x0	0x1008721c	0xae1b0	0xacbb0	0x4ff
free	0x0	0x10087220	0xae1b4	0xacbb4	0x4a6
abort	0x0	0x10087224	0xae1b8	0xacbb8	0x476
vfprintf	0x0	0x10087228	0xae1bc	0xacbbc	0x540
wcsstr	0x0	0x1008722c	0xae1c0	0xacbc0	0x564
getenv	0x0	0x10087230	0xae1c4	0xacbc4	0x4b6
strtoul	0x0	0x10087234	0xae1c8	0xacbc8	0x52b
sprintf	0x0	0x10087238	0xae1cc	0xacbcc	0x50b
strcpy	0x0	0x1008723c	0xae1d0	0xacbd0	0x516
_iob	0x0	0x10087240	0xae1d4	0xacbd4	0x1db
strchr	0x0	0x10087244	0xae1d8	0xacbd8	0x513
_vsnprintf	0x0	0x10087248	0xae1dc	0xacbdc	0x3c8
_errno	0x0	0x1008724c	0xae1e0	0xacbe0	0x156
strstr	0x0	0x10087250	0xae1e4	0xacbe4	0x526

KERNEL32.dll (32)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentThreadId	0x0	0x1008703c	0xadfd0	0xac9d0	0x110
GetLastError	0x0	0x10087040	0xadfd4	0xac9d4	0x131
GetFileType	0x0	0x10087044	0xadfd8	0xac9d8	0x12c
GetStdHandle	0x0	0x10087048	0xadfdc	0xac9dc	0x16c
GetCurrentThread	0x0	0x1008704c	0xadfe0	0xac9e0	0x10f
GetModuleHandleA	0x0	0x10087050	0xadfe4	0xac9e4	0x13e
FindNextFileA	0x0	0x10087054	0xadfe8	0xac9e8	0xb0
FindFirstFileA	0x0	0x10087058	0xadfec	0xac9ec	0xa7
FindClose	0x0	0x1008705c	0xadff0	0xac9f0	0xa3
FreeLibrary	0x0	0x10087060	0xadff4	0xac9f4	0xc7
LoadLibraryA	0x0	0x10087064	0xadff8	0xac9f8	0x1e3
ExitProcess	0x0	0x10087068	0xadffc	0xac9fc	0x90
GetVersion	0x0	0x1008706c	0xae000	0xaca00	0x192
GetProcAddress	0x0	0x10087070	0xae004	0xaca04	0x157
GetThreadTimes	0x0	0x10087074	0xae008	0xaca08	0x189
SetLastError	0x0	0x10087078	0xae00c	0xaca0c	0x2a0
GetTickCount	0x0	0x1008707c	0xae010	0xaca10	0x18a
QueryPerformanceCounter	0x0	0x10087080	0xae014	0xaca14	0x22f
GetCurrentProcessId	0x0	0x10087084	0xae018	0xaca18	0x10e
GetSystemTimeAsFileTime	0x0	0x10087088	0xae01c	0xaca1c	0x17a
SetUnhandledExceptionFilter	0x0	0x1008708c	0xae020	0xaca20	0x2bc
UnhandledExceptionFilter	0x0	0x10087090	0xae024	0xaca24	0x2df
GetCurrentProcess	0x0	0x10087094	0xae028	0xaca28	0x10d
TerminateProcess	0x0	0x10087098	0xae02c	0xaca2c	0x2cf
InterlockedCompareExchange	0x0	0x1008709c	0xae030	0xaca30	0x1cb
Sleep	0x0	0x100870a0	0xae034	0xaca34	0x2c7
InterlockedExchange	0x0	0x100870a4	0xae038	0xaca38	0x1cd
RtlUnwind	0x0	0x100870a8	0xae03c	0xaca3c	0x25b
FlushConsoleInputBuffer	0x0	0x100870ac	0xae040	0xaca40	0xbc
GetVersionExA	0x0	0x100870b0	0xae044	0xaca44	0x193
CloseHandle	0x0	0x100870b4	0xae048	0xaca48	0x1e
GlobalMemoryStatus	0x0	0x100870b8	0xae04c	0xaca4c	0x1ac

Exports (3040)

Api name	EAT Address	Ordinal
ACCESS_DESCRIPTION_free	0x68f08	0x7ca
ACCESS_DESCRIPTION_it	0x68ec3	0xabf
ACCESS_DESCRIPTION_new	0x68efb	0x785
AES_bi_ige_encrypt	0x1bf42	0xf14
AES_cbc_encrypt	0x1db33	0xc63
AES_cfb128_encrypt	0x1b777	0xc91
AES_cfb1_encrypt	0x1b945	0xccf
AES_cfb8_encrypt	0x1b9cc	0xcbd
AES_cfbr_encrypt_block	0x1b813	0xcbc
AES_ctr128_encrypt	0x1bba4	0xc90
AES_decrypt	0x1dac0	0xbe0
AES_ecb_encrypt	0x1b754	0xaf1
AES_encrypt	0x1cf00	0xbd9
AES_ige_encrypt	0x1bbff	0xef5
AES_ofb128_encrypt	0x1ba02	0xc8f
AES_options	0x1b74e	0xc02
AES_set_decrypt_key	0x1e258	0xc22
AES_set_encrypt_key	0x1df9a	0xbd0
AES_unwrap_key	0x1c321	0xf59
AES_wrap_key	0x1c21a	0xf5a
ASN1_ANY_it	0x55665	0xbdb
ASN1_BIT_STRING_asn1_meth	0x598de	0x3
ASN1_BIT_STRING_free	0x55239	0x820
ASN1_BIT_STRING_get_bit	0x4ab56	0x424
ASN1_BIT_STRING_it	0x551f4	0xb3e
ASN1_BIT_STRING_name_print	0x52ae2	0x856
ASN1_BIT_STRING_new	0x5522c	0x7a5
ASN1_BIT_STRING_num_asc	0x52b5b	0x7c2
ASN1_BIT_STRING_set	0x4a88e	0x83d
ASN1_BIT_STRING_set_asc	0x52b9b	0x7e1
ASN1_BIT_STRING_set_bit	0x4aa52	0x425
ASN1_BMPSTRING_free	0x55653	0x809
ASN1_BMPSTRING_it	0x5560e	0xae3
ASN1_BMPSTRING_new	0x55646	0x790
ASN1_BOOLEAN_it	0x557c7	0xc46
ASN1_ENUMERATED_free	0x551e2	0x7eb
ASN1_ENUMERATED_get	0x4c57b	0x4b6
ASN1_ENUMERATED_it	0x5519d	0xbc7
ASN1_ENUMERATED_new	0x551d5	0x804
ASN1_ENUMERATED_set	0x4c4b7	0x4b5
ASN1_ENUMERATED_to_BN	0x4c68b	0x4b8
ASN1_FBOOLEAN_it	0x557d3	0xaf6
ASN1_GENERALIZEDTIME_check	0x4af13	0x485
ASN1_GENERALIZEDTIME_free	0x5554e	0x774
ASN1_GENERALIZEDTIME_it	0x55509	0xa23
ASN1_GENERALIZEDTIME_new	0x55541	0x84e
ASN1_GENERALIZEDTIME_print	0x5084d	0x486
ASN1_GENERALIZEDTIME_set	0x4b0d2	0x487
ASN1_GENERALIZEDTIME_set_string	0x4b079	0x488
ASN1_GENERALSTRING_free	0x554a0	0x9ed
ASN1_GENERALSTRING_it	0x5545b	0xac9
ASN1_GENERALSTRING_new	0x55493	0xb1e
ASN1_HEADER_free	0x568b1	0x4
ASN1_HEADER_new	0x56865	0x5
ASN1_IA5STRING_asn1_meth	0x598d8	0x6
ASN1_IA5STRING_free	0x55449	0x811
ASN1_IA5STRING_it	0x55404	0xaa2
ASN1_IA5STRING_new	0x5543c	0x801
ASN1_INTEGER_cmp	0x4b33b	0x7ab
ASN1_INTEGER_dup	0x4b936	0x842
ASN1_INTEGER_free	0x5518b	0x83f
ASN1_INTEGER_get	0x4b7c8	0x7
ASN1_INTEGER_it	0x55146	0xb62
ASN1_INTEGER_new	0x5517e	0x853
ASN1_INTEGER_set	0x4b6fe	0x8
ASN1_INTEGER_to_BN	0x4b8e7	0x9
ASN1_NULL_free	0x552e7	0x878
ASN1_NULL_it	0x552a2	0xc4e
ASN1_NULL_new	0x552da	0x87a
ASN1_OBJECT_create	0x4a6c4	0xa
ASN1_OBJECT_free	0x4a668	0xb
ASN1_OBJECT_it	0x552f9	0xc6c
ASN1_OBJECT_new	0x4a61d	0xc
ASN1_OCTET_STRING_NDEF_it	0x557d9	0xd3d
ASN1_OCTET_STRING_cmp	0x4b93b	0x7a3
ASN1_OCTET_STRING_dup	0x4b936	0x83c
ASN1_OCTET_STRING_free	0x55290	0x7e0
ASN1_OCTET_STRING_it	0x5524b	0xc12
ASN1_OCTET_STRING_new	0x55283	0x852
ASN1_OCTET_STRING_set	0x4a88e	0x7f8
ASN1_PRINTABLESTRING_free	0x5539b	0x78e
ASN1_PRINTABLESTRING_it	0x55356	0xaed
ASN1_PRINTABLESTRING_new	0x5538e	0x7e9
ASN1_PRINTABLE_free	0x55707	0xc0a
ASN1_PRINTABLE_it	0x556c2	0xb2d
ASN1_PRINTABLE_new	0x556fa	0xa0b
ASN1_PRINTABLE_type	0x4b940	0xd
ASN1_SEQUENCE_it	0x5566b	0xb7f
ASN1_STRING_TABLE_add	0x59e9b	0x8c5
ASN1_STRING_TABLE_cleanup	0x5a012	0x7e4
ASN1_STRING_TABLE_get	0x59e3f	0x82b
ASN1_STRING_cmp	0x595c7	0xe
ASN1_STRING_data	0x39ff1	0x81b
ASN1_STRING_dup	0x5985f	0xf
ASN1_STRING_encode	0x7720e	0xa53
ASN1_STRING_free	0x595a7	0x10
ASN1_STRING_get_default_mask	0x59d88	0x818
ASN1_STRING_length	0x59659	0x7e7
ASN1_STRING_length_set	0x79eca	0x858
ASN1_STRING_new	0x598a4	0x11
ASN1_STRING_print	0x507ac	0x12
ASN1_STRING_print_ex	0x4e0ae	0x980
ASN1_STRING_print_ex_fp	0x4e0ca	0x97e
ASN1_STRING_set	0x59483	0x13
ASN1_STRING_set0	0x5953d	0xf5d
ASN1_STRING_set_by_NID	0x59f97	0x7cc
ASN1_STRING_set_default_mask	0x59d7e	0x7f0
ASN1_STRING_set_default_mask_asc	0x59d8e	0x7a8
ASN1_STRING_to_UTF8	0x4e0e6	0x98a
ASN1_STRING_type	0x39fd1	0x79f
ASN1_STRING_type_new	0x5955f	0x14
ASN1_T61STRING_free	0x553f2	0x79a
ASN1_T61STRING_it	0x553ad	0xa07
ASN1_T61STRING_new	0x553e5	0x80a
ASN1_TBOOLEAN_it	0x557cd	0xc5f
ASN1_TIME_check	0x4b266	0xade
ASN1_TIME_free	0x4b1ec	0x7a2
ASN1_TIME_it	0x4b1a7	0xa9b
ASN1_TIME_new	0x4b1df	0x7b5
ASN1_TIME_print	0x50c15	0x489
ASN1_TIME_set	0x4b1fe	0x4e5
ASN1_TIME_to_generalizedtime	0x4b28a	0xc61
ASN1_TYPE_free	0x556b0	0x15
ASN1_TYPE_get	0x4ba80	0x394
ASN1_TYPE_get_int_octetstring	0x5a1b7	0x434
ASN1_TYPE_get_octetstring	0x5a06c	0x435
ASN1_TYPE_new	0x556a3	0x16
ASN1_TYPE_set	0x4ba95	0x395
ASN1_TYPE_set1	0x4bac1	0xf5c
ASN1_TYPE_set_int_octetstring	0x5a0bc	0x436
ASN1_TYPE_set_octetstring	0x5a030	0x437
ASN1_UNIVERSALSTRING_free	0x555fc	0xca1
ASN1_UNIVERSALSTRING_it	0x555b7	0xca2
ASN1_UNIVERSALSTRING_new	0x555ef	0xc9e
ASN1_UNIVERSALSTRING_to_string	0x4b9f4	0x17
ASN1_UTCTIME_check	0x4ab9c	0x18
ASN1_UTCTIME_cmp_time_t	0x4adea	0x997
ASN1_UTCTIME_free	0x554f7	0x7c4
ASN1_UTCTIME_it	0x554b2	0xbcd
ASN1_UTCTIME_new	0x554ea	0x80c
ASN1_UTCTIME_print	0x509f4	0x19
ASN1_UTCTIME_set	0x4ad14	0x1a
ASN1_UTCTIME_set_string	0x4acbb	0x438
ASN1_UTF8STRING_free	0x55344	0x82c
ASN1_UTF8STRING_it	0x552ff	0x9df
ASN1_UTF8STRING_new	0x55337	0x792
ASN1_VISIBLESTRING_free	0x555a5	0x846
ASN1_VISIBLESTRING_it	0x55560	0xb31
ASN1_VISIBLESTRING_new	0x55598	0x78c
ASN1_add_oid_module	0x5accc	0xc72
ASN1_check_infinite_end	0x5931c	0x1b
ASN1_const_check_infinite_end	0x5931c	0xe27
ASN1_d2i_bio	0x4c17e	0x1c
ASN1_d2i_fp	0x4c280	0x1d
ASN1_digest	0x4cef5	0x1e
ASN1_dup	0x4bee7	0x1f
ASN1_generate_nconf	0x58ad7	0xda0
ASN1_generate_v3	0x5870e	0xdf3
ASN1_get_object	0x59660	0x20
ASN1_i2d_bio	0x4c2dd	0x21
ASN1_i2d_fp	0x4c402	0x22
ASN1_item_d2i	0x54ebd	0xbea
ASN1_item_d2i_bio	0x4c1cd	0xbfd
ASN1_item_d2i_fp	0x4c221	0xb34
ASN1_item_digest	0x4cf6c	0x9f8
ASN1_item_dup	0x4bf60	0xad4
ASN1_item_ex_d2i	0x5469e	0xb8d
ASN1_item_ex_free	0x532ce	0xc45
ASN1_item_ex_i2d	0x53753	0x9e5
ASN1_item_ex_new	0x52f1f	0xbf7
ASN1_item_free	0x532b9	0xa3f
ASN1_item_i2d	0x53c3d	0xa5f
ASN1_item_i2d_bio	0x4c37c	0xb2a
ASN1_item_i2d_fp	0x4c45b	0xc17
ASN1_item_ndef_i2d	0x53c21	0xdec
ASN1_item_new	0x52fae	0xc60
ASN1_item_pack	0x5a4bd	0xc40
ASN1_item_sign	0x4cd02	0xab5
ASN1_item_unpack	0x5a546	0xa50
ASN1_item_verify	0x4d0d9	0xad9
ASN1_mbstring_copy	0x4d781	0x791
ASN1_mbstring_ncopy	0x4d418	0x84b
ASN1_object_size	0x593f8	0x23
ASN1_pack_string	0x5a428	0x4ed
ASN1_parse	0x592b4	0x24
ASN1_parse_dump	0x592d3	0x97b
ASN1_primitive_free	0x52fd8	0xbeb
ASN1_primitive_new	0x52bd1	0xb2c
ASN1_put_eoc	0x593a8	0xdc3
ASN1_put_object	0x59753	0x25
ASN1_seq_pack	0x5a346	0x4eb
ASN1_seq_unpack	0x5a301	0x4ea
ASN1_sign	0x4cb14	0x26
ASN1_tag2bit	0x53c56	0xae4
ASN1_tag2str	0x58b13	0x771
ASN1_template_d2i	0x5441e	0xbab
ASN1_template_free	0x53234	0xb9e
ASN1_template_i2d	0x53673	0xa17
ASN1_template_new	0x52f32	0xc15
ASN1_unpack_string	0x5a3ea	0x4ec
ASN1_verify	0x4cfbb	0x27
AUTHORITY_INFO_ACCESS_free	0x68f5f	0x800
AUTHORITY_INFO_ACCESS_it	0x68f1a	0xaf5
AUTHORITY_INFO_ACCESS_new	0x68f52	0x8c7
AUTHORITY_KEYID_free	0x6959d	0x4e9
AUTHORITY_KEYID_it	0x69558	0xa41
AUTHORITY_KEYID_new	0x69590	0x4e8
BASIC_CONSTRAINTS_free	0x63d44	0x48a
BASIC_CONSTRAINTS_it	0x63cff	0xb6a
BASIC_CONSTRAINTS_new	0x63d37	0x48b
BF_cbc_encrypt	0x190f6	0x28
BF_cfb64_encrypt	0x19300	0x29
BF_decrypt	0x18cdb	0x3db
BF_ecb_encrypt	0x187db	0x2a
BF_encrypt	0x188c0	0x2b
BF_ofb64_encrypt	0x194ca	0x2c
BF_options	0x187d5	0x2d
BF_set_key	0x186fd	0x2e
BIGNUM_it	0x4edc3	0xc62
BIO_accept	0x3d93c	0x33
BIO_callback_ctrl	0x3a31b	0x8cc
BIO_clear_flags	0x39fab	0xf06
BIO_copy_next_retry	0x3a4e5	0x3bb
BIO_ctrl	0x3a295	0x34
BIO_ctrl_get_read_request	0x3ea20	0x707
BIO_ctrl_get_write_guarantee	0x3ea0a	0x70b
BIO_ctrl_pending	0x3a3a1	0x708
BIO_ctrl_reset_read_request	0x3ea36	0x772
BIO_ctrl_wpending	0x3a3b4	0x709
BIO_debug_callback	0x3a6ad	0x36
BIO_dgram_non_fatal_error	0x3f0f7	0xe02
BIO_dump	0x3d620	0x37
BIO_dump_cb	0x3d5eb	0xeb4
BIO_dump_fp	0x3d606	0xd2a
BIO_dump_indent	0x3d5cd	0x97a
BIO_dump_indent_cb	0x3d302	0xe71
BIO_dump_indent_fp	0x3d5af	0xdb7
BIO_dup_chain	0x3a60e	0x38
BIO_f_base64	0x46d8b	0x39
BIO_f_buffer	0x3bf51	0x3a
BIO_f_cipher	0x476d7	0x3b
BIO_f_md	0x46b3c	0x3c
BIO_f_nbio_test	0x3e33d	0x393
BIO_f_null	0x3be8d	0x3d
BIO_f_reliable	0x48375	0x4dc
BIO_fd_non_fatal_error	0x3adc3	0x3f
BIO_fd_should_retry	0x3add8	0x40
BIO_find_type	0x3a47e	0x41
BIO_free	0x39f37	0x42
BIO_free_all	0x3a4c0	0x43
BIO_get_accept_socket	0x3db77	0x45
BIO_get_callback	0x39fd1	0xf15
BIO_get_callback_arg	0x39ff1	0xf3e
BIO_get_ex_data	0x3a53e	0x426
BIO_get_ex_new_index	0x3a507	0x427
BIO_get_host_ip	0x3da93	0x47
BIO_get_port	0x3d63a	0x48
BIO_get_retry_BIO	0x3a44e	0x49
BIO_get_retry_reason	0x7d2b2	0x4a
BIO_gethostbyname	0x3d7d8	0x4b
BIO_gets	0x3a1ca	0x4c
BIO_indent	0x3a25b	0xcaa
BIO_int_ctrl	0x3a5bd	0x35
BIO_method_name	0x39ff9	0xf3a
BIO_method_type	0x482c0	0xef2
BIO_new	0x3a570	0x4e
BIO_new_accept	0x3e2db	0x4f
BIO_new_bio_pair	0x3e959	0x70a
BIO_new_connect	0x3be56	0x50
BIO_new_dgram	0x3ed8c	0xd02
BIO_new_fd	0x3ac92	0x51
BIO_new_file	0x3b30e	0x52
BIO_new_fp	0x3b3c9	0x53
BIO_new_mem_buf	0x3a8fb	0x75a
BIO_new_socket	0x3b406	0x54
BIO_next	0x3a4b3	0x99d
BIO_nread	0x3ea98	0x754
BIO_nread0	0x3ea52	0x758
BIO_number_read	0x3a552	0x89b
BIO_number_written	0x3a561	0x89a
BIO_nwrite	0x3eb25	0x752
BIO_nwrite0	0x3eadf	0x756
BIO_pop	0x3a407	0x55
BIO_printf	0x3d2d2	0x56
BIO_ptr_ctrl	0x3a5dd	0x3c9
BIO_push	0x3a3c7	0x57
BIO_puts	0x3a13a	0x58
BIO_read	0x3a003	0x59
BIO_s_accept	0x3de60	0x5a
BIO_s_bio	0x3e52c	0x701
BIO_s_connect	0x3ba67	0x5b
BIO_s_datagram	0x3ed86	0xdd6
BIO_s_fd	0x3ac8c	0x5c
BIO_s_file	0x3aeaf	0x5d
BIO_s_mem	0x3a8f5	0x5f
BIO_s_null	0x3ac31	0x60
BIO_s_socket	0x3b400	0x62
BIO_set	0x39ec8	0x64
BIO_set_callback	0x39fd9	0xf3f
BIO_set_callback_arg	0x39fe5	0xeec
BIO_set_cipher	0x47b82	0x65
BIO_set_ex_data	0x3a525	0x428
BIO_set_flags	0x39fc5	0xeef
BIO_set_tcp_ndelay	0x3da55	0x66
BIO_snprintf	0x3d2e8	0x8f4
BIO_sock_cleanup	0x3d852	0x67
BIO_sock_error	0x3d79e	0x68
BIO_sock_init	0x3d7e2	0x69
BIO_sock_non_fatal_error	0x3f0f7	0x6a
BIO_sock_should_retry	0x3b500	0x6b
BIO_socket_ioctl	0x3d86d	0x6c
BIO_socket_nbio	0x3da6f	0x44e
BIO_test_flags	0x39fb9	0xf1a
BIO_vfree	0x39fa6	0x91e
BIO_vprintf	0x3d1cc	0x98b
BIO_vsnprintf	0x3d292	0x98c
BIO_write	0x3a09b	0x6d
BN_BLINDING_convert	0x22bd9	0x3cd
BN_BLINDING_convert_ex	0x22acc	0xd89
BN_BLINDING_create_param	0x22bf0	0xe79
BN_BLINDING_free	0x22a83	0x3d5
BN_BLINDING_get_flags	0x7d2b2	0xe8d
BN_BLINDING_get_thread_id	0x687f4	0xd0c
BN_BLINDING_invert	0x22e35	0x3ce
BN_BLINDING_invert_ex	0x22dca	0xd09
BN_BLINDING_new	0x22b38	0x3d4
BN_BLINDING_set_flags	0x63a38	0xd53
BN_BLINDING_set_thread_id	0x5f6a5	0xeba
BN_BLINDING_update	0x22d2d	0x3cf
BN_CTX_end	0x20d3f	0x8c1
BN_CTX_free	0x20cd5	0x6e
BN_CTX_get	0x20d73	0x8c3
BN_CTX_init	0x20c5d	0x46f
BN_CTX_new	0x20c80	0x6f
BN_CTX_start	0x20cf6	0x8c2
BN_GENCB_call	0x23f57	0xd92
BN_GF2m_add	0x272bc	0xdf6
BN_GF2m_arr2poly	0x27700	0xde0
BN_GF2m_mod	0x2774c	0xdbb
BN_GF2m_mod_arr	0x2734a	0xd67
BN_GF2m_mod_div	0x27c18	0xd5c
BN_GF2m_mod_div_arr	0x27c71	0xe14
BN_GF2m_mod_exp	0x27dae	0xe0e
BN_GF2m_mod_exp_arr	0x27cc2	0xd21
BN_GF2m_mod_inv	0x27a73	0xe0d
BN_GF2m_mod_inv_arr	0x27bca	0xeb8
BN_GF2m_mod_mul	0x27953	0xda2
BN_GF2m_mod_mul_arr	0x277d9	0xd26
BN_GF2m_mod_solve_quad	0x28205	0xe45
BN_GF2m_mod_solve_quad_arr	0x27f42	0xd59
BN_GF2m_mod_sqr	0x279e3	0xd45
BN_GF2m_mod_sqr_arr	0x27540	0xdd4
BN_GF2m_mod_sqrt	0x27eb2	0xddc
BN_GF2m_mod_sqrt_arr	0x27e3e	0xd7b
BN_GF2m_poly2arr	0x27684	0xd8c
BN_MONT_CTX_copy	0x2683e	0x455
BN_MONT_CTX_free	0x26698	0x70
BN_MONT_CTX_init	0x26668	0x470
BN_MONT_CTX_new	0x2699b	0x71
BN_MONT_CTX_set	0x266ce	0x72
BN_MONT_CTX_set_locked	0x269ca	0xcee
BN_RECP_CTX_free	0x26060	0x46a
BN_RECP_CTX_init	0x26014	0x468
BN_RECP_CTX_new	0x26034	0x469
BN_RECP_CTX_set	0x26089	0x46b
BN_X931_derive_prime_ex	0x29192	0xff5
BN_X931_generate_Xpq	0x293a6	0xcfd
BN_X931_generate_prime_ex	0x29444	0xfdc
BN_add	0x1e6b4	0x73
BN_add_word	0x228e5	0x74
BN_bin2bn	0x2055e	0x76
BN_bn2bin	0x20636	0x78
BN_bn2dec	0x21c7e	0x3ea
BN_bn2hex	0x21bc5	0x77
BN_bn2mpi	0x26a82	0x422
BN_bntest_rand	0x22303	0x9a0
BN_clear	0x204e3	0x79
BN_clear_bit	0x207df	0x7a
BN_clear_free	0x201d0	0x7b
BN_cmp	0x206dc	0x7c
BN_copy	0x203ca	0x7d
BN_dec2bn	0x21f3a	0x3e9
BN_div	0x1eac8	0x7e
BN_div_recp	0x26119	0x46e
BN_div_word	0x22843	0x7f
BN_dup	0x209a8	0x80
BN_exp	0x1eeb0	0x3e6
BN_free	0x2021b	0x81
BN_from_montgomery	0x2661c	0x82
BN_gcd	0x2399d	0x83
BN_generate_prime	0x2902d	0x84
BN_generate_prime_ex	0x24648	0xe7e
BN_get0_nist_prime_192	0x28295	0xd1e
BN_get0_nist_prime_224	0x2829b	0xd8f
BN_get0_nist_prime_256	0x282a1	0xe2d
BN_get0_nist_prime_384	0x282a7	0xd03
BN_get0_nist_prime_521	0x282ad	0xe7c
BN_get_params	0x20129	0x4e1
BN_get_word	0x2050a	0x85
BN_hex2bn	0x21deb	0x75
BN_init	0x20254	0x447
BN_is_bit_set	0x2083d	0x86
BN_is_prime	0x2909f	0x87
BN_is_prime_ex	0x24840	0xdaf
BN_is_prime_fasttest	0x290d4	0x8c0
BN_is_prime_fasttest_ex	0x242fd	0xe86
BN_kronecker	0x22e4c	0xbc3
BN_lshift	0x225c3	0x88
BN_lshift1	0x22487	0x89
BN_mask_bits	0x20879	0x8a
BN_mod_add	0x218da	0xad6
BN_mod_add_quick	0x2190a	0xb6b
BN_mod_exp	0x2003d	0x8c
BN_mod_exp2_mont	0x26bce	0x5ea
BN_mod_exp_mont	0x1fcd4	0x8d
BN_mod_exp_mont_consttime	0x1f386	0xcf6
BN_mod_exp_mont_word	0x1f721	0x961
BN_mod_exp_recp	0x1efd2	0x46d
BN_mod_exp_simple	0x1fa50	0x8f
BN_mod_inverse	0x23a3e	0x90
BN_mod_lshift	0x21b64	0xc30
BN_mod_lshift1	0x21a4b	0xc4f
BN_mod_lshift1_quick	0x21a77	0xb8e
BN_mod_lshift_quick	0x21ab3	0xa3d
BN_mod_mul	0x219af	0x91
BN_mod_mul_montgomery	0x26898	0x92
BN_mod_mul_reciprocal	0x2630a	0x46c
BN_mod_sqr	0x21a19	0xaf2
BN_mod_sqrt	0x23063	0xb91
BN_mod_sub	0x21948	0xb08
BN_mod_sub_quick	0x21978	0xb75
BN_mod_word	0x227ef	0x94
BN_mpi2bn	0x26af9	0x423
BN_mul	0x2160e	0x95
BN_mul_word	0x22a21	0x3e7
BN_new	0x20265	0x96
BN_nist_mod_192	0x282f5	0xd12
BN_nist_mod_224	0x284c0	0xdfc
BN_nist_mod_256	0x28721	0xe76
BN_nist_mod_384	0x28aad	0xe39
BN_nist_mod_521	0x28eaf	0xe1f
BN_nnmod	0x21892	0xa2e
BN_num_bits	0x201ae	0x97
BN_num_bits_word	0x20163	0x98
BN_options	0x29596	0x99
BN_print	0x2205c	0x9a
BN_print_fp	0x22100	0x9b
BN_pseudo_rand	0x222e8	0x8bf
BN_pseudo_rand_range	0x22472	0x9db
BN_rand	0x222cd	0x9c
BN_rand_range	0x2245d	0x9a2
BN_reciprocal	0x260c3	0x9d
BN_rshift	0x226d4	0x9e
BN_rshift1	0x22525	0x9f
BN_set_bit	0x20766	0xa0
BN_set_negative	0x208e6	0xe33
BN_set_params	0x200aa	0x4e0
BN_set_word	0x20524	0xa1
BN_sqr	0x24a8c	0xa2
BN_sub	0x1e60c	0xa3
BN_sub_word	0x22982	0x3e8
BN_swap	0x2046c	0xbae
BN_to_ASN1_ENUMERATED	0x4c5d9	0x4b7
BN_to_ASN1_INTEGER	0x4b826	0xa4
BN_uadd	0x1e3ff	0x2c4
BN_ucmp	0x2069a	0xa5
BN_usub	0x1e4ca	0x2c5
BN_value_one	0x2015d	0xa6
BUF_MEM_free	0x39bdc	0xa7
BUF_MEM_grow	0x39c0b	0xa8
BUF_MEM_grow_clean	0x39cb6	0xca7
BUF_MEM_new	0x39ba4	0xa9
BUF_memdup	0x39d78	0xda1
BUF_strdup	0x39e7e	0xaa
BUF_strlcat	0x39dfc	0xca9
BUF_strlcpy	0x39dc3	0xcab
BUF_strndup	0x39e2c	0xdb9
CAST_cbc_encrypt	0x1b1c2	0x3e0
CAST_cfb64_encrypt	0x1b400	0x3e1
CAST_decrypt	0x1ad22	0x3de
CAST_ecb_encrypt	0x1a7b1	0x3df
CAST_encrypt	0x1a880	0x3dd
CAST_ofb64_encrypt	0x1b5ca	0x3e2
CAST_set_key	0x1964e	0x3dc
CBIGNUM_it	0x4edc9	0xba6
CERTIFICATEPOLICIES_free	0x67826	0x5ce
CERTIFICATEPOLICIES_it	0x677e1	0xaa8
CERTIFICATEPOLICIES_new	0x67819	0x5cd
COMP_CTX_free	0x72a1d	0x449
COMP_CTX_new	0x729d4	0x448
COMP_compress_block	0x72a3c	0x478
COMP_expand_block	0x72a73	0x479
COMP_rle	0x72ad5	0x47a
COMP_zlib	0x72d1b	0x47b
COMP_zlib_cleanup	0x72d86	0xf60
CONF_dump_bio	0x6b83b	0x8f0
CONF_dump_fp	0x6b998	0x8eb
CONF_free	0x6b816	0xab
CONF_get1_default_config_file	0x6ca15	0xc7a
CONF_get_number	0x6b7bb	0xac
CONF_get_section	0x6b746	0xad
CONF_get_string	0x6b778	0xae
CONF_imodule_get_flags	0x7d2aa	0xc7b
CONF_imodule_get_module	0x59659	0xc7c
CONF_imodule_get_name	0x39fd1	0xc7e
CONF_imodule_get_usr_data	0x687f4	0xc80
CONF_imodule_get_value	0x39ff1	0xc76
CONF_imodule_set_flags	0x6c9fd	0xc81
CONF_imodule_set_usr_data	0x5f6a5	0xc6f
CONF_load	0x6b8fd	0xaf
CONF_load_bio	0x6b714	0x70d
CONF_load_fp	0x6b94c	0x70e
CONF_module_add	0x6c9e0	0xc79
CONF_module_get_usr_data	0x36ef3	0xc71
CONF_module_set_usr_data	0x6ca09	0xc77
CONF_modules_finish	0x6cbeb	0xc73
CONF_modules_free	0x6cd81	0xc9a
CONF_modules_load	0x6cd8f	0xc7d
CONF_modules_load_file	0x6ce33	0xc6e
CONF_modules_unload	0x6cd0b	0xc75
CONF_parse_list	0x6ca8f	0xc78
CONF_set_default_method	0x6b4f9	0x8f2
CONF_set_nconf	0x6b4d3	0xc09
CRL_DIST_POINTS_free	0x684b8	0x603
CRL_DIST_POINTS_it	0x68473	0xb35
CRL_DIST_POINTS_new	0x684ab	0x602
CRYPTO_add_lock	0x135c	0xb0
CRYPTO_cleanup_all_ex_data	0x2f65	0xa2c
CRYPTO_dbg_free	0x268c	0xb1
CRYPTO_dbg_get_options	0x238b	0x8c6
CRYPTO_dbg_malloc	0x2536	0xb2
CRYPTO_dbg_pop_info	0x24dd	0xfdf
CRYPTO_dbg_push_info	0x2438	0xfe7
CRYPTO_dbg_realloc	0x26f9	0xb3
CRYPTO_dbg_remove_all_info	0x250a	0xffa
CRYPTO_dbg_set_options	0x2381	0x86d
CRYPTO_destroy_dynlockid	0x19cf	0x96d
CRYPTO_dup_ex_data	0x2fab	0x401
CRYPTO_ex_data_new_class	0x2f50	0xbdc
CRYPTO_free	0x2114	0xb5
CRYPTO_free_ex_data	0x2fc1	0x3ec
CRYPTO_free_locked	0x1f5a	0x5e9
CRYPTO_get_add_lock_callback	0x12f4	0xb6
CRYPTO_get_dynlock_create_callback	0x1b02	0x974
CRYPTO_get_dynlock_destroy_callback	0x1b0e	0x972
CRYPTO_get_dynlock_lock_callback	0x1b08	0x971
CRYPTO_get_dynlock_value	0x1a8c	0x973
CRYPTO_get_ex_data	0x305f	0x3ed
CRYPTO_get_ex_data_implementation	0x2c17	0xc3f
CRYPTO_get_ex_new_index	0x2f7b	0x411
CRYPTO_get_id_callback	0x130e	0xb7
CRYPTO_get_lock_name	0x1ba1	0xb8
CRYPTO_get_locked_mem_ex_functions	0x1e62	0xadd
CRYPTO_get_locked_mem_functions	0x1e2f	0x5e7
CRYPTO_get_locking_callback	0x12ee	0xb9
CRYPTO_get_mem_debug_functions	0x1e90	0x86f
CRYPTO_get_mem_debug_options	0x2178	0x8c8
CRYPTO_get_mem_ex_functions	0x1de4	0xb27
CRYPTO_get_mem_functions	0x1d8f	0xba
CRYPTO_get_new_dynlockid	0x1867	0x96a
CRYPTO_get_new_lockid	0x17d7	0x402
CRYPTO_is_mem_check_on	0x232d	0x870
CRYPTO_lock	0x1339	0xbb
CRYPTO_malloc	0x1f8a	0xbc
CRYPTO_malloc_debug_init	0x2b17	0xfe6
CRYPTO_malloc_locked	0x1ee0	0x5e8
CRYPTO_mem_ctrl	0x2221	0xbd
CRYPTO_mem_leaks	0x2972	0xbe
CRYPTO_mem_leaks_cb	0x2ad0	0xbf
CRYPTO_mem_leaks_fp	0x2a64	0xc0
CRYPTO_new_ex_data	0x2f95	0x403
CRYPTO_num_locks	0x12ea	0x70c
CRYPTO_pop_info	0x2195	0x872
CRYPTO_push_info_	0x2186	0x873
CRYPTO_realloc	0x2004	0xc1
CRYPTO_realloc_clean	0x207c	0xca8
CRYPTO_remalloc	0x2144	0xc2
CRYPTO_remove_all_info	0x21a4	0x86e
CRYPTO_set_add_lock_callback	0x1304	0xc3
CRYPTO_set_dynlock_create_callback	0x1b14	0x96f
CRYPTO_set_dynlock_destroy_callback	0x1b97	0x96c
CRYPTO_set_dynlock_lock_callback	0x1b6f	0x970
CRYPTO_set_ex_data	0x2fd7	0x3ef
CRYPTO_set_ex_data_implementation	0x2c2b	0xb19
CRYPTO_set_id_callback	0x1314	0xc4
CRYPTO_set_locked_mem_ex_functions	0x1d04	0xad2
CRYPTO_set_locked_mem_functions	0x1ccf	0x5e6
CRYPTO_set_locking_callback	0x12fa	0xc5
CRYPTO_set_mem_debug_functions	0x1d36	0x871
CRYPTO_set_mem_debug_options	0x216c	0x874
CRYPTO_set_mem_ex_functions	0x1c72	0xada
CRYPTO_set_mem_functions	0x1c10	0xc6
CRYPTO_set_mem_info_functions	0x1d73	0xfd5
CRYPTO_strdup	0x2b4d	0xffd
CRYPTO_thread_id	0x131e	0xc7
DES_cbc_cksum	0x15b52	0x309
DES_cbc_encrypt	0x10343	0x30a
DES_cfb64_encrypt	0x107d4	0x30c
DES_cfb_encrypt	0x11172	0x30d
DES_check_key_parity	0xffb0	0x8d0
DES_crypt	0x155e4	0x8c9
DES_decrypt3	0x144c8	0x30e
DES_ecb3_encrypt	0x10723	0x30f
DES_ecb_encrypt	0x102a4	0x310
DES_ede3_cbc_encrypt	0x14800	0x311
DES_ede3_cbcm_encrypt	0x15d02	0x4c9
DES_ede3_cfb64_encrypt	0x1099c	0x312
DES_ede3_cfb_encrypt	0x10b6a	0xcb9
DES_ede3_ofb64_encrypt	0x115aa	0x313
DES_enc_read	0x1174c	0x314
DES_enc_write	0x119b8	0x315
DES_encrypt1	0x12640	0x316
DES_encrypt2	0x13541	0x317
DES_encrypt3	0x143a4	0x318
DES_fcrypt	0x154af	0x319
DES_is_weak_key	0xffd1	0x31a
DES_key_sched	0x1029f	0x31b
DES_ncbc_encrypt	0x145ec	0x31c
DES_ofb64_encrypt	0x11b63	0x31d
DES_ofb_encrypt	0x11ce5	0x31e
DES_options	0xff52	0x31f
DES_pcbc_encrypt	0x12216	0x320
DES_quad_cksum	0x12522	0x321
DES_random_key	0x1260a	0x322
DES_read_2passwords	0x1639b	0xc86
DES_read_password	0x16318	0xc87
DES_set_key	0x1027e	0x328
DES_set_key_checked	0x10248	0x860
DES_set_key_unchecked	0xfffe	0x863
DES_set_odd_parity	0xff96	0x329
DES_string_to_2keys	0x1207b	0x32a
DES_string_to_key	0x11f7d	0x32b
DES_xcbc_encrypt	0x155fa	0x32c
DH_OpenSSL	0x2f584	0x762
DH_check	0x2fb79	0xc8
DH_check_pub_key	0x2fc72	0xebe
DH_compute_key	0x2f56d	0xc9
DH_free	0x2fa0f	0xca
DH_generate_key	0x2f560	0xcb
DH_generate_parameters	0x2fd03	0xcc
DH_generate_parameters_ex	0x2f535	0xe81
DH_get_default_method	0x2f88d	0x764
DH_get_ex_data	0x2fb42	0x75e
DH_get_ex_new_index	0x2fb0b	0x75f
DH_new	0x2fb70	0xcd
DH_new_method	0x2f8dd	0x761
DH_set_default_method	0x2f883	0x766
DH_set_ex_data	0x2fb29	0x75b
DH_set_method	0x2f8a1	0x75c
DH_size	0x2fb56	0xce
DH_up_ref	0x2fae2	0xb72
DHparams_print	0x5182b	0xcf
DHparams_print_fp	0x52601	0xd0
DIRECTORYSTRING_free	0x557b5	0x7f6
DIRECTORYSTRING_it	0x55770	0xacf
DIRECTORYSTRING_new	0x557a8	0x859
DISPLAYTEXT_free	0x5575e	0x7ce
DISPLAYTEXT_it	0x55719	0xb14
DISPLAYTEXT_new	0x55751	0x773
DIST_POINT_NAME_free	0x6840a	0x60b
DIST_POINT_NAME_it	0x683c5	0xc0c
DIST_POINT_NAME_new	0x683fd	0x60a
DIST_POINT_free	0x68461	0x608
DIST_POINT_it	0x6841c	0xb86
DIST_POINT_new	0x68454	0x606
DSA_OpenSSL	0x2dc78	0x75d
DSA_SIG_free	0x2e3b1	0x536
DSA_SIG_new	0x2e393	0x535
DSA_do_sign	0x2dc1b	0x537
DSA_do_verify	0x2dc00	0x538
DSA_dup_DH	0x2d92b	0x74f
DSA_free	0x2d7f2	0xd1
DSA_generate_key	0x2d643	0xd2
DSA_generate_parameters	0x2e339	0xd3
DSA_generate_parameters_ex	0x2d512	0xe67
DSA_get_default_method	0x2d669	0x795
DSA_get_ex_data	0x2d917	0x767
DSA_get_ex_new_index	0x2d8e0	0x763
DSA_new	0x2d9b5	0xd5
DSA_new_method	0x2d6b9	0x760
DSA_print	0x51d83	0xd6
DSA_print_fp	0x527bd	0xd7
DSA_set_default_method	0x2d65f	0x7c5
DSA_set_ex_data	0x2d8fe	0x765
DSA_set_method	0x2d67d	0x79d
DSA_sign	0x2db0b	0xd8
DSA_sign_setup	0x2dc32	0xd9
DSA_size	0x2db58	0xda
DSA_up_ref	0x2d8b7	0xae1
DSA_verify	0x2dbaa	0xdb
DSAparams_print	0x5194e	0xdc
DSAparams_print_fp	0x52659	0xdd
DSO_METHOD_dl	0x2e3de	0x8e3
DSO_METHOD_dlfcn	0x2e3de	0x8e0
DSO_METHOD_null	0x2ea5d	0x8de
DSO_METHOD_openssl	0x2ea63	0x8df
DSO_METHOD_vms	0x2e3de	0x99e
DSO_METHOD_win32	0x2ea68	0x8e1
DSO_bind_func	0x2e635	0x969
DSO_bind_var	0x2e5d9	0x8dd
DSO_convert_filename	0x2e860	0xa3a
DSO_ctrl	0x2e691	0x8f5
DSO_flags	0x2e58b	0x8d6
DSO_free	0x2e4d0	0x8d5
DSO_get_default_method	0x2e416	0x8d9
DSO_get_filename	0x2e742	0xc2b
DSO_get_loaded_filename	0x2e925	0xaab
DSO_get_method	0x59659	0x8da
DSO_load	0x2e958	0x8dc
DSO_merge	0x2e80c	0xeb2
DSO_new	0x2e94f	0x8d3
DSO_new_method	0x2e429	0x8d4
DSO_set_default_method	0x2e40c	0x8d8
DSO_set_filename	0x2e769	0xa3e
DSO_set_method	0x2e41c	0x8db
DSO_set_name_converter	0x2e707	0xc21
DSO_up_ref	0x2e598	0xb1b
ECDH_OpenSSL	0x38c84	0xd72
ECDH_compute_key	0x38eda	0xe3c
ECDH_get_default_method	0x38aac	0xd17
ECDH_get_ex_data	0x38c34	0xd6e
ECDH_get_ex_new_index	0x38bf2	0xe06
ECDH_set_default_method	0x38aa2	0xddd
ECDH_set_ex_data	0x38c10	0xe1d
ECDH_set_method	0x38c53	0xe1b
ECDSA_OpenSSL	0x391ef	0xe24
ECDSA_SIG_free	0x391dd	0xd7f
ECDSA_SIG_new	0x391d0	0xd43
ECDSA_do_sign	0x39ace	0xd70
ECDSA_do_sign_ex	0x39a49	0xe57
ECDSA_do_verify	0x39b0a	0xe58
ECDSA_get_default_method	0x38f28	0xdc2
ECDSA_get_ex_data	0x39148	0xdb5
ECDSA_get_ex_new_index	0x39106	0xea0
ECDSA_set_default_method	0x38f1e	0xe29
ECDSA_set_ex_data	0x39124	0xe9b
ECDSA_set_method	0x39167	0xe93
ECDSA_sign	0x39ae7	0xe87
ECDSA_sign_ex	0x39a62	0xd4b
ECDSA_sign_setup	0x39ab5	0xd58
ECDSA_size	0x3906b	0xe7a
ECDSA_verify	0x39b23	0xe52
ECPKParameters_print	0x51f6d	0xe17
ECPKParameters_print_fp	0x52819	0xd7d
ECParameters_print	0x526b1	0xd9d
ECParameters_print_fp	0x528d7	0xe68
EC_GF2m_simple_method	0x381bb	0xe9a
EC_GFp_mont_method	0x338dd	0xa81
EC_GFp_nist_method	0x33b7e	0xdc9
EC_GFp_simple_method	0x33504	0xc1b
EC_GROUP_check	0x34ece	0xde3
EC_GROUP_check_discriminant	0x30010	0xd2c
EC_GROUP_clear_free	0x30b73	0x9f6
EC_GROUP_cmp	0x30e51	0xe2b
EC_GROUP_copy	0x30bf2	0xb92
EC_GROUP_dup	0x30d7c	0xe4d
EC_GROUP_free	0x30b1a	0xb3d
EC_GROUP_get0_generator	0x39fd1	0xa85
EC_GROUP_get0_seed	0x7469b	0xe11
EC_GROUP_get_asn1_flag	0x735ea	0xe03
EC_GROUP_get_basis_type	0x35253	0xe35
EC_GROUP_get_cofactor	0x2fe2b	0xa7b
EC_GROUP_get_curve_GF2m	0x2ff9e	0xdac
EC_GROUP_get_curve_GFp	0x2ff1a	0xba9
EC_GROUP_get_curve_name	0x735e2	0xe6f
EC_GROUP_get_degree	0x2ffe0	0xdf2
EC_GROUP_get_order	0x2fe06	0xa8d
EC_GROUP_get_pentanomial_basis	0x352f4	0xd51
EC_GROUP_get_point_conversion_form	0x2fe73	0xd4d
EC_GROUP_get_seed_len	0x7d2da	0xdbd
EC_GROUP_get_trinomial_basis	0x3529d	0xd13
EC_GROUP_have_precompute_mult	0x30af7	0xd65
EC_GROUP_method_of	0x59659	0xa08
EC_GROUP_new	0x2fd54	0xbb3
EC_GROUP_new_by_curve_name	0x34e1f	0xe7f
EC_GROUP_new_curve_GF2m	0x33c2a	0xd36
EC_GROUP_new_curve_GFp	0x33b84	0xb45
EC_GROUP_precompute_mult	0x30aca	0xc1c
EC_GROUP_set_asn1_flag	0x2fe5b	0xea5
EC_GROUP_set_curve_GF2m	0x2ff5c	0xdd9
EC_GROUP_set_curve_GFp	0x2fedb	0xa04
EC_GROUP_set_curve_name	0x2fe4f	0xdcd
EC_GROUP_set_generator	0x30db5	0xaa4
EC_GROUP_set_point_conversion_form	0x2fe67	0xe21
EC_GROUP_set_seed	0x2fe7b	0xda6
EC_KEY_check_key	0x36cac	0xea6
EC_KEY_copy	0x36a01	0xd29
EC_KEY_dup	0x36b36	0xe91
EC_KEY_free	0x36997	0xd5e
EC_KEY_generate_key	0x36b8c	0xdde
EC_KEY_get0_group	0x39fd1	0xdf7
EC_KEY_get0_private_key	0x7d2aa	0xe18
EC_KEY_get0_public_key	0x39ff1	0xd98
EC_KEY_get_conv_form	0x36ef3	0xd3c
EC_KEY_get_enc_flags	0x687f4	0xe26
EC_KEY_get_key_method_data	0x36f17	0xd4a
EC_KEY_insert_key_method_data	0x36f33	0xde5
EC_KEY_new	0x36946	0xe4f
EC_KEY_new_by_curve_name	0x36fc5	0xd19
EC_KEY_precompute_mult	0x36fac	0xd2e
EC_KEY_print	0x5241e	0xe9e
EC_KEY_print_fp	0x52878	0xd66
EC_KEY_set_asn1_flag	0x36f94	0xd48
EC_KEY_set_conv_form	0x36efb	0xd73
EC_KEY_set_enc_flags	0x5f6a5	0xe51
EC_KEY_set_group	0x36e6e	0xdb8
EC_KEY_set_private_key	0x36e99	0xd83
EC_KEY_set_public_key	0x36ec4	0xe62
EC_KEY_up_ref	0x36b63	0xd5a
EC_METHOD_get_field_type	0x59659	0xdc8
EC_POINT_add	0x3075e	0x9e4
EC_POINT_bn2point	0x3509a	0xd46
EC_POINT_clear_free	0x30256	0xbdf
EC_POINT_cmp	0x30928	0xb89
EC_POINT_copy	0x3028f	0xbc2
EC_POINT_dbl	0x307d2	0xbfe
EC_POINT_dup	0x302e0	0xd74
EC_POINT_free	0x30237	0xb71
EC_POINT_get_Jprojective_coordinates_GFp	0x303d4	0xadb
EC_POINT_get_affine_coordinates_GF2m	0x30565	0xe4c
EC_POINT_get_affine_coordinates_GFp	0x30503	0xb5d
EC_POINT_hex2point	0x3520c	0xeb3
EC_POINT_invert	0x3082c	0xb50
EC_POINT_is_at_infinity	0x30879	0xa38
EC_POINT_is_on_curve	0x308ce	0xad1
EC_POINT_make_affine	0x30982	0xc2a
EC_POINT_method_of	0x59659	0xb24
EC_POINT_mul	0x30a85	0xb0f
EC_POINT_new	0x301ab	0xb6c
EC_POINT_oct2point	0x306fc	0xa12
EC_POINT_point2bn	0x35025	0xd33
EC_POINT_point2hex	0x35143	0xe53
EC_POINT_point2oct	0x30697	0xc6a
EC_POINT_set_Jprojective_coordinates_GFp	0x3036f	0xa0f
EC_POINT_set_affine_coordinates_GF2m	0x3049b	0xd20
EC_POINT_set_affine_coordinates_GFp	0x30439	0xa33
EC_POINT_set_compressed_coordinates_GF2m	0x3062f	0xe2a
EC_POINT_set_compressed_coordinates_GFp	0x305cd	0xa25
EC_POINT_set_to_infinity	0x3031a	0xc68
EC_POINTs_make_affine	0x309dc	0xb0e
EC_POINTs_mul	0x30a55	0xb7c
EC_get_builtin_curves	0x34e87	0xd77
EDIPARTYNAME_free	0x66236	0xb43
EDIPARTYNAME_it	0x661f1	0xbbd
EDIPARTYNAME_new	0x66229	0xa6f
ENGINE_add	0x73b57	0x9d6
ENGINE_add_conf_module	0x75809	0xc82
ENGINE_by_id	0x738ca	0x9bd
ENGINE_cleanup	0x734ae	0xb85
ENGINE_cmd_is_executable	0x74066	0xac7
ENGINE_ctrl	0x73f74	0x9b1
ENGINE_ctrl_cmd	0x740a9	0xb54
ENGINE_ctrl_cmd_string	0x74134	0xa44
ENGINE_finish	0x73ce9	0x9ae
ENGINE_free	0x733f0	0x9c6
ENGINE_get_DH	0x687f4	0x9b0
ENGINE_get_DSA	0x7d2aa	0x9d8
ENGINE_get_ECDH	0x36ef3	0xe84
ENGINE_get_ECDSA	0x7d2b2	0xe8b
ENGINE_get_RAND	0x74f47	0x9bb
ENGINE_get_RSA	0x39ff1	0x9b9
ENGINE_get_STORE	0x7d2ba	0xe54
ENGINE_get_cipher	0x75092	0xac4
ENGINE_get_cipher_engine	0x75072	0xbc0
ENGINE_get_ciphers	0x7d2c2	0x9e1
ENGINE_get_cmd_defns	0x735f2	0xa62
ENGINE_get_ctrl_function	0x2fe73	0x9d9
ENGINE_get_default_DH	0x74de9	0x9b8
ENGINE_get_default_DSA	0x74ca9	0x9ca
ENGINE_get_default_ECDH	0x74e89	0xd3b
ENGINE_get_default_ECDSA	0x74d49	0xe4e
ENGINE_get_default_RAND	0x74f38	0x9cd
ENGINE_get_default_RSA	0x74c09	0x9a6
ENGINE_get_destroy_function	0x7d2d2	0xc08
ENGINE_get_digest	0x751b3	0xabc
ENGINE_get_digest_engine	0x751a2	0xa03
ENGINE_get_digests	0x7d2ca	0xb00
ENGINE_get_ex_data	0x73513	0xb28
ENGINE_get_ex_new_index	0x734dc	0xb0a
ENGINE_get_finish_function	0x735ea	0x9a5
ENGINE_get_first	0x73694	0x9bc
ENGINE_get_flags	0x5f641	0xb5f
ENGINE_get_id	0x59659	0x9d4
ENGINE_get_init_function	0x735e2	0x9b2
ENGINE_get_last	0x736d2	0x9b6
ENGINE_get_load_privkey_function	0x7469b	0xc64
ENGINE_get_load_pubkey_function	0x7d2da	0xae8
ENGINE_get_name	0x39fd1	0x9b5
ENGINE_get_next	0x73710	0x9c8
ENGINE_get_prev	0x73776	0x9b7
ENGINE_get_ssl_client_cert_function	0x746a3	0xfcd
ENGINE_get_static_state	0x735fa	0xd41
ENGINE_get_table_flags	0x74290	0xc47
ENGINE_init	0x73c92	0x9ab
ENGINE_load_4758cca	0x7e67d	0xc92
ENGINE_load_aep	0x7f269	0xc8a
ENGINE_load_atalla	0x7fa0f	0xc3a
ENGINE_load_builtin_engines	0x74b46	0xa94
ENGINE_load_chil	0x821c2	0xc03
ENGINE_load_cryptodev	0x72d86	0xa39
ENGINE_load_cswift	0x80db1	0xbd3
ENGINE_load_dynamic	0x75f01	0x9f3
ENGINE_load_nuron	0x82670	0xbef
ENGINE_load_openssl	0x7542e	0xa61
ENGINE_load_padlock	0x76953	0xdcc
ENGINE_load_private_key	0x746ab	0x9c2
ENGINE_load_public_key	0x7475c	0x9af
ENGINE_load_ssl_client_cert	0x74823	0xfce
ENGINE_load_sureware	0x83b45	0xc8b
ENGINE_load_ubsec	0x84abb	0xa4c
ENGINE_new	0x732f2	0x9d3
ENGINE_register_DH	0x74d75	0xa18
ENGINE_register_DSA	0x74c35	0xaca
ENGINE_register_ECDH	0x74e15	0xd1b
ENGINE_register_ECDSA	0x74cd5	0xd07
ENGINE_register_RAND	0x74ec4	0xa31
ENGINE_register_RSA	0x74b95	0xa68
ENGINE_register_STORE	0x74f6c	0xe65
ENGINE_register_all_DH	0x74da0	0xb5b
ENGINE_register_all_DSA	0x74c60	0xb66
ENGINE_register_all_ECDH	0x74e40	0xe3e
ENGINE_register_all_ECDSA	0x74d00	0xe4a
ENGINE_register_all_RAND	0x74eef	0x9f2
ENGINE_register_all_RSA	0x74bc0	0xaf9
ENGINE_register_all_STORE	0x74f97	0xdef
ENGINE_register_all_ciphers	0x75013	0xbc1
ENGINE_register_all_complete	0x74b27	0xb9a
ENGINE_register_all_digests	0x75143	0xa4d
ENGINE_register_ciphers	0x74fd2	0xa3c
ENGINE_register_complete	0x74aea	0xb7d
ENGINE_register_digests	0x75102	0xb49
ENGINE_remove	0x737dc	0x9c5
ENGINE_set_DH	0x7d250	0x9a9
ENGINE_set_DSA	0x7d241	0x9a4
ENGINE_set_ECDH	0x74e98	0xd95
ENGINE_set_ECDSA	0x7d25f	0xe15
ENGINE_set_RAND	0x7d26e	0x9cf
ENGINE_set_RSA	0x7d232	0x9c1
ENGINE_set_STORE	0x7d27d	0xd06
ENGINE_set_ciphers	0x75083	0xa74
ENGINE_set_cmd_defns	0x735d3	0xb3b
ENGINE_set_ctrl_function	0x735b5	0x9da
ENGINE_set_default	0x748e9	0x9ba
ENGINE_set_default_DH	0x74dbe	0x9d2
ENGINE_set_default_DSA	0x74c7e	0x9b4
ENGINE_set_default_ECDH	0x74e5e	0xeaf
ENGINE_set_default_ECDSA	0x74d1e	0xdda
ENGINE_set_default_RAND	0x74f0d	0x9c3
ENGINE_set_default_RSA	0x74bde	0x9cc
ENGINE_set_default_ciphers	0x75031	0xbd5
ENGINE_set_default_digests	0x75161	0xa65
ENGINE_set_default_string	0x74a7f	0xc70
ENGINE_set_destroy_function	0x73588	0xbb0
ENGINE_set_digests	0x7d28c	0xb79
ENGINE_set_ex_data	0x734fa	0xba4
ENGINE_set_finish_function	0x735a6	0x9be
ENGINE_set_flags	0x735c4	0xc5a
ENGINE_set_id	0x73527	0x9d0
ENGINE_set_init_function	0x73597	0x9b3
ENGINE_set_load_privkey_function	0x7d29b	0xa63
ENGINE_set_load_pubkey_function	0x7467d	0xacc
ENGINE_set_load_ssl_client_cert_function	0x7468c	0xfcc
ENGINE_set_name	0x73557	0x9c9
ENGINE_set_table_flags	0x74296	0xc01
ENGINE_unregister_DH	0x74d58	0xb65
ENGINE_unregister_DSA	0x74c18	0xa69
ENGINE_unregister_ECDH	0x74df8	0xd71
ENGINE_unregister_ECDSA	0x74cb8	0xeb9
ENGINE_unregister_RAND	0x74ea7	0xbe4
ENGINE_unregister_RSA	0x74b78	0x9eb
ENGINE_unregister_STORE	0x74f4f	0xd38
ENGINE_unregister_ciphers	0x74fb5	0x9e0
ENGINE_unregister_digests	0x750e5	0xafd
ENGINE_up_ref	0x73a38	0xca6
ERR_add_error_data	0x41708	0x439
ERR_clear_error	0x41537	0xde
ERR_error_string	0x422f8	0xdf
ERR_error_string_n	0x421d0	0x8f3
ERR_free_strings	0x41d3e	0xe0
ERR_func_error_string	0x41dad	0xe1
ERR_get_err_state_table	0x41d5b	0xe2
ERR_get_error	0x418ba	0xe3
ERR_get_error_line	0x418cd	0xe4
ERR_get_error_line_data	0x418e5	0x5eb
ERR_get_implementation	0x419d8	0xa29
ERR_get_next_error_library	0x41f64	0x3c6
ERR_get_state	0x41eb1	0xe5
ERR_get_string_table	0x41d4b	0xe6
ERR_lib_error_string	0x41d79	0xe7
ERR_load_ASN1_strings	0x598ad	0xe8
ERR_load_BIO_strings	0x3a8ca	0xe9
ERR_load_BN_strings	0x2485b	0xea
ERR_load_BUF_strings	0x39e9d	0xeb
ERR_load_COMP_strings	0x72aaa	0x9dd
ERR_load_CONF_strings	0x6b4a8	0xec
ERR_load_CRYPTO_strings	0x354e	0x3f1
ERR_load_DH_strings	0x2fcd8	0xed
ERR_load_DSA_strings	0x2dc4d	0xee
ERR_load_DSO_strings	0x2e3e1	0x8e2
ERR_load_ECDH_strings	0x38ef3	0xe90
ERR_load_ECDSA_strings	0x39b79	0xe34
ERR_load_EC_strings	0x34b4f	0xb21
ERR_load_ENGINE_strings	0x732c7	0x9a3
ERR_load_ERR_strings	0x424d1	0xef
ERR_load_EVP_strings	0x47bea	0xf0
ERR_load_OBJ_strings	0x43833	0xf1
ERR_load_OCSP_strings	0x79649	0xc69
ERR_load_PEM_strings	0x5d470	0xf2
ERR_load_PKCS12_strings	0x728db	0x514
ERR_load_PKCS7_strings	0x6e2b9	0x397
ERR_load_RAND_strings	0x40a05	0x89d
ERR_load_RSA_strings	0x2b43e	0xf4
ERR_load_STORE_strings	0x7ac32	0xdbe
ERR_load_UI_strings	0x79674	0xc13
ERR_load_X509V3_strings	0x6616f	0x48c
ERR_load_X509_strings	0x60836	0xf5
ERR_load_crypto_strings	0x4210e	0xf6
ERR_load_strings	0x41cfe	0xf7
ERR_peek_error	0x41902	0xf8
ERR_peek_error_line	0x41914	0xf9
ERR_peek_error_line_data	0x4192b	0x5ec
ERR_peek_last_error	0x41948	0xc85
ERR_peek_last_error_line	0x4195b	0xc83
ERR_peek_last_error_line_data	0x41973	0xc84
ERR_pop_to_mark	0x417dc	0xdee
ERR_print_errors	0x4252e	0xfa
ERR_print_errors_cb	0x4231c	0xa73
ERR_print_errors_fp	0x423e8	0xfb
ERR_put_error	0x41468	0xfc
ERR_reason_error_string	0x41df1	0xfd
ERR_release_err_state_table	0x41d6c	0xcaf
ERR_remove_state	0x41e7b	0xfe
ERR_set_error_data	0x416bb	0x43a
ERR_set_implementation	0x419e3	0xb20
ERR_set_mark	0x417b7	0xd04
ERR_unload_strings	0x41d12	0xb41
EVP_BytesToKey	0x44891	0xff
EVP_CIPHER_CTX_block_size	0x39ff9	0xf27
EVP_CIPHER_CTX_cipher	0x59659	0xf30
EVP_CIPHER_CTX_cleanup	0x45b17	0x100
EVP_CIPHER_CTX_clear_flags	0x482fb	0xfd2
EVP_CIPHER_CTX_ctrl	0x45b92	0x960
EVP_CIPHER_CTX_flags	0x45bfa	0xf33
EVP_CIPHER_CTX_free	0x4463f	0xec7
EVP_CIPHER_CTX_get_app_data	0x482a4	0xf31
EVP_CIPHER_CTX_init	0x45a98	0x3c1
EVP_CIPHER_CTX_iv_length	0x5e128	0xf3b
EVP_CIPHER_CTX_key_length	0x482b8	0xf01
EVP_CIPHER_CTX_new	0x441c9	0xec6
EVP_CIPHER_CTX_nid	0x482c0	0xef7
EVP_CIPHER_CTX_rand_key	0x446cf	0xe92
EVP_CIPHER_CTX_set_app_data	0x482ac	0xeeb
EVP_CIPHER_CTX_set_flags	0x482ef	0xfdb
EVP_CIPHER_CTX_set_key_length	0x44658	0x95f
EVP_CIPHER_CTX_set_padding	0x446b0	0xbcb
EVP_CIPHER_CTX_test_flags	0x48309	0xfe5
EVP_CIPHER_asn1_to_param	0x48345	0x43b
EVP_CIPHER_block_size	0x39fd1	0xee8
EVP_CIPHER_flags	0x687f4	0xf11
EVP_CIPHER_get_asn1_iv	0x48131	0x43d
EVP_CIPHER_iv_length	0x7d2aa	0xefc
EVP_CIPHER_key_length	0x39ff1	0xf21
EVP_CIPHER_nid	0x59659	0xf25
EVP_CIPHER_param_to_asn1	0x48315	0x43c
EVP_CIPHER_set_asn1_iv	0x481a4	0x43e
EVP_CIPHER_type	0x481e8	0x671
EVP_Cipher	0x45b78	0xf22
EVP_CipherFinal	0x44760	0x101
EVP_CipherFinal_ex	0x44732	0xa2a
EVP_CipherInit	0x441ef	0x102
EVP_CipherInit_ex	0x45c04	0xb63
EVP_CipherUpdate	0x44708	0x103
EVP_DecodeBlock	0x4396e	0x104
EVP_DecodeFinal	0x43a70	0x105
EVP_DecodeInit	0x43958	0x106
EVP_DecodeUpdate	0x43bd5	0x107
EVP_DecryptFinal	0x4475b	0x108
EVP_DecryptFinal_ex	0x4454e	0xa60
EVP_DecryptInit	0x44255	0x109
EVP_DecryptInit_ex	0x44270	0xbfb
EVP_DecryptUpdate	0x44467	0x10a
EVP_Digest	0x4413d	0xc5d
EVP_DigestFinal	0x4403e	0x10b
EVP_DigestFinal_ex	0x43f50	0xb78
EVP_DigestInit	0x44022	0x10c
EVP_DigestInit_ex	0x43e9e	0xc25
EVP_DigestUpdate	0x43f3a	0x10d
EVP_EncodeBlock	0x43871	0x10e
EVP_EncodeFinal	0x43ba0	0x10f
EVP_EncodeInit	0x4385e	0x110
EVP_EncodeUpdate	0x43aa8	0x111
EVP_EncryptFinal	0x44756	0x112
EVP_EncryptFinal_ex	0x443cb	0xa64
EVP_EncryptInit	0x4421c	0x113
EVP_EncryptInit_ex	0x44237	0xb4e
EVP_EncryptUpdate	0x4428e	0x114
EVP_MD_CTX_cleanup	0x43fba	0xb05
EVP_MD_CTX_clear_flags	0x482d5	0xf0d
EVP_MD_CTX_copy	0x441ba	0x4b2
EVP_MD_CTX_copy_ex	0x44062	0xa1d
EVP_MD_CTX_create	0x43dbf	0xa98
EVP_MD_CTX_destroy	0x441ab	0xb6d
EVP_MD_CTX_init	0x43dae	0xa46
EVP_MD_CTX_md	0x59659	0xf38
EVP_MD_CTX_set_flags	0x482c9	0xf2b
EVP_MD_CTX_test_flags	0x482e3	0xf05
EVP_MD_block_size	0x7d2da	0xf32
EVP_MD_pkey_type	0x39fd1	0xf0c
EVP_MD_size	0x39ff1	0xf04
EVP_MD_type	0x59659	0xefd
EVP_OpenFinal	0x460ff	0x115
EVP_OpenInit	0x46001	0x116
EVP_PBE_CipherInit	0x49917	0x672
EVP_PBE_alg_add	0x49a34	0x52a
EVP_PBE_cleanup	0x49b14	0x52c
EVP_PKCS82PKEY	0x48ac2	0x526
EVP_PKEY2PKCS8	0x49909	0x527
EVP_PKEY2PKCS8_broken	0x497ba	0x8c4
EVP_PKEY_add1_attr	0x4972e	0xe6a
EVP_PKEY_add1_attr_by_NID	0x4976e	0xd11
EVP_PKEY_add1_attr_by_OBJ	0x49748	0xeac
EVP_PKEY_add1_attr_by_txt	0x49794	0xd52
EVP_PKEY_assign	0x46997	0x117
EVP_PKEY_bits	0x4646a	0x3f2
EVP_PKEY_cmp	0x46611	0xd69
EVP_PKEY_cmp_parameters	0x46577	0x3c7
EVP_PKEY_copy_parameters	0x4688d	0x118
EVP_PKEY_decrypt	0x46afc	0x42e
EVP_PKEY_delete_attr	0x4971b	0xe28
EVP_PKEY_encrypt	0x46abd	0x42f
EVP_PKEY_free	0x46a72	0x119
EVP_PKEY_get1_DH	0x467be	0x850
EVP_PKEY_get1_DSA	0x4674a	0x78f
EVP_PKEY_get1_EC_KEY	0x46781	0xd39
EVP_PKEY_get1_RSA	0x46716	0x7f2
EVP_PKEY_get_attr	0x49708	0xd6f
EVP_PKEY_get_attr_by_NID	0x496d8	0xe89
EVP_PKEY_get_attr_by_OBJ	0x496f0	0xe43
EVP_PKEY_get_attr_count	0x496ca	0xdaa
EVP_PKEY_missing_parameters	0x4653b	0x11a
EVP_PKEY_new	0x466cf	0x11b
EVP_PKEY_save_parameters	0x46517	0x11c
EVP_PKEY_set1_DH	0x46a4b	0x83b
EVP_PKEY_set1_DSA	0x469fa	0x7b2
EVP_PKEY_set1_EC_KEY	0x46a21	0xd7a
EVP_PKEY_set1_RSA	0x469d3	0x80f
EVP_PKEY_size	0x464da	0x11d
EVP_PKEY_type	0x467f5	0x11e
EVP_SealFinal	0x4623c	0x11f
EVP_SealInit	0x46129	0x120
EVP_SignFinal	0x46266	0x121
EVP_VerifyFinal	0x46365	0x122
EVP_add_alg_module	0x44b7a	0xfed
EVP_add_cipher	0x4552e	0x124
EVP_add_digest	0x45563	0x125
EVP_aes_128_cbc	0x4534a	0xb6f
EVP_aes_128_cfb1	0x4543b	0xcb3
EVP_aes_128_cfb128	0x45350	0xc96
EVP_aes_128_cfb8	0x45484	0xcb0
EVP_aes_128_ecb	0x4535c	0xa54
EVP_aes_128_ofb	0x45356	0xc98
EVP_aes_192_cbc	0x45362	0xc53
EVP_aes_192_cfb1	0x45441	0xcc0
EVP_aes_192_cfb128	0x45368	0xc99
EVP_aes_192_cfb8	0x454b4	0xcb4
EVP_aes_192_ecb	0x45374	0xb2e
EVP_aes_192_ofb	0x4536e	0xc95
EVP_aes_256_cbc	0x45423	0xbb4
EVP_aes_256_cfb1	0x4547e	0xcc7
EVP_aes_256_cfb128	0x45429	0xc97
EVP_aes_256_cfb8	0x454ba	0xcb7
EVP_aes_256_ecb	0x45435	0xaa0
EVP_aes_256_ofb	0x4542f	0xc94
EVP_bf_cbc	0x44e4f	0x126
EVP_bf_cfb64	0x44e55	0x127
EVP_bf_ecb	0x44e61	0x128
EVP_bf_ofb	0x44e5b	0x129
EVP_cast5_cbc	0x45a5f	0x3d7
EVP_cast5_cfb64	0x45a65	0x3d8
EVP_cast5_ecb	0x45a71	0x3d9
EVP_cast5_ofb	0x45a6b	0x3da
EVP_cleanup	0x455f9	0x12a
EVP_des_cbc	0x44d18	0x12b
EVP_des_cfb1	0x44d30	0xccd
EVP_des_cfb64	0x44d1e	0x12c
EVP_des_cfb8	0x44d36	0xcc3
EVP_des_ecb	0x44d2a	0x12d
EVP_des_ede	0x452d1	0x12e
EVP_des_ede3	0x451e9	0x12f
EVP_des_ede3_cbc	0x451d7	0x130
EVP_des_ede3_cfb1	0x451ef	0xcd0
EVP_des_ede3_cfb64	0x451dd	0x131
EVP_des_ede3_cfb8	0x451f5	0xcba
EVP_des_ede3_ecb	0x451e9	0xca4
EVP_des_ede3_ofb	0x451e3	0x132
EVP_des_ede_cbc	0x451c5	0x133
EVP_des_ede_cfb64	0x451cb	0x134
EVP_des_ede_ecb	0x452d1	0xc9f
EVP_des_ede_ofb	0x451d1	0x135
EVP_des_ofb	0x44d24	0x136
EVP_desx_cbc	0x45616	0x137
EVP_dss	0x45fa6	0x138
EVP_dss1	0x45fac	0x139
EVP_ecdsa	0x45ffb	0xe8c
EVP_enc_null	0x47c15	0x13a
EVP_get_cipherbyname	0x455dd	0x13b
EVP_get_digestbyname	0x455eb	0x13c
EVP_get_pw_prompt	0x447af	0x13d
EVP_idea_cbc	0x44f51	0x13e
EVP_idea_cfb64	0x44f57	0x13f
EVP_idea_ecb	0x44f63	0x140
EVP_idea_ofb	0x44f5d	0x141
EVP_md2	0x45e32	0x142
EVP_md4	0x45e63	0x986
EVP_md5	0x45ea2	0x143
EVP_md_null	0x45df3	0x144
EVP_rc2_40_cbc	0x45791	0x3bf
EVP_rc2_64_cbc	0x4578b	0x44f
EVP_rc2_cbc	0x45773	0x145
EVP_rc2_cfb64	0x45779	0x146
EVP_rc2_ecb	0x45785	0x147
EVP_rc2_ofb	0x4577f	0x148
EVP_rc4	0x452d7	0x149
EVP_rc4_40	0x452dd	0x3c0
EVP_read_pw_string	0x447c0	0x14a
EVP_ripemd160	0x45fdd	0x4e4
EVP_set_pw_prompt	0x44784	0x14b
EVP_sha	0x45ed3	0x14c
EVP_sha1	0x45ed9	0x14d
EVP_sha224	0x45f26	0xcf2
EVP_sha256	0x45f2c	0xcf3
EVP_sha384	0x45f79	0xcf0
EVP_sha512	0x45f7f	0xcf1
EXTENDED_KEY_USAGE_free	0x64899	0xa47
EXTENDED_KEY_USAGE_it	0x64854	0xc1a
EXTENDED_KEY_USAGE_new	0x6488c	0x9f5
GENERAL_NAMES_free	0x662e4	0x4c0
GENERAL_NAMES_it	0x6629f	0xaf4
GENERAL_NAMES_new	0x662d7	0x4bf
GENERAL_NAME_free	0x6628d	0x4be
GENERAL_NAME_it	0x66248	0xa22
GENERAL_NAME_new	0x66280	0x4bd
GENERAL_NAME_print	0x664e2	0xb36
GENERAL_SUBTREE_free	0x69913	0xd15
GENERAL_SUBTREE_it	0x698fa	0xe6e
GENERAL_SUBTREE_new	0x69906	0xd75
HMAC	0xc692	0x3c2
HMAC_CTX_cleanup	0xc5ff	0xae0
HMAC_CTX_init	0xc5da	0xabb
HMAC_CTX_set_flags	0xc631	0xcd8
HMAC_Final	0xc572	0x3c5
HMAC_Init	0xc662	0x3c3
HMAC_Init_ex	0xc3bf	0xa0c
HMAC_Update	0xc559	0x3c4
KRB5_APREQBODY_free	0x7aa16	0xa84
KRB5_APREQBODY_it	0x7a9d1	0xbf5
KRB5_APREQBODY_new	0x7aa09	0xa42
KRB5_APREQ_free	0x7aa6d	0xc6b
KRB5_APREQ_it	0x7aa28	0xc07
KRB5_APREQ_new	0x7aa60	0xba8
KRB5_AUTHDATA_free	0x7ab72	0xad7
KRB5_AUTHDATA_it	0x7ab2d	0xc31
KRB5_AUTHDATA_new	0x7ab65	0xa7f
KRB5_AUTHENTBODY_free	0x7abc9	0xbe9
KRB5_AUTHENTBODY_it	0x7ab84	0xba0
KRB5_AUTHENTBODY_new	0x7abbc	0xbbb
KRB5_AUTHENT_free	0x7ac20	0xa55
KRB5_AUTHENT_it	0x7abdb	0xaaf
KRB5_AUTHENT_new	0x7ac13	0xc1f
KRB5_CHECKSUM_free	0x7aac4	0xa4a
KRB5_CHECKSUM_it	0x7aa7f	0x9e3
KRB5_CHECKSUM_new	0x7aab7	0xbd2
KRB5_ENCDATA_free	0x7a8ba	0xb93
KRB5_ENCDATA_it	0x7a875	0xae7
KRB5_ENCDATA_new	0x7a8ad	0xb1a
KRB5_ENCKEY_free	0x7ab1b	0xa20
KRB5_ENCKEY_it	0x7aad6	0x9fd
KRB5_ENCKEY_new	0x7ab0e	0xbaa
KRB5_PRINCNAME_free	0x7a911	0xc18
KRB5_PRINCNAME_it	0x7a8cc	0xbfa
KRB5_PRINCNAME_new	0x7a904	0xa8b
KRB5_TICKET_free	0x7a9bf	0xc54
KRB5_TICKET_it	0x7a97a	0xc52
KRB5_TICKET_new	0x7a9b2	0xba7
KRB5_TKTBODY_free	0x7a968	0xa40
KRB5_TKTBODY_it	0x7a923	0xabe
KRB5_TKTBODY_new	0x7a95b	0xc11
LONG_it	0x4ee9f	0xb30
MD2	0x3948	0x14e
MD2_Final	0x3823	0x14f
MD2_Init	0x36b3	0x150
MD2_Update	0x38b0	0x151
MD2_options	0x36ad	0x152
MD4	0x4459	0x981
MD4_Final	0x434c	0x983
MD4_Init	0x39c2	0x985
MD4_Transform	0x4339	0x982
MD4_Update	0x425f	0x984
MD5	0x4d58	0x153
MD5_Final	0x4598	0x154
MD5_Init	0x39c2	0x155
MD5_Transform	0x4585	0x3f3
MD5_Update	0x44ab	0x156
NAME_CONSTRAINTS_free	0x69932	0xd0a
NAME_CONSTRAINTS_it	0x69900	0xd16
NAME_CONSTRAINTS_new	0x69925	0xd96
NCONF_WIN32	0x6bd1e	0xc9d
NCONF_default	0x6bd18	0xc9b
NCONF_dump_bio	0x6b6e4	0x8ef
NCONF_dump_fp	0x6b8b2	0x8ed
NCONF_free	0x6b537	0x8e9
NCONF_free_data	0x6b547	0x8f1
NCONF_get_number_e	0x6b667	0xa90
NCONF_get_section	0x6b5c1	0x8ee
NCONF_get_string	0x6b5fd	0x8e8
NCONF_load	0x6b557	0x8e4
NCONF_load_bio	0x6b58c	0x8ec
NCONF_load_fp	0x6b863	0x8e6
NCONF_new	0x6b506	0x8e7
NETSCAPE_CERT_SEQUENCE_free	0x4fcd0	0x48d
NETSCAPE_CERT_SEQUENCE_it	0x4fc8b	0xaf3
NETSCAPE_CERT_SEQUENCE_new	0x4fcc3	0x48e
NETSCAPE_SPKAC_free	0x4fc05	0x15b
NETSCAPE_SPKAC_it	0x4fbc0	0xa51
NETSCAPE_SPKAC_new	0x4fbf8	0x15c
NETSCAPE_SPKI_b64_decode	0x5ee58	0x76d
NETSCAPE_SPKI_b64_encode	0x5eeed	0x76b
NETSCAPE_SPKI_free	0x4fc5c	0x15d
NETSCAPE_SPKI_get_pubkey	0x5ee3e	0x76c
NETSCAPE_SPKI_it	0x4fc17	0xbbe
NETSCAPE_SPKI_new	0x4fc4f	0x15e
NETSCAPE_SPKI_print	0x52932	0x769
NETSCAPE_SPKI_set_pubkey	0x5ee20	0x76a
NETSCAPE_SPKI_sign	0x623a4	0x15f
NETSCAPE_SPKI_verify	0x62300	0x160
NOTICEREF_free	0x67988	0x5df
NOTICEREF_it	0x67943	0xbd6
NOTICEREF_new	0x6797b	0x5dd
OBJ_NAME_add	0x429b9	0x44d
OBJ_NAME_cleanup	0x42897	0x450
OBJ_NAME_do_all	0x4277f	0xb7b
OBJ_NAME_do_all_sorted	0x427ec	0xab7
OBJ_NAME_get	0x4293e	0x451
OBJ_NAME_init	0x428fe	0x452
OBJ_NAME_new_index	0x4253f	0x453
OBJ_NAME_remove	0x426de	0x454
OBJ_add_object	0x42c87	0x161
OBJ_bsearch	0x430c7	0x162
OBJ_bsearch_ex	0x42f72	0xe0a
OBJ_cleanup	0x42c26	0x163
OBJ_cmp	0x4380f	0x164
OBJ_create	0x4300c	0x165
OBJ_create_objects	0x430e5	0x3e5
OBJ_dup	0x436ce	0x166
OBJ_ln2nid	0x43513	0x167
OBJ_new_nid	0x42c74	0x168
OBJ_nid2ln	0x42ec3	0x169
OBJ_nid2obj	0x42dba	0x16a
OBJ_nid2sn	0x42e3d	0x16b
OBJ_obj2nid	0x4320f	0x16c
OBJ_obj2txt	0x43279	0x74e
OBJ_sn2nid	0x4357f	0x16d
OBJ_txt2nid	0x436a9	0x16e
OBJ_txt2obj	0x435eb	0x48f
OCSP_BASICRESP_add1_ext_i2d	0x770f4	0xb17
OCSP_BASICRESP_add_ext	0x77116	0x9fc
OCSP_BASICRESP_delete_ext	0x770c1	0x9f9
OCSP_BASICRESP_free	0x76dce	0xb16
OCSP_BASICRESP_get1_ext_d2i	0x770d6	0xb59
OCSP_BASICRESP_get_ext	0x770ac	0xc3e
OCSP_BASICRESP_get_ext_by_NID	0x7705e	0xc0b
OCSP_BASICRESP_get_ext_by_OBJ	0x77078	0xa11
OCSP_BASICRESP_get_ext_by_critical	0x77092	0xa56
OCSP_BASICRESP_get_ext_count	0x7704e	0xbc6
OCSP_BASICRESP_it	0x76d89	0xaf0
OCSP_BASICRESP_new	0x76dc1	0xc05
OCSP_CERTID_free	0x76a11	0xaa6
OCSP_CERTID_it	0x769cc	0x9e6
OCSP_CERTID_new	0x76a04	0xbe3
OCSP_CERTSTATUS_free	0x76cc9	0xa5d
OCSP_CERTSTATUS_it	0x76c84	0xc2c
OCSP_CERTSTATUS_new	0x76cbc	0xa2b
OCSP_CRLID_free	0x76e25	0xb58
OCSP_CRLID_it	0x76de0	0xc37
OCSP_CRLID_new	0x76e18	0xb5e
OCSP_ONEREQ_add1_ext_i2d	0x7700f	0xc49
OCSP_ONEREQ_add_ext	0x7702f	0xb76
OCSP_ONEREQ_delete_ext	0x76fe0	0xc5e
OCSP_ONEREQ_free	0x76a68	0xaec
OCSP_ONEREQ_get1_ext_d2i	0x76ff3	0x9f1
OCSP_ONEREQ_get_ext	0x76fcd	0xb23
OCSP_ONEREQ_get_ext_by_NID	0x76f85	0xaad
OCSP_ONEREQ_get_ext_by_OBJ	0x76f9d	0xb2b
OCSP_ONEREQ_get_ext_by_critical	0x76fb5	0xb67
OCSP_ONEREQ_get_ext_count	0x76f77	0xa9d
OCSP_ONEREQ_it	0x76a23	0xb60
OCSP_ONEREQ_new	0x76a5b	0xc51
OCSP_REQINFO_free	0x76abf	0xb44
OCSP_REQINFO_it	0x76a7a	0xbb9
OCSP_REQINFO_new	0x76ab2	0xc3d
OCSP_REQUEST_add1_ext_i2d	0x76f34	0xb0c
OCSP_REQUEST_add_ext	0x76f56	0xa96
OCSP_REQUEST_delete_ext	0x76f01	0xaea
OCSP_REQUEST_free	0x76b16	0xb0b
OCSP_REQUEST_get1_ext_d2i	0x76f16	0xb46
OCSP_REQUEST_get_ext	0x76eec	0xa4b
OCSP_REQUEST_get_ext_by_NID	0x76e9e	0xc06
OCSP_REQUEST_get_ext_by_OBJ	0x76eb8	0xa05
OCSP_REQUEST_get_ext_by_critical	0x76ed2	0xc59
OCSP_REQUEST_get_ext_count	0x76e8e	0xc39
OCSP_REQUEST_it	0x76ad1	0xaef
OCSP_REQUEST_new	0x76b09	0xbda
OCSP_REQUEST_print	0x78a64	0xba5
OCSP_REQ_CTX_free	0x7779c	0xf51
OCSP_RESPBYTES_free	0x76b6d	0xb6e
OCSP_RESPBYTES_it	0x76b28	0xafb
OCSP_RESPBYTES_new	0x76b60	0xa97
OCSP_RESPDATA_free	0x76d77	0xb02
OCSP_RESPDATA_it	0x76d32	0xb98
OCSP_RESPDATA_new	0x76d6a	0xa80
OCSP_RESPID_free	0x76c1b	0xc34
OCSP_RESPID_it	0x76bd6	0xbb2
OCSP_RESPID_new	0x76c0e	0xb97
OCSP_RESPONSE_free	0x76bc4	0xc65
OCSP_RESPONSE_it	0x76b7f	0xc27
OCSP_RESPONSE_new	0x76bb7	0xbcf
OCSP_RESPONSE_print	0x78bc4	0xabd
OCSP_REVOKEDINFO_free	0x76c72	0xa82
OCSP_REVOKEDINFO_it	0x76c2d	0xbd8
OCSP_REVOKEDINFO_new	0x76c65	0xb8a
OCSP_SERVICELOC_free	0x76e7c	0xb3c
OCSP_SERVICELOC_it	0x76e37	0xab4
OCSP_SERVICELOC_new	0x76e6f	0xa32
OCSP_SIGNATURE_free	0x769ba	0xc16
OCSP_SIGNATURE_it	0x76975	0x9fa
OCSP_SIGNATURE_new	0x769ad	0xb2f
OCSP_SINGLERESP_add1_ext_i2d	0x771cf	0xb32
OCSP_SINGLERESP_add_ext	0x771ef	0xb9f
OCSP_SINGLERESP_delete_ext	0x771a0	0xb37
OCSP_SINGLERESP_free	0x76d20	0xa93
OCSP_SINGLERESP_get1_ext_d2i	0x771b3	0xb70
OCSP_SINGLERESP_get_ext	0x7718d	0xb57
OCSP_SINGLERESP_get_ext_by_NID	0x77145	0xb09
OCSP_SINGLERESP_get_ext_by_OBJ	0x7715d	0xb95
OCSP_SINGLERESP_get_ext_by_critical	0x77175	0xa5c
OCSP_SINGLERESP_get_ext_count	0x77137	0xa13
OCSP_SINGLERESP_it	0x76cdb	0xb87
OCSP_SINGLERESP_new	0x76d13	0xac6
OCSP_accept_responses_new	0x77570	0xbf2
OCSP_archive_cutoff_new	0x7760c	0xa0e
OCSP_basic_add1_cert	0x78750	0xa28
OCSP_basic_add1_nonce	0x773e4	0xb8c
OCSP_basic_add1_status	0x78620	0xc33
OCSP_basic_sign	0x7879d	0xb51
OCSP_basic_verify	0x79496	0xbe8
OCSP_cert_id_new	0x77d10	0xb69
OCSP_cert_status_str	0x789c9	0xa57
OCSP_cert_to_id	0x78045	0xb96
OCSP_check_nonce	0x773fe	0xb53
OCSP_check_validity	0x7841e	0xb9b
OCSP_copy_nonce	0x7746c	0xa7e
OCSP_crlID_new	0x774a1	0xc6d
OCSP_crl_reason_str	0x789dd	0xb1c
OCSP_id_cmp	0x77e8d	0xc04
OCSP_id_get0_info	0x78565	0xb90
OCSP_id_issuer_cmp	0x77e4f	0xb7a
OCSP_onereq_get0_id	0x59659	0xbd4
OCSP_parse_url	0x77eb4	0xb56
OCSP_request_add0_id	0x7809a	0xc29
OCSP_request_add1_cert	0x78133	0xc2d
OCSP_request_add1_nonce	0x773ca	0xb3a
OCSP_request_is_signed	0x785a7	0xa1e
OCSP_request_onereq_count	0x78540	0xbe7
OCSP_request_onereq_get0	0x78550	0xc1d
OCSP_request_set1_name	0x780e1	0xa9c
OCSP_request_sign	0x7819f	0xb77
OCSP_request_verify	0x79301	0xa8f
OCSP_resp_count	0x782ef	0xbd1
OCSP_resp_find	0x78321	0xa2d
OCSP_resp_find_status	0x783d7	0xa99
OCSP_resp_get0	0x78307	0xa21
OCSP_response_create	0x785b4	0xc56
OCSP_response_get1_basic	0x78298	0xc5c
OCSP_response_status	0x7828b	0xa01
OCSP_response_status_str	0x789b5	0xa26
OCSP_sendreq_bio	0x77cb3	0x9f7
OCSP_sendreq_nbio	0x779f9	0xf53
OCSP_sendreq_new	0x777c6	0xf54
OCSP_single_get0_status	0x78372	0xbad
OCSP_url_svcloc_new	0x77680	0xb9d
OPENSSL_DIR_end	0x3671	0xd44
OPENSSL_DIR_read	0x359d	0xe49
OPENSSL_add_all_algorithms_conf	0x44a68	0xc8d
OPENSSL_add_all_algorithms_noconf	0x47c3a	0xc8c
OPENSSL_cleanse	0x21b3	0xcad
OPENSSL_config	0x6cec6	0xc74
OPENSSL_ia32cap_loc	0x13aa	0xd8b
OPENSSL_init	0x72d86	0xffb
OPENSSL_isservice	0x143c	0xfd0
OPENSSL_issetugid	0x2e3de	0x9a1
OPENSSL_load_builtin_modules	0x6ceb7	0xc8e
OPENSSL_no_config	0x6cf34	0xc9c
OSSL_DES_version	0x87dc8	0x2f
OSSL_libdes_version	0x87d9c	0x30
OTHERNAME_free	0x661df	0x840
OTHERNAME_it	0x6619a	0xb04
OTHERNAME_new	0x661d2	0x7cf
OpenSSLDie	0x15d6	0xcac
OpenSSL_add_all_ciphers	0x47c49	0x1fd
OpenSSL_add_all_digests	0x48017	0x1fe
PBE2PARAM_free	0x5a77d	0x57c
PBE2PARAM_it	0x5a738	0xac1
PBE2PARAM_new	0x5a770	0x57a
PBEPARAM_free	0x5a5d1	0x521
PBEPARAM_it	0x5a58c	0xbba
PBEPARAM_new	0x5a5c4	0x51f
PBKDF2PARAM_free	0x5a7d4	0x578
PBKDF2PARAM_it	0x5a78f	0x9f4
PBKDF2PARAM_new	0x5a7c7	0x576
PEM_ASN1_read	0x5b897	0x16f
PEM_ASN1_read_bio	0x5d639	0x170
PEM_ASN1_write	0x5ca2e	0x171
PEM_ASN1_write_bio	0x5c3ad	0x172
PEM_SealFinal	0x5afc2	0x173
PEM_SealInit	0x5ad7d	0x174
PEM_SealUpdate	0x5aefa	0x175
PEM_SignFinal	0x5acfc	0x176
PEM_SignInit	0x5ace4	0x177
PEM_SignUpdate	0x5acf7	0x178
PEM_X509_INFO_read	0x5b69b	0x179
PEM_X509_INFO_read_bio	0x5b0dc	0x17a
PEM_X509_INFO_write_bio	0x5b4f0	0x17b
PEM_bytes_read_bio	0x5c8e2	0xace
PEM_def_callback	0x5b6f8	0xb84
PEM_dek_info	0x5b80f	0x17c
PEM_do_header	0x5baaf	0x17d
PEM_get_EVP_CIPHER_INFO	0x5c6e5	0x17e
PEM_proc_type	0x5b7ae	0x17f
PEM_read	0x5c87f	0x180
PEM_read_DHparams	0x5d2f3	0x181
PEM_read_DSAPrivateKey	0x5d036	0x182
PEM_read_DSA_PUBKEY	0x5cfcf	0x7c0
PEM_read_DSAparams	0x5d07c	0x183
PEM_read_ECPKParameters	0x5d164	0xe63
PEM_read_ECPrivateKey	0x5d2ad	0xe30
PEM_read_EC_PUBKEY	0x5d246	0xe22
PEM_read_NETSCAPE_CERT_SEQUENCE	0x5cca2	0x490
PEM_read_PKCS7	0x5cc18	0x184
PEM_read_PKCS8	0x5d812	0x6f6
PEM_read_PKCS8_PRIV_KEY_INFO	0x5d89c	0x6fa
PEM_read_PUBKEY	0x5d409	0x7dc
PEM_read_PrivateKey	0x5de28	0x185
PEM_read_RSAPrivateKey	0x5cd67	0x186
PEM_read_RSAPublicKey	0x5ce05	0x3b3
PEM_read_RSA_PUBKEY	0x5ce8f	0x7b9
PEM_read_X509	0x5d4be	0x187
PEM_read_X509_AUX	0x5d548	0x77d
PEM_read_X509_CERT_PAIR	0x5d5d2	0xdb3
PEM_read_X509_CRL	0x5cb8e	0x188
PEM_read_X509_REQ	0x5cac0	0x189
PEM_read_bio	0x5bed3	0x18a
PEM_read_bio_DHparams	0x5d2d0	0x18b
PEM_read_bio_DSAPrivateKey	0x5cf31	0x18c
PEM_read_bio_DSA_PUBKEY	0x5cfac	0x828
PEM_read_bio_DSAparams	0x5d059	0x18d
PEM_read_bio_ECPKParameters	0x5d141	0xd50
PEM_read_bio_ECPrivateKey	0x5d11e	0xe82
PEM_read_bio_EC_PUBKEY	0x5d223	0xdbf
PEM_read_bio_NETSCAPE_CERT_SEQUENCE	0x5cc7f	0x491
PEM_read_bio_PKCS7	0x5cbf5	0x18e
PEM_read_bio_PKCS8	0x5d7ef	0x6fb
PEM_read_bio_PKCS8_PRIV_KEY_INFO	0x5d879	0x6f2
PEM_read_bio_PUBKEY	0x5d3e6	0x7cb
PEM_read_bio_PrivateKey	0x5dbeb	0x18f
PEM_read_bio_RSAPrivateKey	0x5cd44	0x190
PEM_read_bio_RSAPublicKey	0x5cde2	0x3af
PEM_read_bio_RSA_PUBKEY	0x5ce6c	0x821
PEM_read_bio_X509	0x5d49b	0x191
PEM_read_bio_X509_AUX	0x5d525	0x7a7
PEM_read_bio_X509_CERT_PAIR	0x5d5af	0xea9
PEM_read_bio_X509_CRL	0x5cb6b	0x192
PEM_read_bio_X509_REQ	0x5ca9d	0x193
PEM_write	0x5c81c	0x194
PEM_write_DHparams	0x5d338	0x195
PEM_write_DSAPrivateKey	0x5cf80	0x196
PEM_write_DSA_PUBKEY	0x5d014	0x835
PEM_write_DSAparams	0x5d0c1	0x197
PEM_write_ECPKParameters	0x5d1a9	0xe3b
PEM_write_ECPrivateKey	0x5d1f7	0xe5f
PEM_write_EC_PUBKEY	0x5d28b	0xe19
PEM_write_NETSCAPE_CERT_SEQUENCE	0x5cce7	0x492
PEM_write_PKCS7	0x5cc5d	0x198
PEM_write_PKCS8	0x5d857	0x6f9
PEM_write_PKCS8PrivateKey	0x5dbc5	0x706
PEM_write_PKCS8PrivateKey_nid	0x5db9f	0x875
PEM_write_PKCS8_PRIV_KEY_INFO	0x5d8e1	0x6fc
PEM_write_PUBKEY	0x5d44e	0x781
PEM_write_PrivateKey	0x5d3a0	0x199
PEM_write_RSAPrivateKey	0x5cdb6	0x19a
PEM_write_RSAPublicKey	0x5ce4a	0x3b5
PEM_write_RSA_PUBKEY	0x5ced4	0x82f
PEM_write_X509	0x5d503	0x19b
PEM_write_X509_AUX	0x5d58d	0x7f7
PEM_write_X509_CERT_PAIR	0x5d617	0xe70
PEM_write_X509_CRL	0x5cbd3	0x19c
PEM_write_X509_REQ	0x5cb05	0x19d
PEM_write_X509_REQ_NEW	0x5cb49	0x8cb
PEM_write_bio	0x5bcbb	0x19e
PEM_write_bio_DHparams	0x5d316	0x19f
PEM_write_bio_DSAPrivateKey	0x5cf54	0x1a0
PEM_write_bio_DSA_PUBKEY	0x5cff2	0x7b0
PEM_write_bio_DSAparams	0x5d09f	0x1a1
PEM_write_bio_ECPKParameters	0x5d187	0xd80
PEM_write_bio_ECPrivateKey	0x5d1cb	0xd60
PEM_write_bio_EC_PUBKEY	0x5d269	0xd99
PEM_write_bio_NETSCAPE_CERT_SEQUENCE	0x5ccc5	0x493
PEM_write_bio_PKCS7	0x5cc3b	0x1a2
PEM_write_bio_PKCS8	0x5d835	0x6f0
PEM_write_bio_PKCS8PrivateKey	0x5dae1	0x705
PEM_write_bio_PKCS8PrivateKey_nid	0x5dabb	0x876
PEM_write_bio_PKCS8_PRIV_KEY_INFO	0x5d8bf	0x6f5
PEM_write_bio_PUBKEY	0x5d42c	0x845
PEM_write_bio_PrivateKey	0x5d35a	0x1a3
PEM_write_bio_RSAPrivateKey	0x5cd8a	0x1a4
PEM_write_bio_RSAPublicKey	0x5ce28	0x3b0
PEM_write_bio_RSA_PUBKEY	0x5ceb2	0x7a9
PEM_write_bio_X509	0x5d4e1	0x1a5
PEM_write_bio_X509_AUX	0x5d56b	0x812
PEM_write_bio_X509_CERT_PAIR	0x5d5f5	0xd68
PEM_write_bio_X509_CRL	0x5cbb1	0x1a6
PEM_write_bio_X509_REQ	0x5cae3	0x1a7
PEM_write_bio_X509_REQ_NEW	0x5cb27	0x8ca
PKCS12_AUTHSAFES_it	0x70ad8	0xa9f
PKCS12_BAGS_free	0x70a63	0x507
PKCS12_BAGS_it	0x70a1e	0xb9c
PKCS12_BAGS_new	0x70a56	0x505
PKCS12_MAC_DATA_free	0x70a06	0x50f
PKCS12_MAC_DATA_it	0x709c1	0xbf1
PKCS12_MAC_DATA_new	0x709f9	0x50d
PKCS12_MAKE_KEYBAG	0x7065e	0x4ef
PKCS12_MAKE_SHKEYBAG	0x7069b	0x4f1
PKCS12_PBE_add	0x70db1	0x515
PKCS12_PBE_keyivgen	0x70c3a	0x5ed
PKCS12_SAFEBAGS_it	0x70ad2	0xb38
PKCS12_SAFEBAG_free	0x70ac0	0x513
PKCS12_SAFEBAG_it	0x70a7b	0xa8c
PKCS12_SAFEBAG_new	0x70ab3	0x511
PKCS12_add_CSPName_asc	0x70b80	0xa37
PKCS12_add_cert	0x70fae	0xe8e
PKCS12_add_friendlyname_asc	0x70b2e	0x4f5
PKCS12_add_friendlyname_uni	0x70b57	0x4f6
PKCS12_add_key	0x71037	0xeb1
PKCS12_add_localkeyid	0x70ade	0x4f4
PKCS12_add_safe	0x70e91	0xd18
PKCS12_add_safes	0x70f6d	0xd88
PKCS12_certbag2x509	0x7247a	0xa70
PKCS12_certbag2x509crl	0x724b9	0xac2
PKCS12_create	0x710b3	0x519
PKCS12_decrypt_skey	0x708e4	0xaae
PKCS12_free	0x709af	0x50b
PKCS12_gen_mac	0x71f19	0x4fe
PKCS12_get_attr_gen	0x70ba9	0x517
PKCS12_get_friendlyname	0x70c0b	0x4f7
PKCS12_init	0x71609	0x4fb
PKCS12_it	0x7096a	0xa5b
PKCS12_item_decrypt_d2i	0x71499	0x9de
PKCS12_item_i2d_encrypt	0x7153c	0xa88
PKCS12_item_pack_safebag	0x705d9	0xb47
PKCS12_key_gen_asc	0x71a01	0x4fc
PKCS12_key_gen_uni	0x71694	0x4fd
PKCS12_new	0x709a2	0x50a
PKCS12_newpass	0x72875	0x85d
PKCS12_pack_authsafes	0x708fc	0xaa1
PKCS12_pack_p7data	0x706fe	0x4f2
PKCS12_pack_p7encdata	0x707b6	0x4f3
PKCS12_parse	0x71de2	0x518
PKCS12_pbe_crypt	0x7136f	0x4f8
PKCS12_set_mac	0x7225f	0x500
PKCS12_setup_mac	0x72135	0x501
PKCS12_unpack_authsafes	0x70920	0xa4f
PKCS12_unpack_p7data	0x70772	0xa7c
PKCS12_unpack_p7encdata	0x708a1	0xaba
PKCS12_verify_mac	0x720a5	0x4ff
PKCS12_x5092certbag	0x72440	0xc24
PKCS12_x509crl2certbag	0x7245d	0xab3
PKCS1_MGF1	0x2b89f	0xcfc
PKCS5_PBE_add	0x49d5c	0x6ef
PKCS5_PBE_keyivgen	0x49b2e	0x6fd
PKCS5_PBKDF2_HMAC_SHA1	0x49e0a	0x703
PKCS5_pbe2_set	0x5a7e6	0x702
PKCS5_pbe_set	0x5a5e3	0x52b
PKCS5_v2_PBE_keyivgen	0x49f70	0x704
PKCS7_ATTR_SIGN_it	0x6d97d	0xa48
PKCS7_ATTR_VERIFY_it	0x6d983	0xbf4
PKCS7_DIGEST_free	0x6d96b	0x1a8
PKCS7_DIGEST_it	0x6d926	0xc23
PKCS7_DIGEST_new	0x6d95e	0x1a9
PKCS7_ENCRYPT_free	0x6d914	0x1aa
PKCS7_ENCRYPT_it	0x6d8cf	0xa79
PKCS7_ENCRYPT_new	0x6d907	0x1ab
PKCS7_ENC_CONTENT_free	0x6d866	0x1ac
PKCS7_ENC_CONTENT_it	0x6d821	0xc28
PKCS7_ENC_CONTENT_new	0x6d859	0x1ad
PKCS7_ENVELOPE_free	0x6d79e	0x1ae
PKCS7_ENVELOPE_it	0x6d759	0x9e9
PKCS7_ENVELOPE_new	0x6d791	0x1af
PKCS7_ISSUER_AND_SERIAL_digest	0x62882	0x1b0
PKCS7_ISSUER_AND_SERIAL_free	0x6d747	0x1b1
PKCS7_ISSUER_AND_SERIAL_it	0x6d702	0xac0
PKCS7_ISSUER_AND_SERIAL_new	0x6d73a	0x1b2
PKCS7_RECIP_INFO_free	0x6d80f	0x1b3
PKCS7_RECIP_INFO_it	0x6d7ca	0xc19
PKCS7_RECIP_INFO_new	0x6d802	0x1b4
PKCS7_RECIP_INFO_set	0x6e0f9	0x430
PKCS7_SIGNED_free	0x6d67f	0x1b5
PKCS7_SIGNED_it	0x6d63a	0xac3
PKCS7_SIGNED_new	0x6d672	0x1b6
PKCS7_SIGNER_INFO_free	0x6d6f0	0x1b7
PKCS7_SIGNER_INFO_it	0x6d6ab	0xa8a
PKCS7_SIGNER_INFO_new	0x6d6e3	0x1b8
PKCS7_SIGNER_INFO_set	0x6de47	0x3a2
PKCS7_SIGN_ENVELOPE_free	0x6d8bd	0x1b9
PKCS7_SIGN_ENVELOPE_it	0x6d878	0xb42
PKCS7_SIGN_ENVELOPE_new	0x6d8b0	0x1ba
PKCS7_add_attrib_smimecap	0x70359	0x86c
PKCS7_add_attribute	0x6f2c7	0x472
PKCS7_add_certificate	0x6dd21	0x3a4
PKCS7_add_crl	0x6ddb4	0x3a5
PKCS7_add_recipient	0x6e27e	0x431
PKCS7_add_recipient_info	0x6e0a5	0x432
PKCS7_add_signature	0x6dfa4	0x3aa
PKCS7_add_signed_attribute	0x6f2a9	0x473
PKCS7_add_signer	0x6dc2d	0x3a3
PKCS7_cert_from_signer_info	0x6e197	0x3ab
PKCS7_content_new	0x6e242	0x3a6
PKCS7_ctrl	0x6d989	0x39f
PKCS7_dataDecode	0x6e87c	0x4de
PKCS7_dataFinal	0x6f2e5	0x4dd
PKCS7_dataInit	0x6e3c9	0x3a9
PKCS7_dataVerify	0x6f7bb	0x3a8
PKCS7_decrypt	0x6fda5	0x867
PKCS7_digest_from_attributes	0x6ee84	0x474
PKCS7_dup	0x6d628	0x1bb
PKCS7_encrypt	0x6fc85	0x862
PKCS7_free	0x6d5ff	0x1bc
PKCS7_get0_signers	0x6fb38	0x866
PKCS7_get_attribute	0x6f295	0x475
PKCS7_get_issuer_and_serial	0x6edbc	0x476
PKCS7_get_signed_attribute	0x6f281	0x477
PKCS7_get_signer_info	0x6e078	0x3ac
PKCS7_get_smimecap	0x70407	0x86a
PKCS7_it	0x6d5ba	0xc58
PKCS7_new	0x6d5f2	0x1bd
PKCS7_set0_type_other	0x6dc11	0xea8
PKCS7_set_attributes	0x6ef0a	0x481
PKCS7_set_cipher	0x6e1ca	0x433
PKCS7_set_content	0x6da2f	0x3a1
PKCS7_set_digest	0x6dfe8	0xe9d
PKCS7_set_signed_attributes	0x6ee9b	0x482
PKCS7_set_type	0x6daa0	0x3a0
PKCS7_sign	0x6f8a1	0x86b
PKCS7_signatureVerify	0x6f02d	0x735
PKCS7_simple_smimecap	0x7045a	0x869
PKCS7_verify	0x6ff3a	0x861
PKCS8_PRIV_KEY_INFO_free	0x5ab32	0x525
PKCS8_PRIV_KEY_INFO_it	0x5aaed	0xbb8
PKCS8_PRIV_KEY_INFO_new	0x5ab25	0x523
PKCS8_add_keyusage	0x70b04	0x516
PKCS8_decrypt	0x72906	0xacd
PKCS8_encrypt	0x7292a	0x4f0
PKCS8_set_broken	0x48fb7	0x528
PKEY_USAGE_PERIOD_free	0x672ab	0x4d3
PKEY_USAGE_PERIOD_it	0x67266	0xa4e
PKEY_USAGE_PERIOD_new	0x6729e	0x4d2
POLICYINFO_free	0x6787d	0x5d3
POLICYINFO_it	0x67838	0xbaf
POLICYINFO_new	0x67870	0x5d1
POLICYQUALINFO_free	0x678da	0x5d7
POLICYQUALINFO_it	0x67895	0xa3b
POLICYQUALINFO_new	0x678cd	0x5d5
POLICY_CONSTRAINTS_free	0x697bc	0xd10
POLICY_CONSTRAINTS_it	0x697a9	0xe41
POLICY_CONSTRAINTS_new	0x697af	0xddb
POLICY_MAPPINGS_it	0x695b5	0xe6d
POLICY_MAPPING_free	0x695c8	0xd5b
POLICY_MAPPING_it	0x695af	0xd0e
POLICY_MAPPING_new	0x695bb	0xea2
PROXY_CERT_INFO_EXTENSION_free	0x69cb5	0xcea
PROXY_CERT_INFO_EXTENSION_it	0x69c70	0xceb
PROXY_CERT_INFO_EXTENSION_new	0x69ca8	0xce9
PROXY_POLICY_free	0x69c5e	0xcec
PROXY_POLICY_it	0x69c19	0xce5
PROXY_POLICY_new	0x69c51	0xced
RAND_SSLeay	0x3feae	0x459
RAND_add	0x40997	0x899
RAND_bytes	0x409c4	0x1d0
RAND_cleanup	0x4096a	0x1d1
RAND_egd	0x40a30	0x8cd
RAND_egd_bytes	0x40a30	0x962
RAND_event	0x41369	0x8d2
RAND_file_name	0x407f7	0x1d2
RAND_get_rand_method	0x408e0	0x471
RAND_load_file	0x40600	0x1d3
RAND_poll	0x40c0c	0x977
RAND_pseudo_bytes	0x409da	0x89e
RAND_query_egd_bytes	0x40a30	0xb81
RAND_screen	0x4145e	0x1d4
RAND_seed	0x40985	0x1d5
RAND_set_rand_engine	0x4092b	0xaaa
RAND_set_rand_method	0x408bc	0x45a
RAND_status	0x409f0	0x8ce
RAND_write_file	0x40710	0x1d6
RC2_cbc_encrypt	0x1681e	0x1d7
RC2_cfb64_encrypt	0x16c92	0x1d8
RC2_decrypt	0x166e0	0x3e3
RC2_ecb_encrypt	0x1642b	0x1d9
RC2_encrypt	0x165ae	0x1da
RC2_ofb64_encrypt	0x16e54	0x1db
RC2_set_key	0x164d3	0x1dc
RC4	0x16fe0	0x1dd
RC4_options	0x17336	0x1de
RC4_set_key	0x1733c	0x1df
RIPEMD160	0xff00	0x415
RIPEMD160_Final	0xe8dc	0x414
RIPEMD160_Init	0xc71f	0x412
RIPEMD160_Transform	0xe8c9	0x416
RIPEMD160_Update	0xe7ef	0x413
RSAPrivateKey_asn1_meth	0x2c9c3	0x1e0
RSAPrivateKey_dup	0x2ca85	0x1e1
RSAPrivateKey_it	0x2ca03	0xb5a
RSAPublicKey_dup	0x2ca73	0x1e2
RSAPublicKey_it	0x2ca09	0xab1
RSA_PKCS1_SSLeay	0x295c7	0x1e3
RSA_X931_derive_ex	0x2c661	0xfe1
RSA_X931_generate_key_ex	0x2c8dc	0xfd6
RSA_X931_hash_id	0x2c637	0xcf7
RSA_blinding_off	0x2ac40	0x3d2
RSA_blinding_on	0x2ae89	0x3d1
RSA_check_key	0x2bcc5	0x74d
RSA_flags	0x2ce66	0x3bc
RSA_free	0x2ccf5	0x1e4
RSA_generate_key	0x2ca97	0x1e5
RSA_generate_key_ex	0x2ab81	0xe66
RSA_get_default_method	0x2cb3e	0x738
RSA_get_ex_data	0x2ce52	0x405
RSA_get_ex_new_index	0x2ce1b	0x406
RSA_get_method	0x39ff1	0x737
RSA_memory_lock	0x2ce76	0x45b
RSA_new	0x2cf73	0x1e6
RSA_new_method	0x2cb8e	0x1e7
RSA_null_method	0x2c04b	0x770
RSA_padding_add_PKCS1_OAEP	0x2b9bd	0x4ca
RSA_padding_add_PKCS1_PSS	0x2c331	0xcfb
RSA_padding_add_PKCS1_type_1	0x2b469	0x407
RSA_padding_add_PKCS1_type_2	0x2b578	0x408
RSA_padding_add_SSLv23	0x2b6a7	0x409
RSA_padding_add_X931	0x2c50f	0xcfa
RSA_padding_add_none	0x2b808	0x40a
RSA_padding_check_PKCS1_OAEP	0x2bb0e	0x4cb
RSA_padding_check_PKCS1_type_1	0x2b4cf	0x40b
RSA_padding_check_PKCS1_type_2	0x2b60a	0x40c
RSA_padding_check_SSLv23	0x2b743	0x40d
RSA_padding_check_X931	0x2c586	0xcf8
RSA_padding_check_none	0x2b84d	0x40e
RSA_print	0x51a92	0x1e8
RSA_print_fp	0x52764	0x1e9
RSA_private_decrypt	0x2abea	0x1ea
RSA_private_encrypt	0x2abcc	0x1eb
RSA_public_decrypt	0x2ac08	0x1ec
RSA_public_encrypt	0x2abae	0x1ed
RSA_set_default_method	0x2cb34	0x1ee
RSA_set_ex_data	0x2ce39	0x404
RSA_set_method	0x2cb52	0x736
RSA_setup_blinding	0x2ad1e	0xdd5
RSA_sign	0x2aec6	0x1ef
RSA_sign_ASN1_OCTET_STRING	0x2b271	0x1f0
RSA_size	0x2ac26	0x1f1
RSA_up_ref	0x2cdf2	0xac8
RSA_verify	0x2b059	0x1f2
RSA_verify_ASN1_OCTET_STRING	0x2b34e	0x1f3
RSA_verify_PKCS1_PSS	0x2c0d0	0xcf9
SHA	0x7f40	0x1f4
SHA1	0x7f92	0x1f5
SHA1_Final	0x6739	0x1f6
SHA1_Init	0xc71f	0x1f7
SHA1_Transform	0x6726	0x3f4
SHA1_Update	0x664c	0x1f8
SHA224	0x95e3	0xdb6
SHA224_Final	0x9682	0xde8
SHA224_Init	0x7fe4	0xe2f
SHA224_Update	0x967d	0xdea
SHA256	0x9630	0xe46
SHA256_Final	0x949e	0xe80
SHA256_Init	0x8035	0xd97
SHA256_Transform	0x948c	0xe50
SHA256_Update	0x93b2	0xeb5
SHA384	0xc2e7	0xea1
SHA384_Final	0xc1f3	0xe9c
SHA384_Init	0x9687	0xe99
SHA384_Update	0xc2d0	0xddf
SHA512	0xc353	0xe55
SHA512_Final	0xbff9	0xdfd
SHA512_Init	0x971c	0xe31
SHA512_Transform	0xc2d5	0xe5b
SHA512_Update	0xc1f8	0xd1c
SHA_Final	0x6517	0x1f9
SHA_Init	0xc71f	0x1fa
SHA_Transform	0x6505	0x3f5
SHA_Update	0x642b	0x1fb
SMIME_crlf_copy	0x574e0	0x864
SMIME_read_ASN1	0x57a66	0xfb1
SMIME_read_PKCS7	0x7050a	0x85f
SMIME_text	0x57d9e	0x868
SMIME_write_PKCS7	0x70590	0x85e
SSLeay	0x2bd2	0x1
SSLeay_version	0x2b7a	0x2
STORE_ATTR_INFO_compare	0x7c37e	0xd8e
STORE_ATTR_INFO_free	0x7d1ae	0xda8
STORE_ATTR_INFO_get0_cstr	0x7b8ab	0xe40
STORE_ATTR_INFO_get0_dn	0x7b9b7	0xda4
STORE_ATTR_INFO_get0_number	0x7ba3d	0xd3a
STORE_ATTR_INFO_get0_sha1str	0x7b931	0xe3d
STORE_ATTR_INFO_in	0x7c400	0xd4f
STORE_ATTR_INFO_in_ex	0x7c438	0xe04
STORE_ATTR_INFO_in_range	0x7c3ae	0xd9c
STORE_ATTR_INFO_modify_cstr	0x7bd55	0xdf4
STORE_ATTR_INFO_modify_dn	0x7be7f	0xdfe
STORE_ATTR_INFO_modify_number	0x7bf11	0xd22
STORE_ATTR_INFO_modify_sha1str	0x7bdea	0xe7d
STORE_ATTR_INFO_new	0x7b896	0xdab
STORE_ATTR_INFO_set_cstr	0x7bac3	0xd9a
STORE_ATTR_INFO_set_dn	0x7bc11	0xd34
STORE_ATTR_INFO_set_number	0x7bcb3	0xd0b
STORE_ATTR_INFO_set_sha1str	0x7bb6a	0xe0c
STORE_Memory	0x7d2e2	0xdd7
STORE_OBJECT_free	0x7b836	0xe38
STORE_OBJECT_new	0x7b80a	0xe8f
STORE_create_method	0x7d1d2	0xe16
STORE_ctrl	0x7ac8a	0xd8d
STORE_delete_arbitrary	0x7b79d	0xdb2
STORE_delete_certificate	0x7ae0b	0xe5a
STORE_delete_crl	0x7b4c5	0xe25
STORE_delete_number	0x7b6c1	0xe00
STORE_delete_private_key	0x7b06a	0xded
STORE_delete_public_key	0x7b2c9	0xd3e
STORE_destroy_method	0x7d206	0xd37
STORE_free	0x7ac5d	0xe5e
STORE_generate_crl	0x7cc88	0xdf8
STORE_generate_key	0x7c81b	0xe1e
STORE_get_arbitrary	0x7d096	0xd85
STORE_get_certificate	0x7c640	0xe56
STORE_get_crl	0x7cd1c	0xe97
STORE_get_ex_data	0x7ad18	0xe61
STORE_get_ex_new_index	0x7ace1	0xe42
STORE_get_method	0x59659	0xd49
STORE_get_number	0x7cf81	0xd57
STORE_get_private_key	0x7c8af	0xda9
STORE_get_public_key	0x7ca9a	0xd3f
STORE_list_certificate_end	0x7aecf	0xe96
STORE_list_certificate_endp	0x7af2c	0xea3
STORE_list_certificate_next	0x7c78e	0xd9f
STORE_list_certificate_start	0x7ae6f	0xdba
STORE_list_crl_end	0x7b589	0xd79
STORE_list_crl_endp	0x7b5e6	0xd76
STORE_list_crl_next	0x7ce60	0xd9b
STORE_list_crl_start	0x7b529	0xe05
STORE_list_private_key_end	0x7b12e	0xdc0
STORE_list_private_key_endp	0x7b18b	0xe73
STORE_list_private_key_next	0x7ca0d	0xda5
STORE_list_private_key_start	0x7b0ce	0xe6c
STORE_list_public_key_end	0x7b38d	0xd82
STORE_list_public_key_endp	0x7b3ea	0xd27
STORE_list_public_key_next	0x7cbfb	0xe36
STORE_list_public_key_start	0x7b32d	0xd6c
STORE_method_get_cleanup_function	0x39ff1	0xe83
STORE_method_get_ctrl_function	0x7d2da	0xe5d
STORE_method_get_delete_function	0x7d2ba	0xe2e
STORE_method_get_generate_function	0x7d2aa	0xd62
STORE_method_get_get_function	0x687f4	0xde1
STORE_method_get_initialise_function	0x39fd1	0xdff
STORE_method_get_list_end_function	0x7d2d2	0xeab
STORE_method_get_list_next_function	0x7d2ca	0xda3
STORE_method_get_list_start_function	0x7d2c2	0xe10
STORE_method_get_lock_store_function	0x2fe73	0xde6
STORE_method_get_modify_function	0x7d2b2	0xe07
STORE_method_get_revoke_function	0x74f47	0xdcf
STORE_method_get_store_function	0x36ef3	0xdd2
STORE_method_get_unlock_store_function	0x7469b	0xe60
STORE_method_get_update_store_function	0x735ea	0xd1a
STORE_method_set_cleanup_function	0x7d232	0xde2
STORE_method_set_ctrl_function	0x7467d	0xd81
STORE_method_set_delete_function	0x7d27d	0xd9e
STORE_method_set_generate_function	0x7d241	0xd94
STORE_method_set_get_function	0x7d250	0xdd0
STORE_method_set_initialise_function	0x7d223	0xd30
STORE_method_set_list_end_function	0x73588	0xd63
STORE_method_set_list_next_function	0x7d28c	0xd5f
STORE_method_set_list_start_function	0x75083	0xd08
STORE_method_set_lock_store_function	0x735b5	0xe9f
STORE_method_set_modify_function	0x7d25f	0xdca
STORE_method_set_revoke_function	0x7d26e	0xdad
STORE_method_set_store_function	0x74e98	0xd4e
STORE_method_set_unlock_store_function	0x7d29b	0xe13
STORE_method_set_update_store_function	0x735a6	0xde9
STORE_modify_arbitrary	0x7b725	0xd40
STORE_modify_certificate	0x7ad2c	0xd1f
STORE_modify_crl	0x7b44d	0xe6b
STORE_modify_number	0x7b649	0xdd1
STORE_modify_private_key	0x7af8f	0xdc6
STORE_modify_public_key	0x7b1ee	0xe0f
STORE_new_engine	0x7c5b3	0xd6b
STORE_new_method	0x7c52b	0xeb0
STORE_parse_attrs_end	0x7c188	0xd4c
STORE_parse_attrs_endp	0x7c1be	0xe32
STORE_parse_attrs_next	0x7c009	0xdcb
STORE_parse_attrs_start	0x7bfa3	0xd0f
STORE_revoke_certificate	0x7ada4	0xe2c
STORE_revoke_private_key	0x7b007	0xdfb
STORE_revoke_public_key	0x7b266	0xdb0
STORE_set_ex_data	0x7acff	0xe8a
STORE_set_method	0x79eca	0xd14
STORE_store_arbitrary	0x7cff9	0xe12
STORE_store_certificate	0x7c6d4	0xe09
STORE_store_crl	0x7cdb0	0xd86
STORE_store_number	0x7ceed	0xdae
STORE_store_private_key	0x7c943	0xdd3
STORE_store_public_key	0x7cb2e	0xdf9
SXNETID_free	0x673c2	0x534
SXNETID_it	0x6737d	0xa6d
SXNETID_new	0x673b5	0x533
SXNET_add_id_INTEGER	0x67514	0x5c7
SXNET_add_id_asc	0x676ed	0x5c5
SXNET_add_id_ulong	0x67732	0x5c6
SXNET_free	0x67419	0x530
SXNET_get_id_INTEGER	0x674c8	0x5ca
SXNET_get_id_asc	0x6763d	0x5c8
SXNET_get_id_ulong	0x6768e	0x5c9
SXNET_it	0x673d4	0xa35
SXNET_new	0x6740c	0x52f
TXT_DB_create_index	0x6d230	0x1ff
TXT_DB_free	0x6d4c5	0x200
TXT_DB_get_by_index	0x6d1f3	0x201
TXT_DB_insert	0x6d415	0x202
TXT_DB_read	0x6cf3f	0x203
TXT_DB_write	0x6d30d	0x204
UI_OpenSSL	0x7a2ab	0xb83
UI_UTIL_read_pw	0x7a787	0xc88
UI_UTIL_read_pw_string	0x7a806	0xc89
UI_add_error_string	0x79b5c	0xa49
UI_add_info_string	0x79aec	0xc4c
UI_add_input_boolean	0x799e7	0x9ea
UI_add_input_string	0x798e7	0xc36
UI_add_user_data	0x79cac	0xae9
UI_add_verify_string	0x79965	0xbf8
UI_construct_prompt	0x79bcc	0xa19
UI_create_method	0x79ed5	0xc48
UI_ctrl	0x79dfa	0xa14
UI_destroy_method	0x79f0c	0xb29
UI_dup_error_string	0x79b7a	0xab0
UI_dup_info_string	0x79b0a	0xa59
UI_dup_input_boolean	0x79a0d	0xa36
UI_dup_input_string	0x7990f	0xa1b
UI_dup_verify_string	0x7998e	0xc2f
UI_free	0x796dc	0xb4c
UI_get0_action_string	0x79feb	0xb22
UI_get0_output_string	0x6b3f4	0xc2e
UI_get0_result	0x7a239	0xa9e
UI_get0_result_string	0x7a003	0xb1d
UI_get0_test_string	0x7a01a	0xbbf
UI_get0_user_data	0x39ff1	0xadf
UI_get_default_method	0x79eb6	0xa86
UI_get_ex_data	0x79e98	0xa83
UI_get_ex_new_index	0x79e61	0xb74
UI_get_input_flags	0x79fde	0xaa3
UI_get_method	0x59659	0xaeb
UI_get_result_maxsize	0x7a047	0xbe2
UI_get_result_minsize	0x7a02f	0xc4d
UI_get_string_type	0x61012	0xb64
UI_method_get_closer	0x79fcf	0xbe5
UI_method_get_flusher	0x79fb1	0xa76
UI_method_get_opener	0x79f93	0xba3
UI_method_get_reader	0x79fc0	0xbc5
UI_method_get_writer	0x79fa2	0xb82
UI_method_set_closer	0x79f7d	0x9fe
UI_method_set_flusher	0x79f51	0xae5
UI_method_set_opener	0x79f25	0xc44
UI_method_set_reader	0x79f67	0xc66
UI_method_set_writer	0x79f3b	0xc1e
UI_new	0x7a2a2	0xc55
UI_new_method	0x7a1db	0xb4d
UI_process	0x79d05	0xb61
UI_set_default_method	0x79eac	0xb80
UI_set_ex_data	0x79e7f	0xaf7
UI_set_method	0x79eca	0xb8f
UI_set_result	0x7a05f	0xbc8
USERNOTICE_free	0x67931	0x5db
USERNOTICE_it	0x678ec	0xc3c
USERNOTICE_new	0x67924	0x5d9
UTF8_getc	0x4c6da	0x76f
UTF8_putc	0x4c97d	0x76e
X509V3_EXT_CRL_add_conf	0x647f8	0x4df
X509V3_EXT_CRL_add_nconf	0x646f3	0xbd7
X509V3_EXT_REQ_add_conf	0x64826	0x768
X509V3_EXT_REQ_add_nconf	0x64718	0xa43
X509V3_EXT_add	0x64d54	0x494
X509V3_EXT_add_alias	0x64dc4	0x495
X509V3_EXT_add_conf	0x647ca	0x496
X509V3_EXT_add_list	0x64da1	0x670
X509V3_EXT_add_nconf	0x646ce	0xb10
X509V3_EXT_add_nconf_sk	0x64654	0xacb
X509V3_EXT_cleanup	0x64e3b	0x497
X509V3_EXT_conf	0x6476e	0x498
X509V3_EXT_conf_nid	0x6479c	0x499
X509V3_EXT_d2i	0x64b32	0x4d6
X509V3_EXT_get	0x64b07	0x49a
X509V3_EXT_get_nid	0x64a9c	0x49b
X509V3_EXT_i2d	0x6406c	0x66e
X509V3_EXT_nconf	0x64578	0x9ec
X509V3_EXT_nconf_nid	0x64603	0xb7e
X509V3_EXT_print	0x64fcb	0x49c
X509V3_EXT_print_fp	0x65237	0x49d
X509V3_EXT_val_prn	0x64e55	0x66f
X509V3_NAME_from_section	0x65aaa	0xe69
X509V3_add1_i2d	0x64c57	0x9e8
X509V3_add_standard_extensions	0x7d2e8	0x49e
X509V3_add_value	0x65270	0x49f
X509V3_add_value_bool	0x6537a	0x4a0
X509V3_add_value_bool_nf	0x6539f	0x673
X509V3_add_value_int	0x65557	0x4a1
X509V3_add_value_uchar	0x6533a	0x60d
X509V3_conf_free	0x6533f	0x4a2
X509V3_extensions_print	0x65109	0xc0d
X509V3_get_d2i	0x64b85	0x7ea
X509V3_get_section	0x641ed	0x5e1
X509V3_get_string	0x641a6	0x5e0
X509V3_get_value_bool	0x65597	0x4a3
X509V3_get_value_int	0x656e3	0x4a4
X509V3_parse_list	0x65b3d	0x4a5
X509V3_section_free	0x64252	0x5e3
X509V3_set_conf_lhash	0x642bf	0x5cb
X509V3_set_ctx	0x64290	0x5e4
X509V3_set_nconf	0x6427d	0xa87
X509V3_string_free	0x64231	0x5e2
X509_ALGORS_it	0x4e14e	0xf56
X509_ALGOR_dup	0x4e1d7	0x5ee
X509_ALGOR_free	0x4e193	0x205
X509_ALGOR_get0	0x4e258	0xf57
X509_ALGOR_it	0x4e148	0xa9a
X509_ALGOR_new	0x4e186	0x206
X509_ALGOR_set0	0x4e1e9	0xf58
X509_ATTRIBUTE_count	0x61582	0x891
X509_ATTRIBUTE_create	0x4ed51	0x483
X509_ATTRIBUTE_create_by_NID	0x61810	0x88f
X509_ATTRIBUTE_create_by_OBJ	0x615fa	0x892
X509_ATTRIBUTE_create_by_txt	0x6167d	0x8aa
X509_ATTRIBUTE_dup	0x4ed3f	0x484
X509_ATTRIBUTE_free	0x4ed2d	0x207
X509_ATTRIBUTE_get0_data	0x616e5	0x896
X509_ATTRIBUTE_get0_object	0x61012	0x893
X509_ATTRIBUTE_get0_type	0x615a1	0x88b
X509_ATTRIBUTE_it	0x4ece8	0xaac
X509_ATTRIBUTE_new	0x4ed20	0x208
X509_ATTRIBUTE_set1_data	0x6146e	0x88c
X509_ATTRIBUTE_set1_object	0x61441	0x890
X509_CERT_AUX_free	0x4f6db	0x786
X509_CERT_AUX_it	0x4f696	0xaa7
X509_CERT_AUX_new	0x4f6ce	0x7d1
X509_CERT_AUX_print	0x51167	0x7be
X509_CERT_PAIR_free	0x4f94e	0xdfa
X509_CERT_PAIR_it	0x4f909	0xdce
X509_CERT_PAIR_new	0x4f941	0xe64
X509_CINF_free	0x4f4a6	0x209
X509_CINF_it	0x4f461	0xafc
X509_CINF_new	0x4f499	0x20a
X509_CRL_INFO_free	0x4fa02	0x20b
X509_CRL_INFO_it	0x4f966	0xc20
X509_CRL_INFO_new	0x4f9f5	0x20c
X509_CRL_add0_revoked	0x4fa8f	0xbbc
X509_CRL_add1_ext_i2d	0x6119b	0xb12
X509_CRL_add_ext	0x611bd	0x20d
X509_CRL_cmp	0x5e659	0x20e
X509_CRL_delete_ext	0x61168	0x20f
X509_CRL_digest	0x62825	0x957
X509_CRL_dup	0x4fa65	0x210
X509_CRL_free	0x4fa53	0x211
X509_CRL_get_ext	0x61153	0x212
X509_CRL_get_ext_by_NID	0x5ecd0	0x213
X509_CRL_get_ext_by_OBJ	0x6111f	0x214
X509_CRL_get_ext_by_critical	0x61139	0x215
X509_CRL_get_ext_count	0x6110f	0x216
X509_CRL_get_ext_d2i	0x6117d	0x7d9
X509_CRL_it	0x4f96c	0x9fb
X509_CRL_new	0x4fa46	0x217
X509_CRL_print	0x51375	0x4cd
X509_CRL_print_fp	0x5151e	0x4cc
X509_CRL_set_issuer_name	0x6066f	0xab6
X509_CRL_set_lastUpdate	0x60690	0xb15
X509_CRL_set_nextUpdate	0x606d3	0xaee
X509_CRL_set_version	0x60639	0xb07
X509_CRL_sign	0x62374	0x218
X509_CRL_sort	0x60716	0xa2f
X509_CRL_verify	0x622e1	0x219
X509_EXTENSIONS_it	0x56d91	0xf4f
X509_EXTENSION_create_by_NID	0x610ba	0x21a
X509_EXTENSION_create_by_OBJ	0x61032	0x21b
X509_EXTENSION_dup	0x56e1a	0x21c
X509_EXTENSION_free	0x56dd6	0x21d
X509_EXTENSION_get_critical	0x6101e	0x21e
X509_EXTENSION_get_data	0x79fde	0x21f
X509_EXTENSION_get_object	0x61012	0x220
X509_EXTENSION_it	0x56d8b	0xa6b
X509_EXTENSION_new	0x56dc9	0x221
X509_EXTENSION_set_critical	0x60fcd	0x222
X509_EXTENSION_set_data	0x60fec	0x223
X509_EXTENSION_set_object	0x61441	0x224
X509_INFO_free	0x4fb5c	0x225
X509_INFO_new	0x4fb11	0x226
X509_LOOKUP_by_alias	0x61add	0x227
X509_LOOKUP_by_fingerprint	0x61ab1	0x228
X509_LOOKUP_by_issuer_serial	0x61a85	0x229
X509_LOOKUP_by_subject	0x61a57	0x22a
X509_LOOKUP_ctrl	0x61a25	0x22b
X509_LOOKUP_file	0x63010	0x22c
X509_LOOKUP_free	0x619c9	0x22d
X509_LOOKUP_hash_dir	0x63446	0x22e
X509_LOOKUP_init	0x619ed	0x22f
X509_LOOKUP_new	0x6197d	0x230
X509_LOOKUP_shutdown	0x61a09	0x231
X509_NAME_ENTRY_create_by_NID	0x60d42	0x232
X509_NAME_ENTRY_create_by_OBJ	0x60c09	0x233
X509_NAME_ENTRY_create_by_txt	0x60cda	0x817
X509_NAME_ENTRY_dup	0x4f05d	0x234
X509_NAME_ENTRY_free	0x4f04b	0x235
X509_NAME_ENTRY_get_data	0x6b3f4	0x236
X509_NAME_ENTRY_get_object	0x61012	0x237
X509_NAME_ENTRY_it	0x4f006	0xb73
X509_NAME_ENTRY_new	0x4f03e	0x238
X509_NAME_ENTRY_set_data	0x60ae6	0x239
X509_NAME_ENTRY_set_object	0x60a9b	0x23a
X509_NAME_add_entry	0x6098e	0x23b
X509_NAME_add_entry_by_NID	0x60d95	0x77a
X509_NAME_add_entry_by_OBJ	0x60c99	0x7d8
X509_NAME_add_entry_by_txt	0x60dd6	0x778
X509_NAME_cmp	0x5e2f6	0x23c
X509_NAME_delete_entry	0x608f4	0x23d
X509_NAME_digest	0x62863	0x23e
X509_NAME_dup	0x4f0d2	0x23f
X509_NAME_entry_count	0x60861	0x240
X509_NAME_free	0x4f0c0	0x241
X509_NAME_get_entry	0x608c3	0x242
X509_NAME_get_index_by_NID	0x60be5	0x243
X509_NAME_get_index_by_OBJ	0x60873	0x244
X509_NAME_get_text_by_NID	0x60c71	0x245
X509_NAME_get_text_by_OBJ	0x60b85	0x246
X509_NAME_hash	0x5e434	0x247
X509_NAME_it	0x4f07b	0xc3b
X509_NAME_new	0x4f0b3	0x248
X509_NAME_oneline	0x5e71b	0x249
X509_NAME_print	0x50b44	0x24a
X509_NAME_print_ex	0x4e020	0x97f
X509_NAME_print_ex_fp	0x4e054	0x97d
X509_NAME_set	0x4f3ed	0x24b
X509_OBJECT_free_contents	0x61d2b	0x24c
X509_OBJECT_idx_by_subject	0x61d4b	0x992
X509_OBJECT_retrieve_by_subject	0x61db9	0x24d
X509_OBJECT_retrieve_match	0x61de2	0x991
X509_OBJECT_up_ref_count	0x61ced	0x24e
X509_PKEY_free	0x56a98	0x24f
X509_PKEY_new	0x56a19	0x250
X509_POLICY_NODE_print	0x67dff	0xe98
X509_PUBKEY_free	0x4e346	0x251
X509_PUBKEY_get	0x4e6b3	0x252
X509_PUBKEY_it	0x4e301	0xa77
X509_PUBKEY_new	0x4e339	0x253
X509_PUBKEY_set	0x4e358	0x254
X509_PURPOSE_add	0x6867e	0x82a
X509_PURPOSE_cleanup	0x687c2	0x847
X509_PURPOSE_get0	0x685db	0x77b
X509_PURPOSE_get0_name	0x687f4	0x7db
X509_PURPOSE_get0_sname	0x36ef3	0x839
X509_PURPOSE_get_by_id	0x6863e	0x7c6
X509_PURPOSE_get_by_sname	0x68606	0x7a0
X509_PURPOSE_get_count	0x685c3	0x813
X509_PURPOSE_get_id	0x59659	0x7cd
X509_PURPOSE_get_trust	0x39fd1	0x7e6
X509_PURPOSE_set	0x68e88	0xc42
X509_REQ_INFO_free	0x4ec67	0x255
X509_REQ_INFO_it	0x4ec22	0xc43
X509_REQ_INFO_new	0x4ec5a	0x256
X509_REQ_add1_attr	0x5ecea	0x8a6
X509_REQ_add1_attr_by_NID	0x5ed2e	0x8a1
X509_REQ_add1_attr_by_OBJ	0x5ed06	0x8a4
X509_REQ_add1_attr_by_txt	0x5ed56	0x8a9
X509_REQ_add_extensions	0x5ecaa	0x759
X509_REQ_add_extensions_nid	0x5eb97	0x757
X509_REQ_check_private_key	0x5eac8	0xdbc
X509_REQ_delete_attr	0x61168	0x8a7
X509_REQ_digest	0x62844	0x93a
X509_REQ_dup	0x4ecd0	0x257
X509_REQ_extension_nid	0x5eb6b	0x753
X509_REQ_free	0x4ecbe	0x258
X509_REQ_get1_email	0x65fc0	0x963
X509_REQ_get_attr	0x61153	0x8a0
X509_REQ_get_attr_by_NID	0x5ecd0	0x89f
X509_REQ_get_attr_by_OBJ	0x6111f	0x8a2
X509_REQ_get_attr_count	0x5ecc0	0x8a5
X509_REQ_get_extension_nids	0x5eb87	0x755
X509_REQ_get_extensions	0x5ed7e	0x750
X509_REQ_get_pubkey	0x5eaad	0x259
X509_REQ_it	0x4ec79	0xb3f
X509_REQ_new	0x4ecb1	0x25a
X509_REQ_print	0x5053a	0x25b
X509_REQ_print_ex	0x5000f	0xca5
X509_REQ_print_fp	0x5054f	0x25c
X509_REQ_set_extension_nids	0x5eb8d	0x751
X509_REQ_set_pubkey	0x60815	0x25d
X509_REQ_set_subject_name	0x607f4	0x25e
X509_REQ_set_version	0x607da	0x25f
X509_REQ_sign	0x6234f	0x260
X509_REQ_to_X509	0x5df76	0x261
X509_REQ_verify	0x622c2	0x262
X509_REVOKED_add1_ext_i2d	0x6137e	0xc0f
X509_REVOKED_add_ext	0x61343	0x263
X509_REVOKED_delete_ext	0x61330	0x264
X509_REVOKED_free	0x4f9b1	0x265
X509_REVOKED_get_ext	0x6131d	0x266
X509_REVOKED_get_ext_by_NID	0x612d5	0x267
X509_REVOKED_get_ext_by_OBJ	0x612ed	0x268
X509_REVOKED_get_ext_by_critical	0x61305	0x269
X509_REVOKED_get_ext_count	0x612c7	0x26a
X509_REVOKED_get_ext_d2i	0x61362	0x775
X509_REVOKED_it	0x4f960	0xa52
X509_REVOKED_new	0x4f9a4	0x26b
X509_REVOKED_set_revocationDate	0x60763	0xa30
X509_REVOKED_set_serialNumber	0x607a0	0x9ef
X509_SIG_free	0x4ebef	0x26c
X509_SIG_it	0x4ebaa	0xb1f
X509_SIG_new	0x4ebe2	0x26d
X509_STORE_CTX_cleanup	0x5f7cc	0x26e
X509_STORE_CTX_free	0x5fac5	0x7b1
X509_STORE_CTX_get0_param	0x36ef3	0xdb1
X509_STORE_CTX_get0_policy_tree	0x5f87a	0xea4
X509_STORE_CTX_get1_chain	0x5f649	0x89c
X509_STORE_CTX_get1_issuer	0x62139	0x990
X509_STORE_CTX_get_chain	0x5f641	0x3f6
X509_STORE_CTX_get_current_cert	0x5f639	0x3f7
X509_STORE_CTX_get_error	0x5f625	0x3f8
X509_STORE_CTX_get_error_depth	0x482b8	0x3f9
X509_STORE_CTX_get_ex_data	0x5f611	0x3fa
X509_STORE_CTX_get_ex_new_index	0x5f5da	0x44c
X509_STORE_CTX_get_explicit_policy	0x482a4	0xdc4
X509_STORE_CTX_init	0x5ff77	0x26f
X509_STORE_CTX_new	0x5f76f	0x7f1
X509_STORE_CTX_purpose_inherit	0x5f6b1	0x7b8
X509_STORE_CTX_set0_crls	0x5f6a5	0xd05
X509_STORE_CTX_set0_param	0x5f8a1	0xd0d
X509_STORE_CTX_set_cert	0x39fe5	0x3fc
X509_STORE_CTX_set_chain	0x6c9fd	0x3fd
X509_STORE_CTX_set_default	0x5f882	0xe0b
X509_STORE_CTX_set_depth	0x5f835	0xd31
X509_STORE_CTX_set_error	0x5f62d	0x3fe
X509_STORE_CTX_set_ex_data	0x5f5f8	0x3ff
X509_STORE_CTX_set_flags	0x5f848	0x993
X509_STORE_CTX_set_purpose	0x5fa9b	0x810
X509_STORE_CTX_set_time	0x5f85b	0x98f
X509_STORE_CTX_set_trust	0x5fab0	0x7ee
X509_STORE_CTX_set_verify_cb	0x5f86e	0x9dc
X509_STORE_CTX_trusted_stack	0x5f7b9	0x994
X509_STORE_add_cert	0x61f97	0x270
X509_STORE_add_crl	0x62068	0x3bd
X509_STORE_add_lookup	0x61c85	0x271
X509_STORE_free	0x61c04	0x272
X509_STORE_get_by_subject	0x61ed7	0x273
X509_STORE_load_locations	0x5df02	0x274
X509_STORE_new	0x61b42	0x275
X509_STORE_set1_param	0x61ec4	0xe5c
X509_STORE_set_default_paths	0x5deac	0x276
X509_STORE_set_depth	0x61e88	0xdb4
X509_STORE_set_flags	0x61e75	0xa24
X509_STORE_set_purpose	0x61e9e	0x9ff
X509_STORE_set_trust	0x61eb1	0xa1a
X509_TRUST_add	0x62d5f	0x78b
X509_TRUST_cleanup	0x62e85	0x7d7
X509_TRUST_get0	0x62cb9	0x7ff
X509_TRUST_get0_name	0x7d2aa	0x7fe
X509_TRUST_get_by_id	0x62ce4	0x7e5
X509_TRUST_get_count	0x62ca1	0x83e
X509_TRUST_get_flags	0x39fd1	0x808
X509_TRUST_get_trust	0x59659	0x807
X509_TRUST_set	0x62d24	0xb11
X509_TRUST_set_default	0x62c91	0x889
X509_VAL_free	0x4e2d5	0x277
X509_VAL_it	0x4e290	0xb0d
X509_VAL_new	0x4e2c8	0x278
X509_VERIFY_PARAM_add0_policy	0x63a54	0xe44
X509_VERIFY_PARAM_add0_table	0x63b33	0xe77
X509_VERIFY_PARAM_clear_flags	0x639ff	0xebc
X509_VERIFY_PARAM_free	0x639a0	0xdc7
X509_VERIFY_PARAM_get_depth	0x7d2b2	0xde7
X509_VERIFY_PARAM_get_flags	0x7d2aa	0xec5
X509_VERIFY_PARAM_inherit	0x63c14	0xd32
X509_VERIFY_PARAM_lookup	0x63b9f	0xe4b
X509_VERIFY_PARAM_new	0x63979	0xd6d
X509_VERIFY_PARAM_set1	0x63cdc	0xe1a
X509_VERIFY_PARAM_set1_name	0x639b3	0xd55
X509_VERIFY_PARAM_set1_policies	0x63a83	0xd54
X509_VERIFY_PARAM_set_depth	0x63a38	0xd47
X509_VERIFY_PARAM_set_flags	0x639dc	0xd5d
X509_VERIFY_PARAM_set_purpose	0x63a10	0xd56
X509_VERIFY_PARAM_set_time	0x63a44	0xead
X509_VERIFY_PARAM_set_trust	0x63a24	0xda7
X509_VERIFY_PARAM_table_cleanup	0x63bf6	0xdc5
X509_add1_ext_i2d	0x612a5	0xa89
X509_add1_reject_object	0x4f872	0x822
X509_add1_trust_object	0x4f82e	0x85c
X509_add_ext	0x61266	0x279
X509_alias_get0	0x4f7d8	0x81a
X509_alias_set1	0x4f70a	0x78d
X509_asn1_meth	0x4f5c9	0x27a
X509_certificate_type	0x618a6	0x27b
X509_check_ca	0x68b2d	0xcd6
X509_check_issued	0x68d0d	0x996
X509_check_private_key	0x5e553	0x27c
X509_check_purpose	0x68e20	0x803
X509_check_trust	0x62f6e	0x823
X509_cmp	0x5e13c	0x857
X509_cmp_current_time	0x5ff69	0x27d
X509_cmp_time	0x5f909	0x98e
X509_delete_ext	0x61251	0x27e
X509_digest	0x62806	0x27f
X509_dup	0x4f5b7	0x280
X509_email_free	0x659c0	0x965
X509_find_by_issuer_and_serial	0x5e693	0x398
X509_find_by_subject	0x5e4d5	0x399
X509_free	0x4f5a5	0x281
X509_get0_pubkey_bitstr	0x5e541	0xa66
X509_get1_email	0x65f84	0x964
X509_get1_ocsp	0x65d7a	0xf50
X509_get_default_cert_area	0x5de8e	0x282
X509_get_default_cert_dir	0x5de94	0x283
X509_get_default_cert_dir_env	0x5dea0	0x284
X509_get_default_cert_file	0x5de9a	0x285
X509_get_default_cert_file_env	0x5dea6	0x286
X509_get_default_private_dir	0x5de88	0x287
X509_get_ex_data	0x4f606	0x79e
X509_get_ex_new_index	0x4f5cf	0x7e3
X509_get_ext	0x6123c	0x288
X509_get_ext_by_NID	0x611ee	0x289
X509_get_ext_by_OBJ	0x61208	0x28a
X509_get_ext_by_critical	0x61222	0x28b
X509_get_ext_count	0x611de	0x28c
X509_get_ext_d2i	0x61287	0x7a6
X509_get_issuer_name	0x5e128	0x28d
X509_get_pubkey	0x5e526	0x28e
X509_get_pubkey_parameters	0x5f506	0x28f
X509_get_serialNumber	0x39ff9	0x290
X509_get_subject_name	0x5e132	0x291
X509_gmtime_adj	0x5fa88	0x292
X509_issuer_and_serial_cmp	0x5e5f6	0x293
X509_issuer_and_serial_hash	0x5e068	0x294
X509_issuer_name_cmp	0x5e625	0x295
X509_issuer_name_hash	0x5e673	0x296
X509_it	0x4f560	0xad5
X509_keyid_get0	0x4f803	0xd23
X509_keyid_set1	0x4f771	0x99c
X509_load_cert_crl_file	0x632b2	0x7b4
X509_load_cert_file	0x63016	0x297
X509_load_crl_file	0x63164	0x3be
X509_new	0x4f598	0x298
X509_ocspid_print	0x505a4	0xae6
X509_policy_check	0x6b303	0xe88
X509_policy_level_get0_node	0x6b45e	0xdf0
X509_policy_level_node_count	0x6b436	0xd6a
X509_policy_node_get0_parent	0x6b3f4	0xd2b
X509_policy_node_get0_policy	0x6b48a	0xd87
X509_policy_node_get0_qualifiers	0x6b499	0xd78
X509_policy_tree_free	0x6aff3	0xd8a
X509_policy_tree_get0_level	0x6b401	0xe20
X509_policy_tree_get0_policies	0x2e58b	0xd35
X509_policy_tree_get0_user_policies	0x6b41f	0xe48
X509_policy_tree_level_count	0x6b3f4	0xdf5
X509_print	0x5113d	0x299
X509_print_ex	0x50c55	0x9f0
X509_print_ex_fp	0x510e0	0xbca
X509_print_fp	0x51152	0x29a
X509_pubkey_digest	0x627db	0xb4f
X509_reject_clear	0x4f8e0	0x888
X509_set_ex_data	0x4f5ed	0x776
X509_set_issuer_name	0x60539	0x29b
X509_set_notAfter	0x605c8	0x29c
X509_set_notBefore	0x6057b	0x29d
X509_set_pubkey	0x60618	0x29e
X509_set_serialNumber	0x604f6	0x29f
X509_set_subject_name	0x6055a	0x2a0
X509_set_version	0x60639	0x2a1
X509_sign	0x6231f	0x2a2
X509_signature_print	0x506e5	0xa92
X509_subject_name_cmp	0x5e63f	0x2a3
X509_subject_name_hash	0x5e683	0x2a4
X509_supported_extension	0x687fc	0xba1
X509_time_adj	0x5f4b3	0x995
X509_to_X509_REQ	0x5e9f2	0x2a5
X509_trust_clear	0x4f8b9	0x788
X509_verify	0x622a3	0x2a6
X509_verify_cert	0x60133	0x2a7
X509_verify_cert_error_string	0x62a85	0x2a8
X509at_add1_attr	0x613a3	0x895
X509at_add1_attr_by_NID	0x6186b	0x8a3
X509at_add1_attr_by_OBJ	0x6172e	0x8a8
X509at_add1_attr_by_txt	0x61769	0x8ab
X509at_delete_attr	0x60ef3	0x897
X509at_get0_data_by_OBJ	0x617a4	0xf5b
X509at_get_attr	0x60ecc	0x88d
X509at_get_attr_by_NID	0x615d6	0x894
X509at_get_attr_by_OBJ	0x60e26	0x898
X509at_get_attr_count	0x6139e	0x88e
X509v3_add_ext	0x60f1a	0x2a9
X509v3_delete_ext	0x60ef3	0x2b0
X509v3_get_ext	0x60ecc	0x2b1
X509v3_get_ext_by_NID	0x615d6	0x2b2
X509v3_get_ext_by_OBJ	0x60e26	0x2b3
X509v3_get_ext_by_critical	0x60e75	0x2b4
X509v3_get_ext_count	0x60e17	0x2b5
ZLONG_it	0x4eea5	0xadc
_ossl_096_des_random_seed	0x162d0	0xc93
_ossl_old_crypt	0x162b0	0x2c7
_ossl_old_des_cbc_cksum	0x16238	0xad8
_ossl_old_des_cbc_encrypt	0x16241	0xb40
_ossl_old_des_cfb64_encrypt	0x16306	0xc0e
_ossl_old_des_cfb_encrypt	0x1625c	0xb94
_ossl_old_des_crypt	0x162b0	0xa5e
_ossl_old_des_decrypt3	0x16279	0xa91
_ossl_old_des_ecb3_encrypt	0x1622f	0xb26
_ossl_old_des_ecb_encrypt	0x16265	0xc5b
_ossl_old_des_ede3_cbc_encrypt	0x1627e	0xaa9
_ossl_old_des_ede3_cfb64_encrypt	0x16287	0xae2
_ossl_old_des_ede3_ofb64_encrypt	0x16290	0xbc4
_ossl_old_des_enc_read	0x16299	0xa78
_ossl_old_des_enc_write	0x162a2	0xbce
_ossl_old_des_encrypt	0x1626a	0xa0a
_ossl_old_des_encrypt2	0x1626f	0xbb6
_ossl_old_des_encrypt3	0x16274	0xbb7
_ossl_old_des_fcrypt	0x162ab	0xb13
_ossl_old_des_is_weak_key	0x162f2	0xa10
_ossl_old_des_key_sched	0x162f7	0xa6a
_ossl_old_des_ncbc_encrypt	0x1624a	0xbdd
_ossl_old_des_ofb64_encrypt	0x1630f	0xa71
_ossl_old_des_ofb_encrypt	0x162b5	0xc10
_ossl_old_des_options	0x1622a	0xa34
_ossl_old_des_pcbc_encrypt	0x162be	0xbf0
_ossl_old_des_quad_cksum	0x162c7	0xbac
_ossl_old_des_random_key	0x162de	0xa06
_ossl_old_des_random_seed	0x162d0	0x323
_ossl_old_des_read_2passwords	0x162e8	0x324
_ossl_old_des_read_password	0x162e3	0x325
_ossl_old_des_read_pw	0x7a86c	0x326
_ossl_old_des_read_pw_string	0x7a867	0x327
_ossl_old_des_set_key	0x1029f	0xbf9
_ossl_old_des_set_odd_parity	0x162ed	0xb01
_ossl_old_des_string_to_2keys	0x16301	0xaa5
_ossl_old_des_string_to_key	0x162fc	0xaf8
_ossl_old_des_xcbc_encrypt	0x16253	0xc57
_shadow_DES_check_key	0xff90	0xc4a
_shadow_DES_rw_mode	0x11746	0xa15
a2d_ASN1_OBJECT	0x4a24a	0x2bb
a2i_ASN1_ENUMERATED	0x56588	0x4ba
a2i_ASN1_INTEGER	0x558c4	0x2bc
a2i_ASN1_STRING	0x55bdb	0x2bd
a2i_IPADDRESS	0x66049	0xd2f
a2i_IPADDRESS_NC	0x660ad	0xe94
a2i_ipadd	0x66009	0xee5
asc2uni	0x7231f	0x502
asn1_Finish	0x59477	0x2be
asn1_GetSequence	0x597e4	0x2bf
asn1_add_error	0x595f5	0x443
asn1_const_Finish	0x59477	0xe74
asn1_do_adb	0x550be	0xa16
asn1_do_lock	0x54f29	0xbf3
asn1_enc_free	0x54fc1	0xbb1
asn1_enc_init	0x54f9f	0xbe1
asn1_enc_restore	0x55053	0xb4b
asn1_enc_save	0x54ff4	0xbee
asn1_ex_c2i	0x53c6a	0xb48
asn1_ex_i2c	0x5351e	0xa67
asn1_get_choice_selector	0x54f02	0xbff
asn1_get_field_ptr	0x550a3	0xc35
asn1_set_choice_selector	0x54f13	0xc32
bn_add_words	0x2512f	0x40f
bn_div_words	0x25118	0x2c0
bn_dup_expand	0x209dd	0xb68
bn_expand2	0x20393	0x2c1
bn_mul_add_words	0x24c00	0x2c2
bn_mul_words	0x24ec0	0x2c3
bn_sqr_words	0x25013	0x2c6
bn_sub_words	0x252ef	0x45c
c2i_ASN1_BIT_STRING	0x4a947	0x975
c2i_ASN1_INTEGER	0x4b481	0x978
c2i_ASN1_OBJECT	0x4a700	0x97c
d2i_ACCESS_DESCRIPTION	0x68ec9	0x787
d2i_ASN1_BIT_STRING	0x551fa	0x2c8
d2i_ASN1_BMPSTRING	0x55614	0x444
d2i_ASN1_BOOLEAN	0x56d10	0x2c9
d2i_ASN1_ENUMERATED	0x551a3	0x4b4
d2i_ASN1_GENERALIZEDTIME	0x5550f	0x4a6
d2i_ASN1_GENERALSTRING	0x55461	0xb06
d2i_ASN1_HEADER	0x568d9	0x2ca
d2i_ASN1_IA5STRING	0x5540a	0x2cb
d2i_ASN1_INTEGER	0x5514c	0x2cc
d2i_ASN1_NULL	0x552a8	0x879
d2i_ASN1_OBJECT	0x4a812	0x2cd
d2i_ASN1_OCTET_STRING	0x55251	0x2ce
d2i_ASN1_PRINTABLE	0x556c8	0x2cf
d2i_ASN1_PRINTABLESTRING	0x5535c	0x2d0
d2i_ASN1_SET	0x4bd2c	0x2d1
d2i_ASN1_T61STRING	0x553b3	0x2d2
d2i_ASN1_TIME	0x4b1ad	0x4a7
d2i_ASN1_TYPE	0x55671	0x2d3
d2i_ASN1_UINTEGER	0x4b5da	0x674
d2i_ASN1_UNIVERSALSTRING	0x555bd	0xca3
d2i_ASN1_UTCTIME	0x554b8	0x2d4
d2i_ASN1_UTF8STRING	0x55305	0x53e
d2i_ASN1_VISIBLESTRING	0x55566	0x53c
d2i_ASN1_bytes	0x59ab6	0x2d5
d2i_ASN1_type_bytes	0x598e4	0x2d6
d2i_AUTHORITY_INFO_ACCESS	0x68f20	0x77e
d2i_AUTHORITY_KEYID	0x6955e	0x4e7
d2i_AutoPrivateKey	0x4fec6	0x88a
d2i_BASIC_CONSTRAINTS	0x63d05	0x4a8
d2i_CERTIFICATEPOLICIES	0x677e7	0x5cf
d2i_CRL_DIST_POINTS	0x68479	0x604
d2i_DHparams	0x2f380	0x2d7
d2i_DIRECTORYSTRING	0x55776	0x540
d2i_DISPLAYTEXT	0x5571f	0x542
d2i_DIST_POINT	0x68422	0x607
d2i_DIST_POINT_NAME	0x683cb	0x60c
d2i_DSAPrivateKey	0x2da63	0x2d8
d2i_DSAPrivateKey_bio	0x626b5	0x2d9
d2i_DSAPrivateKey_fp	0x62653	0x2da
d2i_DSAPublicKey	0x2dad9	0x2db
d2i_DSA_PUBKEY	0x4ea42	0x802
d2i_DSA_PUBKEY_bio	0x626e6	0x82d
d2i_DSA_PUBKEY_fp	0x62684	0x7f9
d2i_DSA_SIG	0x2d9f1	0x539
d2i_DSAparams	0x2da9b	0x2dc
d2i_ECDSA_SIG	0x3919e	0xe85
d2i_ECPKParameters	0x361f2	0xd93
d2i_ECParameters	0x3672f	0xe95
d2i_ECPrivateKey	0x362f2	0xdeb
d2i_ECPrivateKey_bio	0x627aa	0xde4
d2i_ECPrivateKey_fp	0x62748	0xe59
d2i_EC_PUBKEY	0x4eaf6	0xd61
d2i_EC_PUBKEY_bio	0x62779	0xe7b
d2i_EC_PUBKEY_fp	0x62717	0xea7
d2i_EDIPARTYNAME	0x661f7	0xafe
d2i_EXTENDED_KEY_USAGE	0x6485a	0xa72
d2i_GENERAL_NAME	0x6624e	0x4bc
d2i_GENERAL_NAMES	0x662a5	0x4c1
d2i_KRB5_APREQ	0x7aa2e	0xa1c
d2i_KRB5_APREQBODY	0x7a9d7	0xa75
d2i_KRB5_AUTHDATA	0x7ab33	0xa7d
d2i_KRB5_AUTHENT	0x7abe1	0xa0d
d2i_KRB5_AUTHENTBODY	0x7ab8a	0xb18
d2i_KRB5_CHECKSUM	0x7aa85	0xad3
d2i_KRB5_ENCDATA	0x7a87b	0xbe6
d2i_KRB5_ENCKEY	0x7aadc	0xb55
d2i_KRB5_PRINCNAME	0x7a8d2	0xafa
d2i_KRB5_TICKET	0x7a980	0xb03
d2i_KRB5_TKTBODY	0x7a929	0xb88
d2i_NETSCAPE_CERT_SEQUENCE	0x4fc91	0x4a9
d2i_NETSCAPE_SPKAC	0x4fbc6	0x2dd
d2i_NETSCAPE_SPKI	0x4fc1d	0x2de
d2i_NOTICEREF	0x67949	0x5de
d2i_Netscape_RSA	0x564b3	0x2df
d2i_OCSP_BASICRESP	0x76d8f	0x9e2
d2i_OCSP_CERTID	0x769d2	0xb33
d2i_OCSP_CERTSTATUS	0x76c8a	0x9ee
d2i_OCSP_CRLID	0x76de6	0xad0
d2i_OCSP_ONEREQ	0x76a29	0xc50
d2i_OCSP_REQINFO	0x76a80	0xc4b
d2i_OCSP_REQUEST	0x76ad7	0xa58
d2i_OCSP_RESPBYTES	0x76b2e	0x9e7
d2i_OCSP_RESPDATA	0x76d38	0xb99
d2i_OCSP_RESPID	0x76bdc	0xa8e
d2i_OCSP_RESPONSE	0x76b85	0xbcc
d2i_OCSP_REVOKEDINFO	0x76c33	0xa27
d2i_OCSP_SERVICELOC	0x76e3d	0xaff
d2i_OCSP_SIGNATURE	0x7697b	0xb39
d2i_OCSP_SINGLERESP	0x76ce1	0xa6e
d2i_OTHERNAME	0x661a0	0x830
d2i_PBE2PARAM	0x5a73e	0x57b
d2i_PBEPARAM	0x5a592	0x520
d2i_PBKDF2PARAM	0x5a795	0x577
d2i_PKCS12	0x70970	0x509
d2i_PKCS12_BAGS	0x70a24	0x506
d2i_PKCS12_MAC_DATA	0x709c7	0x50e
d2i_PKCS12_SAFEBAG	0x70a81	0x512
d2i_PKCS12_bio	0x72412	0x51c
d2i_PKCS12_fp	0x72429	0x51d
d2i_PKCS7	0x6d5c0	0x2e0
d2i_PKCS7_DIGEST	0x6d92c	0x2e1
d2i_PKCS7_ENCRYPT	0x6d8d5	0x2e2
d2i_PKCS7_ENC_CONTENT	0x6d827	0x2e3
d2i_PKCS7_ENVELOPE	0x6d75f	0x2e4
d2i_PKCS7_ISSUER_AND_SERIAL	0x6d708	0x2e5
d2i_PKCS7_RECIP_INFO	0x6d7d0	0x2e6
d2i_PKCS7_SIGNED	0x6d640	0x2e7
d2i_PKCS7_SIGNER_INFO	0x6d6b1	0x2e8
d2i_PKCS7_SIGN_ENVELOPE	0x6d87e	0x2e9
d2i_PKCS7_bio	0x624af	0x2ea
d2i_PKCS7_fp	0x62481	0x2eb
d2i_PKCS8PrivateKey_bio	0x5d6b0	0x877
d2i_PKCS8PrivateKey_fp	0x5d79c	0x87f
d2i_PKCS8_PRIV_KEY_INFO	0x5aaf3	0x524
d2i_PKCS8_PRIV_KEY_INFO_bio	0x629c4	0x6f7
d2i_PKCS8_PRIV_KEY_INFO_fp	0x62903	0x6f4
d2i_PKCS8_bio	0x628d2	0x6f3
d2i_PKCS8_fp	0x628a1	0x6f8
d2i_PKEY_USAGE_PERIOD	0x6726c	0x4d1
d2i_POLICYINFO	0x6783e	0x5d2
d2i_POLICYQUALINFO	0x6789b	0x5d6
d2i_PROXY_CERT_INFO_EXTENSION	0x69c76	0xce4
d2i_PROXY_POLICY	0x69c1f	0xce8
d2i_PUBKEY	0x4e8fa	0x806
d2i_PUBKEY_bio	0x62a6a	0x989
d2i_PUBKEY_fp	0x629a9	0x98d
d2i_PrivateKey	0x4fdd3	0x2ec
d2i_PrivateKey_bio	0x62a39	0x885
d2i_PrivateKey_fp	0x62978	0x886
d2i_PublicKey	0x4fce2	0x2ed
d2i_RSAPrivateKey	0x2ca0f	0x2ee
d2i_RSAPrivateKey_bio	0x625c6	0x2ef
d2i_RSAPrivateKey_fp	0x62539	0x2f0
d2i_RSAPublicKey	0x2ca41	0x2f1
d2i_RSAPublicKey_bio	0x625f4	0x3b1
d2i_RSAPublicKey_fp	0x62567	0x3b8
d2i_RSA_NET	0x563b5	0x968
d2i_RSA_PUBKEY	0x4e98e	0x7fc
d2i_RSA_PUBKEY_bio	0x6260b	0x805
d2i_RSA_PUBKEY_fp	0x6257e	0x7ac
d2i_SXNET	0x673da	0x52e
d2i_SXNETID	0x67383	0x532
d2i_USERNOTICE	0x678f2	0x5da
d2i_X509	0x4f566	0x2f2
d2i_X509_ALGOR	0x4e154	0x2f3
d2i_X509_ALGORS	0x4e1a5	0xf61
d2i_X509_ATTRIBUTE	0x4ecee	0x2f4
d2i_X509_AUX	0x4f61a	0x7bc
d2i_X509_CERT_AUX	0x4f69c	0x843
d2i_X509_CERT_PAIR	0x4f90f	0xe72
d2i_X509_CINF	0x4f467	0x2f5
d2i_X509_CRL	0x4fa14	0x2f6
d2i_X509_CRL_INFO	0x4f9c3	0x2f7
d2i_X509_CRL_bio	0x62453	0x2f8
d2i_X509_CRL_fp	0x62425	0x2f9
d2i_X509_EXTENSION	0x56d97	0x2fa
d2i_X509_EXTENSIONS	0x56de8	0xf55
d2i_X509_NAME	0x4f081	0x2fb
d2i_X509_NAME_ENTRY	0x4f00c	0x2fc
d2i_X509_PKEY	0x56b06	0x2fd
d2i_X509_PUBKEY	0x4e307	0x2fe
d2i_X509_REQ	0x4ec7f	0x2ff
d2i_X509_REQ_INFO	0x4ec28	0x300
d2i_X509_REQ_bio	0x6250b	0x301
d2i_X509_REQ_fp	0x624dd	0x302
d2i_X509_REVOKED	0x4f972	0x303
d2i_X509_SIG	0x4ebb0	0x304
d2i_X509_VAL	0x4e296	0x305
d2i_X509_bio	0x623f7	0x306
d2i_X509_fp	0x623c9	0x307
get_rfc2409_prime_1024	0x294f5	0xebd
get_rfc2409_prime_768	0x294e1	0xec4
get_rfc3526_prime_1536	0x2950c	0xec1
get_rfc3526_prime_2048	0x29523	0xebf
get_rfc3526_prime_3072	0x2953a	0xec2
get_rfc3526_prime_4096	0x29551	0xec3
get_rfc3526_prime_6144	0x29568	0xec0
get_rfc3526_prime_8192	0x2957f	0xebb
hex_to_string	0x65783	0x4c7
i2a_ACCESS_DESCRIPTION	0x69234	0xc26
i2a_ASN1_ENUMERATED	0x564ce	0x4b9
i2a_ASN1_INTEGER	0x557df	0x32f
i2a_ASN1_OBJECT	0x4a55c	0x330
i2a_ASN1_STRING	0x55b21	0x331
i2c_ASN1_BIT_STRING	0x4a893	0x976
i2c_ASN1_INTEGER	0x4b377	0x979
i2d_ACCESS_DESCRIPTION	0x68ee4	0x81d
i2d_ASN1_BIT_STRING	0x55215	0x332
i2d_ASN1_BMPSTRING	0x5562f	0x445
i2d_ASN1_BOOLEAN	0x56cbf	0x333
i2d_ASN1_ENUMERATED	0x551be	0x4b3
i2d_ASN1_GENERALIZEDTIME	0x5552a	0x4ad
i2d_ASN1_GENERALSTRING	0x5547c	0xa00
i2d_ASN1_HEADER	0x567e2	0x334
i2d_ASN1_IA5STRING	0x55425	0x335
i2d_ASN1_INTEGER	0x55167	0x336
i2d_ASN1_NULL	0x552c3	0x87d
i2d_ASN1_OBJECT	0x4a1dc	0x337
i2d_ASN1_OCTET_STRING	0x5526c	0x338
i2d_ASN1_PRINTABLE	0x556e3	0x339
i2d_ASN1_PRINTABLESTRING	0x55377	0x865
i2d_ASN1_SET	0x4bb3a	0x33a
i2d_ASN1_T61STRING	0x553ce	0xc67
i2d_ASN1_TIME	0x4b1c8	0x4ae
i2d_ASN1_TYPE	0x5568c	0x33b
i2d_ASN1_UNIVERSALSTRING	0x555d8	0xca0
i2d_ASN1_UTCTIME	0x554d3	0x33c
i2d_ASN1_UTF8STRING	0x55320	0x53d
i2d_ASN1_VISIBLESTRING	0x55581	0x53b
i2d_ASN1_bytes	0x59a28	0x33d
i2d_AUTHORITY_INFO_ACCESS	0x68f3b	0x80e
i2d_AUTHORITY_KEYID	0x69579	0x4e6
i2d_BASIC_CONSTRAINTS	0x63d20	0x4af
i2d_CERTIFICATEPOLICIES	0x67802	0x5cc
i2d_CRL_DIST_POINTS	0x68494	0x601
i2d_DHparams	0x2f39b	0x33e
i2d_DIRECTORYSTRING	0x55791	0x53f
i2d_DISPLAYTEXT	0x5573a	0x541
i2d_DIST_POINT	0x6843d	0x605
i2d_DIST_POINT_NAME	0x683e6	0x609
i2d_DSAPrivateKey	0x2da7e	0x33f
i2d_DSAPrivateKey_bio	0x626d0	0x340
i2d_DSAPrivateKey_fp	0x6266e	0x341
i2d_DSAPublicKey	0x2daf4	0x342
i2d_DSA_PUBKEY	0x4ea9c	0x7bd
i2d_DSA_PUBKEY_bio	0x62701	0x7de
i2d_DSA_PUBKEY_fp	0x6269f	0x7b3
i2d_DSA_SIG	0x2da0c	0x53a
i2d_DSAparams	0x2dab6	0x343
i2d_ECDSA_SIG	0x391b9	0xe23
i2d_ECPKParameters	0x36282	0xd91
i2d_ECParameters	0x366fa	0xd90
i2d_ECPrivateKey	0x364bc	0xd1d
i2d_ECPrivateKey_bio	0x627c5	0xd7c
i2d_ECPrivateKey_fp	0x62763	0xe47
i2d_EC_PUBKEY	0x4eb50	0xdc1
i2d_EC_PUBKEY_bio	0x62794	0xe01
i2d_EC_PUBKEY_fp	0x62732	0xe75
i2d_EDIPARTYNAME	0x66212	0xb5c
i2d_EXTENDED_KEY_USAGE	0x64875	0xbec
i2d_GENERAL_NAME	0x66269	0x4bb
i2d_GENERAL_NAMES	0x662c0	0x4c2
i2d_KRB5_APREQ	0x7aa49	0xa09
i2d_KRB5_APREQBODY	0x7a9f2	0xb25
i2d_KRB5_AUTHDATA	0x7ab4e	0xba2
i2d_KRB5_AUTHENT	0x7abfc	0xa6c
i2d_KRB5_AUTHENTBODY	0x7aba5	0xc38
i2d_KRB5_CHECKSUM	0x7aaa0	0xc00
i2d_KRB5_ENCDATA	0x7a896	0xc41
i2d_KRB5_ENCKEY	0x7aaf7	0xc14
i2d_KRB5_PRINCNAME	0x7a8ed	0xbb5
i2d_KRB5_TICKET	0x7a99b	0xbc9
i2d_KRB5_TKTBODY	0x7a944	0xbde
i2d_NETSCAPE_CERT_SEQUENCE	0x4fcac	0x4b0
i2d_NETSCAPE_SPKAC	0x4fbe1	0x344
i2d_NETSCAPE_SPKI	0x4fc38	0x345
i2d_NOTICEREF	0x67964	0x5dc
i2d_Netscape_RSA	0x5639e	0x346
i2d_OCSP_BASICRESP	0x76daa	0xab8
i2d_OCSP_CERTID	0x769ed	0xbfc
i2d_OCSP_CERTSTATUS	0x76ca5	0xb8b
i2d_OCSP_CRLID	0x76e01	0xac5
i2d_OCSP_ONEREQ	0x76a44	0xa95
i2d_OCSP_REQINFO	0x76a9b	0xa1f
i2d_OCSP_REQUEST	0x76af2	0xab2
i2d_OCSP_RESPBYTES	0x76b49	0xab9
i2d_OCSP_RESPDATA	0x76d53	0xa45
i2d_OCSP_RESPID	0x76bf7	0xb52
i2d_OCSP_RESPONSE	0x76ba0	0xa7a
i2d_OCSP_REVOKEDINFO	0x76c4e	0xb4a
i2d_OCSP_SERVICELOC	0x76e58	0xa02
i2d_OCSP_SIGNATURE	0x76996	0xbed
i2d_OCSP_SINGLERESP	0x76cfc	0xbf6
i2d_OTHERNAME	0x661bb	0x7df
i2d_PBE2PARAM	0x5a759	0x579
i2d_PBEPARAM	0x5a5ad	0x51e
i2d_PBKDF2PARAM	0x5a7b0	0x575
i2d_PKCS12	0x7098b	0x508
i2d_PKCS12_BAGS	0x70a3f	0x504
i2d_PKCS12_MAC_DATA	0x709e2	0x50c
i2d_PKCS12_SAFEBAG	0x70a9c	0x510
i2d_PKCS12_bio	0x723e4	0x51a
i2d_PKCS12_fp	0x723fb	0x51b
i2d_PKCS7	0x6d5db	0x347
i2d_PKCS7_DIGEST	0x6d947	0x348
i2d_PKCS7_ENCRYPT	0x6d8f0	0x349
i2d_PKCS7_ENC_CONTENT	0x6d842	0x34a
i2d_PKCS7_ENVELOPE	0x6d77a	0x34b
i2d_PKCS7_ISSUER_AND_SERIAL	0x6d723	0x34c
i2d_PKCS7_NDEF	0x6d611	0xdf1
i2d_PKCS7_RECIP_INFO	0x6d7eb	0x34d
i2d_PKCS7_SIGNED	0x6d65b	0x34e
i2d_PKCS7_SIGNER_INFO	0x6d6cc	0x34f
i2d_PKCS7_SIGN_ENVELOPE	0x6d899	0x350
i2d_PKCS7_bio	0x624c6	0x351
i2d_PKCS7_fp	0x62498	0x352
i2d_PKCS8PrivateKeyInfo_bio	0x629f5	0x882
i2d_PKCS8PrivateKeyInfo_fp	0x62934	0x881
i2d_PKCS8PrivateKey_bio	0x5db07	0x87b
i2d_PKCS8PrivateKey_fp	0x5db53	0x87c
i2d_PKCS8PrivateKey_nid_bio	0x5db2d	0x880
i2d_PKCS8PrivateKey_nid_fp	0x5db79	0x87e
i2d_PKCS8_PRIV_KEY_INFO	0x5ab0e	0x522
i2d_PKCS8_PRIV_KEY_INFO_bio	0x629df	0x700
i2d_PKCS8_PRIV_KEY_INFO_fp	0x6291e	0x6ff
i2d_PKCS8_bio	0x628ed	0x6fe
i2d_PKCS8_fp	0x628bc	0x6f1
i2d_PKEY_USAGE_PERIOD	0x67287	0x4d0
i2d_POLICYINFO	0x67859	0x5d0
i2d_POLICYQUALINFO	0x678b6	0x5d4
i2d_PROXY_CERT_INFO_EXTENSION	0x69c91	0xce7
i2d_PROXY_POLICY	0x69c3a	0xce6
i2d_PUBKEY	0x4e945	0x7c3
i2d_PUBKEY_bio	0x62a54	0x987
i2d_PUBKEY_fp	0x62993	0x988
i2d_PrivateKey	0x4ffad	0x353
i2d_PrivateKey_bio	0x62a23	0x887
i2d_PrivateKey_fp	0x62962	0x884
i2d_PublicKey	0x4ff4b	0x354
i2d_RSAPrivateKey	0x2ca2a	0x355
i2d_RSAPrivateKey_bio	0x625dd	0x356
i2d_RSAPrivateKey_fp	0x62550	0x357
i2d_RSAPublicKey	0x2ca5c	0x358
i2d_RSAPublicKey_bio	0x62626	0x3b2
i2d_RSAPublicKey_fp	0x62599	0x3ba
i2d_RSA_NET	0x55ea8	0x966
i2d_RSA_PUBKEY	0x4e9e8	0x7b6
i2d_RSA_PUBKEY_bio	0x6263d	0x7c1
i2d_RSA_PUBKEY_fp	0x625b0	0x841
i2d_SXNET	0x673f5	0x52d
i2d_SXNETID	0x6739e	0x531
i2d_USERNOTICE	0x6790d	0x5d8
i2d_X509	0x4f581	0x359
i2d_X509_ALGOR	0x4e16f	0x35a
i2d_X509_ALGORS	0x4e1c0	0xf5e
i2d_X509_ATTRIBUTE	0x4ed09	0x35b
i2d_X509_AUX	0x4f669	0x854
i2d_X509_CERT_AUX	0x4f6b7	0x7ec
i2d_X509_CERT_PAIR	0x4f92a	0xe3a
i2d_X509_CINF	0x4f482	0x35c
i2d_X509_CRL	0x4fa2f	0x35d
i2d_X509_CRL_INFO	0x4f9de	0x35e
i2d_X509_CRL_bio	0x6246a	0x35f
i2d_X509_CRL_fp	0x6243c	0x360
i2d_X509_EXTENSION	0x56db2	0x361
i2d_X509_EXTENSIONS	0x56e03	0xf52
i2d_X509_NAME	0x4f09c	0x362
i2d_X509_NAME_ENTRY	0x4f027	0x363
i2d_X509_PKEY	0x2e3de	0x364
i2d_X509_PUBKEY	0x4e322	0x365
i2d_X509_REQ	0x4ec9a	0x366
i2d_X509_REQ_INFO	0x4ec43	0x367
i2d_X509_REQ_bio	0x62522	0x368
i2d_X509_REQ_fp	0x624f4	0x369
i2d_X509_REVOKED	0x4f98d	0x36a
i2d_X509_SIG	0x4ebcb	0x36b
i2d_X509_VAL	0x4e2b1	0x36c
i2d_X509_bio	0x6240e	0x36d
i2d_X509_fp	0x623e0	0x36e
i2o_ECPublicKey	0x3684d	0xd2d
i2s_ASN1_ENUMERATED	0x653c0	0x4d9
i2s_ASN1_ENUMERATED_TABLE	0x67346	0x4da
i2s_ASN1_INTEGER	0x65412	0x4d5
i2s_ASN1_OCTET_STRING	0x66e1f	0x4c4
i2t_ASN1_OBJECT	0x4a545	0x3d3
i2v_ASN1_BIT_STRING	0x63e5a	0xe37
i2v_GENERAL_NAME	0x662f6	0x4ce
i2v_GENERAL_NAMES	0x66944	0x4c3
idea_cbc_encrypt	0x17cbf	0x36f
idea_cfb64_encrypt	0x180c3	0x370
idea_ecb_encrypt	0x18417	0x371
idea_encrypt	0x174a2	0x372
idea_ofb64_encrypt	0x1828d	0x373
idea_options	0x18411	0x374
idea_set_decrypt_key	0x18668	0x375
idea_set_encrypt_key	0x184b6	0x376
int_CRYPTO_set_do_dynlock_callback	0x132f	0xfd9
int_smime_write_ASN1	0x56ff5	0xf8b
lh_delete	0x3fba1	0x377
lh_doall	0x3f81c	0x378
lh_doall_arg	0x3f834	0x379
lh_free	0x3f79d	0x37a
lh_insert	0x3fb25	0x37b
lh_new	0x3fa67	0x37c
lh_node_stats	0x3fe42	0x37d
lh_node_stats_bio	0x3fd20	0x37e
lh_node_usage_stats	0x3fe78	0x37f
lh_node_usage_stats_bio	0x3fd5a	0x380
lh_num_items	0x3fa58	0x8d1
lh_retrieve	0x3fbfe	0x381
lh_stats	0x3fe0c	0x382
lh_stats_bio	0x3fc2a	0x383
lh_strhash	0x3fa0e	0x384
ms_time_cmp	0x34b1	0x47f
ms_time_diff	0x344c	0x47c
ms_time_free	0x7d679	0x47e
ms_time_get	0x3424	0x480
ms_time_new	0x33ee	0x47d
name_cmp	0x65987	0x4d7
o2i_ECPublicKey	0x367b4	0xd28
pitem_free	0x7d679	0xeb7
pitem_new	0x7d64a	0xd25
pqueue_find	0x7d718	0xd7e
pqueue_free	0x7d679	0xe78
pqueue_insert	0x7d6b1	0xeb6
pqueue_iterator	0x7d785	0xd42
pqueue_new	0x7d686	0xeae
pqueue_next	0x7d78a	0xeaa
pqueue_peek	0x59659	0xd84
pqueue_pop	0x7d708	0xe3f
pqueue_print	0x7d760	0xd64
pqueue_size	0x7d7a1	0x1012
s2i_ASN1_INTEGER	0x65464	0x5e5
s2i_ASN1_OCTET_STRING	0x66e30	0x4c5
sk_delete	0x3f4cf	0x385
sk_delete_ptr	0x3f6b2	0x386
sk_dup	0x3f63c	0x387
sk_find	0x3f748	0x388
sk_find_ex	0x3f75a	0xdd8
sk_free	0x3f594	0x389
sk_insert	0x3f446	0x38a
sk_is_sorted	0x3f62e	0xcd5
sk_new	0x3f3e4	0x38b
sk_new_null	0x3f6a9	0x96b
sk_num	0x3f5b4	0x676
sk_pop	0x3f553	0x38c
sk_pop_free	0x3f76c	0x38d
sk_push	0x3f511	0x38e
sk_set	0x3f5e1	0x677
sk_set_cmp_func	0x3f3cd	0x38f
sk_shift	0x3f538	0x390
sk_sort	0x3f603	0x687
sk_unshift	0x3f525	0x391
sk_value	0x3f5c3	0x675
sk_zero	0x3f56f	0x392
string_to_hex	0x65803	0x4c8
uni2asc	0x7238e	0x503
v2i_ASN1_BIT_STRING	0x63e96	0xe08
v2i_GENERAL_NAME	0x66ba7	0x4cf
v2i_GENERAL_NAMES	0x66d9a	0x4d4
v2i_GENERAL_NAME_ex	0x6698f	0xe1c

c:\windows\temp\trfo-2.dll

Created File

Binary

Blacklisted

Mime Type	application/x-dosexec
File Size	29.00 KB
MD5	3e89c56056e5525bf4d9e52b28fbbca7
SHA1	08f93ab25190a44c4e29bee5e8aacecc90dab80c
SHA256	b2a3172a1d676f00a62df376d8da805714553bb3221a8426f9823a8a5887daaa
SSDeep	768:NluruFqeE4KRu8B/4VHNaEoPw6HtFhCC48qkfg:Nlu0EDRTl4VHkw6NLA8
ImpHash	5f4323fd2ad75a83e642205dc50294b4

File Reputation Information

Severity	Blacklisted
First Seen	2017-04-15 03:02 (UTC+2)
Last Seen	2018-10-15 09:20 (UTC+2)
Names	Win32.Trojan.Shadowbrokers
Families	Shadowbrokers
Classification	Trojan

PE Information

Image Base	0x10000000
Entry Point	0x10006040
Size Of Code	0x5600
Size Of Initialized Data	0x1e00
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:51:38+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x5526	0x5600	0x400	cnt_code, mem_execute, mem_read	6.69
.rdata	0x10007000	0xfa7	0x1000	0x5a00	cnt_initialized_data, mem_read	5.31
.data	0x10008000	0x7e4	0x400	0x6a00	cnt_initialized_data, mem_read, mem_write	6.4
.reloc	0x10009000	0x5e6	0x600	0x6e00	cnt_initialized_data, mem_discardable, mem_read	3.57

Imports (5)

KERNEL32.dll (14)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetVersion	0x0	0x10007000	0x767c	0x607c	0x192
GetCurrentProcessId	0x0	0x10007004	0x7680	0x6080	0x10e
GetCurrentThreadId	0x0	0x10007008	0x7684	0x6084	0x110
GetTickCount	0x0	0x1000700c	0x7688	0x6088	0x18a
QueryPerformanceCounter	0x0	0x10007010	0x768c	0x608c	0x22f
SetUnhandledExceptionFilter	0x0	0x10007014	0x7690	0x6090	0x2bc
UnhandledExceptionFilter	0x0	0x10007018	0x7694	0x6094	0x2df
GetCurrentProcess	0x0	0x1000701c	0x7698	0x6098	0x10d
TerminateProcess	0x0	0x10007020	0x769c	0x609c	0x2cf
InterlockedCompareExchange	0x0	0x10007024	0x76a0	0x60a0	0x1cb
Sleep	0x0	0x10007028	0x76a4	0x60a4	0x2c7
InterlockedExchange	0x0	0x1000702c	0x76a8	0x60a8	0x1cd
RtlUnwind	0x0	0x10007030	0x76ac	0x60ac	0x25b
GetSystemTimeAsFileTime	0x0	0x10007034	0x76b0	0x60b0	0x17a

posh-0.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
POSH_SwapU32	0x0	0x100070c8	0x7744	0x6144	0x11

ucl.dll (4)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ucl_crc32	0x0	0x100070d0	0x774c	0x614c	0x45
ucl_nrv2d_99_compress	0x0	0x100070d4	0x7750	0x6150	0x58
__ucl_init2	0x0	0x100070d8	0x7754	0x6154	0x1
ucl_nrv2d_decompress_8	0x0	0x100070dc	0x7758	0x6158	0x59

WS2_32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
htonl	0x8	0x1000703c	0x76b8	0x60b8	-

msvcrt.dll (32)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_iob	0x0	0x10007044	0x76c0	0x60c0	0x1db
calloc	0x0	0x10007048	0x76c4	0x60c4	0x485
memcpy	0x0	0x1000704c	0x76c8	0x60c8	0x4ea
memset	0x0	0x10007050	0x76cc	0x60cc	0x4ee
tolower	0x0	0x10007054	0x76d0	0x60d0	0x539
memmove	0x0	0x10007058	0x76d4	0x60d4	0x4ec
pow	0x0	0x1000705c	0x76d8	0x60d8	0x4f2
free	0x0	0x10007060	0x76dc	0x60dc	0x4a6
srand	0x0	0x10007064	0x76e0	0x60e0	0x50e
time	0x0	0x10007068	0x76e4	0x60e4	0x534
fread	0x0	0x1000706c	0x76e8	0x60e8	0x4a5
ftell	0x0	0x10007070	0x76ec	0x60ec	0x4ae
fclose	0x0	0x10007074	0x76f0	0x60f0	0x492
fseek	0x0	0x10007078	0x76f4	0x60f4	0x4ac
fwrite	0x0	0x1000707c	0x76f8	0x60f8	0x4b1
fgets	0x0	0x10007080	0x76fc	0x60fc	0x498
_snprintf	0x0	0x10007084	0x7700	0x6100	0x32f
floor	0x0	0x10007088	0x7704	0x6104	0x49b
rand	0x0	0x1000708c	0x7708	0x6108	0x4fd
_ftime	0x0	0x10007090	0x770c	0x610c	0x18e
malloc	0x0	0x10007094	0x7710	0x6110	0x4de
sscanf	0x0	0x10007098	0x7714	0x6114	0x50f
strcspn	0x0	0x1000709c	0x7718	0x6118	0x518
strcat	0x0	0x100070a0	0x771c	0x611c	0x511
sprintf	0x0	0x100070a4	0x7720	0x6120	0x50b
strlen	0x0	0x100070a8	0x7724	0x6124	0x51c
_XcptFilter	0x0	0x100070ac	0x7728	0x6128	0x6a
_initterm	0x0	0x100070b0	0x772c	0x612c	0x1d5
_amsg_exit	0x0	0x100070b4	0x7730	0x6130	0x101
_adjust_fdiv	0x0	0x100070b8	0x7734	0x6134	0xf5
strncmp	0x0	0x100070bc	0x7738	0x6138	0x51f
fopen	0x0	0x100070c0	0x773c	0x613c	0x49d

Exports (51)

Api name	EAT Address	Ordinal
TfBase64Decode	0x102d	0x1
TfBase64Encode	0x1194	0x2
TfBuildPatternString	0x16f7	0x3
TfBuildPatternUnicodeString	0x170b	0x4
TfBuildRandomString	0x172a	0x5
TfBuildRandomUnicodeString	0x1740	0x6
TfChecksumXor32	0x1765	0x7
TfCrc32	0x17b7	0x8
TfDulEncoder	0x2f12	0x9
TfEscapeJavaScriptBuffer	0x32d9	0xa
TfFillPattern	0x127f	0xb
TfFillRandom	0x1302	0xc
TfFillRandomUnicode	0x132e	0xd
TfFree	0x309f	0xe
TfGetUserInput	0x32ba	0xf
TfHasBadBytes	0x1449	0x10
TfHmacMd5Final	0x3181	0x11
TfHmacMd5Init	0x30c0	0x12
TfHmacMd5Update	0x317c	0x13
TfLzCompress	0x35ba	0x14
TfLzDecompress	0x33af	0x15
TfMakeGfaHash	0x30a5	0x16
TfMd4	0x3e05	0x17
TfMd5Final	0x4a4b	0x18
TfMd5Init	0x3f8d	0x19
TfMd5Update	0x49b0	0x1a
TfNrvCalculateMaxExpansion	0x4b73	0x1b
TfNrvCompress	0x4ad3	0x1c
TfNrvDecompress	0x4b26	0x1d
TfRandomAscii	0x4c6f	0x1e
TfRandomBase64	0x4c80	0x1f
TfRandomByte	0x4cbf	0x20
TfRandomByteFromAlphabet	0x4bfc	0x21
TfRandomByteFromRange	0x4c39	0x22
TfRandomInt	0x4b9a	0x23
TfRandomizeBuffer	0x147c	0x24
TfRc4Encrypt	0x4d2b	0x25
TfRc4Init	0x4cd3	0x26
TfReadFileIntoBuffer	0x31c0	0x27
TfRollingXorDecode	0x4ea9	0x28
TfRollingXorEncode	0x4e2a	0x29
TfSeedRandom	0x4b84	0x2a
TfStrICmp	0x1760	0x2b
TfStrcasecmp	0x1496	0x2c
TfStrncasecmp	0x14de	0x2d
TfUuDecode	0x4f28	0x2e
TfUuEncode	0x5105	0x2f
TfWriteBufferIntoFile	0x3271	0x30
TfXorBuffer	0x152f	0x31
TfXorw2Encoder	0x5565	0x32
TfXorwEncoder	0x530c	0x33

c:\windows\temp\dmgd-4.dll

Created File

Binary

Blacklisted

Mime Type	application/x-dosexec
File Size	468.50 KB
MD5	a05c7011ab464e6c353a057973f5a06e
SHA1	e819a4f985657b58d06b4f8ad483d8e9733e0c37
SHA256	50f329e034db96ba254328cd1e0f588af6126c341ed92ddf4aeb96bc76835937
SSDeep	3072:VgSjV199+51p9xrQmd1xHQmh1t38lzwpzKVJV2E5Jp2rxrI1+uhHIZ+gHTTnIv+g:Vg1gm
ImpHash	4edfb3614d85009edda4e6c7c687371e

File Reputation Information

Severity	Blacklisted
First Seen	2017-04-15 03:01 (UTC+2)
Last Seen	2018-10-14 08:21 (UTC+2)
Names	Win32.Trojan.Shadowbrokers
Families	Shadowbrokers
Classification	Trojan

PE Information

Image Base	0x10000000
Entry Point	0x10005474
Size Of Code	0x4a00
Size Of Initialized Data	0x70800
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2013-07-12 10:36:35+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x4886	0x4a00	0x400	cnt_code, mem_execute, mem_read	6.19
.rdata	0x10006000	0x58e	0x600	0x4e00	cnt_initialized_data, mem_read	4.48
.data	0x10007000	0x6f41c	0x6f200	0x5400	cnt_initialized_data, mem_read, mem_write	6.03
.reloc	0x10077000	0xbaa	0xc00	0x74600	cnt_initialized_data, mem_discardable, mem_read	3.03

Imports (3)

KERNEL32.dll (13)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x10006000	0x6244	0x5044	0x10e
GetCurrentThreadId	0x0	0x10006004	0x6248	0x5048	0x110
GetTickCount	0x0	0x10006008	0x624c	0x504c	0x18a
QueryPerformanceCounter	0x0	0x1000600c	0x6250	0x5050	0x22f
SetUnhandledExceptionFilter	0x0	0x10006010	0x6254	0x5054	0x2bc
UnhandledExceptionFilter	0x0	0x10006014	0x6258	0x5058	0x2df
GetCurrentProcess	0x0	0x10006018	0x625c	0x505c	0x10d
TerminateProcess	0x0	0x1000601c	0x6260	0x5060	0x2cf
InterlockedCompareExchange	0x0	0x10006020	0x6264	0x5064	0x1cb
Sleep	0x0	0x10006024	0x6268	0x5068	0x2c7
InterlockedExchange	0x0	0x10006028	0x626c	0x506c	0x1cd
RtlUnwind	0x0	0x1000602c	0x6270	0x5070	0x25b
GetSystemTimeAsFileTime	0x0	0x10006030	0x6274	0x5074	0x17a

trfo-2.dll (4)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TfNrvCompress	0x0	0x10006064	0x62a8	0x50a8	0x1b
TfRandomByte	0x0	0x10006068	0x62ac	0x50ac	0x1f
TfFillRandom	0x0	0x1000606c	0x62b0	0x50b0	0xb
TfNrvCalculateMaxExpansion	0x0	0x10006070	0x62b4	0x50b4	0x1a

msvcrt.dll (10)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
memcpy	0x0	0x10006038	0x627c	0x507c	0x4ea
strlen	0x0	0x1000603c	0x6280	0x5080	0x51c
calloc	0x0	0x10006040	0x6284	0x5084	0x485
malloc	0x0	0x10006044	0x6288	0x5088	0x4de
free	0x0	0x10006048	0x628c	0x508c	0x4a6
realloc	0x0	0x1000604c	0x6290	0x5090	0x4ff
_XcptFilter	0x0	0x10006050	0x6294	0x5094	0x6a
_initterm	0x0	0x10006054	0x6298	0x5098	0x1d5
_amsg_exit	0x0	0x10006058	0x629c	0x509c	0x101
_adjust_fdiv	0x0	0x1000605c	0x62a0	0x50a0	0xf5

Exports (8)

Api name	EAT Address	Ordinal
DgCalloc	0x3f11	0x1
DgFree	0x3f0b	0x2
DgMalloc	0x3f05	0x3
DgRealloc	0x3f17	0x4
noargs	0x4c0b	0x5
pkgtype1	0x413f	0x6
pkgtype1export	0x4199	0x7
pkgtype2	0x4999	0x8

c:\windows\temp\svchostbs.xml

Created File

XML

Blacklisted

Mime Type	application/xml
File Size	5.22 KB
MD5	09d45ae26830115fd8d9cdc2aa640ca5
SHA1	41a6ad8d88b6999ac8a3ff00dd9641a37ee20933
SHA256	cf33a92a05ba3c807447a5f6b7e45577ed53174699241da360876d4f4a2eb2de
SSDeep	96:yJhKJ6yPl/rGH4rAH+6UlbscJsZPF97yr+HKSB+x+M+rEH:k4JFIXepb9ga

File Reputation Information

Severity	Blacklisted
First Seen	2017-04-14 16:04 (UTC+2)
Last Seen	2018-09-18 08:41 (UTC+2)
Names	Script.Trojan.Xjd
Families	Xjd
Classification	Trojan

c:\windows\temp\m64.exe

Created File

Binary

Suspicious

Mime Type	application/x-dosexec
File Size	363.50 KB
MD5	2d2e3b0d8a9723eb49bd6f817cbe2e22
SHA1	0de80d21c389061e69dd3a0c61ac3ba225b9bb44
SHA256	db995430707d2d34de8e5ce5fb4b22a87422f5a7b4d38960ed6615d4ea3d9495
SSDeep	6144:J7a3Ui4FEK7EwGV/2Bk2qvwsWK1a6wWjed90AIEOznjKP/k3IKiMSUP+mPH8W1OL:J7a3UB7vG8qIsb18WwKE+jKPo/SC4UiB
ImpHash	00eb01ea9f9b5018c923024af21d496d

File Reputation Information

Severity	Suspicious
First Seen	2018-10-15 04:38 (UTC+2)
Last Seen	2018-10-15 04:54 (UTC+2)
Names	Win64.Hacktool.Mimikatz
Families	Mimikatz
Classification	Hacktool

PE Information

Image Base	0x140000000
Entry Point	0x140103661
Size Of Code	0x9aa00
Size Of Initialized Data	0x5c800
File Type	executable
Subsystem	windows_cui
Machine Type	amd64
Compile Timestamp	2018-05-03 05:44:53+00:00

Version Information (10)

LegalCopyright	Copyright (c) 2007 - 2018 gentilkiwi (Benjamin DELPY)
InternalName	mimikatz
FileVersion	2.1.1.0
FileDescription	mimikatz for Windows
CompanyName	gentilkiwi (Benjamin DELPY)
SpecialBuild	kiwi flavor !
ProductName	mimikatz
ProductVersion	2.1.1.0
PrivateBuild	Build with love for POC only
OriginalFilename	mimikatz.exe

Sections (3)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.MPRESS1	0x140001000	0x102000	0x59200	0x200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	8.0
.MPRESS2	0x140103000	0x115b	0x1200	0x59400	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	5.7
.rsrc	0x140105000	0x684	0x800	0x5a600	cnt_initialized_data, mem_read, mem_write	3.79

Imports (24)

KERNEL32 (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x14010321c	0x10321c	0x5961c	0x0
GetProcAddress	0x0	0x140103224	0x103224	0x59624	0x0

ADVAPI32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CopySid	0x0	0x140103234	0x103234	0x59634	0x0

CRYPT32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CertOpenStore	0x0	0x140103244	0x103244	0x59644	0x0

CABINET.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
(by ordinal)	0xb	0x140103254	0x103254	0x59654	-

FLTLIB.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FilterFindNext	0x0	0x140103264	0x103264	0x59664	0x0

HID.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
HidP_GetCaps	0x0	0x140103274	0x103274	0x59674	0x0

NETAPI32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NetRemoteTOD	0x0	0x140103284	0x103284	0x59684	0x0

OLEAUT32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysAllocString	0x2	0x140103294	0x103294	0x59694	-

RPCRT4.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
UuidCreate	0x0	0x1401032a4	0x1032a4	0x596a4	0x0

SAMLIB.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SamConnect	0x0	0x1401032b4	0x1032b4	0x596b4	0x0

SETUPAPI.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetupDiGetClassDevsW	0x0	0x1401032c4	0x1032c4	0x596c4	0x0

SHELL32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CommandLineToArgvW	0x0	0x1401032d4	0x1032d4	0x596d4	0x0

SHLWAPI.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PathCombineW	0x0	0x1401032e4	0x1032e4	0x596e4	0x0

SECUR32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FreeContextBuffer	0x0	0x1401032f4	0x1032f4	0x596f4	0x0

USER32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetMessageW	0x0	0x140103304	0x103304	0x59704	0x0

USERENV.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateEnvironmentBlock	0x0	0x140103314	0x103314	0x59714	0x0

VERSION.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VerQueryValueW	0x0	0x140103324	0x103324	0x59724	0x0

WINSTA.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WinStationConnectW	0x0	0x140103334	0x103334	0x59734	0x0

WLDAP32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
(by ordinal)	0x71	0x140103344	0x103344	0x59744	-

WINSCARD.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SCardControl	0x0	0x140103354	0x103354	0x59754	0x0

CRYPTDLL.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
MD5Init	0x0	0x140103364	0x103364	0x59764	0x0

MSASN1.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ASN1_FreeEncoded	0x0	0x140103374	0x103374	0x59774	0x0

NTDLL.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NtQueryObject	0x0	0x140103384	0x103384	0x59784	0x0

OLE32.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CoInitializeEx	0x0	0x140103394	0x103394	0x59794	0x0

c:\windows\temp\KillDuplicate.cmd

Created File

Text

Whitelisted

Mime Type	text/plain
File Size	0.22 KB
MD5	68cecdf24aa2fd011ece466f00ef8450
SHA1	2f859046187e0d5286d0566fac590b1836f6e1b7
SHA256	64929489dc8a0d66ea95113d4e676368edb576ea85d23564d53346b21c202770
SSDeep	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3

File Reputation Information

Severity	Whitelisted
First Seen	2017-01-08 04:44 (UTC+1)
Last Seen	2018-09-25 03:41 (UTC+2)

C:\Windows\temp\snamelog

Created File

Text

Unknown

Mime Type	text/plain
File Size	0.09 KB
MD5	4b8087ec44aa670c5ded3c0f0ed5181e
SHA1	0438738922fd7425cffb5fa19940c40743c6f847
SHA256	bb3d12ea94c3edce913e4dce63a3ca5e03525d2967d15e8546acc4b9f5b43bc1
SSDeep	3:A+aktGJoiTktGJoiTktGJoiTktGy:ALk4tTk4tTk4tTk4y

C:\Windows\temp\spasslog

Created File

Text

Unknown

Mime Type	text/plain
File Size	0.02 KB
MD5	55f4877f42efd234ac09f6917638815e
SHA1	4a9397c02641a11ba800e4957afa9d96325c22a1
SHA256	104f85e225a7d61b90e51c77a929a0499b11076bc54b680be332a8634571d2ab
SSDeep	3:EB+mS2+v:rmSv

C:\Windows\temp\spasslog

Created File

Text

Unknown

Mime Type	text/plain
File Size	0.04 KB
MD5	8b2aaad0ab43761aa1e21776c1ed6abb
SHA1	e8dc690ed319ffce6e9944859b98c7f8176605bc
SHA256	d71044bba2bc1c851b9dc92bb0b80af1d92c12227efd863659a464b09985b3ca
SSDeep	3:EB+mS2+mS2+mS2+v:rmSmSmSv

C:\Windows\temp\snamelog

Created File

Text

Unknown

Mime Type	text/plain
File Size	0.13 KB
MD5	6e4134227775963a2292dfb24fc13589
SHA1	470a39c445b48942ce08bbebc5f863e194184169
SHA256	b9bc94de89d0614470cee4d796b558a8a7ae9324886d0d0d08d2b6c742f49446
SSDeep	3:A+aktGJoiTktGJoiTktGJoiTktGJoiTktGJoiTktGy:ALk4tTk4tTk4tTk4tTk4tTk4y

C:\Windows\temp\spasslog

Created File

Text

Unknown

Mime Type	text/plain
File Size	0.03 KB
MD5	d7b71db2a3b0fab3a680b87d25f0d7be
SHA1	a67e9ce207230b099449a66f0f64aa6c1deb18af
SHA256	df0c2ffa6dcb0da5369f9a0d84097bfb8cfa05895071e527e0a0ebf079f63922
SSDeep	3:EB+mS2+mS2+v:rmSmSv

C:\Windows\temp\snamelog

Created File

Text

Unknown

Mime Type	text/plain
File Size	0.11 KB
MD5	4ee6589a0118e74bc1da717c882ce860
SHA1	f257639e24ea24ba693308147349d3a6c2cae0c6
SHA256	f67648be7cc55e5cdc9fe47c493ab463003e15c934b39f594d55065e419b0251
SSDeep	3:A+aktGJoiTktGJoiTktGJoiTktGJoiTktGy:ALk4tTk4tTk4tTk4tTk4y

C:\Windows\temp\spasslog

Created File

Text

Unknown

Mime Type	text/plain
File Size	0.01 KB
MD5	9eeb0b45c472b477e58b1b2e053a29c6
SHA1	342c1efe3950ec050f3a6705ae8abff876b6fe4e
SHA256	af5d93bbb6d1e96dd3ccb830951790612e5f81d6765f081ed2ca8ee7a0d03b88
SSDeep	3:EB+v:rv

C:\Windows\temp\spasslog

Created File

Text

Unknown

Mime Type	text/plain
File Size	0.06 KB
MD5	fcadd0a8f5a3edb4042dc65f08d2a9ce
SHA1	ccc8ec23c42cebee231b4f4f0c0a381e55e5b115
SHA256	6e97db867acf54d449f54387a9efc21d49be72fa262ccd29fdc568cde4b44415
SSDeep	3:EB+mS2+mS2+mS2+mS2+mS2+v:rmSmSmSmSmSv

c:\windows\temp\m32.exe

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	322.00 KB
MD5	0b5469b69a0d2e205640b78157ca225a
SHA1	b2d7079a39fe7bbb835090ec74512d4bfa5c44cf
SHA256	4179a1bff4c698ea6958bacb1f1734b9ab804cef35ecaf0e2a2b4b2eadf8e935
SSDeep	6144:nLMTrKephodcr8tIV7bDb8hVqgB2DWF7HwDFTLPIDZXws1gq0BcDnLy3/:nA3Ks1d8VqgB2DI+XADd/LS/
ImpHash	734baded3d96d0289bd8d3bc2b002085

PE Information

Image Base	0x400000
Entry Point	0x4d95be
Size Of Code	0xd4000
Size Of Initialized Data	0x4000
File Type	executable
Subsystem	windows_cui
Machine Type	i386
Compile Timestamp	1970-01-01 00:00:00+00:00

Version Information (10)

LegalCopyright	Copyright (c) 2007 - 2018 gentilkiwi (Benjamin DELPY)
InternalName	mimikatz
FileVersion	2.1.1.0
FileDescription	mimikatz for Windows
CompanyName	gentilkiwi (Benjamin DELPY)
SpecialBuild	kiwi flavor !
ProductName	mimikatz
ProductVersion	2.1.1.0
PrivateBuild	Build with love for POC only
OriginalFilename	mimikatz.exe

Sections (3)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.MPRESS1	0x401000	0xd8000	0x4ec00	0x200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	8.0
.MPRESS2	0x4d9000	0x1128	0x1200	0x4ee00	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	5.73
.rsrc	0x4db000	0x684	0x800	0x50000	cnt_initialized_data, mem_read, mem_write	3.79

Imports (24)

KERNEL32.DLL (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x4d9230	0xd9230	0x4f030	0x0
GetProcAddress	0x0	0x4d9234	0xd9234	0x4f034	0x0

advapi32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CopySid	0x0	0x4d923c	0xd923c	0x4f03c	0x0

crypt32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CertOpenStore	0x0	0x4d9244	0xd9244	0x4f044	0x0

cabinet.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FCICreate	0x0	0x4d924c	0xd924c	0x4f04c	0x0

fltlib.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FilterFindNext	0x0	0x4d9254	0xd9254	0x4f054	0x0

hid.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
HidP_GetCaps	0x0	0x4d925c	0xd925c	0x4f05c	0x0

netapi32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NetRemoteTOD	0x0	0x4d9264	0xd9264	0x4f064	0x0

oleaut32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VariantInit	0x0	0x4d926c	0xd926c	0x4f06c	0x0

rpcrt4.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
UuidCreate	0x0	0x4d9274	0xd9274	0x4f074	0x0

samlib.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SamConnect	0x0	0x4d927c	0xd927c	0x4f07c	0x0

setupapi.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetupDiGetClassDevsW	0x0	0x4d9284	0xd9284	0x4f084	0x0

shell32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CommandLineToArgvW	0x0	0x4d928c	0xd928c	0x4f08c	0x0

shlwapi.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PathCombineW	0x0	0x4d9294	0xd9294	0x4f094	0x0

secur32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FreeContextBuffer	0x0	0x4d929c	0xd929c	0x4f09c	0x0

user32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetMessageW	0x0	0x4d92a4	0xd92a4	0x4f0a4	0x0

userenv.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateEnvironmentBlock	0x0	0x4d92ac	0xd92ac	0x4f0ac	0x0

version.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VerQueryValueW	0x0	0x4d92b4	0xd92b4	0x4f0b4	0x0

winsta.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WinStationConnectW	0x0	0x4d92bc	0xd92bc	0x4f0bc	0x0

wldap32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ber_free	0x0	0x4d92c4	0xd92c4	0x4f0c4	0x0

winscard.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SCardControl	0x0	0x4d92cc	0xd92cc	0x4f0cc	0x0

cryptdll.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
MD5Init	0x0	0x4d92d4	0xd92d4	0x4f0d4	0x0

msasn1.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ASN1Free	0x0	0x4d92dc	0xd92dc	0x4f0dc	0x0

ntdll.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NtQueryObject	0x0	0x4d92e4	0xd92e4	0x4f0e4	0x0

ole32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CoInitializeEx	0x0	0x4d92ec	0xd92ec	0x4f0ec	0x0

c:\windows\temp\posh-0.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	11.00 KB
MD5	2f0a52ce4f445c6e656ecebbcaceade5
SHA1	35493e06b0b2cdab2211c0fc02286f45d5e2606d
SHA256	cde45f7ff05f52b7215e4b0ea1f2f42ad9b42031e16a3be9772aa09e014bacdb
SSDeep	192:BNn+r+YB4cdCjWXGyby8Eaw5Xs+dNjnGy6W4l5t1Ib/X:BdW+k4z3yu8rwy+dNjnGlW40
ImpHash	3238dd5467a491407079286b75fed933

PE Information

Image Base	0x10000000
Entry Point	0x10001d25
Size Of Code	0x1200
Size Of Initialized Data	0x1a00
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:50:37+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x1136	0x1200	0x400	cnt_code, mem_execute, mem_read	6.33
.rdata	0x10003000	0xbe2	0xc00	0x1600	cnt_initialized_data, mem_read	5.42
.data	0x10004000	0x65c	0x400	0x2200	cnt_initialized_data, mem_read, mem_write	5.79
.reloc	0x10005000	0x468	0x600	0x2600	cnt_initialized_data, mem_discardable, mem_read	1.78

Imports (2)

KERNEL32.dll (13)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x10003000	0x3640	0x1c40	0x10e
GetCurrentThreadId	0x0	0x10003004	0x3644	0x1c44	0x110
GetTickCount	0x0	0x10003008	0x3648	0x1c48	0x18a
QueryPerformanceCounter	0x0	0x1000300c	0x364c	0x1c4c	0x22f
SetUnhandledExceptionFilter	0x0	0x10003010	0x3650	0x1c50	0x2bc
UnhandledExceptionFilter	0x0	0x10003014	0x3654	0x1c54	0x2df
GetCurrentProcess	0x0	0x10003018	0x3658	0x1c58	0x10d
TerminateProcess	0x0	0x1000301c	0x365c	0x1c5c	0x2cf
InterlockedCompareExchange	0x0	0x10003020	0x3660	0x1c60	0x1cb
Sleep	0x0	0x10003024	0x3664	0x1c64	0x2c7
InterlockedExchange	0x0	0x10003028	0x3668	0x1c68	0x1cd
RtlUnwind	0x0	0x1000302c	0x366c	0x1c6c	0x25b
GetSystemTimeAsFileTime	0x0	0x10003030	0x3670	0x1c70	0x17a

msvcrt.dll (6)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
malloc	0x0	0x10003038	0x3678	0x1c78	0x4de
free	0x0	0x1000303c	0x367c	0x1c7c	0x4a6
_XcptFilter	0x0	0x10003040	0x3680	0x1c80	0x6a
_initterm	0x0	0x10003044	0x3684	0x1c84	0x1d5
_amsg_exit	0x0	0x10003048	0x3688	0x1c88	0x101
_adjust_fdiv	0x0	0x1000304c	0x368c	0x1c8c	0xf5

Exports (31)

Api name	EAT Address	Ordinal
POSH_GetArchString	0x1560	0x1
POSH_ReadI16FromBig	0x11ed	0x2
POSH_ReadI16FromLittle	0x11ab	0x3
POSH_ReadI32FromBig	0x1215	0x4
POSH_ReadI32FromLittle	0x11d3	0x5
POSH_ReadI64FromBig	0x128b	0x6
POSH_ReadI64FromLittle	0x1254	0x7
POSH_ReadU16FromBig	0x11d8	0x8
POSH_ReadU16FromLittle	0x1196	0x9
POSH_ReadU32FromBig	0x11f2	0xa
POSH_ReadU32FromLittle	0x11b0	0xb
POSH_ReadU64FromBig	0x1259	0xc
POSH_ReadU64FromLittle	0x1222	0xd
POSH_SwapI16	0x100d	0xe
POSH_SwapI32	0x103a	0xf
POSH_SwapI64	0x1085	0x10
POSH_SwapU16	0x1003	0x11
POSH_SwapU32	0x1012	0x12
POSH_SwapU64	0x103f	0x13
POSH_WriteI16ToBig	0x10eb	0x14
POSH_WriteI16ToLittle	0x10a9	0x15
POSH_WriteI32ToBig	0x1114	0x16
POSH_WriteI32ToLittle	0x10d2	0x17
POSH_WriteI64ToBig	0x1181	0x18
POSH_WriteI64ToLittle	0x1141	0x19
POSH_WriteU16ToBig	0x10d7	0x1a
POSH_WriteU16ToLittle	0x1095	0x1b
POSH_WriteU32ToBig	0x10f0	0x1c
POSH_WriteU32ToLittle	0x10ae	0x1d
POSH_WriteU64ToBig	0x1156	0x1e
POSH_WriteU64ToLittle	0x1119	0x1f

c:\windows\temp\tibe-2.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	232.00 KB
MD5	f0881d5a7f75389deba3eff3f4df09ac
SHA1	8404f2776fa8f7f8eaffb7a1859c19b0817b147a
SHA256	ca63dbb99d9da431bf23aca80dc787df67bb01104fb9358a7813ed2fce479362
SSDeep	3072:GQng3MAngh6CNXfdUrYSaocn484kQL93ZnV6Bbf5+1qo3/mlch9VQ816oPYQ3:GwkQf4q481Qx3hV6Bbf5+1qbch9V91J
ImpHash	bf232b241eab6d3f1724ea6a36af0cbb

PE Information

Image Base	0x10000000
Entry Point	0x1003263e
Size Of Code	0x31c00
Size Of Initialized Data	0x8800
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:52:53+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x31a16	0x31c00	0x400	cnt_code, mem_execute, mem_read	6.5
.rdata	0x10033000	0x5ac7	0x5c00	0x32000	cnt_initialized_data, mem_read	5.89
.data	0x10039000	0x1d14	0x1600	0x37c00	cnt_initialized_data, mem_read, mem_write	4.38
.reloc	0x1003b000	0xcda	0xe00	0x39200	cnt_initialized_data, mem_discardable, mem_read	4.63

Imports (4)

KERNEL32.dll (16)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Sleep	0x0	0x10033000	0x33ba8	0x32ba8	0x2c7
SystemTimeToFileTime	0x0	0x10033004	0x33bac	0x32bac	0x2cc
GetSystemTime	0x0	0x10033008	0x33bb0	0x32bb0	0x178
FormatMessageA	0x0	0x1003300c	0x33bb4	0x32bb4	0xc2
GetCurrentProcessId	0x0	0x10033010	0x33bb8	0x32bb8	0x10e
GetCurrentThreadId	0x0	0x10033014	0x33bbc	0x32bbc	0x110
GetTickCount	0x0	0x10033018	0x33bc0	0x32bc0	0x18a
QueryPerformanceCounter	0x0	0x1003301c	0x33bc4	0x32bc4	0x22f
SetUnhandledExceptionFilter	0x0	0x10033020	0x33bc8	0x32bc8	0x2bc
UnhandledExceptionFilter	0x0	0x10033024	0x33bcc	0x32bcc	0x2df
GetCurrentProcess	0x0	0x10033028	0x33bd0	0x32bd0	0x10d
TerminateProcess	0x0	0x1003302c	0x33bd4	0x32bd4	0x2cf
InterlockedCompareExchange	0x0	0x10033030	0x33bd8	0x32bd8	0x1cb
InterlockedExchange	0x0	0x10033034	0x33bdc	0x32bdc	0x1cd
RtlUnwind	0x0	0x10033038	0x33be0	0x32be0	0x25b
GetSystemTimeAsFileTime	0x0	0x1003303c	0x33be4	0x32be4	0x17a

trfo-2.dll (10)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TfCrc32	0x0	0x10033124	0x33ccc	0x32ccc	0x7
TfRc4Init	0x0	0x10033128	0x33cd0	0x32cd0	0x25
TfRc4Encrypt	0x0	0x1003312c	0x33cd4	0x32cd4	0x24
TfMd4	0x0	0x10033130	0x33cd8	0x32cd8	0x16
TfMd5Init	0x0	0x10033134	0x33cdc	0x32cdc	0x18
TfMd5Update	0x0	0x10033138	0x33ce0	0x32ce0	0x19
TfMd5Final	0x0	0x1003313c	0x33ce4	0x32ce4	0x17
TfHmacMd5Init	0x0	0x10033140	0x33ce8	0x32ce8	0x11
TfHmacMd5Update	0x0	0x10033144	0x33cec	0x32cec	0x12
TfHmacMd5Final	0x0	0x10033148	0x33cf0	0x32cf0	0x10

WS2_32.dll (24)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ntohs	0xf	0x10033044	0x33bec	0x32bec	-
ntohl	0xe	0x10033048	0x33bf0	0x32bf0	-
htons	0x9	0x1003304c	0x33bf4	0x32bf4	-
inet_addr	0xb	0x10033050	0x33bf8	0x32bf8	-
WSAStartup	0x73	0x10033054	0x33bfc	0x32bfc	-
WSACleanup	0x74	0x10033058	0x33c00	0x32c00	-
accept	0x1	0x1003305c	0x33c04	0x32c04	-
closesocket	0x3	0x10033060	0x33c08	0x32c08	-
ioctlsocket	0xa	0x10033064	0x33c0c	0x32c0c	-
WSAGetLastError	0x6f	0x10033068	0x33c10	0x32c10	-
send	0x13	0x1003306c	0x33c14	0x32c14	-
sendto	0x14	0x10033070	0x33c18	0x32c18	-
recv	0x10	0x10033074	0x33c1c	0x32c1c	-
select	0x12	0x10033078	0x33c20	0x32c20	-
recvfrom	0x11	0x1003307c	0x33c24	0x32c24	-
WSASetLastError	0x70	0x10033080	0x33c28	0x32c28	-
connect	0x4	0x10033084	0x33c2c	0x32c2c	-
listen	0xd	0x10033088	0x33c30	0x32c30	-
getsockname	0x6	0x1003308c	0x33c34	0x32c34	-
bind	0x2	0x10033090	0x33c38	0x32c38	-
socket	0x17	0x10033094	0x33c3c	0x32c3c	-
setsockopt	0x15	0x10033098	0x33c40	0x32c40	-
htonl	0x8	0x1003309c	0x33c44	0x32c44	-
inet_ntoa	0xc	0x100330a0	0x33c48	0x32c48	-

msvcrt.dll (30)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
strchr	0x0	0x100330a8	0x33c50	0x32c50	0x513
toupper	0x0	0x100330ac	0x33c54	0x32c54	0x53a
memcpy	0x0	0x100330b0	0x33c58	0x32c58	0x4ea
memset	0x0	0x100330b4	0x33c5c	0x32c5c	0x4ee
memcmp	0x0	0x100330b8	0x33c60	0x32c60	0x4e9
strlen	0x0	0x100330bc	0x33c64	0x32c64	0x51c
strcmp	0x0	0x100330c0	0x33c68	0x32c68	0x514
sscanf	0x0	0x100330c4	0x33c6c	0x32c6c	0x50f
strcpy	0x0	0x100330c8	0x33c70	0x32c70	0x516
atoi	0x0	0x100330cc	0x33c74	0x32c74	0x480
strncpy	0x0	0x100330d0	0x33c78	0x32c78	0x520
strcat	0x0	0x100330d4	0x33c7c	0x32c7c	0x511
_snprintf	0x0	0x100330d8	0x33c80	0x32c80	0x32f
strncmp	0x0	0x100330dc	0x33c84	0x32c84	0x51f
islower	0x0	0x100330e0	0x33c88	0x32c88	0x4c3
strncat	0x0	0x100330e4	0x33c8c	0x32c8c	0x51d
srand	0x0	0x100330e8	0x33c90	0x32c90	0x50e
free	0x0	0x100330ec	0x33c94	0x32c94	0x4a6
malloc	0x0	0x100330f0	0x33c98	0x32c98	0x4de
realloc	0x0	0x100330f4	0x33c9c	0x32c9c	0x4ff
rand	0x0	0x100330f8	0x33ca0	0x32ca0	0x4fd
gmtime	0x0	0x100330fc	0x33ca4	0x32ca4	0x4bb
mktime	0x0	0x10033100	0x33ca8	0x32ca8	0x4ef
tolower	0x0	0x10033104	0x33cac	0x32cac	0x539
sprintf	0x0	0x10033108	0x33cb0	0x32cb0	0x50b
_XcptFilter	0x0	0x1003310c	0x33cb4	0x32cb4	0x6a
_initterm	0x0	0x10033110	0x33cb8	0x32cb8	0x1d5
_amsg_exit	0x0	0x10033114	0x33cbc	0x32cbc	0x101
_adjust_fdiv	0x0	0x10033118	0x33cc0	0x32cc0	0xf5
time	0x0	0x1003311c	0x33cc4	0x32cc4	0x534

Exports (691)

Api name	EAT Address	Ordinal
TbAddInterfacePointer	0x2c234	0x1
TbAddSnegoAuthType	0x2f5a0	0x2
TbAsnOidToBytes	0xb221	0x3
TbB1size	0x12ee	0x4
TbB2size	0x1334	0x5
TbB3size	0x136e	0x6
TbB4size	0x13a8	0x7
TbBuffCat	0xaa01	0x8
TbBuffCpy	0xa9d5	0x9
TbBuffnCat	0xaa3d	0xa
TbBuildKerbApReply	0x6a1d	0xb
TbBuildKerbApReq	0x7fae	0xc
TbBuildKerbAsReq	0x6a72	0xd
TbBuildKerbTgsReq	0x8266	0xe
TbBytesToAsnOid	0xb4b5	0xf
TbCatUniBuff	0xb885	0x10
TbCheckActid	0xf2aa	0x11
TbCheckSecuritySignature	0x1b9b6	0x12
TbCleanAuthBlob1	0x1608	0x13
TbCleanAuthBlob2	0x162d	0x14
TbCleanAuthBlob3	0x164e	0x15
TbCleanAuthBlob4	0x164e	0x16
TbCleanDirListContents	0x1bd03	0x17
TbCleanIdInfo	0x2eeef	0x18
TbCleanInfoStruct	0x2fea6	0x19
TbCleanJobListDescription	0x14837	0x1a
TbCleanKerbAuthInfo	0x2f6d5	0x1b
TbCleanSB	0x2e403	0x1c
TbCleanSnegoAuthInfo	0x2f494	0x1d
TbCleanSnegoBlob1	0x2a866	0x1e
TbCleanSnegoBlob2	0x2a8a1	0x1f
TbCleanSnegoBlob3	0x2a8d4	0x20
TbCleanSnegoBlob4	0x2a8d4	0x21
TbClearSmbAuthInfo	0x2db4f	0x22
TbCloseListenSocket	0x312bd	0x23
TbCloseSocket	0x31297	0x24
TbCloseStructSockets	0x2ee7a	0x25
TbComputeUtf8Len	0x30a35	0x26
TbConnectNonblocking	0x31b21	0x27
TbConvAreYouThere_makeresp	0x9c2f	0x28
TbConvWhoAreYou2_makeresp	0x9b9e	0x29
TbConvWhoAreYouAuthMore_makeresp	0x9ae4	0x2a
TbConvWhoAreYouAuth_makeresp	0x9853	0x2b
TbConvWhoAreYou_makeresp	0x9800	0x2c
TbConvWhoAreYou_parserequest	0x9c57	0x2d
TbConvertTimeStringToFileTime	0x3075d	0x2e
TbCopyBuffStrToUniBuffStr	0xaaa7	0x2f
TbCopyRemoteInfoToDest	0x2fc40	0x30
TbCopySizedBuffer	0x2e427	0x31
TbCreateActid	0xf319	0x32
TbCreateInfoStruct	0x30416	0x33
TbCreateNonzeroPointer	0xab13	0x34
TbD_P16	0x15298	0x35
TbDealWithAlterContext	0xe357	0x36
TbDealWithAuth3	0xe2c4	0x37
TbDealWithBind	0xdfea	0x38
TbDealWithDecryption	0x14f1	0x39
TbDealWithEncryption	0x1495	0x3a
TbDealWithNetlogonDecryption	0x941d	0x3b
TbDealWithNetlogonEncryption	0x938a	0x3c
TbDealWithNtlmDecryption	0x4473	0x3d
TbDealWithNtlmEncryption	0x43b8	0x3e
TbDealWithSnegoDecryption	0x2ac4e	0x3f
TbDealWithSnegoEncryption	0x2ac16	0x40
TbDealWithTcpReq	0xeb93	0x41
TbDeleteFileA	0x1c6fc	0x42
TbDeleteFileU	0x1c271	0x43
TbDesDecrypt8	0x15549	0x44
TbDesEncrypt8	0x15532	0x45
TbDisplayJobList	0x1487e	0x46
TbDoAuth3	0xd924	0x47
TbDoBind	0xdd22	0x48
TbDoCoCreateInstance	0x1180c	0x49
TbDoCoCreateInstance2	0x11941	0x4a
TbDoGetClassObject	0x11990	0x4b
TbDoGetClassObject2	0x11ac5	0x4c
TbDoHttpStartup	0x9cc9	0x4d
TbDoKerbAsRequestReply	0x7778	0x4e
TbDoKerbTgsRequestReply	0x82c7	0x4f
TbDoNbtSessionRequest	0x88f1	0x50
TbDoNetlogonAuth	0x13e9e	0x51
TbDoRegQueryHklmKey	0x135e7	0x52
TbDoRegQueryHklmKeyU	0x13493	0x53
TbDoRegQueryHklmValue	0x12cf9	0x54
TbDoRegQueryHklmValueU	0x12b53	0x55
TbDoRegQueryUsersKey	0x1333f	0x56
TbDoRegQueryUsersKeyU	0x131eb	0x57
TbDoRegQueryUsersValue	0x13045	0x58
TbDoRegQueryUsersValueU	0x12e9f	0x59
TbDoRemQI	0x11b14	0x5a
TbDoRemoteJobAddA	0x145e5	0x5b
TbDoRemoteJobAddU	0x14353	0x5c
TbDoRemoteJobDel	0x14670	0x5d
TbDoRemoteJobsEnum	0x1497d	0x5e
TbDoRemoteTOD	0x14036	0x5f
TbDoRpcBind	0xf1f4	0x60
TbDoRpcBindEx	0xf297	0x61
TbDoRpcRequest	0xf18d	0x62
TbDoRpcRequestEx	0xf1bc	0x63
TbDoSmbCancelForward	0x1f366	0x64
TbDoSmbChangePipe	0x1b537	0x65
TbDoSmbChangeShare	0x1b49a	0x66
TbDoSmbCheckDirectory	0x1f396	0x67
TbDoSmbClose	0x1674a	0x68
TbDoSmbCloseAndTdisc	0x1f3c3	0x69
TbDoSmbClosePrint	0x1f3f0	0x6a
TbDoSmbCopy	0x1f420	0x6b
TbDoSmbCreate	0x1f507	0x6c
TbDoSmbCreateDir	0x1f621	0x6d
TbDoSmbCreateNew	0x1f594	0x6e
TbDoSmbCreateTemp	0x1f6d3	0x6f
TbDoSmbDelete	0x1f75e	0x70
TbDoSmbDeleteDirectory	0x1f78b	0x71
TbDoSmbEcho	0x1f7b8	0x72
TbDoSmbFind	0x20c13	0x73
TbDoSmbFindClose	0x20dbd	0x74
TbDoSmbFindClose2	0x1f894	0x75
TbDoSmbFindNotifyClose	0x1f8c4	0x76
TbDoSmbFindUnique	0x20ce8	0x77
TbDoSmbFlush	0x1f8f1	0x78
TbDoSmbForwardUserName	0x1f91e	0x79
TbDoSmbGeneric	0x21294	0x7a
TbDoSmbGetMachineName	0x1f9bd	0x7b
TbDoSmbGetPrintQueue	0x1fb2b	0x7c
TbDoSmbHalfNtExtSessionSetupAndX	0x23b6e	0x7d
TbDoSmbIoctl	0x16308	0x7e
TbDoSmbIoctlSecondary	0x16474	0x7f
TbDoSmbLockAndRead	0x21fec	0x80
TbDoSmbLockByteRange	0x1fbac	0x81
TbDoSmbLockingAndX	0x1fbd9	0x82
TbDoSmbLogoffAndX	0x1671d	0x83
TbDoSmbMove	0x1fca2	0x84
TbDoSmbNegotiate	0x1de55	0x85
TbDoSmbNtCancel	0x21227	0x86
TbDoSmbNtCreateAndX	0x1e8f5	0x87
TbDoSmbNtExtSessionSetupAndX	0x2398e	0x88
TbDoSmbNtLockingAndX	0x1fc06	0x89
TbDoSmbNtReadAndX	0x1edcf	0x8a
TbDoSmbNtReadRaw	0x22242	0x8b
TbDoSmbNtRename	0x20959	0x8c
TbDoSmbNtSessionSetupAndX	0x238ed	0x8d
TbDoSmbNtTransact	0x25def	0x8e
TbDoSmbNtTransactSecondary	0x25ee9	0x8f
TbDoSmbNtWriteAndX	0x1f2c3	0x90
TbDoSmbNtWriteRaw	0x299b6	0x91
TbDoSmbOpen	0x1fdd2	0x92
TbDoSmbOpenAndX	0x2006c	0x93
TbDoSmbOpenPrintFile	0x200fb	0x94
TbDoSmbPacket	0x1c151	0x95
TbDoSmbPeekNamedPipe	0x27176	0x96
TbDoSmbProcessExit	0x20189	0x97
TbDoSmbQueryInformation	0x202b8	0x98
TbDoSmbQueryInformation2	0x20469	0x99
TbDoSmbQueryInformationDisk	0x205ae	0x9a
TbDoSmbQueryInformationSrv	0x208ae	0x9b
TbDoSmbRead	0x21f49	0x9c
TbDoSmbReadAndX	0x2208f	0x9d
TbDoSmbReadMpx	0x22130	0x9e
TbDoSmbReadRaw	0x221d1	0x9f
TbDoSmbRecvData	0x1b817	0xa0
TbDoSmbRename	0x2092c	0xa1
TbDoSmbSearch	0x20b3e	0xa2
TbDoSmbSeek	0x20efb	0xa3
TbDoSmbSendBroadcastMessage	0x20f79	0xa4
TbDoSmbSendData	0x1b726	0xa5
TbDoSmbSendEndMbMessage	0x2104a	0xa6
TbDoSmbSendMessage	0x20fad	0xa7
TbDoSmbSendStartMbMessage	0x2107a	0xa8
TbDoSmbSendTextMbMessage	0x21108	0xa9
TbDoSmbSessionSetupAndX	0x23874	0xaa
TbDoSmbSetInformation	0x21138	0xab
TbDoSmbSetInformation2	0x21165	0xac
TbDoSmbShutdown	0x1b647	0xad
TbDoSmbStartup	0x1b262	0xae
TbDoSmbStartupEx	0x1b442	0xaf
TbDoSmbTransactRemApi	0x26078	0xb0
TbDoSmbTransaction	0x259f1	0xb1
TbDoSmbTransaction2	0x25af6	0xb2
TbDoSmbTransaction2Secondary	0x25cf5	0xb3
TbDoSmbTransactionMailslot	0x25fe0	0xb4
TbDoSmbTransactionNamedPipe	0x27080	0xb5
TbDoSmbTransactionSecondary	0x25bfb	0xb6
TbDoSmbTreeConnect	0x27ae1	0xb7
TbDoSmbTreeConnectAndX	0x27b6c	0xb8
TbDoSmbTreeDisconnect	0x21192	0xb9
TbDoSmbUnlockByteRange	0x211fa	0xba
TbDoSmbWrite	0x29489	0xbb
TbDoSmbWrite103Raw	0x29a52	0xbc
TbDoSmbWriteAndClose	0x29597	0xbd
TbDoSmbWriteAndCloseLong	0x2961c	0xbe
TbDoSmbWriteAndUnlock	0x29510	0xbf
TbDoSmbWriteAndX	0x296a1	0xc0
TbDoSmbWriteMpx	0x29726	0xc1
TbDoSmbWriteMpxComplete	0x2985f	0xc2
TbDoSmbWriteMpxSecondary	0x297da	0xc3
TbDoSmbWritePrintFile	0x298e4	0xc4
TbDoSmbWriteRaw	0x2991a	0xc5
TbDoTcpFault	0xec15	0xc6
TbDoTcpReply	0xeca5	0xc7
TbDoTcpReq	0xed67	0xc8
TbDoTcpSendRecv	0xcf8e	0xc9
TbDoUdpReq	0x1029c	0xca
TbE_P16	0x151ee	0xcb
TbE_P24	0x15257	0xcc
TbE_old_pw_hash	0x152cb	0xcd
TbEmulateNT	0x2db69	0xce
TbEmulateSamba	0x2e2db	0xcf
TbEmulateVista	0x2e1b9	0xd0
TbEmulateVista_64	0x2e3eb	0xd1
TbEmulateW2K	0x2dc70	0xd2
TbEmulateW2K3SP0	0x2df7b	0xd3
TbEmulateW2K3SP1	0x2e09a	0xd4
TbEmulateW2K3_64	0x2e3eb	0xd5
TbEmulateXPSP2	0x2de60	0xd6
TbEmulateXP_64	0x2e3eb	0xd7
TbEmulateXPpre2	0x2dd68	0xd8
TbFileTimeToSystemTime	0x307be	0xd9
TbFillMechOidBuffer	0x29ade	0xda
TbFillUdpHdr	0xf7ac	0xdb
TbFinishSocket	0x312d1	0xdc
TbFixSmbSecuritySignature	0x1baf9	0xdd
TbFreeInt	0x30444	0xde
TbFreeStructBuffers	0x2fda7	0xdf
TbGet32BitJan70Time	0x304e7	0xe0
TbGet32BitJan80Time	0x3047b	0xe1
TbGetAllRpcServices	0x11450	0xe2
TbGetArg	0xa151	0xe3
TbGetAsnDerSize	0xafb3	0xe4
TbGetAsnOid	0xb0de	0xe5
TbGetAuth3	0xc5d0	0xe6
TbGetAuthTrailerTcp	0xc53b	0xe7
TbGetAuthVSize	0x1469	0xe8
TbGetAuthVerifier	0x1596	0xe9
TbGetBindAckRpc	0xca94	0xea
TbGetBindRpc	0xc8dd	0xeb
TbGetBuff	0xa193	0xec
TbGetBuff2	0xa1f8	0xed
TbGetByte	0xae6d	0xee
TbGetCtxHand	0xa6e5	0xef
TbGetCurrentTime	0x304ff	0xf0
TbGetDirectoryListingA	0x1d6f8	0xf1
TbGetDirectoryListingU	0x1d0c8	0xf2
TbGetErrString	0x39bd	0xf3
TbGetErrStringFromList	0x467b	0xf4
TbGetFaultHdr	0xf784	0xf5
TbGetFaultRpc	0xcc3a	0xf6
TbGetHyper	0xae1c	0xf7
TbGetHyperAligned	0xae88	0xf8
TbGetIfData	0x2c203	0xf9
TbGetIpid	0xa877	0xfa
TbGetKerbAuthInfo	0x2f626	0xfb
TbGetKerberosTicket	0x83b3	0xfc
TbGetLangStringInfo	0x1373b	0xfd
TbGetLastKerbError	0x2f704	0xfe
TbGetListHdr	0xa26e	0xff
TbGetListenSocket	0x319c1	0x100
TbGetLong	0xae37	0x101
TbGetLongAligned	0xaeb2	0x102
TbGetMgmt0Info	0x116e4	0x103
TbGetMicroseconds	0x3053a	0x104
TbGetNSH	0x855b	0x105
TbGetNetlogonAuthItems	0x2f723	0x106
TbGetNetlogonAuthVerifier	0x8bc9	0x107
TbGetNetlogonAuthVerifierSize	0x8cc9	0x108
TbGetNtlmAuthVerifier	0x39be	0x109
TbGetNtlmAuthVerifierSize	0x3a32	0x10a
TbGetNtlmInitNegFlags	0x2eebc	0x10b
TbGetNtlmResultNegFlags	0x2eecc	0x10c
TbGetOxid	0xa7f8	0x10d
TbGetPointer	0xaf04	0x10e
TbGetPointerAligned	0xaf3b	0x10f
TbGetProtocolLegCount	0x13c3	0x110
TbGetRemoteIdInfo	0x2ef6d	0x111
TbGetRemoteTime	0x2fac4	0x112
TbGetReplyRpc	0xcd47	0x113
TbGetRequestRpc	0xcce5	0x114
TbGetResponseBuffer	0x2eead	0x115
TbGetRpcArray	0xb6a4	0x116
TbGetRpcArrayWithMax	0xb748	0x117
TbGetRpcAsciiString	0xb802	0x118
TbGetRpcSize	0xaf81	0x119
TbGetRpcUniString	0xb7e7	0x11a
TbGetSRpc	0xbf26	0x11b
TbGetSessionKey	0x2faf2	0x11c
TbGetShort	0xae52	0x11d
TbGetShortAligned	0xaedc	0x11e
TbGetSmbErrString	0x39bd	0x11f
TbGetSmbExtendedSecurityFlag	0x2f99d	0x120
TbGetSmbHeader	0x1ac2a	0x121
TbGetSmbLocalInfo	0x2f8a9	0x122
TbGetSmbRemoteInfo	0x2f91b	0x123
TbGetSmbTransactionData	0x27238	0x124
TbGetSmbTransactionParameters	0x272a1	0x125
TbGetSnegoAuthInfo	0x2f239	0x126
TbGetSnegoAuthVerifier	0x2aaa2	0x127
TbGetSnegoAuthVerifierSize	0x2abcb	0x128
TbGetSocket	0x319b9	0x129
TbGetSocketError	0x31344	0x12a
TbGetSocketErrorString	0x3134a	0x12b
TbGetString	0xa3b0	0x12c
TbGetStringValue	0x1bc56	0x12d
TbGetStubBuffer	0x2ee9e	0x12e
TbGetSyntax	0xa792	0x12f
TbGetTcpRecvCt	0xf182	0x130
TbGetTcpSendCt	0xf168	0x131
TbGetTcpStub	0xe95c	0x132
TbGetTextTimeString	0x3107c	0x133
TbGetTimeString	0x30fba	0x134
TbGetTimeout	0x319f4	0x135
TbGetUdpHdr	0xf57f	0x136
TbGetUdpStub	0xfd5b	0x137
TbGetUuid	0xa668	0x138
TbGoodString	0x39bd	0x139
TbHandleNbtError	0x39bd	0x13a
TbInitCrypto	0x13e8	0x13b
TbInitNetlogonCrypto	0x39bd	0x13c
TbInitNtlmCrypto	0x3a36	0x13d
TbInitSnegoCrypto	0x2abef	0x13e
TbInitStruct	0x2ff80	0x13f
TbLocateNpRpcPort	0x11374	0x140
TbLocateRpcService	0x111ef	0x141
TbLocateTcpRpcPort	0x11325	0x142
TbLocateUdpRpcPort	0x11401	0x143
TbMakeAlterCtx	0xd5d1	0x144
TbMakeAuth3	0xd7ab	0x145
TbMakeAuthVerifier	0x1416	0x146
TbMakeBind	0xd41d	0x147
TbMakeBindAck	0xcfb5	0x148
TbMakeBindNak	0xd394	0x149
TbMakeBlob1	0x1000	0x14a
TbMakeBlob2	0x1043	0x14b
TbMakeBlob3	0x108f	0x14c
TbMakeBlob4	0x10d4	0x14d
TbMakeCancelForward	0x16777	0x14e
TbMakeCheckDirectory	0x168b7	0x14f
TbMakeClose	0x1661a	0x150
TbMakeCloseAndTdisc	0x169f3	0x151
TbMakeClosePrint	0x16af6	0x152
TbMakeCopy	0x16bce	0x153
TbMakeCreate	0x16e0c	0x154
TbMakeCreateDir	0x16faa	0x155
TbMakeCreateTemp	0x170de	0x156
TbMakeDelete	0x1727b	0x157
TbMakeDeleteDirectory	0x173ee	0x158
TbMakeEcho	0x17529	0x159
TbMakeFault	0xd8ad	0x15a
TbMakeFindClose2	0x1769d	0x15b
TbMakeFindNotifyClose	0x17787	0x15c
TbMakeFlush	0x17847	0x15d
TbMakeForwardUserName	0x1791c	0x15e
TbMakeGeneric	0x1a644	0x15f
TbMakeGetPrintQueue	0x17a5a	0x160
TbMakeIoctl	0x15933	0x161
TbMakeIoctlSecondary	0x15e09	0x162
TbMakeLockByteRange	0x17b50	0x163
TbMakeLockingAndX	0x17c7f	0x164
TbMakeLogoffAndX	0x1654d	0x165
TbMakeMove	0x185b5	0x166
TbMakeNbtSessionRequest	0x87c7	0x167
TbMakeNegotiate	0x1d7b3	0x168
TbMakeNetlogonAuthVerifier	0x9238	0x169
TbMakeNetlogonBlob1	0x891d	0x16a
TbMakeNetlogonBlob2	0x39bd	0x16b
TbMakeNetlogonBlob3	0x39bd	0x16c
TbMakeNtCreateAndX	0x1e5cc	0x16d
TbMakeNtExtSessionSetupAndX	0x22d89	0x16e
TbMakeNtLockingAndX	0x1805b	0x16f
TbMakeNtReadAndX	0x1ec55	0x170
TbMakeNtReadRaw	0x21adc	0x171
TbMakeNtRename	0x19321	0x172
TbMakeNtSessionSetupAndX	0x22742	0x173
TbMakeNtTransact	0x245e3	0x174
TbMakeNtTransactSecondary	0x24ae8	0x175
TbMakeNtWriteAndX	0x1f0bf	0x176
TbMakeNtWriteRaw	0x28fc1	0x177
TbMakeNtlmAuthVerifier	0x4124	0x178
TbMakeNtlmBlob1	0x33a0	0x179
TbMakeNtlmBlob2	0x372c	0x17a
TbMakeNtlmBlob3	0x3d81	0x17b
TbMakeOpen	0x187f3	0x17c
TbMakeOpenAndX	0x1899c	0x17d
TbMakeOpenPrintFile	0x18ce9	0x17e
TbMakePeekNamedPipe	0x265f1	0x17f
TbMakeQueryInformation	0x18e8b	0x180
TbMakeQueryInformation2	0x18f9c	0x181
TbMakeQueryInformationSrv	0x19071	0x182
TbMakeRead	0x2138d	0x183
TbMakeReadAndX	0x214f6	0x184
TbMakeReadMpx	0x2173a	0x185
TbMakeReadRaw	0x2190a	0x186
TbMakeRemQIRequest	0x2c8a2	0x187
TbMakeRename	0x19131	0x188
TbMakeSearch	0x19587	0x189
TbMakeSeek	0x1999c	0x18a
TbMakeSendEndMbMessage	0x19cff	0x18b
TbMakeSendMessage	0x19acc	0x18c
TbMakeSendStartMbMessage	0x19dd7	0x18d
TbMakeSendTextMbMessage	0x19f42	0x18e
TbMakeServerSocket	0x31bc6	0x18f
TbMakeSessionSetupAndX	0x222b3	0x190
TbMakeSetInformation	0x1a0cc	0x191
TbMakeSetInformation2	0x1a303	0x192
TbMakeSmbHeader	0x1aa19	0x193
TbMakeSnegoAuthVerifier	0x2acb3	0x194
TbMakeSnegoBlob1	0x29c81	0x195
TbMakeSnegoBlob2	0x29d8e	0x196
TbMakeSnegoBlob3	0x29e23	0x197
TbMakeSnegoBlob4	0x29ee2	0x198
TbMakeSocket	0x31a08	0x199
TbMakeSocketPair	0x31866	0x19a
TbMakeSysactRequest	0x2ba0f	0x19b
TbMakeTcpReply	0xe36a	0x19c
TbMakeTcpReq	0xe612	0x19d
TbMakeTransaction	0x23db5	0x19e
TbMakeTransactionMailSlot	0x24ece	0x19f
TbMakeTransactionNamedPipe	0x26163	0x1a0
TbMakeTransactionRemApi	0x2543f	0x1a1
TbMakeTransactionSecondary	0x2424d	0x1a2
TbMakeTreeConnect	0x2730a	0x1a3
TbMakeTreeConnectAndX	0x2762e	0x1a4
TbMakeUNDHeader	0x85cf	0x1a5
TbMakeUdpFack	0xfb59	0x1a6
TbMakeUdpReq	0xf8d6	0x1a7
TbMakeUdpResp	0xfc9d	0x1a8
TbMakeUnlockByteRange	0x1a50d	0x1a9
TbMakeWrite	0x27be7	0x1aa
TbMakeWrite103Raw	0x29284	0x1ab
TbMakeWriteAndClose	0x27dc9	0x1ac
TbMakeWriteAndCloseLong	0x27f81	0x1ad
TbMakeWriteAndX	0x28191	0x1ae
TbMakeWriteMpx	0x2848d	0x1af
TbMakeWriteMpxComplete	0x28934	0x1b0
TbMakeWriteMpxSecondary	0x28732	0x1b1
TbMakeWritePrintFile	0x28bd9	0x1b2
TbMakeWriteRaw	0x28d39	0x1b3
TbMalloc	0x3044a	0x1b4
TbMatchMechOid	0x29a85	0x1b5
TbNTLMSSPOWFencrypt	0x1571d	0x1b6
TbNetlogonB1size	0x895f	0x1b7
TbNetlogonB2size	0x467b	0x1b8
TbNetlogonB3size	0x467b	0x1b9
TbNlMakeCredential	0x91e4	0x1ba
TbNlMakeSessionKey	0x9172	0x1bb
TbNlMakeWeakSessionKey	0x9118	0x1bc
TbNtlmB1size	0x350d	0x1bd
TbNtlmB2size	0x3919	0x1be
TbNtlmB3size	0x394d	0x1bf
TbOutputBuffer	0x39bd	0x1c0
TbParseBlob1	0x10f3	0x1c1
TbParseBlob2	0x1150	0x1c2
TbParseBlob3	0x11a2	0x1c3
TbParseBlob4	0x11df	0x1c4
TbParseKerbBlob	0x7440	0x1c5
TbParseKerbTicketBlob	0x7884	0x1c6
TbParseNegFlags	0x39bd	0x1c7
TbParseNetlogonBlob1	0x6431	0x1c8
TbParseNetlogonBlob2	0x6431	0x1c9
TbParseNetlogonBlob3	0x6431	0x1ca
TbParseNtlmBlob1	0x237e	0x1cb
TbParseNtlmBlob2	0x1fe2	0x1cc
TbParseNtlmBlob3	0x265b	0x1cd
TbParseRemQIResponse	0x2c941	0x1ce
TbParseSmbCaps	0x39bd	0x1cf
TbParseSmbFlag1	0x39bd	0x1d0
TbParseSmbFlag2	0x39bd	0x1d1
TbParseSmbNativeOS	0x212c7	0x1d2
TbParseSnegoBlob1	0x2a025	0x1d3
TbParseSnegoBlob2	0x2a248	0x1d4
TbParseSnegoBlob3	0x2a29b	0x1d5
TbParseSysactResponse	0x2c5d3	0x1d6
TbPrintAsnTree	0x39bd	0x1d7
TbPrintAsnTreeNodes	0x39bd	0x1d8
TbPrintBlob2Info	0x39bd	0x1d9
TbPrintIfPtr	0x39bd	0x1da
TbPrintNetlogonBlob2Info	0x39bd	0x1db
TbPrintNtTransactResp	0x39bd	0x1dc
TbPrintNtlmBlob2Info	0x39bd	0x1dd
TbPrintSmbNtExtSessionSetupAndXResp	0x39bd	0x1de
TbPrintSmbSessionSetupAndXResp	0x39bd	0x1df
TbPrintSnegoBlob2Info	0x39bd	0x1e0
TbPrintSysActReplyData	0x39bd	0x1e1
TbPrintTOD	0x39bd	0x1e2
TbPrintTowerInfo	0x39bd	0x1e3
TbPrintTransactionResp	0x39bd	0x1e4
TbPutARG	0x9ee5	0x1e5
TbPutAlign	0xab5d	0x1e6
TbPutArg	0x9e32	0x1e7
TbPutAsnBerShortSize	0xadcb	0x1e8
TbPutAsnDerSize	0xacd1	0x1e9
TbPutAuth3	0xc697	0x1ea
TbPutAuthTrailerTcp	0xc4c0	0x1eb
TbPutAuthVerifier	0x154d	0x1ec
TbPutBindAckRpc	0xc2df	0x1ed
TbPutBindRpc	0xc171	0x1ee
TbPutBlob1	0x1205	0x1ef
TbPutBlob2	0x125d	0x1f0
TbPutBlob3	0x1294	0x1f1
TbPutBlob4	0x12cb	0x1f2
TbPutBuff	0xa064	0x1f3
TbPutBuffCyclic	0xa0be	0x1f4
TbPutByte	0xabd6	0x1f5
TbPutCTH	0x9742	0x1f6
TbPutContexts	0xc401	0x1f7
TbPutCtxHand	0xba8a	0x1f8
TbPutDSA	0x94af	0x1f9
TbPutFackHdr	0xf4ae	0x1fa
TbPutFault	0xc738	0x1fb
TbPutHyper	0xab8e	0x1fc
TbPutHyperAligned	0xac44	0x1fd
TbPutIfPtr	0x97a9	0x1fe
TbPutIpid	0x9742	0x1ff
TbPutListHdr	0xb90e	0x200
TbPutLocalThis	0x9704	0x201
TbPutLong	0xaba6	0x202
TbPutLongAligned	0xac73	0x203
TbPutNSH	0x84f5	0x204
TbPutNetlogonAuthVerifier	0x8ae5	0x205
TbPutNetlogonBlob1	0x89cd	0x206
TbPutNetlogonBlob2	0x6431	0x207
TbPutNtCreateX	0x1e0fa	0x208
TbPutNtReadX	0x1e983	0x209
TbPutNtWriteX	0x1ee7a	0x20a
TbPutNtlmAuthVerifier	0x9742	0x20b
TbPutNtlmBlob1	0x2cdb	0x20c
TbPutNtlmBlob2	0x2e73	0x20d
TbPutNtlmBlob3	0x304b	0x20e
TbPutOneArg	0x26d7a	0x20f
TbPutOrpcThat	0x9704	0x210
TbPutOrpcThis	0x9677	0x211
TbPutOxid	0xbad3	0x212
TbPutPadding	0x9dc6	0x213
TbPutPointer	0xabee	0x214
TbPutRequest	0xc7ff	0x215
TbPutResponse	0xc864	0x216
TbPutResult	0xc28b	0x217
TbPutRpcArray	0xbc63	0x218
TbPutRpcArrayWithMax	0xbccb	0x219
TbPutRpcAsciiString	0xbb7a	0x21a
TbPutRpcSize	0xac73	0x21b
TbPutRpcUniString	0xbbd3	0x21c
TbPutSRpc	0xc06e	0x21d
TbPutShort	0xabbe	0x21e
TbPutShortAligned	0xaca2	0x21f
TbPutSmbHeader	0x1a86d	0x220
TbPutSnegoAuthVerifier	0x2a970	0x221
TbPutSnegoBlob1	0x2a8d9	0x222
TbPutSnegoBlob2	0x2a900	0x223
TbPutSnegoBlob3	0x2a92b	0x224
TbPutSnegoBlob4	0x2a92b	0x225
TbPutStr	0xa94e	0x226
TbPutStrAsLEUni	0xa8f4	0x227
TbPutString	0xb99d	0x228
TbPutSyntax	0xa73e	0x229
TbPutTransInfo	0x26eb0	0x22a
TbPutTransact	0x23c3a	0x22b
TbPutUNISTRContents	0xbe23	0x22c
TbPutUNISTRHeader	0xbd38	0x22d
TbPutUdpHdr	0xf369	0x22e
TbPutUdpNetbiosHeader	0x8694	0x22f
TbPutUniBuff	0xb81d	0x230
TbPutUuid	0xa601	0x231
TbRc4Init40	0x157cf	0x232
TbReadFileA	0x1d00d	0x233
TbReadFileU	0x1cd0e	0x234
TbReadSmbHeader	0x1ae2b	0x235
TbReadSmbIoctlResp	0x161c5	0x236
TbReadSmbNegOldResp	0x20fe1	0x237
TbReadSmbNegResp	0x1d8da	0x238
TbReadSmbNtCreateAndXResp	0x1e2a5	0x239
TbReadSmbNtExtSessionSetupAndXResp	0x23509	0x23a
TbReadSmbNtNegResp	0x1db69	0x23b
TbReadSmbNtTransactResp	0x25817	0x23c
TbReadSmbPeekResp	0x26a90	0x23d
TbReadSmbReadAndXResp	0x1ea9e	0x23e
TbReadSmbReadMpxResp	0x21ce4	0x23f
TbReadSmbReadResp	0x21e08	0x240
TbReadSmbSessionSetupAndXResp	0x23207	0x241
TbReadSmbTransactionResp	0x268cf	0x242
TbReadSmbTreeConnectAndXResp	0x27973	0x243
TbReadSmbTreeConnectResp	0x275b0	0x244
TbReadSmbWriteAndXResp	0x1efdd	0x245
TbReadSmbWriteRawResp	0x20fe1	0x246
TbReadSmbWriteResp	0x20fe1	0x247
TbRealloc	0x3046f	0x248
TbRecv	0x314c4	0x249
TbRecvBuffer	0x31560	0x24a
TbRecvFrom	0x315f0	0x24b
TbRecvSmb	0x1af78	0x24c
TbRecvTcp	0xcdd5	0x24d
TbRecvUdp	0xfdb0	0x24e
TbReleaseListenSocket	0x319d5	0x24f
TbReleaseSocket	0x319c9	0x250
TbResetLastKerbError	0x2f715	0x251
TbResetPointer2k3Base	0xaafe	0x252
TbResetRemoteInfo	0x2fc2f	0x253
TbResetSocketForDcom	0x2f9aa	0x254
TbResetStruct	0x2eca9	0x255
TbSMBNTencrypt	0x1577f	0x256
TbSMBOWFencrypt	0x156cb	0x257
TbSMBencrypt	0x158be	0x258
TbSamOEMhash	0x153d6	0x259
TbSend	0x31377	0x25a
TbSendBuffer	0x313bb	0x25b
TbSendTo	0x31402	0x25c
TbServerRecv	0x31682	0x25d
TbSetAuthLevelAndType	0x2dae0	0x25e
TbSetAuthenticationData	0x2d435	0x25f
TbSetAuthenticationDataExA	0x2d52d	0x260
TbSetAuthenticationDataExU	0x2d62e	0x261
TbSetAuthenticationHashesA	0x2d8df	0x262
TbSetAuthenticationHashesU	0x2d9d0	0x263
TbSetCallbackSocketData	0x2fb66	0x264
TbSetCharUsageType	0x2f81e	0x265
TbSetDcomVersion	0x2f7ac	0x266
TbSetDestIdInfo	0x2f14c	0x267
TbSetDestMachineNameA	0x2e75e	0x268
TbSetDestMachineNameU	0x2eba5	0x269
TbSetDoNetbiosLogin	0x2f80e	0x26a
TbSetDomainA	0x2e471	0x26b
TbSetDomainU	0x2e839	0x26c
TbSetKerbAuthInfo	0x2fec6	0x26d
TbSetLocalEndian	0x2e3fa	0x26e
TbSetLocalIdInfo	0x2f05f	0x26f
TbSetLocalSocketData	0x2d3fa	0x270
TbSetMachineNameA	0x2e660	0x271
TbSetMachineNameU	0x2ea81	0x272
TbSetMaxFragSend	0x2f787	0x273
TbSetNetbiosLoginFlag	0x2f80e	0x274
TbSetNetlogonAuthItems	0x2f760	0x275
TbSetNlMachinePassword	0x2fbb2	0x276
TbSetNtlmLevel	0x2f7ca	0x277
TbSetNtlmNegFlags	0x2eedc	0x278
TbSetPadChar	0x2f79c	0x279
TbSetPipename	0x2fb0f	0x27a
TbSetRemoteSocketData	0x2d34e	0x27b
TbSetRemoteSocketData2	0x2d3d7	0x27c
TbSetSessionKey	0x2fad5	0x27d
TbSetSmbAuthInfo	0x2db35	0x27e
TbSetSmbAuthenticationData	0x2d73c	0x27f
TbSetSmbAuthenticationDataU	0x2d807	0x280
TbSetSmbExtendedSecurityFlag	0x2f98d	0x281
TbSetSmbLocalInfo	0x2f82e	0x282
TbSetSnegoAuthInfo	0x2f361	0x283
TbSetSnegoAuthType	0x2f511	0x284
TbSetSocketBlocking	0x31309	0x285
TbSetSocketError	0x316bc	0x286
TbSetSocketNonblocking	0x31325	0x287
TbSetTcpRecvCt	0xf173	0x288
TbSetTcpSendCt	0xf159	0x289
TbSetTimeout	0x319e1	0x28a
TbSetTimes	0x30915	0x28b
TbSetVcNumber	0x2fb4d	0x28c
TbSetVerbosity	0x2ee89	0x28d
TbShowDirectoryListInfo	0x1bd67	0x28e
TbSimpleCloseSocket	0x312a9	0x28f
TbSimpleRecv	0x3144f	0x290
TbSimpleRecvBuffer	0x31488	0x291
TbSnegoB1size	0x2a930	0x292
TbSnegoB2size	0x2a949	0x293
TbSnegoB3size	0x2a96b	0x294
TbSnegoB4size	0x2a96b	0x295
TbStrToStx	0x30c96	0x296
TbStrToUuid	0x30df6	0x297
TbStrToWstr	0x30980	0x298
TbStringToSizedBuffer	0x3114e	0x299
TbStxToStr	0x30f19	0x29a
TbStxToStrs	0x30eec	0x29b
TbSystemTimeToFileTime	0x3056c	0x29c
TbTcpRecvRaw	0x316c7	0x29d
TbToLower	0x30c3e	0x29e
TbUdpRecvFromRaw	0x31795	0x29f
TbUniToUtf8	0x30b6e	0x2a0
TbUtf8ToUni	0x30a78	0x2a1
TbUuidToStr	0x30ea1	0x2a2
TbWaitServerSocket	0x31244	0x2a3
TbWaitServerSocketNonBlocking	0x31c50	0x2a4
TbWinsockCleanup	0x31238	0x2a5
TbWinsockStartup	0x311f0	0x2a6
TbWipeInterfacePtrs	0x2ee27	0x2a7
TbWriteFileA	0x1cad7	0x2a8
TbWriteFileU	0x1c7cd	0x2a9
TbWriteInfo	0x39bd	0x2aa
TbWritePacket	0x39bd	0x2ab
TbWstrSize	0x30a1a	0x2ac
TbWstrToStr	0x309bc	0x2ad
Tbcred_hash1	0x152fe	0x2ae
Tbcred_hash2	0x15346	0x2af
Tbcred_hash3	0x15397	0x2b0
Tblm_owf_gen	0x15668	0x2b1
Tbnt_owf_gen	0x15602	0x2b2
Tbsam_pwd_hash	0x154ad	0x2b3

c:\windows\temp\tucl-1.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	9.00 KB
MD5	83076104ae977d850d1e015704e5730a
SHA1	776e7079734bc4817e3af0049f42524404a55310
SHA256	cf25bdc6711a72713d80a4a860df724a79042be210930dcbfc522da72b39bb12
SSDeep	192:EXTHmlw2IjGFKL6rBbnbO8slVnZp7snHQNv8uU4l5XLIb/p2:yHm218DrB768mFZxsKv8v4/cF2
ImpHash	b0f67a582b3891cfaf10698b6300d855

PE Information

Image Base	0x10000000
Entry Point	0x10001b9a
Size Of Code	0x1000
Size Of Initialized Data	0x1400
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:50:54+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0xfb6	0x1000	0x400	cnt_code, mem_execute, mem_read	6.3
.rdata	0x10002000	0x5cf	0x600	0x1400	cnt_initialized_data, mem_read	4.8
.data	0x10003000	0x65c	0x400	0x1a00	cnt_initialized_data, mem_read, mem_write	5.79
.reloc	0x10004000	0x488	0x600	0x1e00	cnt_initialized_data, mem_discardable, mem_read	1.94

Imports (2)

KERNEL32.dll (13)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x10002000	0x2270	0x1670	0x10e
GetCurrentThreadId	0x0	0x10002004	0x2274	0x1674	0x110
GetTickCount	0x0	0x10002008	0x2278	0x1678	0x18a
QueryPerformanceCounter	0x0	0x1000200c	0x227c	0x167c	0x22f
SetUnhandledExceptionFilter	0x0	0x10002010	0x2280	0x1680	0x2bc
UnhandledExceptionFilter	0x0	0x10002014	0x2284	0x1684	0x2df
GetCurrentProcess	0x0	0x10002018	0x2288	0x1688	0x10d
TerminateProcess	0x0	0x1000201c	0x228c	0x168c	0x2cf
InterlockedCompareExchange	0x0	0x10002020	0x2290	0x1690	0x1cb
Sleep	0x0	0x10002024	0x2294	0x1694	0x2c7
InterlockedExchange	0x0	0x10002028	0x2298	0x1698	0x1cd
RtlUnwind	0x0	0x1000202c	0x229c	0x169c	0x25b
GetSystemTimeAsFileTime	0x0	0x10002030	0x22a0	0x16a0	0x17a

msvcrt.dll (21)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_iob	0x0	0x10002038	0x22a8	0x16a8	0x1db
memmove	0x0	0x1000203c	0x22ac	0x16ac	0x4ec
malloc	0x0	0x10002040	0x22b0	0x16b0	0x4de
strlen	0x0	0x10002044	0x22b4	0x16b4	0x51c
fflush	0x0	0x10002048	0x22b8	0x16b8	0x495
vfprintf	0x0	0x1000204c	0x22bc	0x16bc	0x540
isprint	0x0	0x10002050	0x22c0	0x16c0	0x4c4
memcpy	0x0	0x10002054	0x22c4	0x16c4	0x4ea
sprintf	0x0	0x10002058	0x22c8	0x16c8	0x50b
memset	0x0	0x1000205c	0x22cc	0x16cc	0x4ee
fprintf	0x0	0x10002060	0x22d0	0x16d0	0x49f
fclose	0x0	0x10002064	0x22d4	0x16d4	0x492
free	0x0	0x10002068	0x22d8	0x16d8	0x4a6
fopen	0x0	0x1000206c	0x22dc	0x16dc	0x49d
calloc	0x0	0x10002070	0x22e0	0x16e0	0x485
_XcptFilter	0x0	0x10002074	0x22e4	0x16e4	0x6a
_initterm	0x0	0x10002078	0x22e8	0x16e8	0x1d5
_amsg_exit	0x0	0x1000207c	0x22ec	0x16ec	0x101
_adjust_fdiv	0x0	0x10002080	0x22f0	0x16f0	0xf5
_errno	0x0	0x10002084	0x22f4	0x16f4	0x156
perror	0x0	0x10002088	0x22f8	0x16f8	0x4f1

Exports (6)

Api name	EAT Address	Ordinal
DEBUG_TcLog	0x10cb	0x1
TcLog	0x102d	0x2
TcLogBuffer	0x1115	0x3
TcLogClose	0x132b	0x4
TcLogOpen	0x1376	0x5
TcLogSetMask	0x1356	0x6

c:\windows\temp\coli-0.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	15.00 KB
MD5	3c2fe2dbdf09cfa869344fdb53307cb2
SHA1	b67a8475e6076a24066b7cb6b36d307244bb741f
SHA256	0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887
SSDeep	192:c1VDVzDJuoJ/a8yRIB4Al4rKoRbFjGgGz3bG8sEwdCs8Ej2uHR0EhBkM2NFU+z4o:c1VxsoNKI++u1qz3K8BwxCO103z4VL2
ImpHash	3bdaf0330fb6625e9822b4db8158a8ba

PE Information

Image Base	0x10000000
Entry Point	0x100027fa
Size Of Code	0x1e00
Size Of Initialized Data	0x1e00
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:52:55+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x1c16	0x1e00	0x400	cnt_code, mem_execute, mem_read	6.06
.rdata	0x10003000	0xf89	0x1000	0x2200	cnt_initialized_data, mem_read	5.02
.data	0x10004000	0x65c	0x400	0x3200	cnt_initialized_data, mem_read, mem_write	5.79
.reloc	0x10005000	0x528	0x600	0x3600	cnt_initialized_data, mem_discardable, mem_read	2.76

Imports (6)

KERNEL32.dll (13)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x10003000	0x34d0	0x26d0	0x10e
GetCurrentThreadId	0x0	0x10003004	0x34d4	0x26d4	0x110
GetTickCount	0x0	0x10003008	0x34d8	0x26d8	0x18a
QueryPerformanceCounter	0x0	0x1000300c	0x34dc	0x26dc	0x22f
SetUnhandledExceptionFilter	0x0	0x10003010	0x34e0	0x26e0	0x2bc
UnhandledExceptionFilter	0x0	0x10003014	0x34e4	0x26e4	0x2df
GetCurrentProcess	0x0	0x10003018	0x34e8	0x26e8	0x10d
TerminateProcess	0x0	0x1000301c	0x34ec	0x26ec	0x2cf
InterlockedCompareExchange	0x0	0x10003020	0x34f0	0x26f0	0x1cb
Sleep	0x0	0x10003024	0x34f4	0x26f4	0x2c7
InterlockedExchange	0x0	0x10003028	0x34f8	0x26f8	0x1cd
RtlUnwind	0x0	0x1000302c	0x34fc	0x26fc	0x25b
GetSystemTimeAsFileTime	0x0	0x10003030	0x3500	0x2700	0x17a

exma-1.dll (11)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
disconnectRendezvous	0x0	0x10003038	0x3508	0x2708	0x4
closeRendezvous	0x0	0x1000303c	0x350c	0x270c	0x2
sendSockets	0x0	0x10003040	0x3510	0x2710	0x9
readParamsFromEM	0x0	0x10003044	0x3514	0x2714	0x7
writeParamsToEM	0x0	0x10003048	0x3518	0x2718	0xa
recvSocket	0x0	0x1000304c	0x351c	0x271c	0x8
connectRendezvous	0x0	0x10003050	0x3520	0x2720	0x3
getDefaultEMFile	0x0	0x10003054	0x3524	0x2724	0x5
bindRendezvous	0x0	0x10003058	0x3528	0x2728	0x0
closeEM	0x0	0x1000305c	0x352c	0x272c	0x1
openEMForWriting	0x0	0x10003060	0x3530	0x2730	0x6

tibe-2.dll (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TbWinsockCleanup	0x0	0x100030a4	0x3574	0x2774	0x2a4
TbWinsockStartup	0x0	0x100030a8	0x3578	0x2778	0x2a5

trch-1.dll (54)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Parameter_U16_getValue	0x0	0x100030b0	0x3580	0x2780	0x8b
Paramgroup_getNumParamchoices	0x0	0x100030b4	0x3584	0x2784	0xc7
Parameter_matchType	0x0	0x100030b8	0x3588	0x2788	0xbe
Config_getID	0x0	0x100030bc	0x358c	0x278c	0xb
Config_getInputParams	0x0	0x100030c0	0x3590	0x2790	0xc
Config_getNamespaceUri	0x0	0x100030c4	0x3594	0x2794	0xe
Config_getSchemaVersion	0x0	0x100030c8	0x3598	0x2798	0x10
Config_getConstants	0x0	0x100030cc	0x359c	0x279c	0xa
Config_getOutputParams	0x0	0x100030d0	0x35a0	0x27a0	0xf
Parameter_U16_setValue	0x0	0x100030d4	0x35a4	0x27a4	0x8c
Parameter_String_create	0x0	0x100030d8	0x35a8	0x27a8	0x81
Parameter_Boolean_create	0x0	0x100030dc	0x35ac	0x27ac	0x36
Parameter_hasValue	0x0	0x100030e0	0x35b0	0x27b0	0xb4
Parameter_String_getValue	0x0	0x100030e4	0x35b4	0x27b4	0x82
Parameter_markInvalid	0x0	0x100030e8	0x35b8	0x27b8	0xb9
Parameter_Boolean_getValue	0x0	0x100030ec	0x35bc	0x27bc	0x37
Params_findParamchoice	0x0	0x100030f0	0x35c0	0x27c0	0xd3
Config_create	0x0	0x100030f4	0x35c4	0x27c4	0x6
Params_create	0x0	0x100030f8	0x35c8	0x27c8	0xd0
Config_setInputParams	0x0	0x100030fc	0x35cc	0x27cc	0x15
Parameter_LocalFile_create	0x0	0x10003100	0x35d0	0x27d0	0x52
Params_parseCommandLine	0x0	0x10003104	0x35d4	0x27d4	0xde
Config_delete	0x0	0x10003108	0x35d8	0x27d8	0x7
Params_isValid	0x0	0x1000310c	0x35dc	0x27dc	0xdd
Config_printUsage	0x0	0x10003110	0x35e0	0x27e0	0x13
Params_printInvalid	0x0	0x10003114	0x35e4	0x27e4	0xdf
Parameter_LocalFile_getValue	0x0	0x10003118	0x35e8	0x27e8	0x53
Parameter_hasValidValue	0x0	0x1000311c	0x35ec	0x27ec	0xb3
Paramgroup_getParamchoice	0x0	0x10003120	0x35f0	0x27f0	0xc9
Socket_type	0x0	0x10003124	0x35f4	0x27f4	0xf3
Scalar_format	0x0	0x10003128	0x35f8	0x27f8	0xf0
Parameter_matchFormat	0x0	0x1000312c	0x35fc	0x27fc	0xbb
Parameter_Socket_getValue	0x0	0x10003130	0x3600	0x2800	0x7b
Parameter_Socket_setValue	0x0	0x10003134	0x3604	0x2804	0x7c
Parameter_Socket_List_getValue	0x0	0x10003138	0x3608	0x2808	0x78
Parameter_Socket_List_setValue	0x0	0x1000313c	0x360c	0x280c	0x79
Params_removeParameter	0x0	0x10003140	0x3610	0x2810	0xe0
Params_getNumParameters	0x0	0x10003144	0x3614	0x2814	0xda
Params_getParameter	0x0	0x10003148	0x3618	0x2818	0xdc
Params_getNumParamchoices	0x0	0x1000314c	0x361c	0x281c	0xd9
Params_getParamchoice	0x0	0x10003150	0x3620	0x2820	0xdb
Paramchoice_hasValidValue	0x0	0x10003154	0x3624	0x2824	0x2d
Paramchoice_getValue	0x0	0x10003158	0x3628	0x2828	0x2c
Paramchoice_getNumParamgroups	0x0	0x1000315c	0x362c	0x282c	0x2a
Paramchoice_getParamgroup	0x0	0x10003160	0x3630	0x2830	0x2b
Paramgroup_matchName	0x0	0x10003164	0x3634	0x2834	0xcc
Config_marshal	0x0	0x10003168	0x3638	0x2838	0x12
Config_unmarshal	0x0	0x1000316c	0x363c	0x283c	0x17
Params_findParameter	0x0	0x10003170	0x3640	0x2840	0xd4
Parameter_U16_create	0x0	0x10003174	0x3644	0x2844	0x8a
Params_addParameter	0x0	0x10003178	0x3648	0x2848	0xcf
Parameter_delete	0x0	0x1000317c	0x364c	0x284c	0xab
Paramgroup_getNumParameters	0x0	0x10003180	0x3650	0x2850	0xc8
Paramgroup_getParameter	0x0	0x10003184	0x3654	0x2854	0xca

tucl-1.dll (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TcLog	0x0	0x1000318c	0x365c	0x285c	0x1
TcLogClose	0x0	0x10003190	0x3660	0x2860	0x3
TcLogOpen	0x0	0x10003194	0x3664	0x2864	0x4

msvcrt.dll (14)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_adjust_fdiv	0x0	0x10003068	0x3538	0x2738	0xf5
_amsg_exit	0x0	0x1000306c	0x353c	0x273c	0x101
_initterm	0x0	0x10003070	0x3540	0x2740	0x1d5
_XcptFilter	0x0	0x10003074	0x3544	0x2744	0x6a
malloc	0x0	0x10003078	0x3548	0x2748	0x4de
strncpy	0x0	0x1000307c	0x354c	0x274c	0x520
strcat	0x0	0x10003080	0x3550	0x2750	0x511
exit	0x0	0x10003084	0x3554	0x2754	0x48f
strrchr	0x0	0x10003088	0x3558	0x2758	0x524
strlen	0x0	0x1000308c	0x355c	0x275c	0x51c
memcpy	0x0	0x10003090	0x3560	0x2760	0x4ea
tolower	0x0	0x10003094	0x3564	0x2764	0x539
free	0x0	0x10003098	0x3568	0x2768	0x4a6
calloc	0x0	0x1000309c	0x356c	0x276c	0x485

Exports (7)

Api name	EAT Address	Ordinal
coli_create	0x1000	0x1
coli_delete	0x1021	0x2
coli_setCleanup	0x1027	0x3
coli_setID	0x1036	0x4
coli_setProcess	0x1046	0x5
coli_setValidate	0x1056	0x6
mainWrapper	0x1c21	0x7

C:\Windows\temp\spasslog

Created File

Text

Not Queried

Mime Type	text/plain
File Size	0.05 KB
MD5	e8cdce80946fb5b56560510c5ba939c1
SHA1	7627e51c008747f000c6f537c04dd42f2c2abfce
SHA256	3d70971c452ed312c95bab5e4dfa9fb67281472043f39b3c6c0573c226cde8d4
SSDeep	3:EB+mS2+mS2+mS2+mS2+v:rmSmSmSmSv

c:\windows\temp\cnli-1.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	98.50 KB
MD5	a539d27f33ef16e52430d3d2e92e9d5c
SHA1	f6d4f160705dc5a8a028baca75b2601574925ac5
SHA256	db0831e19a4e3a736ea7498dadc2d6702342f75fd8f7fbae1894ee2e9738c2b4
SSDeep	3072:LrZL1wTcqmJ3QthbjsKXhoF3P3aTCLEA7HHxJPt:LN47aF3CTC37H
ImpHash	a482b407319dc74133dc3d7a0212f626

PE Information

Image Base	0x10000000
Entry Point	0x10011905
Size Of Code	0x10e00
Size Of Initialized Data	0x7c00
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:51:34+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x10c56	0x10e00	0x400	cnt_code, mem_execute, mem_read	6.54
.rdata	0x10012000	0x6455	0x6600	0x11200	cnt_initialized_data, mem_read	5.67
.data	0x10019000	0x66c	0x400	0x17800	cnt_initialized_data, mem_read, mem_write	5.84
.reloc	0x1001a000	0xc10	0xe00	0x17c00	cnt_initialized_data, mem_discardable, mem_read	3.75

Imports (4)

KERNEL32.dll (84)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetSystemTimeAsFileTime	0x0	0x10012010	0x12b28	0x11d28	0x17a
GetTimeZoneInformation	0x0	0x10012014	0x12b2c	0x11d2c	0x18d
FileTimeToSystemTime	0x0	0x10012018	0x12b30	0x11d30	0x9d
GetLocalTime	0x0	0x1001201c	0x12b34	0x11d34	0x133
SystemTimeToFileTime	0x0	0x10012020	0x12b38	0x11d38	0x2cc
GetLastError	0x0	0x10012024	0x12b3c	0x11d3c	0x131
CreateFileA	0x0	0x10012028	0x12b40	0x11d40	0x38
CloseHandle	0x0	0x1001202c	0x12b44	0x11d44	0x1e
GetFileAttributesA	0x0	0x10012030	0x12b48	0x11d48	0x124
FlushFileBuffers	0x0	0x10012034	0x12b4c	0x11d4c	0xbd
WriteFile	0x0	0x10012038	0x12b50	0x11d50	0x312
ReadFile	0x0	0x1001203c	0x12b54	0x11d54	0x241
SetEndOfFile	0x0	0x10012040	0x12b58	0x11d58	0x290
FileTimeToLocalFileTime	0x0	0x10012044	0x12b5c	0x11d5c	0x9c
GetFileTime	0x0	0x10012048	0x12b60	0x11d60	0x12b
SetFileTime	0x0	0x1001204c	0x12b64	0x11d64	0x29b
LocalFileTimeToFileTime	0x0	0x10012050	0x12b68	0x11d68	0x1eb
GetFileSize	0x0	0x10012054	0x12b6c	0x11d6c	0x129
DeleteFileA	0x0	0x10012058	0x12b70	0x11d70	0x60
MoveFileExA	0x0	0x1001205c	0x12b74	0x11d74	0x200
CopyFileA	0x0	0x10012060	0x12b78	0x11d78	0x2b
MapViewOfFileEx	0x0	0x10012064	0x12b7c	0x11d7c	0x1fa
CreateFileMappingA	0x0	0x10012068	0x12b80	0x11d80	0x39
UnmapViewOfFile	0x0	0x1001206c	0x12b84	0x11d84	0x2e2
FindClose	0x0	0x10012070	0x12b88	0x11d88	0xa3
CreateDirectoryA	0x0	0x10012074	0x12b8c	0x11d8c	0x30
RemoveDirectoryA	0x0	0x10012078	0x12b90	0x11d90	0x24f
FindNextFileA	0x0	0x1001207c	0x12b94	0x11d94	0xb0
FindFirstFileA	0x0	0x10012080	0x12b98	0x11d98	0xa7
GetCurrentDirectoryA	0x0	0x10012084	0x12b9c	0x11d9c	0x10b
GetCurrentDirectoryW	0x0	0x10012088	0x12ba0	0x11da0	0x10c
ExpandEnvironmentStringsW	0x0	0x1001208c	0x12ba4	0x11da4	0x94
GetTempPathW	0x0	0x10012090	0x12ba8	0x11da8	0x183
GetSystemDirectoryW	0x0	0x10012094	0x12bac	0x11dac	0x175
CreateFileW	0x0	0x10012098	0x12bb0	0x11db0	0x3b
GetFileAttributesW	0x0	0x1001209c	0x12bb4	0x11db4	0x127
SetFilePointer	0x0	0x100120a0	0x12bb8	0x11db8	0x299
DeleteFileW	0x0	0x100120a4	0x12bbc	0x11dbc	0x61
MoveFileExW	0x0	0x100120a8	0x12bc0	0x11dc0	0x201
CopyFileW	0x0	0x100120ac	0x12bc4	0x11dc4	0x2e
GetFullPathNameW	0x0	0x100120b0	0x12bc8	0x11dc8	0x12e
CreateDirectoryW	0x0	0x100120b4	0x12bcc	0x11dcc	0x33
RemoveDirectoryW	0x0	0x100120b8	0x12bd0	0x11dd0	0x250
FindNextFileW	0x0	0x100120bc	0x12bd4	0x11dd4	0xb1
FindFirstFileW	0x0	0x100120c0	0x12bd8	0x11dd8	0xaa
GetSystemTime	0x0	0x100120c4	0x12bdc	0x11ddc	0x178
Sleep	0x0	0x100120c8	0x12be0	0x11de0	0x2c7
CreateThread	0x0	0x100120cc	0x12be4	0x11de4	0x51
GetExitCodeThread	0x0	0x100120d0	0x12be8	0x11de8	0x123
WaitForSingleObject	0x0	0x100120d4	0x12bec	0x11dec	0x301
SetThreadPriority	0x0	0x100120d8	0x12bf0	0x11df0	0x2b8
TerminateThread	0x0	0x100120dc	0x12bf4	0x11df4	0x2d0
ExitThread	0x0	0x100120e0	0x12bf8	0x11df8	0x91
GetCurrentThreadId	0x0	0x100120e4	0x12bfc	0x11dfc	0x110
GetCurrentThread	0x0	0x100120e8	0x12c00	0x11e00	0x10f
CreateMutexA	0x0	0x100120ec	0x12c04	0x11e04	0x43
ReleaseMutex	0x0	0x100120f0	0x12c08	0x11e08	0x24d
CreateSemaphoreA	0x0	0x100120f4	0x12c0c	0x11e0c	0x4e
ReleaseSemaphore	0x0	0x100120f8	0x12c10	0x11e10	0x24e
InitializeCriticalSection	0x0	0x100120fc	0x12c14	0x11e14	0x1c9
CreateEventA	0x0	0x10012100	0x12c18	0x11e18	0x34
DeleteCriticalSection	0x0	0x10012104	0x12c1c	0x11e1c	0x5e
LeaveCriticalSection	0x0	0x10012108	0x12c20	0x11e20	0x1e2
SetEvent	0x0	0x1001210c	0x12c24	0x11e24	0x294
EnterCriticalSection	0x0	0x10012110	0x12c28	0x11e28	0x73
ResetEvent	0x0	0x10012114	0x12c2c	0x11e2c	0x256
InterlockedDecrement	0x0	0x10012118	0x12c30	0x11e30	0x1cc
InterlockedIncrement	0x0	0x1001211c	0x12c34	0x11e34	0x1cf
TlsAlloc	0x0	0x10012120	0x12c38	0x11e38	0x2d4
TlsSetValue	0x0	0x10012124	0x12c3c	0x11e3c	0x2d7
TlsGetValue	0x0	0x10012128	0x12c40	0x11e40	0x2d6
TlsFree	0x0	0x1001212c	0x12c44	0x11e44	0x2d5
ResumeThread	0x0	0x10012130	0x12c48	0x11e48	0x258
GetWindowsDirectoryW	0x0	0x10012134	0x12c4c	0x11e4c	0x19c
GetTickCount	0x0	0x10012138	0x12c50	0x11e50	0x18a
QueryPerformanceCounter	0x0	0x1001213c	0x12c54	0x11e54	0x22f
SetUnhandledExceptionFilter	0x0	0x10012140	0x12c58	0x11e58	0x2bc
UnhandledExceptionFilter	0x0	0x10012144	0x12c5c	0x11e5c	0x2df
GetCurrentProcess	0x0	0x10012148	0x12c60	0x11e60	0x10d
TerminateProcess	0x0	0x1001214c	0x12c64	0x11e64	0x2cf
InterlockedCompareExchange	0x0	0x10012150	0x12c68	0x11e68	0x1cb
InterlockedExchange	0x0	0x10012154	0x12c6c	0x11e6c	0x1cd
RtlUnwind	0x0	0x10012158	0x12c70	0x11e70	0x25b
GetCurrentProcessId	0x0	0x1001215c	0x12c74	0x11e74	0x10e

ADVAPI32.dll (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegQueryValueExW	0x0	0x10012000	0x12b18	0x11d18	0x1af
RegCloseKey	0x0	0x10012004	0x12b1c	0x11d1c	0x18b
RegOpenKeyExW	0x0	0x10012008	0x12b20	0x11d20	0x1a5

WS2_32.dll (24)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
accept	0x1	0x10012164	0x12c7c	0x11e7c	-
connect	0x4	0x10012168	0x12c80	0x11e80	-
closesocket	0x3	0x1001216c	0x12c84	0x11e84	-
shutdown	0x16	0x10012170	0x12c88	0x11e88	-
select	0x12	0x10012174	0x12c8c	0x11e8c	-
send	0x13	0x10012178	0x12c90	0x11e90	-
sendto	0x14	0x1001217c	0x12c94	0x11e94	-
recv	0x10	0x10012180	0x12c98	0x11e98	-
recvfrom	0x11	0x10012184	0x12c9c	0x11e9c	-
gethostbyname	0x34	0x10012188	0x12ca0	0x11ea0	-
gethostbyaddr	0x33	0x1001218c	0x12ca4	0x11ea4	-
getsockopt	0x7	0x10012190	0x12ca8	0x11ea8	-
setsockopt	0x15	0x10012194	0x12cac	0x11eac	-
listen	0xd	0x10012198	0x12cb0	0x11eb0	-
gethostname	0x39	0x1001219c	0x12cb4	0x11eb4	-
__WSAFDIsSet	0x97	0x100121a0	0x12cb8	0x11eb8	-
WSAGetLastError	0x6f	0x100121a4	0x12cbc	0x11ebc	-
getsockname	0x6	0x100121a8	0x12cc0	0x11ec0	-
getpeername	0x5	0x100121ac	0x12cc4	0x11ec4	-
ioctlsocket	0xa	0x100121b0	0x12cc8	0x11ec8	-
WSAStartup	0x73	0x100121b4	0x12ccc	0x11ecc	-
WSACleanup	0x74	0x100121b8	0x12cd0	0x11ed0	-
socket	0x17	0x100121bc	0x12cd4	0x11ed4	-
bind	0x2	0x100121c0	0x12cd8	0x11ed8	-

msvcrt.dll (61)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_vsnwprintf	0x0	0x100121c8	0x12ce0	0x11ee0	0x3ce
wcschr	0x0	0x100121cc	0x12ce4	0x11ee4	0x551
_vsnprintf	0x0	0x100121d0	0x12ce8	0x11ee8	0x3c8
strchr	0x0	0x100121d4	0x12cec	0x11eec	0x513
malloc	0x0	0x100121d8	0x12cf0	0x11ef0	0x4de
memcpy	0x0	0x100121dc	0x12cf4	0x11ef4	0x4ea
realloc	0x0	0x100121e0	0x12cf8	0x11ef8	0x4ff
free	0x0	0x100121e4	0x12cfc	0x11efc	0x4a6
sscanf	0x0	0x100121e8	0x12d00	0x11f00	0x50f
memmove	0x0	0x100121ec	0x12d04	0x11f04	0x4ec
strlen	0x0	0x100121f0	0x12d08	0x11f08	0x51c
wcslen	0x0	0x100121f4	0x12d0c	0x11f0c	0x558
mbstowcs	0x0	0x100121f8	0x12d10	0x11f10	0x4e5
wcstombs	0x0	0x100121fc	0x12d14	0x11f14	0x569
vsprintf	0x0	0x10012200	0x12d18	0x11f18	0x547
strcpy	0x0	0x10012204	0x12d1c	0x11f1c	0x516
wcscpy	0x0	0x10012208	0x12d20	0x11f20	0x554
strncpy	0x0	0x1001220c	0x12d24	0x11f24	0x520
wcsncpy	0x0	0x10012210	0x12d28	0x11f28	0x55c
_strdup	0x0	0x10012214	0x12d2c	0x11f2c	0x35a
_wcsdup	0x0	0x10012218	0x12d30	0x11f30	0x3ea
strcmp	0x0	0x1001221c	0x12d34	0x11f34	0x514
wcscmp	0x0	0x10012220	0x12d38	0x11f38	0x552
_stricmp	0x0	0x10012224	0x12d3c	0x11f3c	0x35e
_wcsicmp	0x0	0x10012228	0x12d40	0x11f40	0x3ef
strncmp	0x0	0x1001222c	0x12d44	0x11f44	0x51f
wcsncmp	0x0	0x10012230	0x12d48	0x11f48	0x55b
_strnicmp	0x0	0x10012234	0x12d4c	0x11f4c	0x368
_wcsnicmp	0x0	0x10012238	0x12d50	0x11f50	0x3f9
strcat	0x0	0x1001223c	0x12d54	0x11f54	0x511
wcscat	0x0	0x10012240	0x12d58	0x11f58	0x54f
strncat	0x0	0x10012244	0x12d5c	0x11f5c	0x51d
strrchr	0x0	0x10012248	0x12d60	0x11f60	0x524
wcsrchr	0x0	0x1001224c	0x12d64	0x11f64	0x560
strpbrk	0x0	0x10012250	0x12d68	0x11f68	0x523
wcspbrk	0x0	0x10012254	0x12d6c	0x11f6c	0x55f
memchr	0x0	0x10012258	0x12d70	0x11f70	0x4e8
strspn	0x0	0x1001225c	0x12d74	0x11f74	0x525
wcsspn	0x0	0x10012260	0x12d78	0x11f78	0x563
strstr	0x0	0x10012264	0x12d7c	0x11f7c	0x526
wcsstr	0x0	0x10012268	0x12d80	0x11f80	0x564
isspace	0x0	0x1001226c	0x12d84	0x11f84	0x4c6
iswctype	0x0	0x10012270	0x12d88	0x11f88	0x4cc
isalnum	0x0	0x10012274	0x12d8c	0x11f8c	0x4bd
isdigit	0x0	0x10012278	0x12d90	0x11f90	0x4c0
isxdigit	0x0	0x1001227c	0x12d94	0x11f94	0x4d5
isgraph	0x0	0x10012280	0x12d98	0x11f98	0x4c1
toupper	0x0	0x10012284	0x12d9c	0x11f9c	0x53a
towupper	0x0	0x10012288	0x12da0	0x11fa0	0x53c
tolower	0x0	0x1001228c	0x12da4	0x11fa4	0x539
towlower	0x0	0x10012290	0x12da8	0x11fa8	0x53b
strtol	0x0	0x10012294	0x12dac	0x11fac	0x52a
wcstol	0x0	0x10012298	0x12db0	0x11fb0	0x568
strtoul	0x0	0x1001229c	0x12db4	0x11fb4	0x52b
wcstoul	0x0	0x100122a0	0x12db8	0x11fb8	0x56b
memset	0x0	0x100122a4	0x12dbc	0x11fbc	0x4ee
_XcptFilter	0x0	0x100122a8	0x12dc0	0x11fc0	0x6a
_initterm	0x0	0x100122ac	0x12dc4	0x11fc4	0x1d5
_amsg_exit	0x0	0x100122b0	0x12dc8	0x11fc8	0x101
_adjust_fdiv	0x0	0x100122b4	0x12dcc	0x11fcc	0xf5
wcsncat	0x0	0x100122b8	0x12dd0	0x11fd0	0x559

Exports (593)

Api name	EAT Address	Ordinal
CNEBlob_append	0x1095	0x1
CNEBlob_appendByte	0x11c4	0x2
CNEBlob_appendRandomData	0x13c6	0x3
CNEBlob_copy	0x1391	0x4
CNEBlob_createFunc	0x131b	0x5
CNEBlob_createNU32Func	0x135b	0x6
CNEBlob_flushMemorySurplus	0x12bb	0x7
CNEBlob_formattedStrAppend	0x166f	0x8
CNEBlob_formattedStrWAppend	0x16c0	0x9
CNEBlob_free	0x1079	0xa
CNEBlob_freeBuffer	0x1054	0xb
CNEBlob_increaseAllocatedSize	0x1262	0xc
CNEBlob_initializeFunc	0x1000	0xd
CNEBlob_pop	0x121a	0xe
CNEBlob_remove	0x11fa	0xf
CNEBlob_strAppend	0x1405	0x10
CNEBlob_strWAppend	0x143e	0x11
CNEDate_daysInMonth	0x1748	0x12
CNEDate_daysOfYear	0x17c7	0x13
CNEDate_getCNEDateDiffFromTimeStampDiff	0x188a	0x14
CNEDate_getCNEDateFromTimeStamp	0xc1ee	0x15
CNEDate_getCNEDateTimeFromFileTime	0xc393	0x16
CNEDate_getCurrentDate	0xc2c3	0x17
CNEDate_getCurrentTimeAndDate	0xc3ec	0x18
CNEDate_getFileTimeFromCNEDateTime	0xc3bf	0x19
CNEDate_getTimeStamp	0xc0c8	0x1a
CNEDate_getTimeStampFromCNEDate	0xc2fb	0x1b
CNEDate_getTimeStampFromTimeval	0xc0e9	0x1c
CNEDate_getTimeZone	0xc120	0x1d
CNEDate_isLeapYear	0x1711	0x1e
CNEFileIO_dirClose	0xd0a1	0x1f
CNEFileIO_dirCreate	0xd0da	0x20
CNEFileIO_dirCreateW	0xe5bf	0x21
CNEFileIO_dirInstall	0xd100	0x22
CNEFileIO_dirInstallW	0xe61d	0x23
CNEFileIO_dirNext	0xd1f8	0x24
CNEFileIO_dirNextDirectory	0xd4a8	0x25
CNEFileIO_dirNextEx	0xd2ce	0x26
CNEFileIO_dirNextExW	0xe8cc	0x27
CNEFileIO_dirNextW	0xe7a3	0x28
CNEFileIO_dirOpen	0xcf9a	0x29
CNEFileIO_dirOpenW	0xe458	0x2a
CNEFileIO_dirRemove	0xd1db	0x2b
CNEFileIO_dirRemoveW	0xe74f	0x2c
CNEFileIO_dirReset	0xd556	0x2d
CNEFileIO_expendFilenameA	0xeac4	0x2e
CNEFileIO_expendFilenameW	0xd5ff	0x2f
CNEFileIO_fileClose	0xc585	0x30
CNEFileIO_fileCopy	0xcc9b	0x31
CNEFileIO_fileCopyW	0xe232	0x32
CNEFileIO_fileExists	0xc5b6	0x33
CNEFileIO_fileExistsW	0xdc5f	0x34
CNEFileIO_fileFlush	0xc5d4	0x35
CNEFileIO_fileGetDir	0x1b7e	0x36
CNEFileIO_fileGetDirExW	0x1c01	0x37
CNEFileIO_fileGetDirW	0x1bbf	0x38
CNEFileIO_fileGetPos	0x1c45	0x39
CNEFileIO_fileGetPosEx	0x1ae9	0x3a
CNEFileIO_fileGetSize	0xe04c	0x3b
CNEFileIO_fileGetSizeByNameExWWithFileAccess	0xe0d0	0x3c
CNEFileIO_fileGetSizeByNameExWithFileAccess	0xcbdf	0x3d
CNEFileIO_fileGetSizeByNameWWithFileAccess	0xebdc	0x3e
CNEFileIO_fileGetSizeByNameWithFileAccess	0xe08c	0x3f
CNEFileIO_fileGetSizeEx	0xcb7d	0x40
CNEFileIO_fileGetTimesFromHandle	0xc885	0x41
CNEFileIO_fileGetTimesWWithFileAccess	0xdd88	0x42
CNEFileIO_fileGetTimesWithFileAccess	0xc763	0x43
CNEFileIO_fileIsOpen	0xec20	0x44
CNEFileIO_fileMap	0xceac	0x45
CNEFileIO_fileMove	0xcc59	0x46
CNEFileIO_fileMoveW	0xe181	0x47
CNEFileIO_fileOpen	0xc50b	0x48
CNEFileIO_fileOpenExpend	0x1a6f	0x49
CNEFileIO_fileOpenExpendW	0x1aac	0x4a
CNEFileIO_fileOpenW	0xdb9e	0x4b
CNEFileIO_fileReadChar	0xc6fe	0x4c
CNEFileIO_fileReadEx	0xc662	0x4d
CNEFileIO_fileSetEndOfFile	0xc73d	0x4e
CNEFileIO_fileSetPos	0xeba1	0x4f
CNEFileIO_fileSetPosEx	0xdcb4	0x50
CNEFileIO_fileSetTimesFromHandle	0xca92	0x51
CNEFileIO_fileSetTimesWWithFileAccess	0xdeea	0x52
CNEFileIO_fileSetTimesWithFileAccess	0xc970	0x53
CNEFileIO_fileUnMap	0xcf65	0x54
CNEFileIO_fileUnlink	0xcc3c	0x55
CNEFileIO_fileUnlinkW	0xe12d	0x56
CNEFileIO_fileWipe	0xec38	0x57
CNEFileIO_fileWipeExpend	0x1b1c	0x58
CNEFileIO_fileWipeExpendW	0x1b4d	0x59
CNEFileIO_fileWipeW	0xed3b	0x5a
CNEFileIO_fileWriteChar	0xc6c4	0x5b
CNEFileIO_fileWriteEx	0xc600	0x5c
CNEFileIO_fixLongPath	0xcd9e	0x5d
CNEFileIO_freeExpendFilename	0xdb49	0x5e
CNEFileIO_getPathFromFileSpecW	0xe3a0	0x5f
CNEFileIO_getWorkingDir	0xd588	0x60
CNEFileIO_getWorkingDirW	0xd5c2	0x61
CNEHashMapIterator_begin	0x1ebe	0x62
CNEHashMapIterator_next	0x1e71	0x63
CNEHashMap_setPVoidKeyCopyBehaviour	0x1f1b	0x64
CNEHashMap_setPVoidKeyHashBehaviour	0x1eed	0x65
CNEHashMap_setPVoidValueFreeBehaviour	0x1efd	0x66
CNEHeap_CreateEmptyFunc	0x47a9	0x67
CNEHeap_CreateFunc	0x476f	0x68
CNEHeap_Empty	0x4744	0x69
CNEHeap_FlushMemorySurplus	0x475b	0x6a
CNEHeap_Free	0x455e	0x6b
CNEHeap_HeadPeek	0x470c	0x6c
CNEHeap_Pop	0x457e	0x6d
CNEHeap_Push	0x4673	0x6e
CNELAList_allocateFromList	0x4caa	0x6f
CNELAList_create	0x49ce	0x70
CNELAList_free	0x4bd8	0x71
CNELAList_freeToList	0x4d92	0x72
CNEListAddBack	0x4e3b	0x73
CNEListAddFront	0x4e06	0x74
CNEListCreate_func	0x569c	0x75
CNEListFree	0x4df8	0x76
CNEListGetBack	0x56e6	0x77
CNEListGetFront	0x56b2	0x78
CNEListInit_func	0x4dee	0x79
CNEListIsEmpty	0x4de4	0x7a
CNEListIterator_equal	0x4f5e	0x7b
CNEListIterator_get	0x4fb5	0x7c
CNEListIterator_getPrev	0x4fde	0x7d
CNEListIterator_getPrevReference	0x4fef	0x7e
CNEListIterator_getReference	0x4fc4	0x7f
CNEListIterator_next	0x4f94	0x80
CNEListIterator_notEqual	0x4f79	0x81
CNEListIterator_prev	0x4fa5	0x82
CNEListMap	0x4ec3	0x83
CNEListPeekBack	0x4e99	0x84
CNEListPeekFront	0x4e6e	0x85
CNEList_at	0x5716	0x86
CNEList_begin	0x4f11	0x87
CNEList_clear	0x575a	0x88
CNEList_clearWithDestructor	0x5783	0x89
CNEList_destroy	0x57c2	0x8a
CNEList_destroyWithDestructor	0x57df	0x8b
CNEList_end	0x4f39	0x8c
CNEList_erase	0x5041	0x8d
CNEList_filter	0x52fa	0x8e
CNEList_filterWithContext	0x5396	0x8f
CNEList_find	0x55c7	0x90
CNEList_findWithContext	0x562c	0x91
CNEList_forEach	0x521c	0x92
CNEList_forEachWithContext	0x5282	0x93
CNEList_insert	0x5000	0x94
CNEList_isEmpty	0x50af	0x95
CNEList_peekBack	0x51f8	0x96
CNEList_peekFront	0x51d4	0x97
CNEList_popBack	0x51a0	0x98
CNEList_popFront	0x5173	0x99
CNEList_pushBack	0x5146	0x9a
CNEList_pushFront	0x5119	0x9b
CNEList_size	0x50c0	0x9c
CNEList_sort	0x544c	0x9d
CNEMem_cleanNClear	0x5807	0x9e
CNEMem_cleanNClearNDestroyPointer	0x594a	0x9f
CNEMem_set	0x582d	0xa0
CNENetwork_Checksum16	0x5f21	0xa1
CNENetwork_CreateEthernetHeader	0x5ecb	0xa2
CNENetwork_CreateIcmpHeader	0x6122	0xa3
CNENetwork_CreateIpHeader	0x60a2	0xa4
CNENetwork_CreateUdpHeader	0x6166	0xa5
CNENetwork_DisplayEthernetHeader	0x31e7	0xa6
CNENetwork_DisplayIcmpHeader	0x31e7	0xa7
CNENetwork_DisplayIpHeader	0x31e7	0xa8
CNENetwork_DisplayUdpHeader	0x31e7	0xa9
CNENetwork_IsIpValidA	0x5cb0	0xaa
CNENetwork_IsIpValidW	0x5df0	0xab
CNENetwork_IsPortValidA	0x5c48	0xac
CNENetwork_IsPortValidW	0x5c71	0xad
CNENetwork_addrToWPIDFunc	0x5a60	0xae
CNENetwork_addrToWPIDWFunc	0x5ae3	0xaf
CNENetwork_ipToAddr	0x5f76	0xb0
CNENetwork_ipToAddrW	0x6009	0xb1
CNENetwork_stripMACSpacers	0x5e4f	0xb2
CNENetwork_wpidToAddr	0x5965	0xb3
CNEPqs_CreateEmptyFunc	0x64e7	0xb4
CNEPqs_CreateFunc	0x64a9	0xb5
CNEPqs_Empty	0x647c	0xb6
CNEPqs_FlushMemorySurplus	0x6494	0xb7
CNEPqs_Free	0x6228	0xb8
CNEPqs_HeadPeek	0x6449	0xb9
CNEPqs_Pop	0x6249	0xba
CNEPqs_Push	0x639a	0xbb
CNERBTree_createTreeFunc	0x64f5	0xbc
CNERBTree_delete	0x6c47	0xbd
CNERBTree_deleteNode	0x6b4a	0xbe
CNERBTree_destroyTree	0x65ae	0xbf
CNERBTree_executeNodeEx	0x6952	0xc0
CNERBTree_getFirst	0x6a88	0xc1
CNERBTree_getLast	0x6ab1	0xc2
CNERBTree_getNext	0x6b0b	0xc3
CNERBTree_getPrev	0x6ac6	0xc4
CNERBTree_insertEx	0x671c	0xc5
CNERBTree_retrieve	0x6a39	0xc6
CNERBTree_retrieveNode	0x69d3	0xc7
CNESocket_accept	0x7e3a	0xc8
CNESocket_addressToIPString	0x75ac	0xc9
CNESocket_bind	0x6d58	0xca
CNESocket_cleanup	0x6d53	0xcb
CNESocket_close	0x6e8d	0xcc
CNESocket_connect	0x6e08	0xcd
CNESocket_create	0x7dd1	0xce
CNESocket_disable	0x6eca	0xcf
CNESocket_fastAccept	0x7f6b	0xd0
CNESocket_fastConnect	0x7eff	0xd1
CNESocket_getLocal	0x7437	0xd2
CNESocket_getNative	0x7a42	0xd3
CNESocket_getOSError	0x7a3d	0xd4
CNESocket_getRemote	0x7478	0xd5
CNESocket_getSocketOption	0x761c	0xd6
CNESocket_getSocketOption_bCast	0x772b	0xd7
CNESocket_getSocketOption_exclusive	0x76cf	0xd8
CNESocket_getSocketOption_keepAlive	0x76fd	0xd9
CNESocket_getSocketOption_linger	0x77b5	0xda
CNESocket_getSocketOption_noDelay	0x7811	0xdb
CNESocket_getSocketOption_noLinger	0x77e3	0xdc
CNESocket_getSocketOption_recvBuff	0x7787	0xdd
CNESocket_getSocketOption_reuseAddr	0x76a2	0xde
CNESocket_getSocketOption_sendBuff	0x7759	0xdf
CNESocket_getSocketOption_ttl	0x783f	0xe0
CNESocket_getString	0x7c1b	0xe1
CNESocket_gethostname	0x7641	0xe2
CNESocket_ipStringToAddress	0x757e	0xe3
CNESocket_isSocketReady	0x6fa0	0xe4
CNESocket_isValidIP	0x74b9	0xe5
CNESocket_listen	0x6db3	0xe6
CNESocket_lookupIP	0x7602	0xe7
CNESocket_lookupName	0x75e3	0xe8
CNESocket_peek	0x7b5d	0xe9
CNESocket_putString	0x7bcf	0xea
CNESocket_recv	0x7247	0xeb
CNESocket_recvExact	0x7a50	0xec
CNESocket_recvFrom	0x733a	0xed
CNESocket_select	0x6f0e	0xee
CNESocket_selectEx	0x6f48	0xef
CNESocket_send	0x6fe9	0xf0
CNESocket_sendExpect	0x7ab1	0xf1
CNESocket_sendTo	0x70eb	0xf2
CNESocket_setBlockingMode	0x7a17	0xf3
CNESocket_setLineEnding	0x7b8b	0xf4
CNESocket_setSocketOption	0x786d	0xf5
CNESocket_setSocketOption_bCast	0x790f	0xf6
CNESocket_setSocketOption_exclusive	0x78bb	0xf7
CNESocket_setSocketOption_keepAlive	0x78e5	0xf8
CNESocket_setSocketOption_linger	0x7981	0xf9
CNESocket_setSocketOption_noDelay	0x79c9	0xfa
CNESocket_setSocketOption_noLinger	0x799f	0xfb
CNESocket_setSocketOption_recvBuff	0x795d	0xfc
CNESocket_setSocketOption_reuseAddr	0x7892	0xfd
CNESocket_setSocketOption_sendBuff	0x7939	0xfe
CNESocket_setSocketOption_ttl	0x79f3	0xff
CNESocket_setThrottle	0x7cea	0x100
CNESocket_shutdown	0x6eee	0x101
CNESocket_startup	0x6d4e	0x102
CNEStaticArray_clear	0x819f	0x103
CNEStaticArray_createFunc	0x806f	0x104
CNEStaticArray_delete	0x80d5	0x105
CNEStaticArray_forEach	0x8324	0x106
CNEStaticArray_forEachWithArgument	0x836e	0x107
CNEStaticArray_get	0x83f5	0x108
CNEStaticArray_getReference	0x810f	0x109
CNEStaticArray_push	0x843a	0x10a
CNEStaticArray_remove	0x848d	0x10b
CNEStaticArray_removeAt	0x81bc	0x10c
CNEStaticArray_removeIf	0x8250	0x10d
CNEStaticArray_removeIfWithArgument	0x82b8	0x10e
CNEStaticArray_set	0x8134	0x10f
CNEStaticArray_size	0x8190	0x110
CNEString_VAFree	0x8fb0	0x111
CNEString_append	0x974a	0x112
CNEString_appendA	0x977e	0x113
CNEString_appendFunc	0x94c8	0x114
CNEString_appendFuncEx	0x9612	0x115
CNEString_appendW	0x9795	0x116
CNEString_atoi	0x9d77	0x117
CNEString_axtoi	0x89ae	0x118
CNEString_buildFormattedString	0x9cae	0x119
CNEString_buildFormattedStringA	0x9ccf	0x11a
CNEString_buildFormattedStringW	0x9ce7	0x11b
CNEString_compare	0x9e64	0x11c
CNEString_compareA	0x9035	0x11d
CNEString_compareCSStringFunc	0x9089	0x11e
CNEString_compareFunc	0x8fdc	0x11f
CNEString_compareIgnoreCase	0x9e77	0x120
CNEString_compareIgnoreCaseA	0x905f	0x121
CNEString_compareIgnoreCaseW	0x9074	0x122
CNEString_compareW	0x904a	0x123
CNEString_concat	0x97ac	0x124
CNEString_copy	0x987d	0x125
CNEString_copySafeAFunc	0x9dc3	0x126
CNEString_copySafeWFunc	0x9e12	0x127
CNEString_createA	0x8f57	0x128
CNEString_createFunc	0x8e71	0x129
CNEString_createW	0x8f6e	0x12a
CNEString_endsWith	0x9e8a	0x12b
CNEString_endsWithA	0x919c	0x12c
CNEString_endsWithW	0x91eb	0x12d
CNEString_findLastCharacterIndexWith	0x8d57	0x12e
CNEString_findStringInBufferFunc	0x8d90	0x12f
CNEString_free	0x8f85	0x130
CNEString_getStringBufferA	0x9195	0x131
CNEString_getStringBufferW	0x9195	0x132
CNEString_getStringType	0x98a9	0x133
CNEString_indexOfStringA	0x9390	0x134
CNEString_indexOfStringFunc	0x923d	0x135
CNEString_indexOfStringW	0x93af	0x136
CNEString_isalnum	0x87b5	0x137
CNEString_isdigit	0x87fd	0x138
CNEString_isgraph	0x886a	0x139
CNEString_isspace	0x8780	0x13a
CNEString_iswalnum	0x87d5	0x13b
CNEString_iswdigit	0x8817	0x13c
CNEString_iswgraph	0x888b	0x13d
CNEString_iswspace	0x879a	0x13e
CNEString_iswxdigit	0x884c	0x13f
CNEString_isxdigit	0x8832	0x140
CNEString_lastIndexOfStringA	0x93ce	0x141
CNEString_lastIndexOfStringW	0x93ed	0x142
CNEString_length	0x986f	0x143
CNEString_lengthSafeA	0x8d06	0x144
CNEString_lengthSafeW	0x8d2e	0x145
CNEString_mbstowcs	0x854b	0x146
CNEString_memchr	0x8676	0x147
CNEString_radix10itoa	0x9da3	0x148
CNEString_remove	0x9829	0x149
CNEString_replaceAll	0xa035	0x14a
CNEString_replaceAllA	0xa074	0x14b
CNEString_replaceAllFunc	0x9ec5	0x14c
CNEString_replaceAllW	0xa08d	0x14d
CNEString_snprintf	0x9d25	0x14e
CNEString_snwprintf	0x9d4e	0x14f
CNEString_split	0x9a54	0x150
CNEString_splitA	0x9a76	0x151
CNEString_splitFunc	0x991e	0x152
CNEString_splitW	0x9a89	0x153
CNEString_sprintf	0x9cff	0x154
CNEString_startsWith	0x9479	0x155
CNEString_startsWithA	0x94a2	0x156
CNEString_startsWithFunc	0x940c	0x157
CNEString_startsWithW	0x94b5	0x158
CNEString_strcat	0x8621	0x159
CNEString_strchr	0x8638	0x15a
CNEString_strcmp	0x85f2	0x15b
CNEString_strcpy	0x85cf	0x15c
CNEString_strdup	0x85e6	0x15d
CNEString_stricmp	0x85fd	0x15e
CNEString_strlen	0x84fe	0x15f
CNEString_strlwr	0x8947	0x160
CNEString_strncat	0x862c	0x161
CNEString_strncmp	0x8609	0x162
CNEString_strncpy	0x85da	0x163
CNEString_strnicmp	0x8615	0x164
CNEString_strpbrk	0x866a	0x165
CNEString_strrchr	0x8651	0x166
CNEString_strstr	0x8774	0x167
CNEString_strtok3	0x874a	0x168
CNEString_strtol	0x8b35	0x169
CNEString_strtoul	0x8b41	0x16a
CNEString_strupr	0x88e0	0x16b
CNEString_substring	0x98b7	0x16c
CNEString_swprintf	0x9d4e	0x16d
CNEString_toLower	0x9179	0x16e
CNEString_toLowerUpperCaseFunc	0x9118	0x16f
CNEString_toStringA	0x90fc	0x170
CNEString_toStringFunc	0x90b1	0x171
CNEString_toStringW	0x910a	0x172
CNEString_toUpper	0x9187	0x173
CNEString_trim	0x9a9c	0x174
CNEString_vsnprintf	0x85c9	0x175
CNEString_vsnwprintf	0x85c3	0x176
CNEString_vsprintf	0x85bd	0x177
CNEString_vswprintf	0x85c3	0x178
CNEString_wcscat	0x8626	0x179
CNEString_wcschr	0x864b	0x17a
CNEString_wcscmp	0x85f7	0x17b
CNEString_wcscpy	0x85d4	0x17c
CNEString_wcsdup	0x85ec	0x17d
CNEString_wcsicmp	0x8603	0x17e
CNEString_wcslen	0x8524	0x17f
CNEString_wcslwr	0x897a	0x180
CNEString_wcsncat	0x8632	0x181
CNEString_wcsncmp	0x860f	0x182
CNEString_wcsncpy	0x85e0	0x183
CNEString_wcsnicmp	0x861b	0x184
CNEString_wcspbrk	0x8670	0x185
CNEString_wcsrchr	0x8664	0x186
CNEString_wcsstr	0x877a	0x187
CNEString_wcstok3	0x875f	0x188
CNEString_wcstol	0x8b3b	0x189
CNEString_wcstombs	0x8581	0x18a
CNEString_wcstoul	0x8b47	0x18b
CNEString_wcstoull	0x8b4d	0x18c
CNEString_wcsupr	0x8913	0x18d
CNEString_wideCharacterStringToSingleByteString	0x8df1	0x18e
CNEString_wmemchr	0x867c	0x18f
CNEString_wxtoi	0x8a18	0x190
CNEString_wxtonu64	0x8a83	0x191
CNESystemWin_getMicroSecondsSinceEpoch	0x10374	0x192
CNESystemWin_sleep	0x103b8	0x193
CNEThread_TlsAlloc	0x10cdf	0x194
CNEThread_TlsFree	0x10d46	0x195
CNEThread_TlsGetValue	0x10d15	0x196
CNEThread_TlsSetValue	0x10d01	0x197
CNEThread_cvBroadcast	0x10847	0x198
CNEThread_cvCreate	0x1078d	0x199
CNEThread_cvDestroy	0x107cb	0x19a
CNEThread_cvSignal	0x10801	0x19b
CNEThread_cvTimedWait	0x10943	0x19c
CNEThread_cvWait	0x1088c	0x19d
CNEThread_eventCreate	0x10a46	0x19e
CNEThread_eventDestroy	0x10ad9	0x19f
CNEThread_eventSet	0x10aa7	0x1a0
CNEThread_eventUnSet	0x10ac0	0x1a1
CNEThread_eventWait	0x10a75	0x1a2
CNEThread_getCurrentThread	0x104db	0x1a3
CNEThread_inverseSemaphoreCreate	0x105f2	0x1a4
CNEThread_inverseSemaphoreGetHolderCount	0x1061e	0x1a5
CNEThread_inverseSemaphoreHold	0x10667	0x1a6
CNEThread_inverseSemaphoreRelease	0x106a1	0x1a7
CNEThread_isCurrentThread	0x10508	0x1a8
CNEThread_mutexCreateFunc	0x1054d	0x1a9
CNEThread_mutexDestroy	0x105d9	0x1aa
CNEThread_mutexHold	0x10572	0x1ab
CNEThread_mutexHoldNoBlock	0x10599	0x1ac
CNEThread_mutexRelease	0x105c0	0x1ad
CNEThread_priorityTable	0x19000	0x1ae
CNEThread_rwLockCreate	0x10af8	0x1af
CNEThread_rwLockDestroy	0x10ca4	0x1b0
CNEThread_rwLockLock	0x10b63	0x1b1
CNEThread_rwLockUnlock	0x10c22	0x1b2
CNEThread_semaphoreCreate	0x1070c	0x1b3
CNEThread_semaphoreDestroy	0x105d9	0x1b4
CNEThread_semaphorePost	0x10738	0x1b5
CNEThread_semaphoreWait	0x10755	0x1b6
CNEThread_semaphoreWaitNoBlock	0x10771	0x1b7
CNEThread_threadCancel	0x104a3	0x1b8
CNEThread_threadClose	0x10489	0x1b9
CNEThread_threadCreate	0x103d0	0x1ba
CNEThread_threadCreateWithPriority	0x10d56	0x1bb
CNEThread_threadExit	0x104be	0x1bc
CNEThread_threadJoin	0x10414	0x1bd
CNEThread_threadMicroSleep	0x10533	0x1be
CNEThread_threadSetPriority	0x10460	0x1bf
CNEThread_threadSleep	0x10521	0x1c0
CNEVector_At	0xa178	0x1c1
CNEVector_Capacity	0xa15c	0x1c2
CNEVector_Clear	0xa467	0x1c3
CNEVector_CreateEmptyFunc	0xa480	0x1c4
CNEVector_CreateFunc	0xa0a6	0x1c5
CNEVector_Erase	0xa30f	0x1c6
CNEVector_EraseFast	0xa37d	0x1c7
CNEVector_FlushMemorySurplus	0xa453	0x1c8
CNEVector_Free	0xa115	0x1c9
CNEVector_Get	0xa492	0x1ca
CNEVector_GetFast	0xa285	0x1cb
CNEVector_PopBack	0xa243	0x1cc
CNEVector_PushBack	0xa4da	0x1cd
CNEVector_Resize	0xa3e6	0x1ce
CNEVector_Size	0xa135	0x1cf
CNEVector_SizeType	0xa14f	0x1d0
CNEVector_Swap	0xa1ba	0x1d1
CNEVirtualArray_do	0xb76d	0x1d2
CNEVirtualArray_doWithParam	0xb7a4	0x1d3
CNEVirtualArray_findFirstElementWith	0xbcb5	0x1d4
CNEVirtualArray_findLastElementWith	0xbace	0x1d5
CNEVirtualArray_findNextElementWith	0xba70	0x1d6
CNEVirtualArray_freeAllElements	0xb814	0x1d7
CNEVirtualArray_freeArrayPointersAndElements	0xb86d	0x1d8
CNEVirtualArray_freeVA	0xb53b	0x1d9
CNEVirtualArray_freeVAAndElements	0xbbb0	0x1da
CNEVirtualArray_getElementAt	0xb56a	0x1db
CNEVirtualArray_getLastElement	0xb9ea	0x1dc
CNEVirtualArray_getSize	0xb58b	0x1dd
CNEVirtualArray_increasePreAllocateArraySize	0xb6f1	0x1de
CNEVirtualArray_insertAtIndex	0xbbe8	0x1df
CNEVirtualArray_insertSorted	0xbc3f	0x1e0
CNEVirtualArray_pop	0xbc99	0x1e1
CNEVirtualArray_positionOfFirstElementFoundWith	0xbb0c	0x1e2
CNEVirtualArray_positionOfLastElementFoundWith	0xb601	0x1e3
CNEVirtualArray_positionOfNextElementFoundWith	0xb598	0x1e4
CNEVirtualArray_push	0xbbd4	0x1e5
CNEVirtualArray_removeAllElementsFoundWith	0xb982	0x1e6
CNEVirtualArray_removeAtIndex	0xb8d8	0x1e7
CNEVirtualArray_removeFirstElementFoundWith	0xb924	0x1e8
CNEVirtualArray_search	0xb66f	0x1e9
CNEVirtualArray_setElementAt	0xba06	0x1ea
CNEVirtualArray_sort	0xbd58	0x1eb
CNEVirtualArray_swapElements	0xbb37	0x1ec
CNE_allocateCleanMemoryFunc	0x5886	0x1ed
CNE_compareMemoryFunc	0x591c	0x1ee
CNE_poisonAllocatedMemoryFunc	0x5848	0x1ef
CNE_poisonFreeMemoryFunc	0x5869	0x1f0
CNE_reallocateCleanMemoryFunc	0x58ee	0x1f1
CNE_reallocateMemoryFunc	0x58a8	0x1f2
SafeVirtualArray_GetArrayFromBlob	0xafa2	0x1f3
SafeVirtualArray_GetBlobFromArray	0xaeec	0x1f4
SafeVirtualArray_GetBlobFromStaticElems	0xaf47	0x1f5
SafeVirtualArray_createFunc	0xa572	0x1f6
SafeVirtualArray_do	0xae9f	0x1f7
SafeVirtualArray_doWithParam	0xb1c6	0x1f8
SafeVirtualArray_findFirstElementWith	0xaaea	0x1f9
SafeVirtualArray_findLastElementWith	0xac75	0x1fa
SafeVirtualArray_findNextElementWith	0xabae	0x1fb
SafeVirtualArray_freeAllElements	0xa685	0x1fc
SafeVirtualArray_freeArrayPointersAndElements	0xa6d6	0x1fd
SafeVirtualArray_freeVA	0xa5bd	0x1fe
SafeVirtualArray_freeVAAndElements	0xa61d	0x1ff
SafeVirtualArray_getElementAt	0xa9c3	0x200
SafeVirtualArray_getLastElement	0xaa22	0x201
SafeVirtualArray_getLock	0xb236	0x202
SafeVirtualArray_getSize	0xaadc	0x203
SafeVirtualArray_getVAAndLock	0xb217	0x204
SafeVirtualArray_increasePreAllocateArraySize	0xade5	0x205
SafeVirtualArray_initializeFunc	0xa528	0x206
SafeVirtualArray_insertAtIndex	0xa791	0x207
SafeVirtualArray_insertSorted	0xa7f0	0x208
SafeVirtualArray_pop	0xa870	0x209
SafeVirtualArray_positionOfFirstElementFoundWith	0xab4c	0x20a
SafeVirtualArray_positionOfLastElementFoundWith	0xacd7	0x20b
SafeVirtualArray_positionOfNextElementFoundWith	0xac13	0x20c
SafeVirtualArray_push	0xa736	0x20d
SafeVirtualArray_pushAndBlob	0xafe8	0x20e
SafeVirtualArray_pushAndBlobStatic	0xb05c	0x20f
SafeVirtualArray_releaseLock	0xb246	0x210
SafeVirtualArray_removeAllElementsFoundWith	0xa98c	0x211
SafeVirtualArray_removeAndBlob	0xb14b	0x212
SafeVirtualArray_removeAndBlobStatic	0xb0d0	0x213
SafeVirtualArray_removeAtIndex	0xa8cb	0x214
SafeVirtualArray_removeFirstElementFoundWith	0xa92a	0x215
SafeVirtualArray_search	0xad86	0x216
SafeVirtualArray_setElementAt	0xaa7d	0x217
SafeVirtualArray_sort	0xad39	0x218
SafeVirtualArray_swapElements	0xae40	0x219
SafeVirtualArray_updateElement	0xb256	0x21a
VAMarshal_GetArrayFromBlob	0xb414	0x21b
VAMarshal_GetBlobFromArray	0xb29d	0x21c
VAMarshal_GetBlobFromStaticElems	0xb347	0x21d
VirtualArray_createFunc	0xb7df	0x21e
VirtualArray_initializeFunc	0xb4e1	0x21f
VirtualBuffer_addBytesToBuffer	0xc08a	0x220
VirtualBuffer_freeBuffer	0xbfd7	0x221
VirtualBuffer_initializeBuffer	0xbf9f	0x222
VirtualBuffer_makeRoomIfNeeded	0xbffc	0x223
byteSwapLong	0x5b83	0x224
byteSwapLongLong	0x5bab	0x225
byteSwapShort	0x5b6e	0x226
kh_clear_PCH_NU32	0x201e	0x227
kh_clear_PVOID_PVOID	0x3eaf	0x228
kh_del_NU32_NU32	0x386e	0x229
kh_del_PCH_NU32	0x2637	0x22a
kh_del_PCH_PVOID	0x29d8	0x22b
kh_del_PVOID_PVOID	0x44c2	0x22c
kh_del_PWCH_NU64	0x3136	0x22d
kh_destroy_NU32_NU32	0x31e8	0x22e
kh_destroy_PCH_NU32	0x1f4a	0x22f
kh_destroy_PCH_PVOID	0x26c8	0x230
kh_destroy_PVOID_NU32	0x399d	0x231
kh_destroy_PVOID_PVOID	0x3dd5	0x232
kh_destroy_PWCH_NU64	0x2a9a	0x233
kh_get_NU32_NU32	0x32b6	0x234
kh_get_PCH_NU32	0x205c	0x235
kh_get_PCH_PVOID	0x205c	0x236
kh_get_value_NU32_NU32	0x335f	0x237
kh_get_value_PCH_NU32	0x2112	0x238
kh_get_value_PCH_PVOID	0x2112	0x239
kh_get_value_PVOID_NU32	0x3a75	0x23a
kh_init_NU32_NU32	0x1c82	0x23b
kh_init_PCH_NU32	0x1c82	0x23c
kh_init_PCH_PVOID	0x1c82	0x23d
kh_init_PVOID_NU32	0x1c82	0x23e
kh_init_PVOID_PVOID	0x1c82	0x23f
kh_init_PWCH_NU64	0x1c82	0x240
kh_iter_key_NU32_NU32	0x1c9a	0x241
kh_iter_key_PCH_NU32	0x1c9a	0x242
kh_iter_key_PCH_PVOID	0x1c9a	0x243
kh_iter_val_NU32_NU32	0x1ce8	0x244
kh_iter_val_PCH_NU32	0x1ce8	0x245
kh_iter_val_PCH_PVOID	0x1ce8	0x246
kh_put_NU32_NU32	0x364e	0x247
kh_put_PCH_NU32	0x2402	0x248
kh_put_PCH_PVOID	0x279f	0x249
kh_put_PVOID_NU32	0x3aa6	0x24a
kh_put_PVOID_PVOID	0x426d	0x24b
kh_put_PWCH_NU64	0x2eec	0x24c
kh_resize_NU32_NU32	0x3390	0x24d
kh_resize_PCH_NU32	0x2143	0x24e
kh_resize_PCH_PVOID	0x2143	0x24f
kh_resize_PVOID_PVOID	0x3fa9	0x250
kh_resize_PWCH_NU64	0x2c24	0x251

c:\windows\temp\katyusha.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	5.00 KB
MD5	94bd92ad65ee59117db13eab0d40ae21
SHA1	ef3f3c19f8f5618c40da861f99b1292da926df16
SHA256	ad8008d02b66ad40acb6389e51aee351363968da5a6b7dc4ac293af354af738f
SSDeep	24:ev1GSFGFiKT9D8iOWDKunsoZ9cniXPwLi/njpnNfuMAcaKq9KWZRCIpF:qFGFxrdsoZ9cPL2cMPE9JZRCc
ImpHash	22647e5b96f2de81d003f25d98d7d2dc

PE Information

Image Base	0x180000000
Entry Point	0x1800011b0
Size Of Code	0x200
Size Of Initialized Data	0xe00
File Type	dll
Subsystem	windows_gui
Machine Type	amd64
Compile Timestamp	2014-02-25 21:20:27+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x180001000	0x1e2	0x200	0x400	cnt_code, mem_execute, mem_read	4.71
.rdata	0x180002000	0x16c	0x200	0x600	cnt_initialized_data, mem_read	2.95
.data	0x180003000	0x80d	0xa00	0x800	cnt_initialized_data, mem_read, mem_write	1.37
.pdata	0x180004000	0x24	0x200	0x1200	cnt_initialized_data, mem_read	0.32

Imports (1)

KERNEL32.dll (8)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CloseHandle	0x0	0x180002000	0x2088	0x688	0x7f
ExitThread	0x0	0x180002008	0x2090	0x690	0x158
ResumeThread	0x0	0x180002010	0x2098	0x698	0x4ab
CreateProcessA	0x0	0x180002018	0x20a0	0x6a0	0xd7
GetThreadContext	0x0	0x180002020	0x20a8	0x6a8	0x2eb
SetThreadContext	0x0	0x180002028	0x20b0	0x6b0	0x538
VirtualAllocEx	0x0	0x180002030	0x20b8	0x6b8	0x5aa
WriteProcessMemory	0x0	0x180002038	0x20c0	0x6c0	0x5f8

c:\windows\temp\zlib1.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	59.00 KB
MD5	e4ad4df4e41240587b4fe8bbcb32db15
SHA1	e8c98dbcd20d45bbbbf4994cc4c95dfcf504c690
SHA256	aa8adf96fc5a7e249a6a487faaf0ed3e00c40259fdae11d4caf47a24a9d3aaed
SSDeep	1536:B/Dm7yqxVqWk9XZDGu8I+rnToIfnIOwIOkyk:B/DmWaq/9XZDwLTBfJmkyk
ImpHash	78d12b81ee403179e41a0e557321f4fd

PE Information

Image Base	0x5a4c0000
Entry Point	0x5a4c97d8
Size Of Code	0x8c00
Size Of Initialized Data	0x6000
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:49:32+00:00

Version Information (8)

LegalCopyright	(C) 1995-2006 Jean-loup Gailly & Mark Adler
InternalName	zlib1.dll
FileVersion	1.2.5
Comments	For more information visit http://www.zlib.net/
ProductName	zlib
ProductVersion	1.2.5
FileDescription	zlib data compression library
OriginalFilename	zlib1.dll

Sections (5)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x5a4c1000	0x8be6	0x8c00	0x400	cnt_code, mem_execute, mem_read	6.75
.rdata	0x5a4ca000	0x4b8c	0x4c00	0x9000	cnt_initialized_data, mem_read	6.67
.data	0x5a4cf000	0x69c	0x400	0xdc00	cnt_initialized_data, mem_read, mem_write	5.98
.rsrc	0x5a4d0000	0x390	0x400	0xe000	cnt_initialized_data, mem_read	3.04
.reloc	0x5a4d1000	0x70e	0x800	0xe400	cnt_initialized_data, mem_discardable, mem_read	3.37

Imports (2)

msvcrt.dll (21)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_XcptFilter	0x0	0x5a4ca038	0xe378	0xd378	0x6a
_initterm	0x0	0x5a4ca03c	0xe37c	0xd37c	0x1d5
_amsg_exit	0x0	0x5a4ca040	0xe380	0xd380	0x101
_adjust_fdiv	0x0	0x5a4ca044	0xe384	0xd384	0xf5
_read	0x0	0x5a4ca048	0xe388	0xd388	0x304
_write	0x0	0x5a4ca04c	0xe38c	0xd38c	0x448
_vsnprintf	0x0	0x5a4ca050	0xe390	0xd390	0x3c8
memchr	0x0	0x5a4ca054	0xe394	0xd394	0x4e8
_errno	0x0	0x5a4ca058	0xe398	0xd398	0x156
strerror	0x0	0x5a4ca05c	0xe39c	0xd39c	0x519
sprintf	0x0	0x5a4ca060	0xe3a0	0xd3a0	0x50b
free	0x0	0x5a4ca064	0xe3a4	0xd3a4	0x4a6
strlen	0x0	0x5a4ca068	0xe3a8	0xd3a8	0x51c
malloc	0x0	0x5a4ca06c	0xe3ac	0xd3ac	0x4de
strcpy	0x0	0x5a4ca070	0xe3b0	0xd3b0	0x516
strcat	0x0	0x5a4ca074	0xe3b4	0xd3b4	0x511
memset	0x0	0x5a4ca078	0xe3b8	0xd3b8	0x4ee
memcpy	0x0	0x5a4ca07c	0xe3bc	0xd3bc	0x4ea
_lseek	0x0	0x5a4ca080	0xe3c0	0xd3c0	0x24a
_open	0x0	0x5a4ca084	0xe3c4	0xd3c4	0x2ec
_close	0x0	0x5a4ca088	0xe3c8	0xd3c8	0x123

KERNEL32.dll (13)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x5a4ca000	0xe340	0xd340	0x10e
GetCurrentThreadId	0x0	0x5a4ca004	0xe344	0xd344	0x110
GetTickCount	0x0	0x5a4ca008	0xe348	0xd348	0x18a
QueryPerformanceCounter	0x0	0x5a4ca00c	0xe34c	0xd34c	0x22f
SetUnhandledExceptionFilter	0x0	0x5a4ca010	0xe350	0xd350	0x2bc
UnhandledExceptionFilter	0x0	0x5a4ca014	0xe354	0xd354	0x2df
GetCurrentProcess	0x0	0x5a4ca018	0xe358	0xd358	0x10d
TerminateProcess	0x0	0x5a4ca01c	0xe35c	0xd35c	0x2cf
InterlockedCompareExchange	0x0	0x5a4ca020	0xe360	0xd360	0x1cb
Sleep	0x0	0x5a4ca024	0xe364	0xd364	0x2c7
InterlockedExchange	0x0	0x5a4ca028	0xe368	0xd368	0x1cd
RtlUnwind	0x0	0x5a4ca02c	0xe36c	0xd36c	0x25b
GetSystemTimeAsFileTime	0x0	0x5a4ca030	0xe370	0xd370	0x17a

Exports (65)

Api name	EAT Address	Ordinal
adler32	0x1000	0x1
adler32_combine	0x1289	0x2
compress	0x1321	0x3
compress2	0x129b	0x4
compressBound	0x133c	0x5
crc32	0x16c7	0x6
crc32_combine	0x16b2	0x7
deflate	0x2a91	0x8
deflateBound	0x1874	0x9
deflateCopy	0x1a5f	0xa
deflateEnd	0x19af	0xb
deflateInit2_	0x3232	0xc
deflateInit_	0x34d6	0xd
deflateParams	0x3409	0xe
deflatePrime	0x1801	0xf
deflateReset	0x2a07	0x10
deflateSetDictionary	0x16e3	0x11
deflateSetHeader	0x17db	0x12
deflateTune	0x1839	0x13
get_crc_table	0x1359	0x14
gzbuffer	0x351e	0x15
gzclearerr	0x3a4d	0x16
gzclose	0x34f7	0x17
gzclose_r	0x44a6	0x18
gzclose_w	0x4a06	0x19
gzdirect	0x4478	0x1a
gzdopen	0x38bd	0x1b
gzeof	0x35e2	0x1c
gzerror	0x3610	0x1d
gzflush	0x492d	0x1e
gzgetc	0x42a0	0x1f
gzgets	0x4397	0x20
gzoffset	0x35d9	0x21
gzopen	0x38a9	0x22
gzprintf	0x488d	0x23
gzputc	0x47e8	0x24
gzputs	0x4862	0x25
gzread	0x418f	0x26
gzrewind	0x3908	0x27
gzseek	0x3a44	0x28
gzsetparams	0x497e	0x29
gztell	0x3588	0x2a
gzungetc	0x42f3	0x2b
gzwrite	0x4700	0x2c
inflate	0x597c	0x2d
inflateBack	0x4b3f	0x2e
inflateBackEnd	0x567c	0x2f
inflateBackInit_	0x4a84	0x30
inflateCopy	0x6e7e	0x31
inflateEnd	0x6c34	0x32
inflateGetHeader	0x6d19	0x33
inflateInit2_	0x578d	0x34
inflateInit_	0x581b	0x35
inflateMark	0x6fca	0x36
inflatePrime	0x5833	0x37
inflateReset	0x56ab	0x38
inflateReset2	0x5718	0x39
inflateSetDictionary	0x6c75	0x3a
inflateSync	0x6d92	0x3b
inflateSyncPoint	0x6e54	0x3c
inflateUndermine	0x6fa6	0x3d
uncompress	0x8b98	0x3e
zError	0x8c2d	0x3f
zlibCompileFlags	0x8c29	0x40
zlibVersion	0x8c23	0x41

C:\Windows\temp\snamelog

Created File

Text

Not Queried

Mime Type	text/plain
File Size	0.06 KB
MD5	48401e5fcdd281a139ce34b616d82861
SHA1	871010918ba08f4e60a851edb1a0498c2c50f026
SHA256	73a34ea312d1543ca3af57eec50116af71195c168f09d348e229944a1c40a878
SSDeep	3:A+aktGJoiTktGJoiTktGy:ALk4tTk4tTk4y

c:/windows/temp/ktsi.exe

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	328.50 KB
MD5	dd2e5fd5109c54cc90b30b88ec0c585a
SHA1	927dc541fd29ef6341b041321fe06bf04b0efcd7
SHA256	a3dabb63f11e208a0d1d9b43b3d2575e2dc2a7d87c14eb654d3062f3bc0ad12d
SSDeep	6144:qivqjCj/C+YiuEk3WKz1O9aiZVDkJFWTnZEPKjUSF/Qarwbbhsriqx83d2Z2k:pvqk/JYymxMYrsKS1Hkbl6xl9
ImpHash	ebe431f94ea6397fb5ce4e94d6fae5a2

PE Information

Image Base	0x400000
Entry Point	0x502115
Size Of Code	0xb6400
Size Of Initialized Data	0x46800
File Type	executable
Subsystem	windows_cui
Machine Type	i386
Compile Timestamp	2018-10-13 22:11:11+00:00

Sections (3)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.MPRESS1	0x401000	0x101000	0x51000	0x200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	8.0
.MPRESS2	0x502000	0xc7f	0xe00	0x51200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	5.65
.rsrc	0x503000	0x1d8	0x200	0x52000	cnt_initialized_data, mem_read, mem_write	4.71

Imports (4)

KERNEL32.DLL (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x502064	0x102064	0x51264	0x0
GetProcAddress	0x0	0x502068	0x102068	0x51268	0x0

USER32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShowWindow	0x0	0x502070	0x102070	0x51270	0x0

ADVAPI32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ReportEventA	0x0	0x502078	0x102078	0x51278	0x0

SHELL32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteA	0x0	0x502080	0x102080	0x51280	0x0

c:\windows\temp\exma-1.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	10.00 KB
MD5	ba629216db6cf7c0c720054b0c9a13f3
SHA1	37bb800b2bb812d4430e2510f14b5b717099abaa
SHA256	15292172a83f2e7f07114693ab92753ed32311dfba7d54fe36cc7229136874d9
SSDeep	192:+ouDzncwrjGQmzZbO8sEk3jMkx6VuxLj4l5JVIb/A:+xDz1azZa8Bkz5xDxH4xmk
ImpHash	38335bfed05954b26590a75c4458da60

PE Information

Image Base	0x10000000
Entry Point	0x10001c5a
Size Of Code	0x1200
Size Of Initialized Data	0x1600
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:52:35+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x1076	0x1200	0x400	cnt_code, mem_execute, mem_read	5.97
.rdata	0x10003000	0x6b9	0x800	0x1600	cnt_initialized_data, mem_read	4.34
.data	0x10004000	0x65c	0x400	0x1e00	cnt_initialized_data, mem_read, mem_write	5.81
.reloc	0x10005000	0x4da	0x600	0x2200	cnt_initialized_data, mem_discardable, mem_read	2.23

Imports (3)

KERNEL32.dll (13)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x10003000	0x3294	0x1894	0x10e
GetCurrentThreadId	0x0	0x10003004	0x3298	0x1898	0x110
GetTickCount	0x0	0x10003008	0x329c	0x189c	0x18a
QueryPerformanceCounter	0x0	0x1000300c	0x32a0	0x18a0	0x22f
SetUnhandledExceptionFilter	0x0	0x10003010	0x32a4	0x18a4	0x2bc
UnhandledExceptionFilter	0x0	0x10003014	0x32a8	0x18a8	0x2df
GetCurrentProcess	0x0	0x10003018	0x32ac	0x18ac	0x10d
TerminateProcess	0x0	0x1000301c	0x32b0	0x18b0	0x2cf
InterlockedCompareExchange	0x0	0x10003020	0x32b4	0x18b4	0x1cb
Sleep	0x0	0x10003024	0x32b8	0x18b8	0x2c7
InterlockedExchange	0x0	0x10003028	0x32bc	0x18bc	0x1cd
RtlUnwind	0x0	0x1000302c	0x32c0	0x18c0	0x25b
GetSystemTimeAsFileTime	0x0	0x10003030	0x32c4	0x18c4	0x17a

WS2_32.dll (16)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
__WSAFDIsSet	0x97	0x10003038	0x32cc	0x18cc	-
select	0x12	0x1000303c	0x32d0	0x18d0	-
accept	0x1	0x10003040	0x32d4	0x18d4	-
closesocket	0x3	0x10003044	0x32d8	0x18d8	-
getsockname	0x6	0x10003048	0x32dc	0x18dc	-
listen	0xd	0x1000304c	0x32e0	0x18e0	-
bind	0x2	0x10003050	0x32e4	0x18e4	-
htons	0x9	0x10003054	0x32e8	0x18e8	-
inet_addr	0xb	0x10003058	0x32ec	0x18ec	-
socket	0x17	0x1000305c	0x32f0	0x18f0	-
send	0x13	0x10003060	0x32f4	0x18f4	-
connect	0x4	0x10003064	0x32f8	0x18f8	-
WSASocketA	0x0	0x10003068	0x32fc	0x18fc	0x3d
recv	0x10	0x1000306c	0x3300	0x1900	-
ntohs	0xf	0x10003070	0x3304	0x1904	-
WSADuplicateSocketA	0x0	0x10003074	0x3308	0x1908	0x12

msvcrt.dll (17)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_iob	0x0	0x1000307c	0x3310	0x1910	0x1db
strcmp	0x0	0x10003080	0x3314	0x1914	0x514
free	0x0	0x10003084	0x3318	0x1918	0x4a6
calloc	0x0	0x10003088	0x331c	0x191c	0x485
_fstat	0x0	0x1000308c	0x3320	0x1920	0x18b
strlen	0x0	0x10003090	0x3324	0x1924	0x51c
memset	0x0	0x10003094	0x3328	0x1928	0x4ee
malloc	0x0	0x10003098	0x332c	0x192c	0x4de
_XcptFilter	0x0	0x1000309c	0x3330	0x1930	0x6a
_initterm	0x0	0x100030a0	0x3334	0x1934	0x1d5
_amsg_exit	0x0	0x100030a4	0x3338	0x1938	0x101
_adjust_fdiv	0x0	0x100030a8	0x333c	0x193c	0xf5
_read	0x0	0x100030ac	0x3340	0x1940	0x304
_write	0x0	0x100030b0	0x3344	0x1944	0x448
_fileno	0x0	0x100030b4	0x3348	0x1948	0x16f
_close	0x0	0x100030b8	0x334c	0x194c	0x123
_open	0x0	0x100030bc	0x3350	0x1950	0x2ec

Exports (11)

Api name	EAT Address	Ordinal
bindRendezvous	0x1153	0x1
closeEM	0x1000	0x2
closeRendezvous	0x1246	0x3
connectRendezvous	0x1253	0x4
disconnectRendezvous	0x12f3	0x5
getDefaultEMFile	0x1028	0x6
openEMForWriting	0x102e	0x7
readParamsFromEM	0x1071	0x8
recvSocket	0x1357	0x9
sendSockets	0x13f6	0xa
writeParamsToEM	0x112c	0xb

c:\windows\temp\libxml2.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	807.00 KB
MD5	9a5cec05e9c158cbc51cdc972693363d
SHA1	ca4d1bb44c64a85871944f3913ca6ccddfa2dc04
SHA256	aceb27720115a63b9d47e737fd878a61c52435ea4ec86ba8e58ee744bc85c4f3
SSDeep	12288:OhdWYPkG1r0VtrTMhsGCQcdGfGwKaNAu5uld+tirrmrx+448+:4lPpr0PsBCfYfGg6t3rm
ImpHash	c17f3a8fe5a31151ab2da99abee9c23c

PE Information

Image Base	0x10000000
Entry Point	0x100920f2
Size Of Code	0x92600
Size Of Initialized Data	0x38400
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:50:55+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x92516	0x92600	0x400	cnt_code, mem_execute, mem_read	6.66
.rdata	0x10094000	0x2e3f7	0x2e400	0x92a00	cnt_initialized_data, mem_read	5.89
.data	0x100c3000	0x24f4	0x1400	0xc0e00	cnt_initialized_data, mem_read, mem_write	5.43
.reloc	0x100c6000	0x79d2	0x7a00	0xc2200	cnt_initialized_data, mem_discardable, mem_read	6.65

Imports (3)

WSOCK32.dll (25)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
inet_ntoa	0xc	0x10094094	0xb5898	0xb4298	-
__WSAFDIsSet	0x97	0x10094098	0xb589c	0xb429c	-
getsockopt	0x7	0x1009409c	0xb58a0	0xb42a0	-
WSASetLastError	0x70	0x100940a0	0xb58a4	0xb42a4	-
getservbyport	0x38	0x100940a4	0xb58a8	0xb42a8	-
ntohs	0xf	0x100940a8	0xb58ac	0xb42ac	-
gethostbyaddr	0x33	0x100940ac	0xb58b0	0xb42b0	-
getservbyname	0x37	0x100940b0	0xb58b4	0xb42b4	-
htonl	0x8	0x100940b4	0xb58b8	0xb42b8	-
inet_addr	0xb	0x100940b8	0xb58bc	0xb42bc	-
WSAGetLastError	0x6f	0x100940bc	0xb58c0	0xb42c0	-
ioctlsocket	0xa	0x100940c0	0xb58c4	0xb42c4	-
WSAStartup	0x73	0x100940c4	0xb58c8	0xb42c8	-
getsockname	0x6	0x100940c8	0xb58cc	0xb42cc	-
bind	0x2	0x100940cc	0xb58d0	0xb42d0	-
listen	0xd	0x100940d0	0xb58d4	0xb42d4	-
gethostbyname	0x34	0x100940d4	0xb58d8	0xb42d8	-
htons	0x9	0x100940d8	0xb58dc	0xb42dc	-
socket	0x17	0x100940dc	0xb58e0	0xb42e0	-
connect	0x4	0x100940e0	0xb58e4	0xb42e4	-
send	0x13	0x100940e4	0xb58e8	0xb42e8	-
select	0x12	0x100940e8	0xb58ec	0xb42ec	-
recv	0x10	0x100940ec	0xb58f0	0xb42f0	-
closesocket	0x3	0x100940f0	0xb58f4	0xb42f4	-
WSACleanup	0x74	0x100940f4	0xb58f8	0xb42f8	-

KERNEL32.dll (36)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetSystemTimeAsFileTime	0x0	0x10094000	0xb5804	0xb4204	0x17a
RtlUnwind	0x0	0x10094004	0xb5808	0xb4208	0x25b
InterlockedExchange	0x0	0x10094008	0xb580c	0xb420c	0x1cd
TerminateProcess	0x0	0x1009400c	0xb5810	0xb4210	0x2cf
GetCurrentProcess	0x0	0x10094010	0xb5814	0xb4214	0x10d
UnhandledExceptionFilter	0x0	0x10094014	0xb5818	0xb4218	0x2df
SetUnhandledExceptionFilter	0x0	0x10094018	0xb581c	0xb421c	0x2bc
QueryPerformanceCounter	0x0	0x1009401c	0xb5820	0xb4220	0x22f
GetTickCount	0x0	0x10094020	0xb5824	0xb4224	0x18a
GetCurrentProcessId	0x0	0x10094024	0xb5828	0xb4228	0x10e
GetVersion	0x0	0x10094028	0xb582c	0xb422c	0x192
GetVersionExA	0x0	0x1009402c	0xb5830	0xb4230	0x193
MultiByteToWideChar	0x0	0x10094030	0xb5834	0xb4234	0x206
TlsGetValue	0x0	0x10094034	0xb5838	0xb4238	0x2d6
GetModuleFileNameA	0x0	0x10094038	0xb583c	0xb423c	0x13c
GetModuleHandleA	0x0	0x1009403c	0xb5840	0xb4240	0x13e
FreeLibrary	0x0	0x10094040	0xb5844	0xb4244	0xc7
GetProcAddress	0x0	0x10094044	0xb5848	0xb4248	0x157
LoadLibraryA	0x0	0x10094048	0xb584c	0xb424c	0x1e3
GetSystemDirectoryA	0x0	0x1009404c	0xb5850	0xb4250	0x174
CreateMutexA	0x0	0x10094050	0xb5854	0xb4254	0x43
CloseHandle	0x0	0x10094054	0xb5858	0xb4258	0x1e
WaitForSingleObject	0x0	0x10094058	0xb585c	0xb425c	0x301
ReleaseMutex	0x0	0x1009405c	0xb5860	0xb4260	0x24d
InitializeCriticalSection	0x0	0x10094060	0xb5864	0xb4264	0x1c9
DeleteCriticalSection	0x0	0x10094064	0xb5868	0xb4268	0x5e
EnterCriticalSection	0x0	0x10094068	0xb586c	0xb426c	0x73
LeaveCriticalSection	0x0	0x1009406c	0xb5870	0xb4270	0x1e2
InterlockedCompareExchange	0x0	0x10094070	0xb5874	0xb4274	0x1cb
GetCurrentThreadId	0x0	0x10094074	0xb5878	0xb4278	0x110
TlsFree	0x0	0x10094078	0xb587c	0xb427c	0x2d5
Sleep	0x0	0x1009407c	0xb5880	0xb4280	0x2c7
TlsAlloc	0x0	0x10094080	0xb5884	0xb4284	0x2d4
InterlockedIncrement	0x0	0x10094084	0xb5888	0xb4288	0x1cf
TlsSetValue	0x0	0x10094088	0xb588c	0xb428c	0x2d7
OutputDebugStringA	0x0	0x1009408c	0xb5890	0xb4290	0x21c

msvcrt.dll (61)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
fopen	0x0	0x100940fc	0xb5900	0xb4300	0x49d
free	0x0	0x10094100	0xb5904	0xb4304	0x4a6
sscanf	0x0	0x10094104	0xb5908	0xb4308	0x50f
strcmp	0x0	0x10094108	0xb590c	0xb430c	0x514
toupper	0x0	0x1009410c	0xb5910	0xb4310	0x53a
memmove	0x0	0x10094110	0xb5914	0xb4314	0x4ec
vfprintf	0x0	0x10094114	0xb5918	0xb4318	0x540
_vsnprintf	0x0	0x10094118	0xb591c	0xb431c	0x3c8
fclose	0x0	0x1009411c	0xb5920	0xb4320	0x492
malloc	0x0	0x10094120	0xb5924	0xb4324	0x4de
strcat	0x0	0x10094124	0xb5928	0xb4328	0x511
strcpy	0x0	0x10094128	0xb592c	0xb432c	0x516
strchr	0x0	0x1009412c	0xb5930	0xb4330	0x513
strncmp	0x0	0x10094130	0xb5934	0xb4334	0x51f
calloc	0x0	0x10094134	0xb5938	0xb4338	0x485
strtoul	0x0	0x10094138	0xb593c	0xb433c	0x52b
strtol	0x0	0x1009413c	0xb5940	0xb4340	0x52a
_errno	0x0	0x10094140	0xb5944	0xb4344	0x156
fwrite	0x0	0x10094144	0xb5948	0xb4348	0x4b1
_wfopen	0x0	0x10094148	0xb594c	0xb434c	0x427
_wstat	0x0	0x1009414c	0xb5950	0xb4350	0x45b
fread	0x0	0x10094150	0xb5954	0xb4354	0x4a5
ferror	0x0	0x10094154	0xb5958	0xb4358	0x494
fflush	0x0	0x10094158	0xb595c	0xb435c	0x495
printf	0x0	0x1009415c	0xb5960	0xb4360	0x4f3
floor	0x0	0x10094160	0xb5964	0xb4364	0x49b
fabs	0x0	0x10094164	0xb5968	0xb4368	0x491
labs	0x0	0x10094168	0xb596c	0xb436c	0x4d6
_isnan	0x0	0x1009416c	0xb5970	0xb4370	0x220
_fpclass	0x0	0x10094170	0xb5974	0xb4374	0x17b
log10	0x0	0x10094174	0xb5978	0xb4378	0x4dc
pow	0x0	0x10094178	0xb597c	0xb437c	0x4f2
fmod	0x0	0x1009417c	0xb5980	0xb4380	0x49c
_XcptFilter	0x0	0x10094180	0xb5984	0xb4384	0x6a
_initterm	0x0	0x10094184	0xb5988	0xb4388	0x1d5
_amsg_exit	0x0	0x10094188	0xb598c	0xb438c	0x101
_adjust_fdiv	0x0	0x1009418c	0xb5990	0xb4390	0xf5
isleadbyte	0x0	0x10094190	0xb5994	0xb4394	0x4c2
_itoa	0x0	0x10094194	0xb5998	0xb4398	0x231
wctomb	0x0	0x10094198	0xb599c	0xb439c	0x56e
__badioinfo	0x0	0x1009419c	0xb59a0	0xb43a0	0x85
__pioinfo	0x0	0x100941a0	0xb59a4	0xb43a4	0xcf
_read	0x0	0x100941a4	0xb59a8	0xb43a8	0x304
_fileno	0x0	0x100941a8	0xb59ac	0xb43ac	0x16f
_lseeki64	0x0	0x100941ac	0xb59b0	0xb43b0	0x24b
_write	0x0	0x100941b0	0xb59b4	0xb43b4	0x448
_isatty	0x0	0x100941b4	0xb59b8	0xb43b8	0x1de
fputc	0x0	0x100941b8	0xb59bc	0xb43bc	0x4a1
_iob	0x0	0x100941bc	0xb59c0	0xb43c0	0x1db
strlen	0x0	0x100941c0	0xb59c4	0xb43c4	0x51c
_snprintf	0x0	0x100941c4	0xb59c8	0xb43c8	0x32f
strncpy	0x0	0x100941c8	0xb59cc	0xb43cc	0x520
getenv	0x0	0x100941cc	0xb59d0	0xb43d0	0x4b6
_stat	0x0	0x100941d0	0xb59d4	0xb43d4	0x352
fprintf	0x0	0x100941d4	0xb59d8	0xb43d8	0x49f
memset	0x0	0x100941d8	0xb59dc	0xb43dc	0x4ee
memcpy	0x0	0x100941dc	0xb59e0	0xb43e0	0x4ea
realloc	0x0	0x100941e0	0xb59e4	0xb43e4	0x4ff
_close	0x0	0x100941e4	0xb59e8	0xb43e8	0x123
_open	0x0	0x100941e8	0xb59ec	0xb43ec	0x2ec
_getcwd	0x0	0x100941ec	0xb59f0	0xb43f0	0x1b7

Exports (1656)

Api name	EAT Address	Ordinal
UTF8ToHtml	0x101d0	0x1
UTF8Toisolat1	0xa7f0	0x2
__docbDefaultSAXHandler	0xe18d	0x3
__htmlDefaultSAXHandler	0xe1a7	0x4
__oldXMLWDcompatibility	0xe1db	0x5
__xmlBufferAllocScheme	0xe1f5	0x6
__xmlDefaultBufferSize	0xe23b	0x7
__xmlDefaultSAXHandler	0xe281	0x8
__xmlDefaultSAXLocator	0xe299	0x9
__xmlDeregisterNodeDefaultValue	0xe649	0xa
__xmlDoValidityCheckingDefaultValue	0xe2b1	0xb
__xmlErrEncoding	0x2c707	0xc
__xmlGenericError	0xe2f7	0xd
__xmlGenericErrorContext	0xe32b	0xe
__xmlGetWarningsDefaultValue	0xe35f	0xf
__xmlIndentTreeOutput	0xe3a5	0x10
__xmlKeepBlanksDefaultValue	0xe431	0x11
__xmlLastError	0xe1c1	0x12
__xmlLineNumbersDefaultValue	0xe477	0x13
__xmlLoadExtDtdDefaultValue	0xe4bd	0x14
__xmlOutputBufferCreateFilenameValue	0xe67d	0x15
__xmlParserDebugEntities	0xe503	0x16
__xmlParserInputBufferCreateFilenameValue	0xe663	0x17
__xmlParserVersion	0xe549	0x18
__xmlPedanticParserDefaultValue	0xe55d	0x19
__xmlRaiseError	0xd9e6	0x1a
__xmlRegisterNodeDefaultValue	0xe62f	0x1b
__xmlSaveNoEmptyTags	0xe5a3	0x1c
__xmlSimpleError	0xddd9	0x1d
__xmlStructuredError	0xe311	0x1e
__xmlStructuredErrorContext	0xe345	0x1f
__xmlSubstituteEntitiesDefaultValue	0xe5e9	0x20
__xmlTreeIndentString	0xe3eb	0x21
attribute	0x1797b	0x22
attributeDecl	0x17840	0x23
cdataBlock	0x17bcc	0x24
characters	0x17a15	0x25
checkNamespace	0x17b39	0x26
comment	0x17b99	0x27
docbCreateFileParserCtxt	0xa434	0x28
docbCreatePushParserCtxt	0xa367	0x29
docbDefaultSAXHandlerInit	0x3c90e	0x2a
docbEncodeEntities	0xa2a4	0x2b
docbFreeParserCtxt	0xa305	0x2c
docbParseChunk	0xa336	0x2d
docbParseDoc	0xa3fd	0x2e
docbParseDocument	0xa2d4	0x2f
docbParseFile	0xa4ae	0x30
docbSAXParseDoc	0xa3af	0x31
docbSAXParseFile	0xa46b	0x32
elementDecl	0x17877	0x33
emptyExp	0xc3784	0x34
endDocument	0x17948	0x35
endElement	0x179af	0x36
entityDecl	0x17809	0x37
externalSubset	0x1773d	0x38
forbiddenExp	0xc3764	0x39
getColumnNumber	0x1763e	0x3a
getEntity	0x177a3	0x3b
getLineNumber	0x1760b	0x3c
getNamespace	0x17b08	0x3d
getParameterEntity	0x177d6	0x3e
getPublicId	0x175a5	0x3f
getSystemId	0x175d8	0x40
globalNamespace	0x17aaa	0x41
hasExternalSubset	0x176d7	0x42
hasInternalSubset	0x176a4	0x43
htmlAttrAllowed	0x1266f	0x44
htmlAutoCloseTag	0xfe0a	0x45
htmlCreateFileParserCtxt	0x12517	0x46
htmlCreateMemoryParserCtxt	0x11fd4	0x47
htmlCreatePushParserCtxt	0x1238e	0x48
htmlCtxtReadDoc	0x157cc	0x49
htmlCtxtReadFd	0x158d0	0x4a
htmlCtxtReadFile	0x15818	0x4b
htmlCtxtReadIO	0x1593c	0x4c
htmlCtxtReadMemory	0x15865	0x4d
htmlCtxtReset	0x1277a	0x4e
htmlCtxtUseOptions	0x1297f	0x4f
htmlDefaultSAXHandlerInit	0x3c849	0x50
htmlDocContentDumpFormatOutput	0x1681b	0x51
htmlDocContentDumpOutput	0x160c5	0x52
htmlDocDump	0x160dc	0x53
htmlDocDumpMemory	0x16a25	0x54
htmlDocDumpMemoryFormat	0x1693b	0x55
htmlElementAllowedHere	0x12600	0x56
htmlElementStatusHere	0x1263b	0x57
htmlEncodeEntities	0x1038c	0x58
htmlEntityLookup	0x1016c	0x59
htmlEntityValueLookup	0x101a2	0x5a
htmlFreeParserCtxt	0x11f85	0x5b
htmlGetMetaEncoding	0x159ae	0x5c
htmlHandleOmittedElem	0x125f0	0x5d
htmlInitAutoClose	0xfb90	0x5e
htmlIsAutoClosed	0xfe60	0x5f
htmlIsBooleanAttr	0x15dff	0x60
htmlIsScriptAttribute	0x10131	0x61
htmlNewDoc	0x107b6	0x62
htmlNewDocNoDtD	0x10725	0x63
htmlNewParserCtxt	0x11f8a	0x64
htmlNodeDump	0x16747	0x65
htmlNodeDumpFile	0x167da	0x66
htmlNodeDumpFileFormat	0x16765	0x67
htmlNodeDumpFormatOutput	0x161f9	0x68
htmlNodeDumpOutput	0x166b3	0x69
htmlNodeStatus	0x126fe	0x6a
htmlParseCharRef	0x117da	0x6b
htmlParseChunk	0x15321	0x6c
htmlParseDoc	0x154e9	0x6d
htmlParseDocument	0x14444	0x6e
htmlParseElement	0x13d5b	0x6f
htmlParseEntityRef	0x12b0d	0x70
htmlParseFile	0x15556	0x71
htmlReadDoc	0x1561a	0x72
htmlReadFd	0x156d3	0x73
htmlReadFile	0x15654	0x74
htmlReadIO	0x1574c	0x75
htmlReadMemory	0x15685	0x76
htmlSAXParseDoc	0x15482	0x77
htmlSAXParseFile	0x154fe	0x78
htmlSaveFile	0x1616e	0x79
htmlSaveFileEnc	0x16924	0x7a
htmlSaveFileFormat	0x16878	0x7b
htmlSetMetaEncoding	0x15b9c	0x7c
htmlTagLookup	0xfbf1	0x7d
ignorableWhitespace	0x17a48	0x7e
initGenericErrorDefaultFunc	0xcee2	0x7f
initdocbDefaultSAXHandler	0x3ca87	0x80
inithtmlDefaultSAXHandler	0x3c9e8	0x81
initxmlDefaultSAXHandler	0x3c91b	0x82
inputPop	0x1ca02	0x83
inputPush	0x1c995	0x84
internalSubset	0x1770a	0x85
isStandalone	0x17671	0x86
isolat1ToUTF8	0xa6e1	0x87
namePop	0x1cc96	0x88
namePush	0x1cc0f	0x89
namespaceDecl	0x17b6a	0x8a
nodePop	0x1cabf	0x8b
nodePush	0x1ca38	0x8c
notationDecl	0x178aa	0x8d
processingInstruction	0x17a77	0x8e
reference	0x179e2	0x8f
resolveEntity	0x17770	0x90
setDocumentLocator	0x17914	0x91
setNamespace	0x17ad9	0x92
startDocument	0x17943	0x93
startElement	0x179aa	0x94
unparsedEntityDecl	0x178dd	0x95
valuePop	0x829d9	0x96
valuePush	0x82a0f	0x97
xlinkGetDefaultDetect	0x50e32	0x98
xlinkGetDefaultHandler	0x50e22	0x99
xlinkIsLink	0x50e42	0x9a
xlinkSetDefaultDetect	0x50e38	0x9b
xlinkSetDefaultHandler	0x50e28	0x9c
xmlACatalogAdd	0x5332	0x9d
xmlACatalogDump	0x3ad4	0x9e
xmlACatalogRemove	0x53b0	0x9f
xmlACatalogResolve	0x51f5	0xa0
xmlACatalogResolvePublic	0x5174	0xa1
xmlACatalogResolveSystem	0x50f4	0xa2
xmlACatalogResolveURI	0x52b6	0xa3
xmlAddAttributeDecl	0x4d6f1	0xa4
xmlAddChild	0x4494c	0xa5
xmlAddChildList	0x455f5	0xa6
xmlAddDocEntity	0xc5c7	0xa7
xmlAddDtdEntity	0xc54a	0xa8
xmlAddElementDecl	0x49efd	0xa9
xmlAddEncodingAlias	0xb242	0xaa
xmlAddID	0x4ab1d	0xab
xmlAddNextSibling	0x46055	0xac
xmlAddNotationDecl	0x4a88c	0xad
xmlAddPrevSibling	0x46140	0xae
xmlAddRef	0x4ad6a	0xaf
xmlAddSibling	0x45536	0xb0
xmlAllocOutputBuffer	0x51ab5	0xb1
xmlAllocParserInputBuffer	0x51a28	0xb2
xmlAttrSerializeTxtContent	0x5f4a5	0xb3
xmlAutomataCompile	0x5e6eb	0xb4
xmlAutomataGetInitState	0x5b88b	0xb5
xmlAutomataIsDeterminist	0x5ce25	0xb6
xmlAutomataNewAllTrans	0x5bfe4	0xb7
xmlAutomataNewCountTrans	0x5bc90	0xb8
xmlAutomataNewCountTrans2	0x5bb36	0xb9
xmlAutomataNewCountedTrans	0x5c04a	0xba
xmlAutomataNewCounter	0x5c01c	0xbb
xmlAutomataNewCounterTrans	0x5c088	0xbc
xmlAutomataNewEpsilon	0x5bfb0	0xbd
xmlAutomataNewNegTrans	0x5b9f1	0xbe
xmlAutomataNewOnceTrans	0x5bebb	0xbf
xmlAutomataNewOnceTrans2	0x5bd85	0xc0
xmlAutomataNewState	0x5bf8f	0xc1
xmlAutomataNewTransition	0x5b8b4	0xc2
xmlAutomataNewTransition2	0x5b91c	0xc3
xmlAutomataSetFinalState	0x5b898	0xc4
xmlBoolToText	0x7d56	0xc5
xmlBufferAdd	0x417cf	0xc6
xmlBufferAddHead	0x4185d	0xc7
xmlBufferCCat	0x41959	0xc8
xmlBufferCat	0x41930	0xc9
xmlBufferContent	0x4169c	0xca
xmlBufferCreate	0x4138d	0xcb
xmlBufferCreateSize	0x413f3	0xcc
xmlBufferCreateStatic	0x41464	0xcd
xmlBufferDump	0x41669	0xce
xmlBufferEmpty	0x41504	0xcf
xmlBufferFree	0x414cf	0xd0
xmlBufferGrow	0x415d9	0xd1
xmlBufferLength	0x416a8	0xd2
xmlBufferResize	0x416b5	0xd3
xmlBufferSetAllocationScheme	0x414a4	0xd4
xmlBufferShrink	0x41540	0xd5
xmlBufferWriteCHAR	0x419c4	0xd6
xmlBufferWriteChar	0x419df	0xd7
xmlBufferWriteQuotedString	0x419fa	0xd8
xmlBuildQName	0x3e79e	0xd9
xmlBuildRelativeURI	0x48c8c	0xda
xmlBuildURI	0x488cf	0xdb
xmlByteConsumed	0xbc78	0xdc
xmlC14NDocDumpMemory	0x2953	0xdd
xmlC14NDocSave	0x2a00	0xde
xmlC14NDocSaveTo	0x292f	0xdf
xmlC14NExecute	0x285c	0xe0
xmlCanonicPath	0x48f9e	0xe1
xmlCatalogAdd	0x5659	0xe2
xmlCatalogAddLocal	0x5785	0xe3
xmlCatalogCleanup	0x3bd1	0xe4
xmlCatalogConvert	0x5730	0xe5
xmlCatalogDump	0x5632	0xe6
xmlCatalogFreeLocal	0x5769	0xe7
xmlCatalogGetDefaults	0x3c65	0xe8
xmlCatalogGetPublic	0x597c	0xe9
xmlCatalogGetSystem	0x58e0	0xea
xmlCatalogIsEmpty	0x3b4c	0xeb
xmlCatalogLocalResolve	0x57fc	0xec
xmlCatalogLocalResolveURI	0x5883	0xed
xmlCatalogRemove	0x56f3	0xee
xmlCatalogResolve	0x55ed	0xef
xmlCatalogResolvePublic	0x55cd	0xf0
xmlCatalogResolveSystem	0x55ad	0xf1
xmlCatalogResolveURI	0x5612	0xf2
xmlCatalogSetDebug	0x3d3c	0xf3
xmlCatalogSetDefaultPrefer	0x3ce3	0xf4
xmlCatalogSetDefaults	0x3c6b	0xf5
xmlCharEncCloseFunc	0xbc61	0xf6
xmlCharEncFirstLine	0xb98a	0xf7
xmlCharEncInFunc	0xb9a1	0xf8
xmlCharEncOutFunc	0xbaaf	0xf9
xmlCharInRange	0x60e0	0xfa
xmlCharStrdup	0x90d0d	0xfb
xmlCharStrndup	0x90cbd	0xfc
xmlCheckFilename	0x5152b	0xfd
xmlCheckHTTPInput	0x526df	0xfe
xmlCheckLanguageID	0x1c569	0xff
xmlCheckUTF8	0x912a5	0x100
xmlCheckVersion	0x2c60e	0x101
xmlChildElementCount	0x40282	0x102
xmlCleanupCharEncodingHandlers	0xb7f0	0x103
xmlCleanupEncodingAliases	0xb148	0x104
xmlCleanupGlobals	0xde5f	0x105
xmlCleanupInputCallbacks	0x51329	0x106
xmlCleanupMemory	0x53157	0x107
xmlCleanupOutputCallbacks	0x513a3	0x108
xmlCleanupParser	0x1e929	0x109
xmlCleanupPredefinedEntities	0x16a3c	0x10a
xmlCleanupThreads	0x3e523	0x10b
xmlClearNodeInfoSeq	0x2d9b6	0x10c
xmlClearParserCtxt	0x2e11f	0x10d
xmlConvertSGMLCatalog	0x315f	0x10e
xmlCopyAttributeTable	0x4a690	0x10f
xmlCopyChar	0x2d226	0x110
xmlCopyCharMultiByte	0x2d18d	0x111
xmlCopyDoc	0x45c6a	0x112
xmlCopyDocElementContent	0x4992f	0x113
xmlCopyDtd	0x45b3d	0x114
xmlCopyElementContent	0x49abf	0x115
xmlCopyElementTable	0x4a26a	0x116
xmlCopyEntitiesTable	0xcc23	0x117
xmlCopyEnumeration	0x4a43d	0x118
xmlCopyError	0xd8e8	0x119
xmlCopyNamespace	0x425d7	0x11a
xmlCopyNamespaceList	0x425f9	0x11b
xmlCopyNode	0x45b11	0x11c
xmlCopyNodeList	0x44c9e	0x11d
xmlCopyNotationTable	0x4a9f1	0x11e
xmlCopyProp	0x45841	0x11f
xmlCopyPropList	0x45853	0x120
xmlCreateDocParserCtxt	0x1e87c	0x121
xmlCreateEntitiesTable	0xcb50	0x122
xmlCreateEntityParserCtxt	0x1e77d	0x123
xmlCreateEnumeration	0x4a3c8	0x124
xmlCreateFileParserCtxt	0x1fca7	0x125
xmlCreateIOParserCtxt	0x1e5a6	0x126
xmlCreateIntSubset	0x3f890	0x127
xmlCreateMemoryParserCtxt	0x1e7f1	0x128
xmlCreatePushParserCtxt	0x1e365	0x129
xmlCreateURI	0x46930	0x12a
xmlCreateURLParserCtxt	0x1fc1c	0x12b
xmlCtxtGetLastError	0xd8ac	0x12c
xmlCtxtReadDoc	0x2c40d	0x12d
xmlCtxtReadFd	0x2c517	0x12e
xmlCtxtReadFile	0x2c45b	0x12f
xmlCtxtReadIO	0x2c589	0x130
xmlCtxtReadMemory	0x2c4aa	0x131
xmlCtxtReset	0x1e971	0x132
xmlCtxtResetLastError	0xd8c6	0x133
xmlCtxtResetPush	0x1eb92	0x134
xmlCtxtUseOptions	0x1ef5b	0x135
xmlCurrentChar	0x2ccc6	0x136
xmlDOMWrapAdoptNode	0x4440b	0x137
xmlDOMWrapCloneNode	0x43bcf	0x138
xmlDOMWrapFreeCtxt	0x41c52	0x139
xmlDOMWrapNewCtxt	0x41c22	0x13a
xmlDOMWrapReconcileNamespaces	0x432b7	0x13b
xmlDOMWrapRemoveNode	0x42ea2	0x13c
xmlDebugCheckDocument	0x7acb	0x13d
xmlDebugDumpAttr	0x8822	0x13e
xmlDebugDumpAttrList	0x787f	0x13f
xmlDebugDumpDTD	0x7a75	0x140
xmlDebugDumpDocument	0x7a23	0x141
xmlDebugDumpDocumentHead	0x79cd	0x142
xmlDebugDumpEntities	0x7838	0x143
xmlDebugDumpNode	0x791d	0x144
xmlDebugDumpNodeList	0x7973	0x145
xmlDebugDumpOneNode	0x78d0	0x146
xmlDebugDumpString	0x77af	0x147
xmlDecodeEntities	0x17393	0x148
xmlDefaultSAXHandlerInit	0x3c791	0x149
xmlDelEncodingAlias	0xb386	0x14a
xmlDeregisterNodeDefault	0xe0d1	0x14b
xmlDetectCharEncoding	0xb023	0x14c
xmlDictCleanup	0x94b7	0x14d
xmlDictCreate	0x98b3	0x14e
xmlDictCreateSub	0xa282	0x14f
xmlDictExists	0x9e5b	0x150
xmlDictFree	0x9b78	0x151
xmlDictLookup	0x9c51	0x152
xmlDictOwns	0xa229	0x153
xmlDictQLookup	0x9fc6	0x154
xmlDictReference	0x9921	0x155
xmlDictSize	0xa264	0x156
xmlDocCopyNode	0x45b26	0x157
xmlDocCopyNodeList	0x44c8b	0x158
xmlDocDump	0x60ea9	0x159
xmlDocDumpFormatMemory	0x60db5	0x15a
xmlDocDumpFormatMemoryEnc	0x60c66	0x15b
xmlDocDumpMemory	0x60d9c	0x15c
xmlDocDumpMemoryEnc	0x60dd0	0x15d
xmlDocFormatDump	0x60deb	0x15e
xmlDocGetRootElement	0x409b2	0x15f
xmlDocSetRootElement	0x45d42	0x160
xmlDumpAttributeDecl	0x4a6a1	0x161
xmlDumpAttributeTable	0x4a829	0x162
xmlDumpElementDecl	0x4a27b	0x163
xmlDumpElementTable	0x4a3a4	0x164
xmlDumpEntitiesTable	0xce96	0x165
xmlDumpEntityDecl	0xcce7	0x166
xmlDumpNotationDecl	0x4aa02	0x167
xmlDumpNotationTable	0x4aa94	0x168
xmlElemDump	0x60c0b	0x169
xmlEncodeEntities	0x17563	0x16a
xmlEncodeEntitiesReentrant	0xc762	0x16b
xmlEncodeSpecialChars	0xca6c	0x16c
xmlErrMemory	0x2c689	0x16d
xmlExpCtxtNbCons	0x5c78c	0x16e
xmlExpCtxtNbNodes	0x5c77c	0x16f
xmlExpDump	0x5c74c	0x170
xmlExpExpDerive	0x5dbc9	0x171
xmlExpFree	0x5c24d	0x172
xmlExpFreeCtxt	0x5c162	0x173
xmlExpGetLanguage	0x5c393	0x174
xmlExpGetStart	0x5c4bf	0x175
xmlExpIsNillable	0x5c4f4	0x176
xmlExpMaxToken	0x5c76c	0x177
xmlExpNewAtom	0x5d1e4	0x178
xmlExpNewCtxt	0x5c0c6	0x179
xmlExpNewOr	0x5d223	0x17a
xmlExpNewRange	0x5d2b1	0x17b
xmlExpNewSeq	0x5d26a	0x17c
xmlExpParse	0x5e042	0x17d
xmlExpRef	0x5c2eb	0x17e
xmlExpStringDerive	0x5d475	0x17f
xmlExpSubsume	0x5dc17	0x180
xmlFileClose	0x517d7	0x181
xmlFileMatch	0x515f2	0x182
xmlFileOpen	0x51691	0x183
xmlFileRead	0x51742	0x184
xmlFindCharEncodingHandler	0xbf13	0x185
xmlFirstElementChild	0x402b8	0x186
xmlFree	0xc32a0	0x187
xmlFreeAttributeTable	0x4a5e5	0x188
xmlFreeAutomata	0x5b86b	0x189
xmlFreeCatalog	0x2c21	0x18a
xmlFreeDoc	0x447fc	0x18b
xmlFreeDocElementContent	0x49acd	0x18c
xmlFreeDtd	0x446c7	0x18d
xmlFreeElementContent	0x49b88	0x18e
xmlFreeElementTable	0x4a1d6	0x18f
xmlFreeEntitiesTable	0xcb69	0x190
xmlFreeEnumeration	0x4a40e	0x191
xmlFreeIDTable	0x4ac3e	0x192
xmlFreeInputStream	0x2d449	0x193
xmlFreeMutex	0x3e346	0x194
xmlFreeNode	0x42397	0x195
xmlFreeNodeList	0x44aa5	0x196
xmlFreeNotationTable	0x4a973	0x197
xmlFreeNs	0x3f77a	0x198
xmlFreeNsList	0x3f7ab	0x199
xmlFreeParserCtxt	0x2d778	0x19a
xmlFreeParserInputBuffer	0x51be9	0x19b
xmlFreePattern	0x2ffc1	0x19c
xmlFreePatternList	0x30071	0x19d
xmlFreeProp	0x3fc56	0x19e
xmlFreePropList	0x422a4	0x19f
xmlFreeRMutex	0x3e3a6	0x1a0
xmlFreeRefTable	0x4aec0	0x1a1
xmlFreeStreamCtxt	0x2f94c	0x1a2
xmlFreeTextReader	0x5482a	0x1a3
xmlFreeTextWriter	0x7e752	0x1a4
xmlFreeURI	0x474dd	0x1a5
xmlFreeValidCtxt	0x497d7	0x1a6
xmlGcMemGet	0x53259	0x1a7
xmlGcMemSetup	0x53204	0x1a8
xmlGetBufferAllocationScheme	0x3f762	0x1a9
xmlGetCharEncodingHandler	0xc008	0x1aa
xmlGetCharEncodingName	0xb714	0x1ab
xmlGetCompressMode	0x41af3	0x1ac
xmlGetDocCompressMode	0x41abf	0x1ad
xmlGetDocEntity	0xc70b	0x1ae
xmlGetDtdAttrDesc	0x4b124	0x1af
xmlGetDtdElementDesc	0x4af94	0x1b0
xmlGetDtdEntity	0xc6e5	0x1b1
xmlGetDtdNotationDesc	0x4b1c0	0x1b2
xmlGetDtdQAttrDesc	0x4b198	0x1b3
xmlGetDtdQElementDesc	0x4b100	0x1b4
xmlGetEncodingAlias	0xb1ad	0x1b5
xmlGetExternalEntityLoader	0x529d6	0x1b6
xmlGetFeature	0x16a91	0x1b7
xmlGetFeaturesList	0x16a3d	0x1b8
xmlGetGlobalState	0x3e663	0x1b9
xmlGetID	0x4acca	0x1ba
xmlGetIntSubset	0x3f86f	0x1bb
xmlGetLastChild	0x5b88b	0x1bc
xmlGetLastError	0xd814	0x1bd
xmlGetLineNo	0x404cd	0x1be
xmlGetNoNsProp	0x411ff	0x1bf
xmlGetNodePath	0x4052d	0x1c0
xmlGetNsList	0x40a68	0x1c1
xmlGetNsProp	0x41223	0x1c2
xmlGetParameterEntity	0xc69e	0x1c3
xmlGetPredefinedEntity	0xc4af	0x1c4
xmlGetProp	0x411e4	0x1c5
xmlGetRefs	0x4af6e	0x1c6
xmlGetThreadId	0x3e4f7	0x1c7
xmlGetUTF8Char	0x911ad	0x1c8
xmlHandleEntity	0x17507	0x1c9
xmlHasFeature	0x1c0d3	0x1ca
xmlHasNsProp	0x411c9	0x1cb
xmlHasProp	0x41146	0x1cc
xmlHashAddEntry	0xf358	0x1cd
xmlHashAddEntry2	0xf371	0x1ce
xmlHashAddEntry3	0xeadc	0x1cf
xmlHashCopy	0xf1c2	0x1d0
xmlHashCreate	0xe846	0x1d1
xmlHashCreateDict	0xe89d	0x1d2
xmlHashFree	0xe9ef	0x1d3
xmlHashLookup	0xf3c7	0x1d4
xmlHashLookup2	0xf3dc	0x1d5
xmlHashLookup3	0xef15	0x1d6
xmlHashQLookup	0xf3f3	0x1d7
xmlHashQLookup2	0xf40e	0x1d8
xmlHashQLookup3	0xefc4	0x1d9
xmlHashRemoveEntry	0xf45e	0x1da
xmlHashRemoveEntry2	0xf477	0x1db
xmlHashRemoveEntry3	0xf24b	0x1dc
xmlHashScan	0xf42e	0x1dd
xmlHashScan3	0xf455	0x1de
xmlHashScanFull	0xf065	0x1df
xmlHashScanFull3	0xf0fd	0x1e0
xmlHashSize	0x5c76c	0x1e1
xmlHashUpdateEntry	0xf38c	0x1e2
xmlHashUpdateEntry2	0xf3a9	0x1e3
xmlHashUpdateEntry3	0xecda	0x1e4
xmlIOFTPClose	0x5191c	0x1e5
xmlIOFTPMatch	0x518e4	0x1e6
xmlIOFTPOpen	0x518fd	0x1e7
xmlIOFTPRead	0x51902	0x1e8
xmlIOHTTPClose	0x518d7	0x1e9
xmlIOHTTPMatch	0x51896	0x1ea
xmlIOHTTPOpen	0x518af	0x1eb
xmlIOHTTPOpenW	0x52c1e	0x1ec
xmlIOHTTPRead	0x518bd	0x1ed
xmlIOParseDTD	0x2baca	0x1ee
xmlInitCharEncodingHandlers	0xbe35	0x1ef
xmlInitGlobals	0xde4b	0x1f0
xmlInitMemory	0x530eb	0x1f1
xmlInitNodeInfoSeq	0x2d9a3	0x1f2
xmlInitParser	0x1e8b1	0x1f3
xmlInitParserCtxt	0x2ddf4	0x1f4
xmlInitThreads	0x3e517	0x1f5
xmlInitializeCatalog	0x53f0	0x1f6
xmlInitializeGlobalState	0xde7b	0x1f7
xmlInitializePredefinedEntities	0x16a3c	0x1f8
xmlIsBaseChar	0x6162	0x1f9
xmlIsBaseCharGroup	0x957dc	0x1fa
xmlIsBlank	0x61b9	0x1fb
xmlIsBlankNode	0x412d0	0x1fc
xmlIsChar	0x61df	0x1fd
xmlIsCharGroup	0x957fc	0x1fe
xmlIsCombining	0x6226	0x1ff
xmlIsCombiningGroup	0x95994	0x200
xmlIsDigit	0x6244	0x201
xmlIsDigitGroup	0x959dc	0x202
xmlIsExtender	0x6269	0x203
xmlIsExtenderGroup	0x95a14	0x204
xmlIsID	0x4da33	0x205
xmlIsIdeographic	0x628f	0x206
xmlIsIdeographicGroup	0x95a24	0x207
xmlIsLetter	0x2c7c9	0x208
xmlIsMainThread	0x3e702	0x209
xmlIsMixedElement	0x4b248	0x20a
xmlIsPubidChar	0x62c4	0x20b
xmlIsPubidChar_tab	0x953c8	0x20c
xmlIsRef	0x4dbee	0x20d
xmlIsXHTML	0x5e93a	0x20e
xmlKeepBlanksDefault	0x2db73	0x20f
xmlLastElementChild	0x402ea	0x210
xmlLineNumbersDefault	0x2db45	0x211
xmlLinkGetData	0x18063	0x212
xmlListAppend	0x17e33	0x213
xmlListClear	0x17f12	0x214
xmlListCopy	0x18126	0x215
xmlListCreate	0x17d00	0x216
xmlListDelete	0x18103	0x217
xmlListDup	0x18185	0x218
xmlListEmpty	0x17f38	0x219
xmlListEnd	0x17f5e	0x21a
xmlListFront	0x17f50	0x21b
xmlListInsert	0x17dd5	0x21c
xmlListMerge	0x1816b	0x21d
xmlListPopBack	0x17fa6	0x21e
xmlListPopFront	0x17f89	0x21f
xmlListPushBack	0x18012	0x220
xmlListPushFront	0x17fc4	0x221
xmlListRemoveAll	0x17eec	0x222
xmlListRemoveFirst	0x17e90	0x223
xmlListRemoveLast	0x17ebe	0x224
xmlListReverse	0x18070	0x225
xmlListReverseSearch	0x17db8	0x226
xmlListReverseWalk	0x180ce	0x227
xmlListSearch	0x17d9b	0x228
xmlListSize	0x17f6d	0x229
xmlListSort	0x181b9	0x22a
xmlListWalk	0x1809b	0x22b
xmlLoadACatalog	0x5f1c	0x22c
xmlLoadCatalog	0x5fe1	0x22d
xmlLoadCatalogs	0x603f	0x22e
xmlLoadExternalEntity	0x529dc	0x22f
xmlLoadSGMLSuperCatalog	0x5ebb	0x230
xmlLockLibrary	0x3e4fd	0x231
xmlLsCountNode	0x7b23	0x232
xmlLsOneNode	0x7b90	0x233
xmlMalloc	0xc32a4	0x234
xmlMallocAtomic	0xc32a8	0x235
xmlMallocAtomicLoc	0x53396	0x236
xmlMallocLoc	0x532ab	0x237
xmlMemBlocks	0x53017	0x238
xmlMemDisplay	0x53065	0x239
xmlMemDisplayLast	0x5301d	0x23a
xmlMemFree	0x535df	0x23b
xmlMemGet	0x531c1	0x23c
xmlMemMalloc	0x53481	0x23d
xmlMemRealloc	0x535c7	0x23e
xmlMemSetup	0x5317b	0x23f
xmlMemShow	0x530c5	0x240
xmlMemStrdup	0xc32b0	0x241
xmlMemStrdupLoc	0x536b9	0x242
xmlMemUsed	0x53011	0x243
xmlMemoryDump	0x16a3c	0x244
xmlMemoryStrdup	0x537a4	0x245
xmlModuleClose	0x5e8c6	0x246
xmlModuleFree	0x5e73d	0x247
xmlModuleOpen	0x5e7be	0x248
xmlModuleSymbol	0x5e83d	0x249
xmlMutexLock	0x3e361	0x24a
xmlMutexUnlock	0x3e374	0x24b
xmlNamespaceParseNCName	0x173c2	0x24c
xmlNamespaceParseNSDef	0x17420	0x24d
xmlNamespaceParseQName	0x173f1	0x24e
xmlNanoFTPCheckResponse	0x1882e	0x24f
xmlNanoFTPCleanup	0x18209	0x250
xmlNanoFTPClose	0x19b73	0x251
xmlNanoFTPCloseConnection	0x19262	0x252
xmlNanoFTPConnect	0x18a5a	0x253
xmlNanoFTPConnectTo	0x19c8a	0x254
xmlNanoFTPCwd	0x18e5f	0x255
xmlNanoFTPDele	0x18f0c	0x256
xmlNanoFTPFreeCtxt	0x185d0	0x257
xmlNanoFTPGet	0x199bf	0x258
xmlNanoFTPGetConnection	0x18fb9	0x259
xmlNanoFTPGetResponse	0x18825	0x25a
xmlNanoFTPGetSocket	0x1989e	0x25b
xmlNanoFTPInit	0x19bb9	0x25c
xmlNanoFTPList	0x195f7	0x25d
xmlNanoFTPNewCtxt	0x18548	0x25e
xmlNanoFTPOpen	0x19cdd	0x25f
xmlNanoFTPProxy	0x18267	0x260
xmlNanoFTPQuit	0x189d8	0x261
xmlNanoFTPRead	0x19b15	0x262
xmlNanoFTPScanProxy	0x184b4	0x263
xmlNanoFTPUpdateURL	0x183f7	0x264
xmlNanoHTTPAuthHeader	0x1b281	0x265
xmlNanoHTTPCleanup	0x1a6b3	0x266
xmlNanoHTTPClose	0x1b261	0x267
xmlNanoHTTPContentLength	0x1b28e	0x268
xmlNanoHTTPEncoding	0x1b2ab	0x269
xmlNanoHTTPFetch	0x1b8d1	0x26a
xmlNanoHTTPInit	0x1b341	0x26b
xmlNanoHTTPMethod	0x1b7db	0x26c
xmlNanoHTTPMethodRedir	0x1b3e0	0x26d
xmlNanoHTTPMimeType	0x1b2b8	0x26e
xmlNanoHTTPOpen	0x1b88a	0x26f
xmlNanoHTTPOpenRedir	0x1b8a8	0x270
xmlNanoHTTPRead	0x1b208	0x271
xmlNanoHTTPRedir	0x1b29e	0x272
xmlNanoHTTPReturnCode	0x1b271	0x273
xmlNanoHTTPSave	0x1b7fc	0x274
xmlNanoHTTPScanProxy	0x1a7a6	0x275
xmlNewAutomata	0x5cdc1	0x276
xmlNewCDataBlock	0x401d3	0x277
xmlNewCatalog	0x3b0c	0x278
xmlNewCharEncodingHandler	0xbd46	0x279
xmlNewCharRef	0x3ff84	0x27a
xmlNewChild	0x454a6	0x27b
xmlNewComment	0x40165	0x27c
xmlNewDoc	0x3fa02	0x27d
xmlNewDocComment	0x40246	0x27e
xmlNewDocElementContent	0x49804	0x27f
xmlNewDocFragment	0x3febc	0x280
xmlNewDocNode	0x452d8	0x281
xmlNewDocNodeEatName	0x4534c	0x282
xmlNewDocPI	0x3fd2a	0x283
xmlNewDocProp	0x45218	0x284
xmlNewDocRawNode	0x453c1	0x285
xmlNewDocText	0x400c1	0x286
xmlNewDocTextLen	0x4014a	0x287
xmlNewDtd	0x3f7c5	0x288
xmlNewElementContent	0x4991c	0x289
xmlNewEntity	0xc644	0x28a
xmlNewEntityInputStream	0x2d507	0x28b
xmlNewGlobalNs	0x17534	0x28c
xmlNewIOInputStream	0x2dd79	0x28d
xmlNewInputFromFile	0x2d66b	0x28e
xmlNewInputStream	0x2d4b7	0x28f
xmlNewMutex	0x3e323	0x290
xmlNewNode	0x3fde1	0x291
xmlNewNodeEatName	0x3fe51	0x292
xmlNewNs	0x41f85	0x293
xmlNewNsProp	0x4225a	0x294
xmlNewNsPropEatName	0x4227f	0x295
xmlNewPI	0x3fdce	0x296
xmlNewParserCtxt	0x2e0d6	0x297
xmlNewProp	0x4223a	0x298
xmlNewRMutex	0x3e385	0x299
xmlNewReference	0x40015	0x29a
xmlNewStringInputStream	0x2d5ec	0x29b
xmlNewText	0x3ff16	0x29c
xmlNewTextChild	0x45416	0x29d
xmlNewTextLen	0x400d7	0x29e
xmlNewTextReader	0x54571	0x29f
xmlNewTextReaderFilename	0x547a8	0x2a0
xmlNewTextWriter	0x7f64a	0x2a1
xmlNewTextWriterDoc	0x7f866	0x2a2
xmlNewTextWriterFilename	0x7f745	0x2a3
xmlNewTextWriterMemory	0x7f7a3	0x2a4
xmlNewTextWriterPushParser	0x7f7ef	0x2a5
xmlNewTextWriterTree	0x7f94f	0x2a6
xmlNewValidCtxt	0x497a5	0x2a7
xmlNextChar	0x2ca04	0x2a8
xmlNextElementSibling	0x40355	0x2a9
xmlNoNetExternalEntityLoader	0x52a40	0x2aa
xmlNodeAddContent	0x44d85	0x2ab
xmlNodeAddContentLen	0x44caf	0x2ac
xmlNodeBufGetContent	0x4284f	0x2ad
xmlNodeDump	0x60b80	0x2ae
xmlNodeDumpOutput	0x607ce	0x2af
xmlNodeGetBase	0x426b9	0x2b0
xmlNodeGetContent	0x429c0	0x2b1
xmlNodeGetLang	0x42625	0x2b2
xmlNodeGetSpacePreserve	0x4264e	0x2b3
xmlNodeIsText	0x412bb	0x2b4
xmlNodeListGetRawString	0x3fb7c	0x2b5
xmlNodeListGetString	0x3faa2	0x2b6
xmlNodeSetBase	0x45e42	0x2b7
xmlNodeSetContent	0x45f09	0x2b8
xmlNodeSetContentLen	0x46575	0x2b9
xmlNodeSetLang	0x45dae	0x2ba
xmlNodeSetName	0x409ce	0x2bb
xmlNodeSetSpacePreserve	0x45dee	0x2bc
xmlNormalizeURIPath	0x4757a	0x2bd
xmlNormalizeWindowsPath	0x51324	0x2be
xmlOutputBufferClose	0x52b58	0x2bf
xmlOutputBufferCreateBuffer	0x52bd6	0x2c0
xmlOutputBufferCreateFd	0x51e49	0x2c1
xmlOutputBufferCreateFile	0x52f95	0x2c2
xmlOutputBufferCreateFilename	0x52f7a	0x2c3
xmlOutputBufferCreateFilenameDefault	0x52fd0	0x2c4
xmlOutputBufferCreateIO	0x51ea0	0x2c5
xmlOutputBufferFlush	0x52550	0x2c6
xmlOutputBufferWrite	0x520ca	0x2c7
xmlOutputBufferWriteEscape	0x522da	0x2c8
xmlOutputBufferWriteString	0x52517	0x2c9
xmlParseAttValue	0x29309	0x2ca
xmlParseAttribute	0x29cad	0x2cb
xmlParseAttributeListDecl	0x29518	0x2cc
xmlParseAttributeType	0x22bd9	0x2cd
xmlParseBalancedChunkMemory	0x2be6b	0x2ce
xmlParseBalancedChunkMemoryRecover	0x28fe0	0x2cf
xmlParseCDSect	0x2483d	0x2d0
xmlParseCatalogFile	0x3339	0x2d1
xmlParseCharData	0x261bc	0x2d2
xmlParseCharEncoding	0xb40e	0x2d3
xmlParseCharRef	0x251b2	0x2d4
xmlParseChunk	0x2b7d5	0x2d5
xmlParseComment	0x21d09	0x2d6
xmlParseContent	0x2858a	0x2d7
xmlParseCtxtExternalEntity	0x288e6	0x2d8
xmlParseDTD	0x2be58	0x2d9
xmlParseDefaultDecl	0x29327	0x2da
xmlParseDoc	0x2c1ec	0x2db
xmlParseDocTypeDecl	0x2417f	0x2dc
xmlParseDocument	0x2a419	0x2dd
xmlParseElement	0x2a11d	0x2de
xmlParseElementChildrenContentDecl	0x237c3	0x2df
xmlParseElementContentDecl	0x237d6	0x2e0
xmlParseElementDecl	0x2389f	0x2e1
xmlParseElementMixedContentDecl	0x22f15	0x2e2
xmlParseEncName	0x1f504	0x2e3
xmlParseEncodingDecl	0x1f672	0x2e4
xmlParseEndTag	0x24400	0x2e5
xmlParseEntity	0x292fb	0x2e6
xmlParseEntityDecl	0x264d2	0x2e7
xmlParseEntityRef	0x23baf	0x2e8
xmlParseEntityValue	0x258fa	0x2e9
xmlParseEnumeratedType	0x22adb	0x2ea
xmlParseEnumerationType	0x2298e	0x2eb
xmlParseExtParsedEnt	0x28720	0x2ec
xmlParseExternalEntity	0x2021d	0x2ed
xmlParseExternalID	0x21655	0x2ee
xmlParseExternalSubset	0x299ce	0x2ef
xmlParseFile	0x2bf61	0x2f0
xmlParseInNodeContext	0x28cb3	0x2f1
xmlParseMarkupDecl	0x298f8	0x2f2
xmlParseMemory	0x2c0b0	0x2f3
xmlParseMisc	0x25136	0x2f4
xmlParseName	0x20aad	0x2f5
xmlParseNamespace	0x1747e	0x2f6
xmlParseNmtoken	0x20dd4	0x2f7
xmlParseNotationDecl	0x2263b	0x2f8
xmlParseNotationType	0x2284f	0x2f9
xmlParsePEReference	0x23d8a	0x2fa
xmlParsePI	0x221cc	0x2fb
xmlParsePITarget	0x220dd	0x2fc
xmlParsePubidLiteral	0x1f1fa	0x2fd
xmlParseQuotedString	0x1744f	0x2fe
xmlParseReference	0x27088	0x2ff
xmlParseSDDecl	0x24c46	0x300
xmlParseStartTag	0x29df2	0x301
xmlParseSystemLiteral	0x21023	0x302
xmlParseTextDecl	0x1fcb5	0x303
xmlParseURI	0x48576	0x304
xmlParseURIRaw	0x485b8	0x305
xmlParseURIReference	0x485a9	0x306
xmlParseVersionInfo	0x1f3d1	0x307
xmlParseVersionNum	0x1dead	0x308
xmlParseXMLDecl	0x24ec0	0x309
xmlParserAddNodeInfo	0x2da4f	0x30a
xmlParserError	0xd3df	0x30b
xmlParserFindNodeInfo	0x2e13b	0x30c
xmlParserFindNodeInfoIndex	0x2d9d7	0x30d
xmlParserGetDirectory	0x52607	0x30e
xmlParserHandlePEReference	0x20241	0x30f
xmlParserHandleReference	0x174da	0x310
xmlParserInputBufferCreateFd	0x51d28	0x311
xmlParserInputBufferCreateFile	0x51ced	0x312
xmlParserInputBufferCreateFilename	0x51cd7	0x313
xmlParserInputBufferCreateFilenameDefault	0x51ecd	0x314
xmlParserInputBufferCreateIO	0x51e73	0x315
xmlParserInputBufferCreateMem	0x51d55	0x316
xmlParserInputBufferCreateStatic	0x51daf	0x317
xmlParserInputBufferGrow	0x51f84	0x318
xmlParserInputBufferPush	0x51eed	0x319
xmlParserInputBufferRead	0x52095	0x31a
xmlParserInputGrow	0x2c8de	0x31b
xmlParserInputRead	0x2c85b	0x31c
xmlParserInputShrink	0x2c960	0x31d
xmlParserMaxDepth	0xc3630	0x31e
xmlParserPrintFileContext	0xd071	0x31f
xmlParserPrintFileInfo	0xcf3a	0x320
xmlParserValidityError	0xd605	0x321
xmlParserValidityWarning	0xd71c	0x322
xmlParserWarning	0xd4f2	0x323
xmlPathToURI	0x490ff	0x324
xmlPatternFromRoot	0x2ff9a	0x325
xmlPatternGetStreamCtxt	0x2feb3	0x326
xmlPatternMatch	0x2fe86	0x327
xmlPatternMaxDepth	0x2ff1f	0x328
xmlPatternMinDepth	0x2ff6a	0x329
xmlPatternStreamable	0x2ff01	0x32a
xmlPatterncompile	0x3008f	0x32b
xmlPedanticParserDefault	0x2db2e	0x32c
xmlPopInput	0x1cd91	0x32d
xmlPopInputCallbacks	0x51368	0x32e
xmlPreviousElementSibling	0x4031c	0x32f
xmlPrintURI	0x47403	0x330
xmlPushInput	0x1f159	0x331
xmlRMutexLock	0x3e3c0	0x332
xmlRMutexUnlock	0x3e3d5	0x333
xmlReadDoc	0x2c28a	0x334
xmlReadFd	0x2c313	0x335
xmlReadFile	0x2c2bb	0x336
xmlReadIO	0x2c390	0x337
xmlReadMemory	0x2c2e6	0x338
xmlReaderForDoc	0x576bf	0x339
xmlReaderForFd	0x562c8	0x33a
xmlReaderForFile	0x56247	0x33b
xmlReaderForIO	0x56327	0x33c
xmlReaderForMemory	0x56273	0x33d
xmlReaderNewDoc	0x576eb	0x33e
xmlReaderNewFd	0x56483	0x33f
xmlReaderNewFile	0x56409	0x340
xmlReaderNewIO	0x564c2	0x341
xmlReaderNewMemory	0x56444	0x342
xmlReaderNewWalker	0x56389	0x343
xmlReaderWalker	0x561cc	0x344
xmlRealloc	0xc32ac	0x345
xmlReallocLoc	0x53495	0x346
xmlReconciliateNs	0x42b66	0x347
xmlRecoverDoc	0x2c5fd	0x348
xmlRecoverFile	0x2bf72	0x349
xmlRecoverMemory	0x2c0c5	0x34a
xmlRegExecErrInfo	0x5a9b5	0x34b
xmlRegExecNextValues	0x5a997	0x34c
xmlRegExecPushString	0x5a54c	0x34d
xmlRegExecPushString2	0x5a563	0x34e
xmlRegFreeExecCtxt	0x59d04	0x34f
xmlRegFreeRegexp	0x5b79a	0x350
xmlRegNewExecCtxt	0x59c11	0x351
xmlRegexpCompile	0x5e64a	0x352
xmlRegexpExec	0x5b77c	0x353
xmlRegexpIsDeterminist	0x5e089	0x354
xmlRegexpPrint	0x5b681	0x355
xmlRegisterCharEncodingHandler	0xb863	0x356
xmlRegisterDefaultInputCallbacks	0x519c1	0x357
xmlRegisterDefaultOutputCallbacks	0x52dd8	0x358
xmlRegisterHTTPPostCallbacks	0x52e26	0x359
xmlRegisterInputCallbacks	0x51921	0x35a
xmlRegisterNodeDefault	0xe081	0x35b
xmlRegisterOutputCallbacks	0x51971	0x35c
xmlRelaxNGCleanupTypes	0x3191a	0x35d
xmlRelaxNGDump	0x33936	0x35e
xmlRelaxNGDumpTree	0x339b4	0x35f
xmlRelaxNGFree	0x38983	0x360
xmlRelaxNGFreeParserCtxt	0x38b0b	0x361
xmlRelaxNGFreeValidCtxt	0x34a51	0x362
xmlRelaxNGGetParserErrors	0x34b25	0x363
xmlRelaxNGGetValidErrors	0x34b25	0x364
xmlRelaxNGInitTypes	0x350fe	0x365
xmlRelaxNGNewDocParserCtxt	0x33185	0x366
xmlRelaxNGNewMemParserCtxt	0x33120	0x367
xmlRelaxNGNewParserCtxt	0x330c0	0x368
xmlRelaxNGNewValidCtxt	0x349de	0x369
xmlRelaxNGParse	0x3a010	0x36a
xmlRelaxNGSetParserErrors	0x34b04	0x36b
xmlRelaxNGSetParserStructuredErrors	0x3350e	0x36c
xmlRelaxNGSetValidErrors	0x34b04	0x36d
xmlRelaxNGSetValidStructuredErrors	0x3350e	0x36e
xmlRelaxNGValidateDoc	0x388fa	0x36f
xmlRelaxNGValidateFullElement	0x38ea6	0x370
xmlRelaxNGValidatePopElement	0x33cb7	0x371
xmlRelaxNGValidatePushCData	0x33c4b	0x372
xmlRelaxNGValidatePushElement	0x38dca	0x373
xmlRelaxParserSetFlag	0x30aee	0x374
xmlRemoveID	0x4ac4f	0x375
xmlRemoveProp	0x3fcd9	0x376
xmlRemoveRef	0x4aed1	0x377
xmlReplaceNode	0x42516	0x378
xmlResetError	0xd827	0x379
xmlResetLastError	0xd894	0x37a
xmlSAX2AttributeDecl	0x3a839	0x37b
xmlSAX2CDataBlock	0x3c5f8	0x37c
xmlSAX2Characters	0x3c2eb	0x37d
xmlSAX2Comment	0x3c563	0x37e
xmlSAX2ElementDecl	0x3a964	0x37f
xmlSAX2EndDocument	0x3ac87	0x380
xmlSAX2EndElement	0x3b94e	0x381
xmlSAX2EndElementNs	0x3c232	0x382
xmlSAX2EntityDecl	0x3a746	0x383
xmlSAX2ExternalSubset	0x3a441	0x384
xmlSAX2GetColumnNumber	0x3a366	0x385
xmlSAX2GetEntity	0x3a60e	0x386
xmlSAX2GetLineNumber	0x3a350	0x387
xmlSAX2GetParameterEntity	0x3a72e	0x388
xmlSAX2GetPublicId	0x4ad67	0x389
xmlSAX2GetSystemId	0x3a33a	0x38a
xmlSAX2HasExternalSubset	0x3a3b7	0x38b
xmlSAX2HasInternalSubset	0x3a39a	0x38c
xmlSAX2IgnorableWhitespace	0x16a3c	0x38d
xmlSAX2InitDefaultSAXHandler	0x3c764	0x38e
xmlSAX2InitDocbDefaultSAXHandler	0x3c856	0x38f
xmlSAX2InitHtmlDefaultSAXHandler	0x3c7a1	0x390
xmlSAX2InternalSubset	0x3a3d4	0x391
xmlSAX2IsStandalone	0x3a37c	0x392
xmlSAX2NotationDecl	0x3a9f6	0x393
xmlSAX2ProcessingInstruction	0x3c4c9	0x394
xmlSAX2Reference	0x3c2ab	0x395
xmlSAX2ResolveEntity	0x3a5bf	0x396
xmlSAX2SetDocumentLocator	0x16a3c	0x397
xmlSAX2StartDocument	0x3ab9b	0x398
xmlSAX2StartElement	0x3b65e	0x399
xmlSAX2StartElementNs	0x3bf31	0x39a
xmlSAX2UnparsedEntityDecl	0x3aaa1	0x39b
xmlSAXDefaultVersion	0x3c644	0x39c
xmlSAXParseDTD	0x2bc94	0x39d
xmlSAXParseDoc	0x2c16e	0x39e
xmlSAXParseEntity	0x29293	0x39f
xmlSAXParseFile	0x2bf4a	0x3a0
xmlSAXParseFileWithData	0x2be8c	0x3a1
xmlSAXParseMemory	0x2c095	0x3a2
xmlSAXParseMemoryWithData	0x2c00e	0x3a3
xmlSAXUserParseFile	0x2bf83	0x3a4
xmlSAXUserParseMemory	0x2c0da	0x3a5
xmlSAXVersion	0x3c662	0x3a6
xmlSaveClose	0x5f457	0x3a7
xmlSaveDoc	0x60b54	0x3a8
xmlSaveFile	0x610a1	0x3a9
xmlSaveFileEnc	0x61073	0x3aa
xmlSaveFileTo	0x60ebc	0x3ab
xmlSaveFlush	0x5f43c	0x3ac
xmlSaveFormatFile	0x6108a	0x3ad
xmlSaveFormatFileEnc	0x60fce	0x3ae
xmlSaveFormatFileTo	0x60f3c	0x3af
xmlSaveSetAttrEscape	0x5f48f	0x3b0
xmlSaveSetEscape	0x5f479	0x3b1
xmlSaveToBuffer	0x5f396	0x3b2
xmlSaveToFd	0x5f31d	0x3b3
xmlSaveToFilename	0x5f358	0x3b4
xmlSaveToIO	0x5f3f9	0x3b5
xmlSaveTree	0x5ff65	0x3b6
xmlSaveUri	0x4696c	0x3b7
xmlScanName	0x174ab	0x3b8
xmlSchemaCheckFacet	0x72912	0x3b9
xmlSchemaCleanupTypes	0x784df	0x3ba
xmlSchemaCollapseString	0x79741	0x3bb
xmlSchemaCompareValues	0x7c939	0x3bc
xmlSchemaCompareValuesWhtsp	0x7c996	0x3bd
xmlSchemaCopyValue	0x7b2af	0x3be
xmlSchemaDump	0x69925	0x3bf
xmlSchemaFree	0x628f1	0x3c0
xmlSchemaFreeFacet	0x626da	0x3c1
xmlSchemaFreeParserCtxt	0x6c35f	0x3c2
xmlSchemaFreeType	0x62715	0x3c3
xmlSchemaFreeValidCtxt	0x681e9	0x3c4
xmlSchemaFreeValue	0x7894c	0x3c5
xmlSchemaFreeWildcard	0x625aa	0x3c6
xmlSchemaGetBuiltInListSimpleTypeItemType	0x789f0	0x3c7
xmlSchemaGetBuiltInType	0x78672	0x3c8
xmlSchemaGetCanonValue	0x7d01b	0x3c9
xmlSchemaGetCanonValueWhtsp	0x7d81f	0x3ca
xmlSchemaGetFacetValueAsULong	0x7ca74	0x3cb
xmlSchemaGetParserErrors	0x683da	0x3cc
xmlSchemaGetPredefinedType	0x789c1	0x3cd
xmlSchemaGetValType	0x4169c	0x3ce
xmlSchemaGetValidErrors	0x683da	0x3cf
xmlSchemaInitTypes	0x77fa5	0x3d0
xmlSchemaIsBuiltInTypeFacet	0x7854d	0x3d1
xmlSchemaIsValid	0x6835f	0x3d2
xmlSchemaNewDocParserCtxt	0x64d29	0x3d3
xmlSchemaNewFacet	0x6224b	0x3d4
xmlSchemaNewMemParserCtxt	0x64cf3	0x3d5
xmlSchemaNewNOTATIONValue	0x78910	0x3d6
xmlSchemaNewParserCtxt	0x64cbd	0x3d7
xmlSchemaNewQNameValue	0x78930	0x3d8
xmlSchemaNewStringValue	0x788d6	0x3d9
xmlSchemaNewValidCtxt	0x68077	0x3da
xmlSchemaParse	0x76fbf	0x3db
xmlSchemaSAXPlug	0x77abf	0x3dc
xmlSchemaSAXUnplug	0x68818	0x3dd
xmlSchemaSetParserErrors	0x6f216	0x3de
xmlSchemaSetParserStructuredErrors	0x6f249	0x3df
xmlSchemaSetValidErrors	0x68376	0x3e0
xmlSchemaSetValidOptions	0x68410	0x3e1
xmlSchemaSetValidStructuredErrors	0x683a9	0x3e2
xmlSchemaValPredefTypeNode	0x7af41	0x3e3
xmlSchemaValPredefTypeNodeNoNorm	0x7af63	0x3e4
xmlSchemaValidCtxtGetOptions	0x6843f	0x3e5
xmlSchemaValidCtxtGetParserCtxt	0x68860	0x3e6
xmlSchemaValidateDoc	0x77a05	0x3e7
xmlSchemaValidateFacet	0x7cfc4	0x3e8
xmlSchemaValidateFacetWhtsp	0x7cffc	0x3e9
xmlSchemaValidateFile	0x77def	0x3ea
xmlSchemaValidateLengthFacet	0x7cbe3	0x3eb
xmlSchemaValidateLengthFacetWhtsp	0x7cc0f	0x3ec
xmlSchemaValidateListSimpleTypeFacet	0x7d8b5	0x3ed
xmlSchemaValidateOneElement	0x779d4	0x3ee
xmlSchemaValidatePredefinedType	0x7af86	0x3ef
xmlSchemaValidateStream	0x77d04	0x3f0
xmlSchemaValueAppend	0x78866	0x3f1
xmlSchemaValueGetAsBoolean	0x788c2	0x3f2
xmlSchemaValueGetAsString	0x78880	0x3f3
xmlSchemaValueGetNext	0x416a8	0x3f4
xmlSchemaWhiteSpaceReplace	0x796eb	0x3f5
xmlSchematronFree	0x3ceb8	0x3f6
xmlSchematronFreeParserCtxt	0x3cf07	0x3f7
xmlSchematronFreeValidCtxt	0x3de43	0x3f8
xmlSchematronNewDocParserCtxt	0x3e208	0x3f9
xmlSchematronNewMemParserCtxt	0x3e190	0x3fa
xmlSchematronNewParserCtxt	0x3e101	0x3fb
xmlSchematronNewValidCtxt	0x3e27d	0x3fc
xmlSchematronParse	0x3d470	0x3fd
xmlSchematronSetValidStructuredErrors	0x3de24	0x3fe
xmlSchematronValidateDoc	0x3dfa3	0x3ff
xmlSearchNs	0x40bb0	0x400
xmlSearchNsByHref	0x40d74	0x401
xmlSetBufferAllocationScheme	0x3f74b	0x402
xmlSetCompressMode	0x41af9	0x403
xmlSetDocCompressMode	0x41acf	0x404
xmlSetEntityReferenceFunc	0x1e8a7	0x405
xmlSetExternalEntityLoader	0x529cc	0x406
xmlSetFeature	0x16ed6	0x407
xmlSetGenericErrorFunc	0xcefe	0x408
xmlSetListDoc	0x4025c	0x409
xmlSetNs	0x3f76a	0x40a
xmlSetNsProp	0x44df6	0x40b
xmlSetProp	0x45fd7	0x40c
xmlSetStructuredErrorFunc	0xcf23	0x40d
xmlSetTreeDoc	0x422bf	0x40e
xmlSetupParserForBuffer	0x1e784	0x40f
xmlShell	0x88ca	0x410
xmlShellBase	0x8006	0x411
xmlShellCat	0x83ad	0x412
xmlShellDir	0x8873	0x413
xmlShellDu	0x8653	0x414
xmlShellList	0x7fa0	0x415
xmlShellLoad	0x841f	0x416
xmlShellPrintNode	0x7eb7	0x417
xmlShellPrintXPathError	0x7d68	0x418
xmlShellPrintXPathResult	0x7f93	0x419
xmlShellPwd	0x8743	0x41a
xmlShellSave	0x8555	0x41b
xmlShellValidate	0x85d6	0x41c
xmlShellWrite	0x84b5	0x41d
xmlSkipBlankChars	0x1f06c	0x41e
xmlSnprintfElementContent	0x49ce6	0x41f
xmlSplitQName	0x1d13a	0x420
xmlSplitQName2	0x3e823	0x421
xmlSplitQName3	0x3e8a3	0x422
xmlSprintfElementContent	0x16a3c	0x423
xmlStopParser	0x1e575	0x424
xmlStrEqual	0x90d6a	0x425
xmlStrPrintf	0x91091	0x426
xmlStrQEqual	0x90d96	0x427
xmlStrVPrintf	0x910c6	0x428
xmlStrcasecmp	0x90e3e	0x429
xmlStrcasestr	0x9154b	0x42a
xmlStrcat	0x91058	0x42b
xmlStrchr	0x90ee0	0x42c
xmlStrcmp	0x90d2f	0x42d
xmlStrdup	0x90c9b	0x42e
xmlStreamPop	0x2fe1b	0x42f
xmlStreamPush	0x2fdd4	0x430
xmlStreamPushAttr	0x2fe04	0x431
xmlStreamPushNode	0x2fdeb	0x432
xmlStreamWantsAnyNode	0x2fe63	0x433
xmlStringComment	0xa5a4c	0x434
xmlStringCurrentChar	0x2cfbc	0x435
xmlStringDecodeEntities	0x258c1	0x436
xmlStringGetNodeList	0x44ef6	0x437
xmlStringLenDecodeEntities	0x2547b	0x438
xmlStringLenGetNodeList	0x46224	0x439
xmlStringText	0xa5a38	0x43a
xmlStringTextNoenc	0xa5a40	0x43b
xmlStrlen	0x90f37	0x43c
xmlStrncasecmp	0x90e87	0x43d
xmlStrncat	0x90f4e	0x43e
xmlStrncatNew	0x90fc3	0x43f
xmlStrncmp	0x90df3	0x440
xmlStrndup	0x90c55	0x441
xmlStrstr	0x914ee	0x442
xmlStrsub	0x90efa	0x443
xmlSubstituteEntitiesDefault	0x2db5c	0x444
xmlSwitchEncoding	0x2db99	0x445
xmlSwitchInputEncoding	0x2d3e5	0x446
xmlSwitchToEncoding	0x2d438	0x447
xmlTextConcat	0x4130c	0x448
xmlTextMerge	0x44dad	0x449
xmlTextReaderAttributeCount	0x55121	0x44a
xmlTextReaderBaseUri	0x555c4	0x44b
xmlTextReaderByteConsumed	0x561b1	0x44c
xmlTextReaderClose	0x549c8	0x44d
xmlTextReaderConstBaseUri	0x555e1	0x44e
xmlTextReaderConstEncoding	0x550eb	0x44f
xmlTextReaderConstLocalName	0x56e30	0x450
xmlTextReaderConstName	0x5539b	0x451
xmlTextReaderConstNamespaceUri	0x55576	0x452
xmlTextReaderConstPrefix	0x554d8	0x453
xmlTextReaderConstString	0x55851	0x454
xmlTextReaderConstValue	0x55737	0x455
xmlTextReaderConstXmlLang	0x55813	0x456
xmlTextReaderConstXmlVersion	0x55b2f	0x457
xmlTextReaderCurrentDoc	0x55add	0x458
xmlTextReaderCurrentNode	0x55993	0x459
xmlTextReaderDepth	0x55622	0x45a
xmlTextReaderExpand	0x54314	0x45b
xmlTextReaderGetAttribute	0x54aa5	0x45c
xmlTextReaderGetAttributeNo	0x54a2d	0x45d
xmlTextReaderGetAttributeNs	0x54bac	0x45e
xmlTextReaderGetErrorHandler	0x55ddd	0x45f
xmlTextReaderGetParserColumnNumber	0x55976	0x460
xmlTextReaderGetParserLineNumber	0x55959	0x461
xmlTextReaderGetParserProp	0x5590a	0x462
xmlTextReaderGetRemainder	0x54c48	0x463
xmlTextReaderHasAttributes	0x5565a	0x464
xmlTextReaderHasValue	0x5568f	0x465
xmlTextReaderIsDefault	0x557e1	0x466
xmlTextReaderIsEmptyElement	0x5525b	0x467
xmlTextReaderIsNamespaceDecl	0x55b07	0x468
xmlTextReaderIsValid	0x55d9b	0x469
xmlTextReaderLocalName	0x56de0	0x46a
xmlTextReaderLocatorBaseURI	0x55c5b	0x46b
xmlTextReaderLocatorLineNumber	0x55c20	0x46c
xmlTextReaderLookupNamespace	0x54cd0	0x46d
xmlTextReaderMoveToAttribute	0x54d62	0x46e
xmlTextReaderMoveToAttributeNo	0x54d02	0x46f
xmlTextReaderMoveToAttributeNs	0x54ec4	0x470
xmlTextReaderMoveToElement	0x55038	0x471
xmlTextReaderMoveToFirstAttribute	0x54fa3	0x472
xmlTextReaderMoveToNextAttribute	0x54fd9	0x473
xmlTextReaderName	0x552a2	0x474
xmlTextReaderNamespaceUri	0x55531	0x475
xmlTextReaderNext	0x57721	0x476
xmlTextReaderNextSibling	0x56da4	0x477
xmlTextReaderNodeType	0x5516f	0x478
xmlTextReaderNormalization	0x5586c	0x479
xmlTextReaderPrefix	0x55488	0x47a
xmlTextReaderPreserve	0x559a9	0x47b
xmlTextReaderPreservePattern	0x559f2	0x47c
xmlTextReaderQuoteChar	0x557ec	0x47d
xmlTextReaderRead	0x56729	0x47e
xmlTextReaderReadAttributeValue	0x55062	0x47f
xmlTextReaderReadInnerXml	0x54344	0x480
xmlTextReaderReadOuterXml	0x543e9	0x481
xmlTextReaderReadState	0x54305	0x482
xmlTextReaderReadString	0x5445a	0x483
xmlTextReaderRelaxNGSetSchema	0x56f39	0x484
xmlTextReaderRelaxNGValidate	0x5717d	0x485
xmlTextReaderSchemaValidate	0x57481	0x486
xmlTextReaderSchemaValidateCtxt	0x5746e	0x487
xmlTextReaderSetErrorHandler	0x57494	0x488
xmlTextReaderSetParserProp	0x5587a	0x489
xmlTextReaderSetSchema	0x56ff9	0x48a
xmlTextReaderSetStructuredErrorHandler	0x575a5	0x48b
xmlTextReaderSetup	0x55dfc	0x48c
xmlTextReaderStandalone	0x55b65	0x48d
xmlTextReaderValue	0x556ce	0x48e
xmlTextReaderXmlLang	0x557f9	0x48f
xmlTextWriterEndAttribute	0x7ed11	0x490
xmlTextWriterEndCDATA	0x7edc7	0x491
xmlTextWriterEndComment	0x7e9d6	0x492
xmlTextWriterEndDTD	0x7fd51	0x493
xmlTextWriterEndDTDAttlist	0x7f0a4	0x494
xmlTextWriterEndDTDElement	0x7f036	0x495
xmlTextWriterEndDTDEntity	0x7f112	0x496
xmlTextWriterEndDocument	0x81316	0x497
xmlTextWriterEndElement	0x80a67	0x498
xmlTextWriterEndPI	0x7ed55	0x499
xmlTextWriterFlush	0x7f327	0x49a
xmlTextWriterFullEndElement	0x80b83	0x49b
xmlTextWriterSetIndent	0x7f5af	0x49c
xmlTextWriterSetIndentString	0x7f5d0	0x49d
xmlTextWriterStartAttribute	0x7faae	0x49e
xmlTextWriterStartAttributeNS	0x7fb65	0x49f
xmlTextWriterStartCDATA	0x8106e	0x4a0
xmlTextWriterStartComment	0x806eb	0x4a1
xmlTextWriterStartDTD	0x7ee1b	0x4a2
xmlTextWriterStartDTDAttlist	0x80025	0x4a3
xmlTextWriterStartDTDElement	0x7fea3	0x4a4
xmlTextWriterStartDTDEntity	0x801a7	0x4a5
xmlTextWriterStartDocument	0x7e7d6	0x4a6
xmlTextWriterStartElement	0x80830	0x4a7
xmlTextWriterStartElementNS	0x8096f	0x4a8
xmlTextWriterStartPI	0x80eda	0x4a9
xmlTextWriterWriteAttribute	0x7fcb6	0x4aa
xmlTextWriterWriteAttributeNS	0x7fcfc	0x4ab
xmlTextWriterWriteBase64	0x80cc0	0x4ac
xmlTextWriterWriteBinHex	0x80d34	0x4ad
xmlTextWriterWriteCDATA	0x8114b	0x4ae
xmlTextWriterWriteComment	0x807ef	0x4af
xmlTextWriterWriteDTD	0x7fe4d	0x4b0
xmlTextWriterWriteDTDAttlist	0x80153	0x4b1
xmlTextWriterWriteDTDElement	0x7ffd1	0x4b2
xmlTextWriterWriteDTDEntity	0x812b7	0x4b3
xmlTextWriterWriteDTDExternalEntity	0x80358	0x4b4
xmlTextWriterWriteDTDExternalEntityContents	0x7f1a2	0x4b5
xmlTextWriterWriteDTDInternalEntity	0x802fa	0x4b6
xmlTextWriterWriteDTDNotation	0x803c3	0x4b7
xmlTextWriterWriteElement	0x80e3a	0x4b8
xmlTextWriterWriteElementNS	0x80e83	0x4b9
xmlTextWriterWriteFormatAttribute	0x81422	0x4ba
xmlTextWriterWriteFormatAttributeNS	0x8143c	0x4bb
xmlTextWriterWriteFormatCDATA	0x81651	0x4bc
xmlTextWriterWriteFormatComment	0x815e7	0x4bd
xmlTextWriterWriteFormatDTD	0x81576	0x4be
xmlTextWriterWriteFormatDTDAttlist	0x815b0	0x4bf
xmlTextWriterWriteFormatDTDElement	0x81596	0x4c0
xmlTextWriterWriteFormatDTDInternalEntity	0x815ca	0x4c1
xmlTextWriterWriteFormatElement	0x815fd	0x4c2
xmlTextWriterWriteFormatElementNS	0x81617	0x4c3
xmlTextWriterWriteFormatPI	0x81637	0x4c4
xmlTextWriterWriteFormatRaw	0x80c82	0x4c5
xmlTextWriterWriteFormatString	0x80c98	0x4c6
xmlTextWriterWritePI	0x8101f	0x4c7
xmlTextWriterWriteRaw	0x7eade	0x4c8
xmlTextWriterWriteRawLen	0x7ea5d	0x4c9
xmlTextWriterWriteString	0x7eaf9	0x4ca
xmlTextWriterWriteVFormatAttribute	0x80da8	0x4cb
xmlTextWriterWriteVFormatAttributeNS	0x80dee	0x4cc
xmlTextWriterWriteVFormatCDATA	0x81534	0x4cd
xmlTextWriterWriteVFormatComment	0x813d0	0x4ce
xmlTextWriterWriteVFormatDTD	0x81196	0x4cf
xmlTextWriterWriteVFormatDTDAttlist	0x81228	0x4d0
xmlTextWriterWriteVFormatDTDElement	0x811e2	0x4d1
xmlTextWriterWriteVFormatDTDInternalEntity	0x8126e	0x4d2
xmlTextWriterWriteVFormatElement	0x8145c	0x4d3
xmlTextWriterWriteVFormatElementNS	0x814a2	0x4d4
xmlTextWriterWriteVFormatPI	0x814ee	0x4d5
xmlTextWriterWriteVFormatRaw	0x7fa28	0x4d6
xmlTextWriterWriteVFormatString	0x7fa6a	0x4d7
xmlThrDefBufferAllocScheme	0xe20f	0x4d8
xmlThrDefDefaultBufferSize	0xe255	0x4d9
xmlThrDefDeregisterNodeDefault	0xe0eb	0x4da
xmlThrDefDoValidityCheckingDefaultValue	0xe2cb	0x4db
xmlThrDefGetWarningsDefaultValue	0xe379	0x4dc
xmlThrDefIndentTreeOutput	0xe3bf	0x4dd
xmlThrDefKeepBlanksDefaultValue	0xe44b	0x4de
xmlThrDefLineNumbersDefaultValue	0xe491	0x4df
xmlThrDefLoadExtDtdDefaultValue	0xe4d7	0x4e0
xmlThrDefOutputBufferCreateFilenameDefault	0xe157	0x4e1
xmlThrDefParserDebugEntities	0xe51d	0x4e2
xmlThrDefParserInputBufferCreateFilenameDefault	0xe121	0x4e3
xmlThrDefPedanticParserDefaultValue	0xe577	0x4e4
xmlThrDefRegisterNodeDefault	0xe09b	0x4e5
xmlThrDefSaveNoEmptyTags	0xe5bd	0x4e6
xmlThrDefSetGenericErrorFunc	0xe01d	0x4e7
xmlThrDefSetStructuredErrorFunc	0xe056	0x4e8
xmlThrDefSubstituteEntitiesDefaultValue	0xe603	0x4e9
xmlThrDefTreeIndentString	0xe405	0x4ea
xmlUCSIsAegeanNumbers	0x7d99c	0x4eb
xmlUCSIsAlphabeticPresentationForms	0x7d9ae	0x4ec
xmlUCSIsArabic	0x7d9c0	0x4ed
xmlUCSIsArabicPresentationFormsA	0x7d9d4	0x4ee
xmlUCSIsArabicPresentationFormsB	0x7d9e8	0x4ef
xmlUCSIsArmenian	0x7d9fc	0x4f0
xmlUCSIsArrows	0x7da0e	0x4f1
xmlUCSIsBasicLatin	0x7da20	0x4f2
xmlUCSIsBengali	0x7da2b	0x4f3
xmlUCSIsBlock	0x7e2e4	0x4f4
xmlUCSIsBlockElements	0x7da3d	0x4f5
xmlUCSIsBopomofo	0x7da4f	0x4f6
xmlUCSIsBopomofoExtended	0x7da61	0x4f7
xmlUCSIsBoxDrawing	0x7da73	0x4f8
xmlUCSIsBraillePatterns	0x7da85	0x4f9
xmlUCSIsBuhid	0x7da99	0x4fa
xmlUCSIsByzantineMusicalSymbols	0x7daab	0x4fb
xmlUCSIsCJKCompatibility	0x7dabf	0x4fc
xmlUCSIsCJKCompatibilityForms	0x7dad3	0x4fd
xmlUCSIsCJKCompatibilityIdeographs	0x7dae5	0x4fe
xmlUCSIsCJKCompatibilityIdeographsSupplement	0x7daf9	0x4ff
xmlUCSIsCJKRadicalsSupplement	0x7db0d	0x500
xmlUCSIsCJKSymbolsandPunctuation	0x7db1f	0x501
xmlUCSIsCJKUnifiedIdeographs	0x7db31	0x502
xmlUCSIsCJKUnifiedIdeographsExtensionA	0x7db45	0x503
xmlUCSIsCJKUnifiedIdeographsExtensionB	0x7db59	0x504
xmlUCSIsCat	0x7e6d5	0x505
xmlUCSIsCatC	0x7e303	0x506
xmlUCSIsCatCc	0x7e314	0x507
xmlUCSIsCatCf	0x7e330	0x508
xmlUCSIsCatCo	0x7e341	0x509
xmlUCSIsCatCs	0x7e376	0x50a
xmlUCSIsCatL	0x7e3ab	0x50b
xmlUCSIsCatLl	0x7e3bc	0x50c
xmlUCSIsCatLm	0x7e3cd	0x50d
xmlUCSIsCatLo	0x7e3de	0x50e
xmlUCSIsCatLt	0x7e3ef	0x50f
xmlUCSIsCatLu	0x7e400	0x510
xmlUCSIsCatM	0x7e411	0x511
xmlUCSIsCatMc	0x7e422	0x512
xmlUCSIsCatMe	0x7e433	0x513
xmlUCSIsCatMn	0x7e46f	0x514
xmlUCSIsCatN	0x7e480	0x515
xmlUCSIsCatNd	0x7e491	0x516
xmlUCSIsCatNl	0x7e4a2	0x517
xmlUCSIsCatNo	0x7e4f3	0x518
xmlUCSIsCatP	0x7e504	0x519
xmlUCSIsCatPc	0x7e515	0x51a
xmlUCSIsCatPd	0x7e56b	0x51b
xmlUCSIsCatPe	0x7e57c	0x51c
xmlUCSIsCatPf	0x7e58d	0x51d
xmlUCSIsCatPi	0x7e5b4	0x51e
xmlUCSIsCatPo	0x7e5e9	0x51f
xmlUCSIsCatPs	0x7e5fa	0x520
xmlUCSIsCatS	0x7e60b	0x521
xmlUCSIsCatSc	0x7e61c	0x522
xmlUCSIsCatSk	0x7e62d	0x523
xmlUCSIsCatSm	0x7e63e	0x524
xmlUCSIsCatSo	0x7e64f	0x525
xmlUCSIsCatZ	0x7e660	0x526
xmlUCSIsCatZl	0x7e671	0x527
xmlUCSIsCatZp	0x7e67f	0x528
xmlUCSIsCatZs	0x7e68d	0x529
xmlUCSIsCherokee	0x7db6d	0x52a
xmlUCSIsCombiningDiacriticalMarks	0x7db7f	0x52b
xmlUCSIsCombiningDiacriticalMarksforSymbols	0x7db91	0x52c
xmlUCSIsCombiningHalfMarks	0x7dba3	0x52d
xmlUCSIsCombiningMarksforSymbols	0x7db91	0x52e
xmlUCSIsControlPictures	0x7dbb5	0x52f
xmlUCSIsCurrencySymbols	0x7dbc7	0x530
xmlUCSIsCypriotSyllabary	0x7dbd9	0x531
xmlUCSIsCyrillic	0x7dbeb	0x532
xmlUCSIsCyrillicSupplement	0x7dbff	0x533
xmlUCSIsDeseret	0x7dc11	0x534
xmlUCSIsDevanagari	0x7dc23	0x535
xmlUCSIsDingbats	0x7dc35	0x536
xmlUCSIsEnclosedAlphanumerics	0x7dc49	0x537
xmlUCSIsEnclosedCJKLettersandMonths	0x7dc5d	0x538
xmlUCSIsEthiopic	0x7dc71	0x539
xmlUCSIsGeneralPunctuation	0x7dc85	0x53a
xmlUCSIsGeometricShapes	0x7dc97	0x53b
xmlUCSIsGeorgian	0x7dca9	0x53c
xmlUCSIsGothic	0x7dcbb	0x53d
xmlUCSIsGreek	0x7dce1	0x53e
xmlUCSIsGreekExtended	0x7dccd	0x53f
xmlUCSIsGreekandCoptic	0x7dce1	0x540
xmlUCSIsGujarati	0x7dcf5	0x541
xmlUCSIsGurmukhi	0x7dd07	0x542
xmlUCSIsHalfwidthandFullwidthForms	0x7dd19	0x543
xmlUCSIsHangulCompatibilityJamo	0x7dd2d	0x544
xmlUCSIsHangulJamo	0x7dd3f	0x545
xmlUCSIsHangulSyllables	0x7dd53	0x546
xmlUCSIsHanunoo	0x7dd67	0x547
xmlUCSIsHebrew	0x7dd79	0x548
xmlUCSIsHighPrivateUseSurrogates	0x7dd8b	0x549
xmlUCSIsHighSurrogates	0x7dd9d	0x54a
xmlUCSIsHiragana	0x7ddb1	0x54b
xmlUCSIsIPAExtensions	0x7ddc3	0x54c
xmlUCSIsIdeographicDescriptionCharacters	0x7ddd5	0x54d
xmlUCSIsKanbun	0x7dde7	0x54e
xmlUCSIsKangxiRadicals	0x7ddf9	0x54f
xmlUCSIsKannada	0x7de0d	0x550
xmlUCSIsKatakana	0x7de1f	0x551
xmlUCSIsKatakanaPhoneticExtensions	0x7de31	0x552
xmlUCSIsKhmer	0x7de43	0x553
xmlUCSIsKhmerSymbols	0x7de55	0x554
xmlUCSIsLao	0x7de67	0x555
xmlUCSIsLatin1Supplement	0x7de79	0x556
xmlUCSIsLatinExtendedA	0x7de89	0x557
xmlUCSIsLatinExtendedAdditional	0x7deaf	0x558
xmlUCSIsLatinExtendedB	0x7de9b	0x559
xmlUCSIsLetterlikeSymbols	0x7dec3	0x55a
xmlUCSIsLimbu	0x7ded5	0x55b
xmlUCSIsLinearBIdeograms	0x7dee7	0x55c
xmlUCSIsLinearBSyllabary	0x7def9	0x55d
xmlUCSIsLowSurrogates	0x7df0b	0x55e
xmlUCSIsMalayalam	0x7df1f	0x55f
xmlUCSIsMathematicalAlphanumericSymbols	0x7df31	0x560
xmlUCSIsMathematicalOperators	0x7df45	0x561
xmlUCSIsMiscellaneousMathematicalSymbolsA	0x7df59	0x562
xmlUCSIsMiscellaneousMathematicalSymbolsB	0x7df6b	0x563
xmlUCSIsMiscellaneousSymbols	0x7df7d	0x564
xmlUCSIsMiscellaneousSymbolsandArrows	0x7df91	0x565
xmlUCSIsMiscellaneousTechnical	0x7dfa5	0x566
xmlUCSIsMongolian	0x7dfb9	0x567
xmlUCSIsMusicalSymbols	0x7dfcd	0x568
xmlUCSIsMyanmar	0x7dfe1	0x569
xmlUCSIsNumberForms	0x7dff5	0x56a
xmlUCSIsOgham	0x7e007	0x56b
xmlUCSIsOldItalic	0x7e019	0x56c
xmlUCSIsOpticalCharacterRecognition	0x7e02b	0x56d
xmlUCSIsOriya	0x7e03d	0x56e
xmlUCSIsOsmanya	0x7e04f	0x56f
xmlUCSIsPhoneticExtensions	0x7e061	0x570
xmlUCSIsPrivateUse	0x7e073	0x571
xmlUCSIsPrivateUseArea	0x7e0a6	0x572
xmlUCSIsRunic	0x7e0ba	0x573
xmlUCSIsShavian	0x7e0cc	0x574
xmlUCSIsSinhala	0x7e0de	0x575
xmlUCSIsSmallFormVariants	0x7e0f0	0x576
xmlUCSIsSpacingModifierLetters	0x7e102	0x577
xmlUCSIsSpecials	0x7e114	0x578
xmlUCSIsSuperscriptsandSubscripts	0x7e126	0x579
xmlUCSIsSupplementalArrowsA	0x7e138	0x57a
xmlUCSIsSupplementalArrowsB	0x7e14a	0x57b
xmlUCSIsSupplementalMathematicalOperators	0x7e15c	0x57c
xmlUCSIsSupplementaryPrivateUseAreaA	0x7e170	0x57d
xmlUCSIsSupplementaryPrivateUseAreaB	0x7e184	0x57e
xmlUCSIsSyriac	0x7e198	0x57f
xmlUCSIsTagalog	0x7e1aa	0x580
xmlUCSIsTagbanwa	0x7e1bc	0x581
xmlUCSIsTags	0x7e1ce	0x582
xmlUCSIsTaiLe	0x7e1e0	0x583
xmlUCSIsTaiXuanJingSymbols	0x7e1f2	0x584
xmlUCSIsTamil	0x7e204	0x585
xmlUCSIsTelugu	0x7e216	0x586
xmlUCSIsThaana	0x7e228	0x587
xmlUCSIsThai	0x7e23a	0x588
xmlUCSIsTibetan	0x7e24c	0x589
xmlUCSIsUgaritic	0x7e260	0x58a
xmlUCSIsUnifiedCanadianAboriginalSyllabics	0x7e272	0x58b
xmlUCSIsVariationSelectors	0x7e286	0x58c
xmlUCSIsVariationSelectorsSupplement	0x7e298	0x58d
xmlUCSIsYiRadicals	0x7e2ac	0x58e
xmlUCSIsYiSyllables	0x7e2be	0x58f
xmlUCSIsYijingHexagramSymbols	0x7e2d2	0x590
xmlURIEscape	0x485f8	0x591
xmlURIEscapeStr	0x47811	0x592
xmlURIUnescapeString	0x476f6	0x593
xmlUTF8Charcmp	0x91124	0x594
xmlUTF8Size	0x910fa	0x595
xmlUTF8Strlen	0x9114f	0x596
xmlUTF8Strloc	0x91425	0x597
xmlUTF8Strndup	0x9137b	0x598
xmlUTF8Strpos	0x913e2	0x599
xmlUTF8Strsize	0x9133c	0x59a
xmlUTF8Strsub	0x9148c	0x59b
xmlUnlinkNode	0x40393	0x59c
xmlUnlockLibrary	0x3e50a	0x59d
xmlUnsetNsProp	0x4127b	0x59e
xmlUnsetProp	0x41249	0x59f
xmlValidBuildContentModel	0x4d5cc	0x5a0
xmlValidCtxtNormalizeAttributeValue	0x4bb49	0x5a1
xmlValidGetPotentialChildren	0x4d501	0x5a2
xmlValidGetValidElements	0x4e797	0x5a3
xmlValidNormalizeAttributeValue	0x4bcf2	0x5a4
xmlValidateAttributeDecl	0x4be01	0x5a5
xmlValidateAttributeValue	0x4b9b3	0x5a6
xmlValidateDocument	0x4e673	0x5a7
xmlValidateDocumentFinal	0x4d2a5	0x5a8
xmlValidateDtd	0x4e5e3	0x5a9
xmlValidateDtdFinal	0x4d460	0x5aa
xmlValidateElement	0x4e4f1	0x5ab
xmlValidateElementDecl	0x4bfcc	0x5ac
xmlValidateNCName	0x3e8dd	0x5ad
xmlValidateNMToken	0x3f3bd	0x5ae
xmlValidateName	0x3f0bd	0x5af
xmlValidateNameValue	0x4b736	0x5b0
xmlValidateNamesValue	0x4b7f3	0x5b1
xmlValidateNmtokenValue	0x4b857	0x5b2
xmlValidateNmtokensValue	0x4b94e	0x5b3
xmlValidateNotationDecl	0x515f2	0x5b4
xmlValidateNotationUse	0x4b1df	0x5b5
xmlValidateOneAttribute	0x4c1e0	0x5b6
xmlValidateOneElement	0x4ded1	0x5b7
xmlValidateOneNamespace	0x4c5d0	0x5b8
xmlValidatePopElement	0x4ceca	0x5b9
xmlValidatePushCData	0x4ce2a	0x5ba
xmlValidatePushElement	0x4ea4d	0x5bb
xmlValidateQName	0x3ebc3	0x5bc
xmlValidateRoot	0x4cf3d	0x5bd
xmlXIncludeFreeContext	0x4ee66	0x5be
xmlXIncludeNewContext	0x4ed39	0x5bf
xmlXIncludeProcess	0x50d73	0x5c0
xmlXIncludeProcessFlags	0x50d60	0x5c1
xmlXIncludeProcessFlagsData	0x50d35	0x5c2
xmlXIncludeProcessNode	0x50df0	0x5c3
xmlXIncludeProcessTree	0x50de2	0x5c4
xmlXIncludeProcessTreeFlags	0x50d81	0x5c5
xmlXIncludeProcessTreeFlagsData	0x50ccb	0x5c6
xmlXIncludeSetFlags	0x50812	0x5c7
xmlXPathAddValues	0x8c873	0x5c8
xmlXPathBooleanFunction	0x8828e	0x5c9
xmlXPathCastBooleanToNumber	0x849b1	0x5ca
xmlXPathCastBooleanToString	0x84752	0x5cb
xmlXPathCastNodeSetToBoolean	0x84a02	0x5cc
xmlXPathCastNodeSetToNumber	0x870c4	0x5cd
xmlXPathCastNodeSetToString	0x84835	0x5ce
xmlXPathCastNodeToNumber	0x87081	0x5cf
xmlXPathCastNodeToString	0x8481b	0x5d0
xmlXPathCastNumberToBoolean	0x849be	0x5d1
xmlXPathCastNumberToString	0x8476c	0x5d2
xmlXPathCastStringToBoolean	0x849e6	0x5d3
xmlXPathCastStringToNumber	0x8707c	0x5d4
xmlXPathCastToBoolean	0x84a16	0x5d5
xmlXPathCastToNumber	0x870fb	0x5d6
xmlXPathCastToString	0x8486f	0x5d7
xmlXPathCeilingFunction	0x8aeaa	0x5d8
xmlXPathCmpNodes	0x82cf0	0x5d9
xmlXPathCompareValues	0x8c50a	0x5da
xmlXPathCompile	0x8bcbf	0x5db
xmlXPathCompiledEval	0x8e36f	0x5dc
xmlXPathCompiledEvalToBoolean	0x8e391	0x5dd
xmlXPathConcatFunction	0x87b67	0x5de
xmlXPathContainsFunction	0x87c33	0x5df
xmlXPathContextSetCache	0x82969	0x5e0
xmlXPathConvertBoolean	0x84aaa	0x5e1
xmlXPathConvertNumber	0x8719b	0x5e2
xmlXPathConvertString	0x84913	0x5e3
xmlXPathCountFunction	0x87598	0x5e4
xmlXPathCtxtCompile	0x8bc04	0x5e5
xmlXPathDebugDumpCompExpr	0x82801	0x5e6
xmlXPathDebugDumpObject	0x820d9	0x5e7
xmlXPathDifference	0x83d0d	0x5e8
xmlXPathDistinct	0x86f3d	0x5e9
xmlXPathDistinctSorted	0x86e7e	0x5ea
xmlXPathDivValues	0x8c9b1	0x5eb
xmlXPathEqualValues	0x8c24d	0x5ec
xmlXPathErr	0x8198e	0x5ed
xmlXPathEval	0x8e442	0x5ee
xmlXPathEvalExpr	0x8e3a8	0x5ef
xmlXPathEvalExpression	0x8e55f	0x5f0
xmlXPathEvalPredicate	0x8654e	0x5f1
xmlXPathEvaluatePredicateResult	0x865d2	0x5f2
xmlXPathFalseFunction	0x8834e	0x5f3
xmlXPathFloorFunction	0x8adfc	0x5f4
xmlXPathFreeCompExpr	0x86857	0x5f5
xmlXPathFreeContext	0x871dd	0x5f6
xmlXPathFreeNodeSet	0x83ae6	0x5f7
xmlXPathFreeNodeSetList	0x62585	0x5f8
xmlXPathFreeObject	0x844d6	0x5f9
xmlXPathFreeParserContext	0x87221	0x5fa
xmlXPathFunctionLookup	0x86f7c	0x5fb
xmlXPathFunctionLookupNS	0x84116	0x5fc
xmlXPathHasSameNodes	0x83e11	0x5fd
xmlXPathIdFunction	0x87647	0x5fe
xmlXPathInit	0x81823	0x5ff
xmlXPathIntersection	0x83d89	0x600
xmlXPathIsInf	0x81874	0x601
xmlXPathIsNaN	0x81863	0x602
xmlXPathIsNodeType	0x8605c	0x603
xmlXPathLangFunction	0x88380	0x604
xmlXPathLastFunction	0x87514	0x605
xmlXPathLeading	0x83f2e	0x606
xmlXPathLeadingSorted	0x83efb	0x607
xmlXPathLocalNameFunction	0x87750	0x608
xmlXPathModValues	0x8cae3	0x609
xmlXPathMultValues	0x8c947	0x60a
xmlXPathNAN	0xc5160	0x60b
xmlXPathNINF	0xc3eb0	0x60c
xmlXPathNamespaceURIFunction	0x87821	0x60d
xmlXPathNewBoolean	0x842d4	0x60e
xmlXPathNewCString	0x843a3	0x60f
xmlXPathNewContext	0x8e817	0x610
xmlXPathNewFloat	0x84297	0x611
xmlXPathNewNodeSet	0x83bec	0x612
xmlXPathNewNodeSetList	0x83c7f	0x613
xmlXPathNewParserContext	0x84ae2	0x614
xmlXPathNewString	0x84316	0x615
xmlXPathNewValueTree	0x83c32	0x616
xmlXPathNextAncestor	0x853c5	0x617
xmlXPathNextAncestorOrSelf	0x85502	0x618
xmlXPathNextAttribute	0x857c1	0x619
xmlXPathNextChild	0x850d8	0x61a
xmlXPathNextDescendant	0x8525d	0x61b
xmlXPathNextDescendantOrSelf	0x852ea	0x61c
xmlXPathNextFollowing	0x855ab	0x61d
xmlXPathNextFollowingSibling	0x8552c	0x61e
xmlXPathNextNamespace	0x85720	0x61f
xmlXPathNextParent	0x85324	0x620
xmlXPathNextPreceding	0x8563b	0x621
xmlXPathNextPrecedingSibling	0x85562	0x622
xmlXPathNextSelf	0x850bb	0x623
xmlXPathNodeLeading	0x83eec	0x624
xmlXPathNodeLeadingSorted	0x83e73	0x625
xmlXPathNodeSetAdd	0x83559	0x626
xmlXPathNodeSetAddNs	0x8346f	0x627
xmlXPathNodeSetAddUnique	0x83610	0x628
xmlXPathNodeSetContains	0x833fc	0x629
xmlXPathNodeSetCreate	0x832e6	0x62a
xmlXPathNodeSetDel	0x83a33	0x62b
xmlXPathNodeSetFreeNs	0x832a3	0x62c
xmlXPathNodeSetMerge	0x836a8	0x62d
xmlXPathNodeSetRemove	0x83a9a	0x62e
xmlXPathNodeSetSort	0x83180	0x62f
xmlXPathNodeTrailing	0x8400e	0x630
xmlXPathNodeTrailingSorted	0x83f8d	0x631
xmlXPathNormalizeFunction	0x87faf	0x632
xmlXPathNotEqualValues	0x8c3aa	0x633
xmlXPathNotFunction	0x882cd	0x634
xmlXPathNsLookup	0x841fb	0x635
xmlXPathNumberFunction	0x8ad79	0x636
xmlXPathObjectCopy	0x84427	0x637
xmlXPathOrderDocElems	0x82c9e	0x638
xmlXPathPINF	0xc3ea8	0x639
xmlXPathParseNCName	0x88528	0x63a
xmlXPathParseName	0x885ee	0x63b
xmlXPathPopBoolean	0x86cf8	0x63c
xmlXPathPopExternal	0x86e0e	0x63d
xmlXPathPopNodeSet	0x86da5	0x63e
xmlXPathPopNumber	0x8acdd	0x63f
xmlXPathPopString	0x86d4f	0x640
xmlXPathPositionFunction	0x87556	0x641
xmlXPathRegisterAllFunctions	0x8e63c	0x642
xmlXPathRegisterFunc	0x86f65	0x643
xmlXPathRegisterFuncLookup	0x840ff	0x644
xmlXPathRegisterFuncNS	0x840a7	0x645
xmlXPathRegisterNs	0x8418f	0x646
xmlXPathRegisterVariable	0x8ad3b	0x647
xmlXPathRegisterVariableLookup	0x84178	0x648
xmlXPathRegisterVariableNS	0x86fb3	0x649
xmlXPathRegisteredFuncsCleanup	0x8415d	0x64a
xmlXPathRegisteredNsCleanup	0x84278	0x64b
xmlXPathRegisteredVariablesCleanup	0x8705e	0x64c
xmlXPathRoot	0x874e5	0x64d
xmlXPathRoundFunction	0x8af7d	0x64e
xmlXPathStartsWithFunction	0x87d08	0x64f
xmlXPathStringEvalNumber	0x85e36	0x650
xmlXPathStringFunction	0x87a20	0x651
xmlXPathStringLengthFunction	0x87a7d	0x652
xmlXPathSubValues	0x8c8dd	0x653
xmlXPathSubstringAfterFunction	0x87eb3	0x654
xmlXPathSubstringBeforeFunction	0x87de7	0x655
xmlXPathSubstringFunction	0x8cb79	0x656
xmlXPathSumFunction	0x8848a	0x657
xmlXPathTrailing	0x8404e	0x658
xmlXPathTrailingSorted	0x8401d	0x659
xmlXPathTranslateFunction	0x880dd	0x65a
xmlXPathTrueFunction	0x8831c	0x65b
xmlXPathValueFlipSign	0x8c78a	0x65c
xmlXPathVariableLookup	0x8ad52	0x65d
xmlXPathVariableLookupNS	0x87012	0x65e
xmlXPathWrapCString	0x843e5	0x65f
xmlXPathWrapExternal	0x843ea	0x660
xmlXPathWrapNodeSet	0x83cd0	0x661
xmlXPathWrapString	0x84366	0x662
xmlXPatherror	0x81ab3	0x663
xmlXPtrBuildNodeList	0x90b5e	0x664
xmlXPtrEval	0x907a9	0x665
xmlXPtrEvalRangePredicate	0x900db	0x666
xmlXPtrFreeLocationSet	0x8f05d	0x667
xmlXPtrLocationSetAdd	0x8eef6	0x668
xmlXPtrLocationSetCreate	0x8ee77	0x669
xmlXPtrLocationSetDel	0x8efd8	0x66a
xmlXPtrLocationSetMerge	0x8efa2	0x66b
xmlXPtrLocationSetRemove	0x8f028	0x66c
xmlXPtrNewCollapsedRange	0x8ed50	0x66d
xmlXPtrNewContext	0x906f7	0x66e
xmlXPtrNewLocationSetNodeSet	0x8f101	0x66f
xmlXPtrNewLocationSetNodes	0x8f098	0x670
xmlXPtrNewRange	0x8eb13	0x671
xmlXPtrNewRangeNodeObject	0x8eda3	0x672
xmlXPtrNewRangeNodePoint	0x8ec76	0x673
xmlXPtrNewRangeNodes	0x8eceb	0x674
xmlXPtrNewRangePointNode	0x8ec07	0x675
xmlXPtrNewRangePoints	0x8eb8e	0x676
xmlXPtrRangeToFunction	0x8f8fc	0x677
xmlXPtrWrapLocationSet	0x8f174	0x678

c:\windows\temp\crli-0.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	17.00 KB
MD5	f82fa69bfe0522163eb0cf8365497da2
SHA1	75be54839f3d01dc4755ddc319f23f287b1f9a7b
SHA256	b556b5c077e38dcb65d21a707c19618d02e0a65ff3f9887323728ec078660cc3
SSDeep	384://8GSU0q4AG2FuEe4k9k+kGP599OdcxwX6Sn+P47kAkluNO8Nofi/4Rtz://8GSU0qnhEEe4QTHP79OdcxwX6S+PQA
ImpHash	31a3d927d0773eea73787c46f29a287b

PE Information

Image Base	0x10000000
Entry Point	0x100036fe
Size Of Code	0x2c00
Size Of Initialized Data	0x1800
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:52:19+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x2b16	0x2c00	0x400	cnt_code, mem_execute, mem_read	5.95
.rdata	0x10004000	0x932	0xa00	0x3000	cnt_initialized_data, mem_read	4.91
.data	0x10005000	0x65c	0x400	0x3a00	cnt_initialized_data, mem_read, mem_write	5.79
.reloc	0x10006000	0x452	0x600	0x3e00	cnt_initialized_data, mem_discardable, mem_read	1.6

Imports (3)

KERNEL32.dll (13)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x10004000	0x4234	0x3234	0x10e
GetCurrentThreadId	0x0	0x10004004	0x4238	0x3238	0x110
GetTickCount	0x0	0x10004008	0x423c	0x323c	0x18a
QueryPerformanceCounter	0x0	0x1000400c	0x4240	0x3240	0x22f
SetUnhandledExceptionFilter	0x0	0x10004010	0x4244	0x3244	0x2bc
UnhandledExceptionFilter	0x0	0x10004014	0x4248	0x3248	0x2df
GetCurrentProcess	0x0	0x10004018	0x424c	0x324c	0x10d
TerminateProcess	0x0	0x1000401c	0x4250	0x3250	0x2cf
InterlockedCompareExchange	0x0	0x10004020	0x4254	0x3254	0x1cb
Sleep	0x0	0x10004024	0x4258	0x3258	0x2c7
InterlockedExchange	0x0	0x10004028	0x425c	0x325c	0x1cd
RtlUnwind	0x0	0x1000402c	0x4260	0x3260	0x25b
GetSystemTimeAsFileTime	0x0	0x10004030	0x4264	0x3264	0x17a

cnli-1.dll (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CNE_allocateCleanMemoryFunc	0x0	0x10004038	0x426c	0x326c	0x1ec
byteSwapLong	0x0	0x1000403c	0x4270	0x3270	0x223
CNEMem_cleanNClearNDestroyPointer	0x0	0x10004040	0x4274	0x3274	0x9e

msvcrt.dll (7)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
memcpy	0x0	0x10004048	0x427c	0x327c	0x4ea
malloc	0x0	0x1000404c	0x4280	0x3280	0x4de
_XcptFilter	0x0	0x10004050	0x4284	0x3284	0x6a
_initterm	0x0	0x10004054	0x4288	0x3288	0x1d5
_amsg_exit	0x0	0x10004058	0x428c	0x328c	0x101
_adjust_fdiv	0x0	0x1000405c	0x4290	0x3290	0xf5
free	0x0	0x10004060	0x4294	0x3294	0x4a6

Exports (33)

Api name	EAT Address	Ordinal
CryptoLibV2_decryptRequestBuffer	0x2cac	0x1
CryptoLibV2_deletePrivateKey	0x2705	0x2
CryptoLibV2_deletePublicKey	0x23af	0x3
CryptoLibV2_encryptRequestBuffer	0x2ddb	0x4
CryptoLibV2_freeBuffer	0x159a	0x5
CryptoLibV2_getRandom	0x159f	0x6
CryptoLibV2_installPrivateKey	0x2657	0x7
CryptoLibV2_installPublicKey	0x2301	0x8
CryptoLibV2_lookupPrivateKey	0x27c5	0x9
CryptoLibV2_lookupPublicKey	0x246f	0xa
CryptoLibV2_md5Digest	0x29ad	0xb
CryptoLibV2_md5DigestFile	0x2aaa	0xc
CryptoLibV2_md5DigestFileW	0x2bab	0xd
CryptoLibV2_pubDecrypt	0x1c51	0xe
CryptoLibV2_pubDecryptFor	0x1d7b	0xf
CryptoLibV2_pubEncrypt	0x19d1	0x10
CryptoLibV2_pubEncryptFor	0x1af3	0x11
CryptoLibV2_queryPrivateKey	0x28e3	0x12
CryptoLibV2_queryPublicKey	0x258d	0x13
CryptoLibV2_sign	0x1ea1	0x14
CryptoLibV2_signFrom	0x1fcb	0x15
CryptoLibV2_symDecrypt	0x18af	0x16
CryptoLibV2_symEncrypt	0x178d	0x17
CryptoLibV2_symGenKey	0x1698	0x18
CryptoLibV2_verify	0x2135	0x19
CryptoLibV2_verifyFrom	0x221d	0x1a
CryptoLib_freeBuffer	0x159a	0x1b
CryptoLib_md5Digest	0x29ad	0x1c
CryptoLib_pubDecrypt	0x1447	0x1d
CryptoLib_pubEncrypt	0x1317	0x1e
CryptoLib_symDecrypt	0x11f9	0x1f
CryptoLib_symEncrypt	0x10ca	0x20
CryptoLib_symGenKey	0x1000	0x21

C:\Windows\temp\snamelog

Created File

Text

Not Queried

Mime Type	text/plain
File Size	0.02 KB
MD5	70621146e9381a42f5c17c3bd50f3b8d
SHA1	926eb1f34ecfbdefc655f2b3901a0d5bd8c875de
SHA256	e35a5546cc9626d7a7f579b37ec72714dffcf4d7789d9b5cd868ed8fef5fbd35
SSDeep	3:A+aktGy:ALk4y

c:\windows\temp\ucl.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	57.00 KB
MD5	6b7276e4aa7a1e50735d2f6923b40de4
SHA1	db8603ac6cac7eb3690f67af7b8d081aa9ce3075
SHA256	f0df80978b3a563077def7ba919e2f49e5883d24176e6b3371a8eef1efe2b06a
SSDeep	1536:ncZeBwroDJXSoY9/8qqG9aCapIu2GfUFd0:ZWrSJCoyUlG9sg0
ImpHash	33ac1cb1711de5488c50eafd916d2ad2

PE Information

Image Base	0x10000000
Entry Point	0x1000c2a8
Size Of Code	0xb800
Size Of Initialized Data	0x2c00
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:49:47+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0xb6b6	0xb800	0x400	cnt_code, mem_execute, mem_read	6.71
.rdata	0x1000d000	0x1d17	0x1e00	0xbc00	cnt_initialized_data, mem_read	5.51
.data	0x1000f000	0x67c	0x400	0xda00	cnt_initialized_data, mem_read, mem_write	5.83
.reloc	0x10010000	0x50a	0x600	0xde00	cnt_initialized_data, mem_discardable, mem_read	2.16

Imports (2)

msvcrt.dll (10)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_XcptFilter	0x0	0x1000d038	0xda40	0xc640	0x6a
_initterm	0x0	0x1000d03c	0xda44	0xc644	0x1d5
_amsg_exit	0x0	0x1000d040	0xda48	0xc648	0x101
_adjust_fdiv	0x0	0x1000d044	0xda4c	0xc64c	0xf5
memmove	0x0	0x1000d048	0xda50	0xc650	0x4ec
memcmp	0x0	0x1000d04c	0xda54	0xc654	0x4e9
memset	0x0	0x1000d050	0xda58	0xc658	0x4ee
memcpy	0x0	0x1000d054	0xda5c	0xc65c	0x4ea
free	0x0	0x1000d058	0xda60	0xc660	0x4a6
malloc	0x0	0x1000d05c	0xda64	0xc664	0x4de

KERNEL32.dll (13)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentProcessId	0x0	0x1000d000	0xda08	0xc608	0x10e
GetCurrentThreadId	0x0	0x1000d004	0xda0c	0xc60c	0x110
GetTickCount	0x0	0x1000d008	0xda10	0xc610	0x18a
QueryPerformanceCounter	0x0	0x1000d00c	0xda14	0xc614	0x22f
SetUnhandledExceptionFilter	0x0	0x1000d010	0xda18	0xc618	0x2bc
UnhandledExceptionFilter	0x0	0x1000d014	0xda1c	0xc61c	0x2df
GetCurrentProcess	0x0	0x1000d018	0xda20	0xc620	0x10d
TerminateProcess	0x0	0x1000d01c	0xda24	0xc624	0x2cf
InterlockedCompareExchange	0x0	0x1000d020	0xda28	0xc628	0x1cb
Sleep	0x0	0x1000d024	0xda2c	0xc62c	0x2c7
InterlockedExchange	0x0	0x1000d028	0xda30	0xc630	0x1cd
RtlUnwind	0x0	0x1000d02c	0xda34	0xc634	0x25b
GetSystemTimeAsFileTime	0x0	0x1000d030	0xda38	0xc638	0x17a

Exports (112)

Api name	EAT Address	Ordinal
__ucl_align_gap	0x6ae0	0x1
__ucl_init2	0x6a5e	0x2
__ucl_ptr_linear	0x6adb	0x3
_ucl_config_check	0x68d7	0x4
_ucl_cpuid_asm	0x6c40	0xb
_ucl_crc32_asm	0x6cd0	0xd
_ucl_crc32_asm_small	0x6da0	0xe
_ucl_nrv2b_decompress_asm_8	0x7970	0x19
_ucl_nrv2b_decompress_asm_fast_8	0x7110	0x1a
_ucl_nrv2b_decompress_asm_fast_le16	0x73d0	0x1b
_ucl_nrv2b_decompress_asm_fast_le32	0x6e30	0x1c
_ucl_nrv2b_decompress_asm_fast_safe_8	0x7210	0x1d
_ucl_nrv2b_decompress_asm_fast_safe_le16	0x74f0	0x1e
_ucl_nrv2b_decompress_asm_fast_safe_le32	0x6f30	0x1f
_ucl_nrv2b_decompress_asm_le16	0x7be0	0x20
_ucl_nrv2b_decompress_asm_le32	0x76e0	0x21
_ucl_nrv2b_decompress_asm_safe_8	0x7a50	0x22
_ucl_nrv2b_decompress_asm_safe_le16	0x7ce0	0x23
_ucl_nrv2b_decompress_asm_safe_le32	0x77c0	0x24
_ucl_nrv2b_decompress_asm_small_8	0x8120	0x25
_ucl_nrv2b_decompress_asm_small_le16	0x8350	0x26
_ucl_nrv2b_decompress_asm_small_le32	0x7eb0	0x27
_ucl_nrv2b_decompress_asm_small_safe_8	0x81e0	0x28
_ucl_nrv2b_decompress_asm_small_safe_le16	0x8430	0x29
_ucl_nrv2b_decompress_asm_small_safe_le32	0x7f80	0x2a
_ucl_nrv2d_decompress_asm_8	0x9220	0x35
_ucl_nrv2d_decompress_asm_fast_8	0x8900	0x36
_ucl_nrv2d_decompress_asm_fast_le16	0x8bf0	0x37
_ucl_nrv2d_decompress_asm_fast_le32	0x85e0	0x38
_ucl_nrv2d_decompress_asm_fast_safe_8	0x8a10	0x39
_ucl_nrv2d_decompress_asm_fast_safe_le16	0x8d20	0x3a
_ucl_nrv2d_decompress_asm_fast_safe_le32	0x8700	0x3b
_ucl_nrv2d_decompress_asm_le16	0x94d0	0x3c
_ucl_nrv2d_decompress_asm_le32	0x8f40	0x3d
_ucl_nrv2d_decompress_asm_safe_8	0x9310	0x3e
_ucl_nrv2d_decompress_asm_safe_le16	0x95e0	0x3f
_ucl_nrv2d_decompress_asm_safe_le32	0x9040	0x40
_ucl_nrv2d_decompress_asm_small_8	0x9a70	0x41
_ucl_nrv2d_decompress_asm_small_le16	0x9ce0	0x42
_ucl_nrv2d_decompress_asm_small_le32	0x97d0	0x43
_ucl_nrv2d_decompress_asm_small_safe_8	0x9b40	0x44
_ucl_nrv2d_decompress_asm_small_safe_le16	0x9dd0	0x45
_ucl_nrv2d_decompress_asm_small_safe_le32	0x98b0	0x46
_ucl_nrv2e_decompress_asm_8	0xac90	0x51
_ucl_nrv2e_decompress_asm_fast_8	0xa300	0x52
_ucl_nrv2e_decompress_asm_fast_le16	0xa610	0x53
_ucl_nrv2e_decompress_asm_fast_le32	0x9fb0	0x54
_ucl_nrv2e_decompress_asm_fast_safe_8	0xa410	0x55
_ucl_nrv2e_decompress_asm_fast_safe_le16	0xa750	0x56
_ucl_nrv2e_decompress_asm_fast_safe_le32	0xa0e0	0x57
_ucl_nrv2e_decompress_asm_le16	0xaf50	0x58
_ucl_nrv2e_decompress_asm_le32	0xa990	0x59
_ucl_nrv2e_decompress_asm_safe_8	0xad80	0x5a
_ucl_nrv2e_decompress_asm_safe_le16	0xb070	0x5b
_ucl_nrv2e_decompress_asm_safe_le32	0xaaa0	0x5c
_ucl_nrv2e_decompress_asm_small_8	0xb550	0x5d
_ucl_nrv2e_decompress_asm_small_le16	0xb7e0	0x5e
_ucl_nrv2e_decompress_asm_small_le32	0xb280	0x5f
_ucl_nrv2e_decompress_asm_small_safe_8	0xb630	0x60
_ucl_nrv2e_decompress_asm_small_safe_le16	0xb8e0	0x61
_ucl_nrv2e_decompress_asm_small_safe_le32	0xb370	0x62
_ucl_rdtsc_add_asm	0xbb00	0x6b
_ucl_rdtsc_asm	0xbae0	0x6c
_ucl_version_date	0x6b33	0x5
_ucl_version_string	0x6b2d	0x6
ucl_adler32	0x6b39	0x7
ucl_alloc	0x107e	0x8
ucl_assert	0x6b17	0x9
ucl_copyright	0x6b21	0xa
ucl_crc32	0x663c	0xc
ucl_free	0x10a7	0xf
ucl_get_crc32_table	0x6636	0x10
ucl_get_malloc_hooks	0x104d	0x11
ucl_malloc	0x106e	0x12
ucl_memcmp	0x6b02	0x13
ucl_memcpy	0x6b07	0x14
ucl_memmove	0x6b0c	0x15
ucl_memset	0x6b12	0x16
ucl_nrv2b_99_compress	0x1305	0x17
ucl_nrv2b_decompress_8	0x1701	0x18
ucl_nrv2b_decompress_le16	0x186e	0x2b
ucl_nrv2b_decompress_le32	0x1a4b	0x2c
ucl_nrv2b_decompress_safe_8	0x1c1f	0x2d
ucl_nrv2b_decompress_safe_le16	0x1e12	0x2e
ucl_nrv2b_decompress_safe_le32	0x2072	0x2f
ucl_nrv2b_test_overlap_8	0x22ce	0x30
ucl_nrv2b_test_overlap_le16	0x24b1	0x31
ucl_nrv2b_test_overlap_le32	0x2700	0x32
ucl_nrv2d_99_compress	0x2c6b	0x33
ucl_nrv2d_decompress_8	0x3067	0x34
ucl_nrv2d_decompress_le16	0x3208	0x47
ucl_nrv2d_decompress_le32	0x3420	0x48
ucl_nrv2d_decompress_safe_8	0x362f	0x49
ucl_nrv2d_decompress_safe_le16	0x384a	0x4a
ucl_nrv2d_decompress_safe_le32	0x3aee	0x4b
ucl_nrv2d_test_overlap_8	0x3d82	0x4c
ucl_nrv2d_test_overlap_le16	0x3f90	0x4d
ucl_nrv2d_test_overlap_le32	0x4223	0x4e
ucl_nrv2e_99_compress	0x4bb0	0x4f
ucl_nrv2e_decompress_8	0x4fac	0x50
ucl_nrv2e_decompress_le16	0x5192	0x63
ucl_nrv2e_decompress_le32	0x53f9	0x64
ucl_nrv2e_decompress_safe_8	0x5649	0x65
ucl_nrv2e_decompress_safe_le16	0x5893	0x66
ucl_nrv2e_decompress_safe_le32	0x5b8a	0x67
ucl_nrv2e_test_overlap_8	0x5e63	0x68
ucl_nrv2e_test_overlap_le16	0x60a9	0x69
ucl_nrv2e_test_overlap_le32	0x639a	0x6a
ucl_set_malloc_hooks	0x101e	0x6d
ucl_version	0x6b27	0x6e
ucl_version_date	0x6b33	0x6f
ucl_version_string	0x6b2d	0x70

c:\windows\temp\svchostp.exe

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	67.00 KB
MD5	0e2d6be0556d0a1ec47a934da3244fc0
SHA1	72d71778aa892d1dfa96e2727e378e9ceb06e88d
SHA256	fa2a5db45a4808a3d087bb9cf807c5672be9e856166a049d15997b56c4626af4
SSDeep	1536:wd0DYbKaBmRiPLzTKIO8qn+FOcHJLFdTr:smwPXTtwn+gcHJnf
ImpHash	0abd25067da599c5197c93c8baa2a5a4
Parser Error Remark	Static analyzer was unable to completely parse the analyzed file

PE Information

Image Base	0x400000
Entry Point	0x4321f7
Size Of Code	0x18c00
Size Of Initialized Data	0x15c00
File Type	executable
Subsystem	windows_cui
Machine Type	i386
Compile Timestamp	2015-02-25 14:35:21+00:00

Version Information (8)

LegalCopyright	Copyright (c) 2012-2015 Power Admin LLC
InternalName	PAExec
FileVersion	1.26.0.0
CompanyName	Power Admin LLC
ProductName	PAExec Application
ProductVersion	1.26.0.0
FileDescription	PAExec Application
OriginalFilename	PAExec.exe

Sections (3)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.MPRESS1	0x401000	0x31000	0xf600	0x200	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	8.0
.MPRESS2	0x432000	0xd61	0xe00	0xf800	cnt_code, cnt_initialized_data, cnt_uninitialized_data, mem_execute, mem_read, mem_write	6.17
.rsrc	0x433000	0x5c0	0x600	0x10600	cnt_initialized_data, mem_read, mem_write	4.35

Imports (8)

KERNEL32.DLL (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x4320b4	0x320b4	0xf8b4	0x0
GetProcAddress	0x0	0x4320b8	0x320b8	0xf8b8	0x0

VERSION.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VerQueryValueW	0x0	0x4320c0	0x320c0	0xf8c0	0x0

NETAPI32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NetServerEnum	0x0	0x4320c8	0x320c8	0xf8c8	0x0

USERENV.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LoadUserProfileW	0x0	0x4320d0	0x320d0	0xf8d0	0x0

PSAPI.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
EnumProcesses	0x0	0x4320d8	0x320d8	0xf8d8	0x0

WTSAPI32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WTSFreeMemory	0x0	0x4320e0	0x320e0	0xf8e0	0x0

MPR.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WNetCloseEnum	0x0	0x4320e8	0x320e8	0xf8e8	0x0

ADVAPI32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LogonUserW	0x0	0x4320f0	0x320f0	0xf8f0	0x0

c:\windows\temp\svchostb.xml

Created File

XML

Not Queried

Mime Type	application/xml
File Size	7.60 KB
MD5	f56025565de4f53f5771d4966c2b5555
SHA1	b22162a38cdd4b85254b6c909a9e5210711d77af
SHA256	ea7caa08e115dbb438e29da46b47f54c62c29697617bae44464a9b63d9bddf18
SSDeep	192:O56qWdem0F0H6/OrYO/ysg7mBMCv7GHrCucPFTU:O5CdZ0F6Le

C:\Windows\temp\snamelog

Created File

Text

Not Queried

Mime Type	text/plain
File Size	0.04 KB
MD5	3987bea11c4d22ae0bddda27730df005
SHA1	d49cb80b941e21b55319b53c1190a92a44237dc9
SHA256	3cab9d330ab209bbbf2064803532f80d251c060f40235a7b1d3f15120b10f2f6
SSDeep	3:A+aktGJoiTktGy:ALk4tTk4y

c:\windows\temp\xdvl-0.dll

Created File

Binary

Not Queried

Mime Type	application/x-dosexec
File Size	31.50 KB
MD5	5b72ccfa122e403919a613785779af49
SHA1	f560ea0a109772be2b62c539b0bb67c46279abd1
SHA256	b7d8fcc3fb533e5e0069e00bc5a68551479e54a990bb1b658e1bd092c0507d68
SSDeep	768:ah/VicQqYL6tqi5CzTbvNJKMEKRW2FN4fn9n:ah/P5YJi5CzvvNJKMEX2FN4f9
ImpHash	477c8eaf510bb0844ff2d9435002bda8

PE Information

Image Base	0x10000000
Entry Point	0x10006500
Size Of Code	0x5a00
Size Of Initialized Data	0x2800
File Type	dll
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-02-28 13:52:57+00:00

Sections (4)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x59e6	0x5a00	0x400	cnt_code, mem_execute, mem_read	6.67
.rdata	0x10007000	0x11da	0x1200	0x5e00	cnt_initialized_data, mem_read	5.46
.data	0x10009000	0xe74	0x800	0x7000	cnt_initialized_data, mem_read, mem_write	5.25
.reloc	0x1000a000	0x576	0x600	0x7800	cnt_initialized_data, mem_discardable, mem_read	3.09

Imports (4)

KERNEL32.dll (14)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetVersion	0x0	0x10007000	0x7408	0x6208	0x192
GetTickCount	0x0	0x10007004	0x740c	0x620c	0x18a
GetCurrentProcessId	0x0	0x10007008	0x7410	0x6210	0x10e
GetCurrentThreadId	0x0	0x1000700c	0x7414	0x6214	0x110
QueryPerformanceCounter	0x0	0x10007010	0x7418	0x6218	0x22f
SetUnhandledExceptionFilter	0x0	0x10007014	0x741c	0x621c	0x2bc
UnhandledExceptionFilter	0x0	0x10007018	0x7420	0x6220	0x2df
GetCurrentProcess	0x0	0x1000701c	0x7424	0x6224	0x10d
TerminateProcess	0x0	0x10007020	0x7428	0x6228	0x2cf
InterlockedCompareExchange	0x0	0x10007024	0x742c	0x622c	0x1cb
Sleep	0x0	0x10007028	0x7430	0x6230	0x2c7
InterlockedExchange	0x0	0x1000702c	0x7434	0x6234	0x1cd
RtlUnwind	0x0	0x10007030	0x7438	0x6238	0x25b
GetSystemTimeAsFileTime	0x0	0x10007034	0x743c	0x623c	0x17a

cnli-1.dll (17)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VirtualArray_createFunc	0x0	0x1000703c	0x7444	0x6244	0x21d
CNEVirtualArray_freeVAAndElements	0x0	0x10007040	0x7448	0x6248	0x1d9
CNEVirtualArray_removeAtIndex	0x0	0x10007044	0x744c	0x624c	0x1e6
CNEBlob_appendRandomData	0x0	0x10007048	0x7450	0x6250	0x2
CNEMem_cleanNClearNDestroyPointer	0x0	0x1000704c	0x7454	0x6254	0x9e
CNEMem_cleanNClear	0x0	0x10007050	0x7458	0x6258	0x9d
CNEString_snprintf	0x0	0x10007054	0x745c	0x625c	0x14d
byteSwapLong	0x0	0x10007058	0x7460	0x6260	0x223
CNE_compareMemoryFunc	0x0	0x1000705c	0x7464	0x6264	0x1ed
CNEVirtualArray_getElementAt	0x0	0x10007060	0x7468	0x6268	0x1da
CNEVirtualArray_getSize	0x0	0x10007064	0x746c	0x626c	0x1dc
CNEVirtualArray_push	0x0	0x10007068	0x7470	0x6270	0x1e4
CNEBlob_free	0x0	0x1000706c	0x7474	0x6274	0x9
CNEBlob_append	0x0	0x10007070	0x7478	0x6278	0x0
CNEBlob_createFunc	0x0	0x10007074	0x747c	0x627c	0x4
CNE_allocateCleanMemoryFunc	0x0	0x10007078	0x7480	0x6280	0x1ec
CNEVirtualArray_freeVA	0x0	0x1000707c	0x7484	0x6284	0x1d8

crli-0.dll (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CryptoLibV2_freeBuffer	0x0	0x10007084	0x748c	0x628c	0x4
CryptoLibV2_getRandom	0x0	0x10007088	0x7490	0x6290	0x5

msvcrt.dll (17)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
pow	0x0	0x10007090	0x7498	0x6298	0x4f2
memset	0x0	0x10007094	0x749c	0x629c	0x4ee
srand	0x0	0x10007098	0x74a0	0x62a0	0x50e
time	0x0	0x1000709c	0x74a4	0x62a4	0x534
free	0x0	0x100070a0	0x74a8	0x62a8	0x4a6
floor	0x0	0x100070a4	0x74ac	0x62ac	0x49b
malloc	0x0	0x100070a8	0x74b0	0x62b0	0x4de
rand	0x0	0x100070ac	0x74b4	0x62b4	0x4fd
strlen	0x0	0x100070b0	0x74b8	0x62b8	0x51c
tolower	0x0	0x100070b4	0x74bc	0x62bc	0x539
realloc	0x0	0x100070b8	0x74c0	0x62c0	0x4ff
strcmp	0x0	0x100070bc	0x74c4	0x62c4	0x514
_XcptFilter	0x0	0x100070c0	0x74c8	0x62c8	0x6a
_initterm	0x0	0x100070c4	0x74cc	0x62cc	0x1d5
_amsg_exit	0x0	0x100070c8	0x74d0	0x62d0	0x101
_adjust_fdiv	0x0	0x100070cc	0x74d4	0x62d4	0xf5
memcpy	0x0	0x100070d0	0x74d8	0x62d8	0x4ea

Exports (62)

Api name	EAT Address	Ordinal
XDevEncodePNG_GenerateChunkType	0x2e56	0x1
XDevEncodePNG_InsertChunk	0x2fb8	0x2
XDevEncode_ConcatBlobs	0x104a	0x3
XDevEncode_DUL	0x29e3	0x4
XDevEncode_JSShift	0x2b58	0x5
XDevEncode_PayloadXORW	0x30c9	0x6
XDevEncode_TEADecrypt	0x319d	0x7
XDevEncode_TEAEncrypt	0x3103	0x8
XDevEncode_TEARandomKey	0x351e	0x9
XDevEncode_UnconcatBlobs	0x10ef	0xa
XDevEncode_XOR	0x3b0e	0xb
XDevEncode_XORW	0x3d6b	0xc
XDevEncode_XTEADecrypt	0x32bb	0xd
XDevEncode_XTEAEncrypt	0x3236	0xe
XDevEncode_XXTEADecrypt	0x342c	0xf
XDevEncode_XXTEAEncrypt	0x333a	0x10
XDevLib_blobAppendRandomData	0x5bdc	0x11
XDevLib_blobXORMangler	0x5c58	0x12
XDevLib_blobXORManglerEx	0x5a88	0x13
XDevLib_generateRandomSequence	0x5ac2	0x14
XDevLib_pseudoRand	0x5a27	0x15
XDevLib_pseudoRandEx	0x5a5b	0x16
XDevLib_pseudoRandSeed	0x5a01	0x17
XDevLib_pseudoRandSeedEx	0x5a15	0x18
XDevLib_xorMask	0x5c21	0x19
XDevParam_addNewParamToList	0x4c12	0x1a
XDevParam_callNextRoutingEntry	0x49d3	0x1b
XDevParam_callNextRoutingEntryWithCallback	0x4e0b	0x1c
XDevParam_copyParamArray	0x52bf	0x1d
XDevParam_createListFromBlob	0x56ba	0x1e
XDevParam_createListFromBuffer	0x53c6	0x1f
XDevParam_createNewParam	0x4ab6	0x20
XDevParam_findNextParamInList	0x49f0	0x21
XDevParam_findPreviousParamInList	0x4a4a	0x22
XDevParam_freeParamAndData	0x4984	0x23
XDevParam_freeParamList	0x4df0	0x24
XDevParam_getNextParamDataInList	0x517f	0x25
XDevParam_getPreviousParamDataInList	0x51d6	0x26
XDevParam_popNextParamDataFromList	0x50cc	0x27
XDevParam_popNextParamFromList	0x5078	0x28
XDevParam_popRequestParam	0x48e7	0x29
XDevParam_popRequestParamList	0x567c	0x2a
XDevParam_popResponseParam	0x4925	0x2b
XDevParam_popResponseParamList	0x569b	0x2c
XDevParam_pushRequestParam	0x48c8	0x2d
XDevParam_pushRequestParamAsList	0x4daf	0x2e
XDevParam_pushRequestParamList	0x4944	0x2f
XDevParam_pushResponseParam	0x4906	0x30
XDevParam_pushResponseParamAsList	0x4dd0	0x31
XDevParam_pushResponseParamList	0x4964	0x32
XDevParam_pushRoutingEntryToList	0x522d	0x33
XDevParam_pushStatusRoutingEntryToList	0x5276	0x34
XDevParam_sendNotificationEvent	0x54c4	0x35
XDevParam_storeListInBlob	0x4c5d	0x36
XDevParam_stripRoutingEntriesFromList	0x4fdb	0x37
XDevShellcode_append	0x58a2	0x38
XDevShellcode_freeShellcode	0x58e9	0x39
XDevShellcode_getShellcodeString	0x59dc	0x3a
XDevShellcode_loadShellcode	0x57b8	0x3b
XDevShellcode_setVar	0x5959	0x3c
badrand	0x1219	0x3d
toHex	0x2b46	0x3e

Notifications (2/3)

Remarks

There are no files for this filter

WHOIS Domain Information

Before

After