DigitalSide Threat Intel

etermproxy.exe

First submission 2024-10-15 18:21:16

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 2756.0 KB (2822144 bytes)
Compile time: 2024-09-03 16:05:44
MD5: d83c3a49036fa08e25465e0b9f7ba110
SHA1: fca90cbfc04f1f04406e3816c988eb2292eeaa4c
SHA256: eec3465923bf6b5dd10a7dd9437687342b6278d2709b0840731e77d53571c29e
Import Hash : f6ec3752075eb089e829965159851b5c
Sections 4 .text .rdata .data .rsrc
Directories 3 import export resource

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 24/77 VT report date: 2024-09-12 13:14:56
Malware Type 1 trojan
Threat Type 1 zusy

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://pid.fly160.com/download/etermproxy.exe VirusTotal Report pid.fly160.com VirusTotal Report 2024-10-15 18:21:16

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x1c4468 1855488 e7d54a125194455e95d9a276f4ac45e3124d8847 9e297beb95791ae60c5faf387645d979
.rdata 0x1c6000 0x3f98b 262144 875525e0e3e807bcc3d53957ce22b40beb63cd37 c6a9989df597ee1c9a486fd3e6293186
.data 0x206000 0x36efc 196608 97d49d18d48042190dde25e3121572fdc3f7d913 5924918e2372410bfd761235ca4e408b
.rsrc 0x23d000 0x7acd0 503808 340cfb796b27c5c6fb404bc90ac364829ec3494b 67e1d3a89f6286cc9d08d58541b1d652

PE Resources 15

Name Language Sublanguage Offset Size Data
CERT LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x2772f8 1690
CODE_VERIFY LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x278578 1015
HZ_MAP LANG_ENGLISH SUBLANG_ENGLISH_US 0x278970 256459
RT_CURSOR LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x278428 308
RT_BITMAP LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x25de80 45796
RT_ICON LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x2415a8 296
RT_MENU LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x269678 60
RT_DIALOG LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x276df0 434
RT_STRING LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x2b78c0 110
RT_ACCELERATOR LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x2696b8 112
RT_GROUP_CURSOR LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x278560 20
RT_GROUP_ICON LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x2416d0 34
RT_VERSION LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x276fa8 848
None LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x2783e0 69
None LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x269168 46

Meta infos 13

LegalCopyright: \x7248\x6743\x6240\x6709 (C) 2012
InternalName: ETermProxy
FileVersion: 2.10.012
FileDescription: PID\x7ba1\x7406\x7cfb\x7edf
SpecialBuild: 20120905
CompanyName:
LegalTrademarks:
Comments: 2012\x5e749\x67085\x65e5\x53d1\x5e03
ProductName: PID\x7ba1\x7406\x7cfb\x7edf
ProductVersion: 2.10.012
PrivateBuild: 20120905
Translation: 0x0804 0x04b0
OriginalFilename: ETermProxy.EXE

Packers detected 3

Microsoft Visual C++ v6.0
Microsoft Visual C++ 5.0
Microsoft Visual C++

Anti debug functions 2

FindWindowA
GetLastError

Strings analysis - File found

Binary
data_v1.bin
pdsys.bin
\pdsys.bin
XML
c:\test.xml
Text
%s%d%02d%02d-ShiXinRen.txt
c:\SK.txt
%s%d%02d_flow_ctrl.txt
c:\eterm.txt
c:\test.txt
%s%d%02d%02d-%s-%s.txt
%s%s-%s-%d%02d%02d.txt
%ssql-command-%d%02d%02d.txt
Library
ADVAPI32.dll
WSOCK32.dll
SHELL32.dll
md5lib.dll
USER32.dll
KERNEL32.dll
ssleay32.dll
libssl.dll
libeay32.dll
MSVCRT.dll
WININET.dll
XTP9601Lib.dll
OLEAUT32.dll
SESDKDummy.dll
ole32.dll
MFC42.DLL
GDI32.dll

Strings analysis - Possible IPs found 5

122.119.97.12
202.106.139.18
10.0.0.1
222.178.68.131
127.0.0.1

Strings analysis - Possible URLs found 27

http://web.travelsky.com/
http://www.myair.cn&Menu=yes
http://www.info-bird.com/
http://www.myair.cn
http://www.sunstn.com
http://web.travelsky.com/TravelWeb/login/isLoginAction.do
http://web.travelsky.com/TravelWeb/jsp/login/Download.jsp
http://%s/ib_internal_req.asp?uid=%s&sessionid=0&verify=0&cmd=xepnr&pnr=%s
http://eterm2.info-bird.com/IBBD2008/WebService/BaseDataInterface.asmx
http://www.sunstn.com.cn&Menu=yes
http://web.travelsky.com/TravelWeb/jsp/login/login.jsp
http://127.0.0.1:%d/ib_internal_req.asp?uid=%s&sessionid=0&verify=0&cmd=tsl&tslr=1&date=%d&device=%s
http://www.hangyi365.com.cn&Menu=yes
http://www.hangyi365.com
http://%s?client=%s&cmd=%s
http://127.0.0.1:352/ib_internal_req.asp?cmd=itinni_internal&ni=%s&uid=%s&sessionid=0&verify=0
http://127.0.0.1:%d/ib_internal_req.asp?uid=%s&termid=rtkt&sessionid=0&verify=0&cmd=RTKT&ticket=%s
http://127.0.0.1:%d/ib_internal_req.asp?uid=%s&sessionid=0&verify=0&cmd=detr&ticket=%s
http://127.0.0.1:%d/ib_tranx_req.asp?cmd=xepnr&uid=xe_user&sessionid=0&termid=%s&verify=0&pnr=%s
http://web2.travelsky.com/TravelWeb/etermConfig.do?method=queryEtermConfig
http://www.fly160.com/download
http://pid.fly160.com/download/etermproxy.exe
http://%s?cmd=%s
http://127.0.0.1:%d/ib_internal_req.asp?uid=qt_uid&termid=qt_term&sessionid=%s&cmd=qt&office_code=%s&type=%s&si=%s&cl=%d
http://%s/ib_internal_req.asp?uid=%s&sessionid=0&verify=0&cmd=rt_parse&pnr=%s
http://%s/ib_internal_req.asp?uid=%s&sessionid=0&verify=0&cmd=rt_parse&pnr=%s&get_rawdata=1&no_pn=1
http://%s/ib_internal_req.asp?uid=%s&sessionid=0&verify=0&cmd=rtu&pnr=%s&rawdata=1

Import functions

Function Address Souspicious Anti Debug
None 0x5c6114
None 0x5c6118
None 0x5c611c
None 0x5c6120
None 0x5c6124
None 0x5c6128
None 0x5c612c
None 0x5c6130
None 0x5c6134
None 0x5c6138
None 0x5c613c
None 0x5c6140
None 0x5c6144
None 0x5c6148
None 0x5c614c
None 0x5c6150
Function Address Souspicious Anti Debug
?DecruptLicenseA@@YA_NPADH@Z 0x5c6e54
?DecruptLicenseB@@YA_NPADH@Z 0x5c6e58
?GetMacByIP@@YAHPADHVCString@@0@Z 0x5c6e5c
?EncruptLicenseB@@YA_NPADH@Z 0x5c6e60
DecruptLicenseC 0x5c6e64
?DecruptString@@YAPADPBD@Z 0x5c6e68
?DestoryDBFile@@YAXXZ 0x5c6e6c
??1CEnumEther@@QAE@XZ 0x5c6e70
?CheckLoopbackAdapter@CEnumEther@@QAEHPADH@Z 0x5c6e74
??0CEnumEther@@QAE@XZ 0x5c6e78
?Zip@@YAHPADH@Z 0x5c6e7c
?EncruptLicenseA@@YA_NPADH@Z 0x5c6e80
?Unzip@@YA_NPADH@Z 0x5c6e84
Function Address Souspicious Anti Debug
ShellExecuteExA 0x5c6a7c
SHBrowseForFolderA 0x5c6a80
SHGetPathFromIDListA 0x5c6a84
Shell_NotifyIconA 0x5c6a88
ShellExecuteA 0x5c6a8c
Function Address Souspicious Anti Debug
MD5Encode 0x5c6e8c
Function Address Souspicious Anti Debug
InternetOpenA 0x5c6bac
InternetSetOptionA 0x5c6bb0
InternetOpenUrlA 0x5c6bb4
InternetReadFile 0x5c6bb8
InternetCloseHandle 0x5c6bbc
Function Address Souspicious Anti Debug
DeleteObject 0x5c6018
CreateFontA 0x5c601c
GetStockObject 0x5c6020
GetObjectA 0x5c6024
CreateFontIndirectA 0x5c6028
CreateDIBitmap 0x5c602c
GetTextExtentPoint32A 0x5c6030
CreateSolidBrush 0x5c6034
Function Address Souspicious Anti Debug
RegCloseKey 0x5c6000
RegOpenKeyExA 0x5c6004
RegCreateKeyExA 0x5c6008
RegSetValueExA 0x5c600c
RegQueryValueExA 0x5c6010
Function Address Souspicious Anti Debug
WideCharToMultiByte 0x5c603c
GetModuleHandleA 0x5c6040
GetDriveTypeA 0x5c6044
FreeLibrary 0x5c6048
MoveFileA 0x5c604c
GetFileAttributesA 0x5c6050
CreatePipe 0x5c6054
GetStartupInfoA 0x5c6058
CreateProcessA 0x5c605c
ReadFile 0x5c6060
FindResourceA 0x5c6064
SizeofResource 0x5c6068
LoadResource 0x5c606c
LockResource 0x5c6070
GetPrivateProfileIntA 0x5c6074
WritePrivateProfileStringA 0x5c6078
GetPrivateProfileStringA 0x5c607c
lstrlenW 0x5c6080
EnterCriticalSection 0x5c6084
GetLocalTime 0x5c6088
LocalFree 0x5c608c
MultiByteToWideChar 0x5c6090
DeleteFileA 0x5c6094
InterlockedDecrement 0x5c6098
WaitForMultipleObjects 0x5c609c
TerminateThread 0x5c60a0
ResetEvent 0x5c60a4
WaitForSingleObject 0x5c60a8
CreateEventA 0x5c60ac
LeaveCriticalSection 0x5c60b0
Sleep 0x5c60b4
DeleteCriticalSection 0x5c60b8
InitializeCriticalSection 0x5c60bc
SetEvent 0x5c60c0
CreateMutexA 0x5c60c4
ReleaseMutex 0x5c60c8
GetWindowsDirectoryA 0x5c60cc
OpenMutexA 0x5c60d0
GetLastError 0x5c60d4
WinExec 0x5c60d8
GetCurrentDirectoryA 0x5c60dc
GetModuleFileNameA 0x5c60e0
SetCurrentDirectoryA 0x5c60e4
CreateDirectoryA 0x5c60e8
lstrlenA 0x5c60ec
GlobalAlloc 0x5c60f0
GlobalLock 0x5c60f4
lstrcpyA 0x5c60f8
GlobalUnlock 0x5c60fc
CreateThread 0x5c6100
CloseHandle 0x5c6104
CopyFileA 0x5c6108
GetTickCount 0x5c610c
Function Address Souspicious Anti Debug
_XcptFilter 0x5c6974
_purecall 0x5c6978
memmove 0x5c697c
_mbscmp 0x5c6980
_mbsicmp 0x5c6984
atoi 0x5c6988
rename 0x5c698c
strstr 0x5c6990
sprintf 0x5c6994
exit 0x5c6998
_mbsnbcpy 0x5c699c
strchr 0x5c69a0
atof 0x5c69a4
_ftol 0x5c69a8
rand 0x5c69ac
srand 0x5c69b0
time 0x5c69b4
strncmp 0x5c69b8
system 0x5c69bc
atol 0x5c69c0
_access 0x5c69c4
strncpy 0x5c69c8
malloc 0x5c69cc
ctime 0x5c69d0
_ftime 0x5c69d4
strrchr 0x5c69d8
sscanf 0x5c69dc
printf 0x5c69e0
_except_handler3 0x5c69e4
?terminate@@YAXXZ 0x5c69e8
__dllonexit 0x5c69ec
_onexit 0x5c69f0
_setmbcp 0x5c69f4
_strupr 0x5c69f8
_stricmp 0x5c69fc
_strnicmp 0x5c6a00
_CxxThrowException 0x5c6a04
wcslen 0x5c6a08
??1type_info@@UAE@XZ 0x5c6a0c
_exit 0x5c6a10
_acmdln 0x5c6a14
__getmainargs 0x5c6a18
_initterm 0x5c6a1c
__setusermatherr 0x5c6a20
_adjust_fdiv 0x5c6a24
__p__commode 0x5c6a28
__p__fmode 0x5c6a2c
__set_app_type 0x5c6a30
_controlfp 0x5c6a34
__CxxFrameHandler 0x5c6a38
Function Address Souspicious Anti Debug
SEDecodeStringA 0x5c6a74
Function Address Souspicious Anti Debug
SysAllocStringByteLen 0x5c6a40
GetErrorInfo 0x5c6a44
SafeArrayGetElement 0x5c6a48
VariantCopy 0x5c6a4c
VariantInit 0x5c6a50
VariantClear 0x5c6a54
SysFreeString 0x5c6a58
VariantChangeType 0x5c6a5c
SysAllocString 0x5c6a60
SysStringByteLen 0x5c6a64
SafeArrayPutElement 0x5c6a68
SafeArrayCreate 0x5c6a6c
Function Address Souspicious Anti Debug
None 0x5c6158
None 0x5c615c
None 0x5c6160
None 0x5c6164
None 0x5c6168
None 0x5c616c
None 0x5c6170
None 0x5c6174
None 0x5c6178
None 0x5c617c
None 0x5c6180
None 0x5c6184
None 0x5c6188
None 0x5c618c
None 0x5c6190
None 0x5c6194
None 0x5c6198
None 0x5c619c
None 0x5c61a0
None 0x5c61a4
None 0x5c61a8
None 0x5c61ac
None 0x5c61b0
None 0x5c61b4
None 0x5c61b8
None 0x5c61bc
None 0x5c61c0
None 0x5c61c4
None 0x5c61c8
None 0x5c61cc
None 0x5c61d0
None 0x5c61d4
None 0x5c61d8
None 0x5c61dc
None 0x5c61e0
None 0x5c61e4
None 0x5c61e8
None 0x5c61ec
None 0x5c61f0
None 0x5c61f4
None 0x5c61f8
None 0x5c61fc
None 0x5c6200
None 0x5c6204
None 0x5c6208
None 0x5c620c
None 0x5c6210
None 0x5c6214
None 0x5c6218
None 0x5c621c
None 0x5c6220
None 0x5c6224
None 0x5c6228
None 0x5c622c
None 0x5c6230
None 0x5c6234
None 0x5c6238
None 0x5c623c
None 0x5c6240
None 0x5c6244
None 0x5c6248
None 0x5c624c
None 0x5c6250
None 0x5c6254
None 0x5c6258
None 0x5c625c
None 0x5c6260
None 0x5c6264
None 0x5c6268
None 0x5c626c
None 0x5c6270
None 0x5c6274
None 0x5c6278
None 0x5c627c
None 0x5c6280
None 0x5c6284
None 0x5c6288
None 0x5c628c
None 0x5c6290
None 0x5c6294
None 0x5c6298
None 0x5c629c
None 0x5c62a0
None 0x5c62a4
None 0x5c62a8
None 0x5c62ac
None 0x5c62b0
None 0x5c62b4
None 0x5c62b8
None 0x5c62bc
None 0x5c62c0
None 0x5c62c4
None 0x5c62c8
None 0x5c62cc
None 0x5c62d0
None 0x5c62d4
None 0x5c62d8
None 0x5c62dc
None 0x5c62e0
None 0x5c62e4
None 0x5c62e8
None 0x5c62ec
None 0x5c62f0
None 0x5c62f4
None 0x5c62f8
None 0x5c62fc
None 0x5c6300
None 0x5c6304
None 0x5c6308
None 0x5c630c
None 0x5c6310
None 0x5c6314
None 0x5c6318
None 0x5c631c
None 0x5c6320
None 0x5c6324
None 0x5c6328
None 0x5c632c
None 0x5c6330
None 0x5c6334
None 0x5c6338
None 0x5c633c
None 0x5c6340
None 0x5c6344
None 0x5c6348
None 0x5c634c
None 0x5c6350
None 0x5c6354
None 0x5c6358
None 0x5c635c
None 0x5c6360
None 0x5c6364
None 0x5c6368
None 0x5c636c
None 0x5c6370
None 0x5c6374
None 0x5c6378
None 0x5c637c
None 0x5c6380
None 0x5c6384
None 0x5c6388
None 0x5c638c
None 0x5c6390
None 0x5c6394
None 0x5c6398
None 0x5c639c
None 0x5c63a0
None 0x5c63a4
None 0x5c63a8
None 0x5c63ac
None 0x5c63b0
None 0x5c63b4
None 0x5c63b8
None 0x5c63bc
None 0x5c63c0
None 0x5c63c4
None 0x5c63c8
None 0x5c63cc
None 0x5c63d0
None 0x5c63d4
None 0x5c63d8
None 0x5c63dc
None 0x5c63e0
None 0x5c63e4
None 0x5c63e8
None 0x5c63ec
None 0x5c63f0
None 0x5c63f4
None 0x5c63f8
None 0x5c63fc
None 0x5c6400
None 0x5c6404
None 0x5c6408
None 0x5c640c
None 0x5c6410
None 0x5c6414
None 0x5c6418
None 0x5c641c
None 0x5c6420
None 0x5c6424
None 0x5c6428
None 0x5c642c
None 0x5c6430
None 0x5c6434
None 0x5c6438
None 0x5c643c
None 0x5c6440
None 0x5c6444
None 0x5c6448
None 0x5c644c
None 0x5c6450
None 0x5c6454
None 0x5c6458
None 0x5c645c
None 0x5c6460
None 0x5c6464
None 0x5c6468
None 0x5c646c
None 0x5c6470
None 0x5c6474
None 0x5c6478
None 0x5c647c
None 0x5c6480
None 0x5c6484
None 0x5c6488
None 0x5c648c
None 0x5c6490
None 0x5c6494
None 0x5c6498
None 0x5c649c
None 0x5c64a0
None 0x5c64a4
None 0x5c64a8
None 0x5c64ac
None 0x5c64b0
None 0x5c64b4
None 0x5c64b8
None 0x5c64bc
None 0x5c64c0
None 0x5c64c4
None 0x5c64c8
None 0x5c64cc
None 0x5c64d0
None 0x5c64d4
None 0x5c64d8
None 0x5c64dc
None 0x5c64e0
None 0x5c64e4
None 0x5c64e8
None 0x5c64ec
None 0x5c64f0
None 0x5c64f4
None 0x5c64f8
None 0x5c64fc
None 0x5c6500
None 0x5c6504
None 0x5c6508
None 0x5c650c
None 0x5c6510
None 0x5c6514
None 0x5c6518
None 0x5c651c
None 0x5c6520
None 0x5c6524
None 0x5c6528
None 0x5c652c
None 0x5c6530
None 0x5c6534
None 0x5c6538
None 0x5c653c
None 0x5c6540
None 0x5c6544
None 0x5c6548
None 0x5c654c
None 0x5c6550
None 0x5c6554
None 0x5c6558
None 0x5c655c
None 0x5c6560
None 0x5c6564
None 0x5c6568
None 0x5c656c
None 0x5c6570
None 0x5c6574
None 0x5c6578
None 0x5c657c
None 0x5c6580
None 0x5c6584
None 0x5c6588
None 0x5c658c
None 0x5c6590
None 0x5c6594
None 0x5c6598
None 0x5c659c
None 0x5c65a0
None 0x5c65a4
None 0x5c65a8
None 0x5c65ac
None 0x5c65b0
None 0x5c65b4
None 0x5c65b8
None 0x5c65bc
None 0x5c65c0
None 0x5c65c4
None 0x5c65c8
None 0x5c65cc
None 0x5c65d0
None 0x5c65d4
None 0x5c65d8
None 0x5c65dc
None 0x5c65e0
None 0x5c65e4
None 0x5c65e8
None 0x5c65ec
None 0x5c65f0
None 0x5c65f4
None 0x5c65f8
None 0x5c65fc
None 0x5c6600
None 0x5c6604
None 0x5c6608
None 0x5c660c
None 0x5c6610
None 0x5c6614
None 0x5c6618
None 0x5c661c
None 0x5c6620
None 0x5c6624
None 0x5c6628
None 0x5c662c
None 0x5c6630
None 0x5c6634
None 0x5c6638
None 0x5c663c
None 0x5c6640
None 0x5c6644
None 0x5c6648
None 0x5c664c
None 0x5c6650
None 0x5c6654
None 0x5c6658
None 0x5c665c
None 0x5c6660
None 0x5c6664
None 0x5c6668
None 0x5c666c
None 0x5c6670
None 0x5c6674
None 0x5c6678
None 0x5c667c
None 0x5c6680
None 0x5c6684
None 0x5c6688
None 0x5c668c
None 0x5c6690
None 0x5c6694
None 0x5c6698
None 0x5c669c
None 0x5c66a0
None 0x5c66a4
None 0x5c66a8
None 0x5c66ac
None 0x5c66b0
None 0x5c66b4
None 0x5c66b8
None 0x5c66bc
None 0x5c66c0
None 0x5c66c4
None 0x5c66c8
None 0x5c66cc
None 0x5c66d0
None 0x5c66d4
None 0x5c66d8
None 0x5c66dc
None 0x5c66e0
None 0x5c66e4
None 0x5c66e8
None 0x5c66ec
None 0x5c66f0
None 0x5c66f4
None 0x5c66f8
None 0x5c66fc
None 0x5c6700
None 0x5c6704
None 0x5c6708
None 0x5c670c
None 0x5c6710
None 0x5c6714
None 0x5c6718
None 0x5c671c
None 0x5c6720
None 0x5c6724
None 0x5c6728
None 0x5c672c
None 0x5c6730
None 0x5c6734
None 0x5c6738
None 0x5c673c
None 0x5c6740
None 0x5c6744
None 0x5c6748
None 0x5c674c
None 0x5c6750
None 0x5c6754
None 0x5c6758
None 0x5c675c
None 0x5c6760
None 0x5c6764
None 0x5c6768
None 0x5c676c
None 0x5c6770
None 0x5c6774
None 0x5c6778
None 0x5c677c
None 0x5c6780
None 0x5c6784
None 0x5c6788
None 0x5c678c
None 0x5c6790
None 0x5c6794
None 0x5c6798
None 0x5c679c
None 0x5c67a0
None 0x5c67a4
None 0x5c67a8
None 0x5c67ac
None 0x5c67b0
None 0x5c67b4
None 0x5c67b8
None 0x5c67bc
None 0x5c67c0
None 0x5c67c4
None 0x5c67c8
None 0x5c67cc
None 0x5c67d0
None 0x5c67d4
None 0x5c67d8
None 0x5c67dc
None 0x5c67e0
None 0x5c67e4
None 0x5c67e8
None 0x5c67ec
None 0x5c67f0
None 0x5c67f4
None 0x5c67f8
None 0x5c67fc
None 0x5c6800
None 0x5c6804
None 0x5c6808
None 0x5c680c
None 0x5c6810
None 0x5c6814
None 0x5c6818
None 0x5c681c
None 0x5c6820
None 0x5c6824
None 0x5c6828
None 0x5c682c
None 0x5c6830
None 0x5c6834
None 0x5c6838
None 0x5c683c
None 0x5c6840
None 0x5c6844
None 0x5c6848
None 0x5c684c
None 0x5c6850
None 0x5c6854
None 0x5c6858
None 0x5c685c
None 0x5c6860
None 0x5c6864
None 0x5c6868
None 0x5c686c
None 0x5c6870
None 0x5c6874
None 0x5c6878
None 0x5c687c
None 0x5c6880
None 0x5c6884
None 0x5c6888
None 0x5c688c
None 0x5c6890
None 0x5c6894
None 0x5c6898
None 0x5c689c
None 0x5c68a0
None 0x5c68a4
None 0x5c68a8
None 0x5c68ac
None 0x5c68b0
None 0x5c68b4
None 0x5c68b8
None 0x5c68bc
None 0x5c68c0
None 0x5c68c4
None 0x5c68c8
None 0x5c68cc
None 0x5c68d0
None 0x5c68d4
None 0x5c68d8
None 0x5c68dc
None 0x5c68e0
None 0x5c68e4
None 0x5c68e8
None 0x5c68ec
None 0x5c68f0
None 0x5c68f4
None 0x5c68f8
None 0x5c68fc
None 0x5c6900
None 0x5c6904
None 0x5c6908
None 0x5c690c
None 0x5c6910
None 0x5c6914
None 0x5c6918
None 0x5c691c
None 0x5c6920
None 0x5c6924
None 0x5c6928
None 0x5c692c
None 0x5c6930
None 0x5c6934
None 0x5c6938
None 0x5c693c
None 0x5c6940
None 0x5c6944
None 0x5c6948
None 0x5c694c
None 0x5c6950
None 0x5c6954
None 0x5c6958
None 0x5c695c
None 0x5c6960
None 0x5c6964
None 0x5c6968
None 0x5c696c
Function Address Souspicious Anti Debug
None 0x5c6a94
None 0x5c6a98
None 0x5c6a9c
None 0x5c6aa0
None 0x5c6aa4
None 0x5c6aa8
None 0x5c6aac
None 0x5c6ab0
None 0x5c6ab4
None 0x5c6ab8
None 0x5c6abc
None 0x5c6ac0
None 0x5c6ac4
None 0x5c6ac8
None 0x5c6acc
None 0x5c6ad0
None 0x5c6ad4
None 0x5c6ad8
None 0x5c6adc
None 0x5c6ae0
None 0x5c6ae4
Function Address Souspicious Anti Debug
?AutoSaveColumns@CXTListBase@@UAEXPBD00@Z 0x5c6c04
?SubclassHeader@CXTListBase@@UAE_N_N@Z 0x5c6c08
?SetExtendedStyle@CXTListViewBase@@UAEXK@Z 0x5c6c0c
?GetExtendedStyle@CXTListViewBase@@UAEKXZ 0x5c6c10
?DisableColumnSizing@CXTListBase@@UAEX_N@Z 0x5c6c14
?HitTestEx@CXTListBase@@UBEHAAVCPoint@@PAH@Z 0x5c6c18
?AddColumn@CXTListBase@@UAEHPBDHH@Z 0x5c6c1c
?BuildColumns@CXTListBase@@UAE_NHPAHPAVCString@@@Z 0x5c6c20
?BuildColumns@CXTListBase@@UAE_NHPAH0@Z 0x5c6c24
?GetColumnCount@CXTListBase@@UAEHXZ 0x5c6c28
?CopyRow@CXTListBase@@UAEHHH@Z 0x5c6c2c
?MoveRow@CXTListBase@@UAE_NHH@Z 0x5c6c30
?SetRowColors@CXTListBase@@UAEXKK@Z 0x5c6c34
?SetRowColor@CXTListBase@@UAEXPAUROWCOLOR@1@@Z 0x5c6c38
?SetRowColor@CXTListBase@@UAEXHKK@Z 0x5c6c3c
?RemoveRowColors@CXTListBase@@UAEXXZ 0x5c6c40
?Lookup@CXTListBase@@UAEPAUROWCOLOR@1@H@Z 0x5c6c44
?ModifyExtendedStyle@CXTListBase@@UAEHKK@Z 0x5c6c48
?InitializeControl@CXTListBase@@MAEXXZ 0x5c6c4c
?OnNotifyImpl@CXTListBase@@MAEHIJPAJ@Z 0x5c6c50
?classCXTListView@CXTListView@@2UCRuntimeClass@@B 0x5c6c54
??0CXTFlatEdit@@QAE@XZ 0x5c6c58
??1CXTFlatEdit@@UAE@XZ 0x5c6c5c
??0CXTSortClass@@QAE@PAVCListCtrl@@H@Z 0x5c6c60
?Sort@CXTSortClass@@UAEX_NW4XTSortType@@@Z 0x5c6c64
??1CXTSortClass@@UAE@XZ 0x5c6c68
??1CXTHeaderCtrl@@UAE@XZ 0x5c6c6c
??0CXTListCtrl@@QAE@XZ 0x5c6c70
??0CXTHeaderCtrl@@QAE@XZ 0x5c6c74
??1CXTListCtrl@@UAE@XZ 0x5c6c78
?SetTipText@CXTHyperLink@@QAEXPBD@Z 0x5c6c7c
??0CXTHyperLink@@QAE@XZ 0x5c6c80
??1CXTHyperLink@@UAE@XZ 0x5c6c84
?GetItemWindow@CXTFlatTabCtrl@@QBEPAVCWnd@@H@Z 0x5c6c88
?SetItemText@CXTFlatTabCtrl@@QAE_NHPBD@Z 0x5c6c8c
?AutoSizeColumn@CXTListBase@@UAEXH@Z 0x5c6c90
??0CXTFlatTabCtrl@@QAE@XZ 0x5c6c94
?GetRuntimeClass@CXTFlatTabCtrl@@UBEPAUCRuntimeClass@@XZ 0x5c6c98
?GetMessageMap@CXTFlatTabCtrl@@MBEPBUAFX_MSGMAP@@XZ 0x5c6c9c
?Create@CXTFlatTabCtrl@@EAEHPBD0KABUtagRECT@@PAVCWnd@@IPAUCCreateContext@@@Z 0x5c6ca0
?GetScrollBarCtrl@CXTFlatTabCtrl@@UBEPAVCScrollBar@@H@Z 0x5c6ca4
?OnNotify@CXTFlatTabCtrl@@MAEHIJPAJ@Z 0x5c6ca8
?PreTranslateMessage@CXTFlatTabCtrl@@MAEHPAUtagMSG@@@Z 0x5c6cac
?SetTabFonts@CXTFlatTabCtrl@@UAEXPAVCFont@@0@Z 0x5c6cb0
?InsertItem@CXTFlatTabCtrl@@UAEHHPBDPAVCWnd@@@Z 0x5c6cb4
?InsertItem@CXTFlatTabCtrl@@UAEHHIPAVCWnd@@@Z 0x5c6cb8
?DeleteItem@CXTFlatTabCtrl@@UAEHH@Z 0x5c6cbc
?SaveColumnWidths@CXTListBase@@UAEXXZ 0x5c6cc0
?LoadColumnWidths@CXTListBase@@UAEXXZ 0x5c6cc4
?SetStoredWidth@CXTListBase@@UAEXH@Z 0x5c6cc8
?GetStoredWidth@CXTListBase@@UAEHH@Z 0x5c6ccc
?SetSortImage@CXTListBase@@UAEHHH@Z 0x5c6cd0
?OnNotify@CXTListViewBase@@MAEHIJPAJ@Z 0x5c6cd4
?PreSubclassWindow@CXTListViewBase@@MAEXXZ 0x5c6cd8
??0CXTListView@@QAE@XZ 0x5c6cdc
?SetPaneWidth@CXTPStatusBar@@QAEXHH@Z 0x5c6ce0
?SetTextSize@CXTPStatusBarLogoPane@@QAEXXZ 0x5c6ce4
?AddIndicator@CXTPStatusBar@@QAEHIH@Z 0x5c6ce8
?AddControl@CXTPStatusBar@@QAEHPAVCWnd@@IH@Z 0x5c6cec
?SetIndicators@CXTPStatusBar@@QAEHPBIH@Z 0x5c6cf0
?s_pInstance@CXTPPaintManager@@1PAV1@A 0x5c6cf4
?classCXTPCommandBars@CXTPCommandBars@@2UCRuntimeClass@@B 0x5c6cf8
?SetTheme@CXTPPaintManager@@SAXW4XTPPaintTheme@@@Z 0x5c6cfc
?SetSite@CXTPCommandBars@@QAEXPAVCWnd@@@Z 0x5c6d00
?EnableDocking@CXTPCommandBars@@QAEXXZ 0x5c6d04
?GetIconsInfo@CXTPPaintManager@@QAEPAUXTP_COMMANDBARS_ICONSINFO@@XZ 0x5c6d08
?SetMenu@CXTPCommandBars@@QAEPAVCXTPMenuBar@@VCString@@I@Z 0x5c6d0c
?SetFlags@CXTPCommandBar@@QAEXKK@Z 0x5c6d10
?EnableDocking@CXTPToolBar@@QAEXK@Z 0x5c6d14
?FindControl@CXTPControls@@QAEPAVCXTPControl@@H@Z 0x5c6d18
?Remove@CXTPControls@@QAEXH@Z 0x5c6d1c
?Add@CXTPCommandBars@@QAEPAVCXTPToolBar@@VCString@@W4XTPBarPosition@@PAUCRuntimeClass@@@Z 0x5c6d20
?s_managerInstance@CXTPImageManager@@0V1@A 0x5c6d24
?SetIcons@CXTPImageManager@@QAEHIW4XTPImageState@@@Z 0x5c6d28
?RedrawCommandBars@CXTPCommandBars@@QAEXXZ 0x5c6d2c
??0CXTPFontDC@@QAE@PAVCDC@@PAVCFont@@@Z 0x5c6d30
??1CXTPFontDC@@UAE@XZ 0x5c6d34
??0CXTSplitterWnd@@QAE@XZ 0x5c6d38
??0CXTCaption@@QAE@XZ 0x5c6d3c
??0CXTPDockingPaneManager@@QAE@XZ 0x5c6d40
??0CXTPStatusBarLogoPane@@QAE@XZ 0x5c6d44
?Instance@CXTPColorManager@@CAAAV1@XZ 0x5c6d48
?GetColor@CXTPColorManager@@QAEKH@Z 0x5c6d4c
??0CXTPStatusBar@@QAE@XZ 0x5c6d50
??1CXTSplitterWnd@@UAE@XZ 0x5c6d54
??1CXTCaption@@UAE@XZ 0x5c6d58
??1CXTPDockingPaneManager@@UAE@XZ 0x5c6d5c
??1CXTPStatusBarLogoPane@@UAE@XZ 0x5c6d60
??1CXTPStatusBar@@UAE@XZ 0x5c6d64
?GetRuntimeClass@CXTPStatusBarBasePane@@UBEPAUCRuntimeClass@@XZ 0x5c6d68
?GetMessageMap@CXTPStatusBarLogoPane@@MBEPBUAFX_MSGMAP@@XZ 0x5c6d6c
?Create@CXTPStatusBarBasePane@@EAEHPBD0KABUtagRECT@@PAVCWnd@@IPAUCCreateContext@@@Z 0x5c6d70
?Create@CXTPStatusBarBasePane@@UAEHPBDPAVCWnd@@KI@Z 0x5c6d74
?SetLogoText@CXTPStatusBarLogoPane@@UAEXPBD@Z 0x5c6d78
?GetLogoText@CXTPStatusBarLogoPane@@UAE?AVCString@@XZ 0x5c6d7c
?SetLogoFont@CXTPStatusBarLogoPane@@UAEXAAUtagLOGFONTA@@@Z 0x5c6d80
?DeleteAllItems@CXTFlatTabCtrl@@UAEHXZ 0x5c6d84
?GetItemRect@CXTFlatTabCtrl@@UAEHHPAUtagRECT@@@Z 0x5c6d88
?HitTest@CXTFlatTabCtrl@@UBEHPAUtagTCHITTESTINFO@@@Z 0x5c6d8c
?GetCurSel@CXTFlatTabCtrl@@UBEHXZ 0x5c6d90
?SetCurSel@CXTFlatTabCtrl@@UAEHH@Z 0x5c6d94
?GetItemCount@CXTFlatTabCtrl@@UBEHXZ 0x5c6d98
?SetTipText@CXTFlatTabCtrl@@UAEXHPBD@Z 0x5c6d9c
?GetTipText@CXTFlatTabCtrl@@UAE?AVCString@@H@Z 0x5c6da0
?Home@CXTFlatTabCtrl@@UAEXXZ 0x5c6da4
?Create@CXTFlatTabCtrl@@UAEHKABVCRect@@PAVCWnd@@I@Z 0x5c6da8
?ButtonHitTest@CXTFlatTabCtrl@@MBEHAAVCPoint@@@Z 0x5c6dac
?DrawTab@CXTFlatTabCtrl@@MAEHPAVCDC@@ABVCPoint@@_NPBD@Z 0x5c6db0
?_DeleteItem@CXTFlatTabCtrl@@MAEHH@Z 0x5c6db4
?GetOverlap@CXTFlatTabCtrl@@MBEHXZ 0x5c6db8
?CreateThemeFactory@CXTThemeManagerStyleHost@@MAEPAVCXTThemeManagerStyleFactory@@XZ 0x5c6dbc
?DelayLayoutParent@CXTPControl@@QAEXXZ 0x5c6dc0
?SetID@CXTPControl@@QAEXH@Z 0x5c6dc4
?CreateObject@CXTPControlButton@@SGPAVCObject@@XZ 0x5c6dc8
?XTAuxData@@YGAAVCXTAuxData@@XZ 0x5c6dcc
?PreTranslateFrameMessage@CXTPCommandBars@@QAEHPAUtagMSG@@@Z 0x5c6dd0
?classCXTPEdit@CXTPEdit@@2UCRuntimeClass@@B 0x5c6dd4
?SetLogoFont@CXTPStatusBarLogoPane@@UAEXPBDHHHH@Z 0x5c6dd8
?GetCaption@CXTPTabManagerItem@@QAE?AVCString@@XZ 0x5c6ddc
?DeleteItem@CXTPTabManager@@QAEHH@Z 0x5c6de0
?Create@CXTPTabControl@@QAEHKABUtagRECT@@PAVCWnd@@I@Z 0x5c6de4
?SetAppearance@CXTPTabPaintManager@@QAEPAVCAppearanceSet@1@W4XTPTabAppearanceStyle@@@Z 0x5c6de8
?SetPosition@CXTPTabPaintManager@@QAEXW4XTPTabPosition@@@Z 0x5c6dec
?GetHandle@CXTPTabManagerItem@@QAEPAUHWND__@@XZ 0x5c6df0
?OnFrameWndMsg@CXTPCommandBars@@QAEHIIJPAJ@Z 0x5c6df4
?OnSetPreviewMode@CXTPToolBar@@QAEXH@Z 0x5c6df8
?GetAt@CXTPCommandBars@@QAEPAVCXTPToolBar@@H@Z 0x5c6dfc
?SetCaption@CXTPTabManagerItem@@QAEXPBD@Z 0x5c6e00
?InsertItem@CXTPTabControl@@QAEPAVCXTPTabManagerItem@@HPBDPAUHWND__@@H@Z 0x5c6e04
??1CXTListView@@UAE@XZ 0x5c6e08
?messageMap@CXTListView@@1UAFX_MSGMAP@@B 0x5c6e0c
?SetMinSize@CXTHeaderCtrl@@QAEXH@Z 0x5c6e10
?GetFlatHeaderCtrl@CXTListBase@@QBEPAVCXTFlatHeaderCtrl@@XZ 0x5c6e14
?SetTheme@CXTThemeManagerStyleHost@@QAEXPAVCXTThemeManagerStyle@@@Z 0x5c6e18
?OnCreateImpl@CXTListBase@@IAEHPAUtagCREATESTRUCTA@@@Z 0x5c6e1c
?ShowTipWindow@CXTTipWindow@@UAEHABVCPoint@@KIIH@Z 0x5c6e20
?ShowTipWindow@CXTTipWindow@@UAEHABVCRect@@ABVCPoint@@KIIHH@Z 0x5c6e24
?Create@CXTTipWindow@@UAEHPAVCWnd@@@Z 0x5c6e28
?Create@CXTTipWindow@@EAEHPBD0KABUtagRECT@@PAVCWnd@@IPAUCCreateContext@@@Z 0x5c6e2c
?GetMessageMap@CXTTipWindow@@MBEPBUAFX_MSGMAP@@XZ 0x5c6e30
??0CXTTipWindow@@QAE@XZ 0x5c6e34
??1CXTTipWindow@@UAE@XZ 0x5c6e38
?SetTipText@CXTTipWindow@@QAEXPBD0H@Z 0x5c6e3c
??0CXTPTabControl@@QAE@XZ 0x5c6e40
??1CXTFlatTabCtrl@@UAE@XZ 0x5c6e44
??1CXTPTabControl@@UAE@XZ 0x5c6e48
?OnThemeChanged@CXTThemeManagerStyleHost@@MAEXXZ 0x5c6e4c
Function Address Souspicious Anti Debug
CoCreateInstance 0x5c6e94
CLSIDFromProgID 0x5c6e98
CLSIDFromString 0x5c6e9c
OleRun 0x5c6ea0
CoUninitialize 0x5c6ea4
CoInitialize 0x5c6ea8
Function Address Souspicious Anti Debug
CallWindowProcA 0x5c6aec
GetParent 0x5c6af0
GetSubMenu 0x5c6af4
GetCursorPos 0x5c6af8
LoadMenuA 0x5c6afc
EnableWindow 0x5c6b00
GetWindowRect 0x5c6b04
RedrawWindow 0x5c6b08
MessageBoxA 0x5c6b0c
IsWindow 0x5c6b10
GetClientRect 0x5c6b14
SetTimer 0x5c6b18
GetKeyboardState 0x5c6b1c
ScreenToClient 0x5c6b20
ClientToScreen 0x5c6b24
GetDlgCtrlID 0x5c6b28
InvalidateRect 0x5c6b2c
PtInRect 0x5c6b30
PostMessageA 0x5c6b34
GetKeyState 0x5c6b38
CloseClipboard 0x5c6b3c
SetClipboardData 0x5c6b40
EmptyClipboard 0x5c6b44
OpenClipboard 0x5c6b48
KillTimer 0x5c6b4c
PostThreadMessageA 0x5c6b50
PeekMessageA 0x5c6b54
SetCursor 0x5c6b58
GetSysColor 0x5c6b5c
GetDC 0x5c6b60
ReleaseDC 0x5c6b64
SetMenuDefaultItem 0x5c6b68
TrackPopupMenu 0x5c6b6c
GetMenuItemID 0x5c6b70
RegisterWindowMessageA 0x5c6b74
SetWindowLongA 0x5c6b78
SendMessageA 0x5c6b7c
GetFocus 0x5c6b80
DefWindowProcA 0x5c6b84
LoadCursorA 0x5c6b88
LoadIconA 0x5c6b8c
FindWindowA 0x5c6b90
IsIconic 0x5c6b94
ShowWindow 0x5c6b98
GetLastActivePopup 0x5c6b9c
SetForegroundWindow 0x5c6ba0
UpdateWindow 0x5c6ba4
Function Address Souspicious Anti Debug
WSACleanup 0x5c6bc4
WSAGetLastError 0x5c6bc8
gethostbyname 0x5c6bcc
socket 0x5c6bd0
shutdown 0x5c6bd4
listen 0x5c6bd8
setsockopt 0x5c6bdc
gethostname 0x5c6be0
WSASetLastError 0x5c6be4
ioctlsocket 0x5c6be8
bind 0x5c6bec
htons 0x5c6bf0
htonl 0x5c6bf4
connect 0x5c6bf8
closesocket 0x5c6bfc

PE Exports 277 suspicious

Function Address
??0CAdoCommand@@QAE@ABV0@@Z 0x401830
??0CAdoCommand@@QAE@PAVCAdoConnection@@VCString@@W4CommandTypeEnum@ADODB@@@Z 0x4e0d60
??0CAdoCommand@@QAE@XZ 0x4e0c30
??0CAdoConnection@@QAE@ABV0@@Z 0x401980
??0CAdoConnection@@QAE@XZ 0x4debd0
??0CAdoRecordSet@@QAE@ABV0@@Z 0x401690
??0CAdoRecordSet@@QAE@PAVCAdoConnection@@@Z 0x4e27c0
??0CAdoRecordSet@@QAE@XZ 0x4e2670
??0CClientInfo@@QAE@XZ 0x401a90
??0CClientObject@@QAE@H@Z 0x4e9af0
??0CClientSock@@QAE@XZ 0x4e9ee0
??0CDBConnCollect@@QAE@XZ 0x4dcb20
??0CListenObject@@QAE@ABV0@@Z 0x401b20
??0CListenObject@@QAE@H@Z 0x4ea9c0
??0CListenSock@@QAE@XZ 0x4ea9f0
??0CRWConfig@@QAE@PAD@Z 0x4eef30
??0CRWReg@@QAE@PAD_N@Z 0x4ef1c0
??0CSslClientSocket@@QAE@XZ 0x4f1680
??1CAdoCommand@@UAE@XZ 0x4e0ed0
??1CAdoConnection@@UAE@XZ 0x4ded00
??1CAdoRecordSet@@UAE@XZ 0x4e2920
??1CClientInfo@@QAE@XZ 0x401ad0
??1CClientObject@@UAE@XZ 0x4e9c30
??1CClientSock@@UAE@XZ 0x4e9f60
??1CDBConnCollect@@QAE@XZ 0x4dcb40
??1CListenObject@@UAE@XZ 0x4ea9e0
??1CListenSock@@UAE@XZ 0x4eaa70
??1CRWConfig@@QAE@XZ 0x42c710
??1CRWReg@@QAE@XZ 0x4ef220
??1CSslClientSocket@@UAE@XZ 0x4f1770
??4CAdoCommand@@QAEAAV0@ABV0@@Z 0x4018b0
??4CAdoConnection@@QAEAAV0@ABV0@@Z 0x4019f0
??4CAdoRecordSet@@QAE?AV?$_com_ptr_t@V?$_com_IIID@U_Recordset@ADODB@@$1?_GUID_00000556_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@AAV1@@Z 0x4e8e50
??4CAdoRecordSet@@QAEAAV0@ABV0@@Z 0x401750
??4CClientInfo@@QAEAAV0@ABV0@@Z 0x401ae0
??4CListenObject@@QAEAAV0@ABV0@@Z 0x401b40
??4CRWConfig@@QAEAAV0@ABV0@@Z 0x4987d0
??4CRWReg@@QAEAAV0@ABV0@@Z 0x411b10
??ACAdoCommand@@QAE?AVCAdoParameter@@H@Z 0x4e20f0
??ACAdoCommand@@QAE?AVCAdoParameter@@PBD@Z 0x4e2270
??_7CAdoCommand@@6B@ 0x5c7098
??_7CAdoConnection@@6B@ 0x5c709c
??_7CAdoRecordSet@@6B@ 0x5c7094
??_7CClientObject@@6B@ 0x5d14e4
??_7CClientSock@@6B@ 0x5d150c
??_7CListenObject@@6B@ 0x5c70a0
??_7CListenSock@@6B@ 0x5d16a0
??_7CSslClientSocket@@6B@ 0x5d1768
??_FCClientObject@@QAEXXZ 0x401b10
?AddNew@CAdoRecordSet@@QAEHAAVCADORecordBinding@@@Z 0x4e9a50
?AddNew@CAdoRecordSet@@QAEHXZ 0x4e3270
?Append@CAdoCommand@@QAEHV?$_com_ptr_t@V?$_com_IIID@U_Parameter@ADODB@@$1?_GUID_0000050c_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@@Z 0x4e1980
?AppendChunk@CAdoRecordSet@@QAEHJPAXI@Z 0x4e87c0
?AppendChunk@CAdoRecordSet@@QAEHJPBD@Z 0x4e8840
?AppendChunk@CAdoRecordSet@@QAEHPBD0@Z 0x4e8920
?AppendChunk@CAdoRecordSet@@QAEHPBDPAXI@Z 0x4e8800
?AppendChunk@CAdoRecordSet@@QAEHV?$_com_ptr_t@V?$_com_IIID@UField@ADODB@@$1?_GUID_00000569_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@PAXI@Z 0x4e8660
?BeginTrans@CAdoConnection@@QAEJXZ 0x4e09c0
?Cancel@CAdoCommand@@QAEHXZ 0x4e10f0
?Cancel@CAdoConnection@@QAEHXZ 0x4df5f0
?Cancel@CAdoRecordSet@@QAEHXZ 0x4e30b0
?CancelBatch@CAdoRecordSet@@QAEHW4AffectEnum@ADODB@@@Z 0x4e3630
?CancelUpdate@CAdoRecordSet@@QAEHXZ 0x4e3570
?CheckTimeout@CClientObject@@QAE_NH@Z 0x4e9d50
?Clone@CAdoRecordSet@@QAEHAAV1@@Z 0x4e9500
?Close@CAdoConnection@@QAEXXZ 0x4df370
?Close@CAdoRecordSet@@QAEXXZ 0x4e3160
?CloseSock@CClientObject@@UAEXPADH@Z 0x55d620
?CloseTimer@CClientObject@@QAEXXZ 0x4e9d40
?CommitTrans@CAdoConnection@@QAEHXZ 0x4e0a70
?Connect@CClientSock@@UAEHPBDI@Z 0x4ea010
?Connect@CSslClientSocket@@UAEHPBDI@Z 0x4f2280
?ConnectAccess@CAdoConnection@@QAEHVCString@@0J@Z 0x4df1f0
?ConnectSQLServer@CAdoConnection@@QAEHVCString@@000J@Z 0x4df070
?CreateParameter@CAdoCommand@@QAE?AV?$_com_ptr_t@V?$_com_IIID@U_Parameter@ADODB@@$1?_GUID_0000050c_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@PBDW4DataTypeEnum@ADODB@@W4ParameterDirectionEnum@4@JV_variant_t@@@Z 0x4e11a0
?CreateSock@CClientObject@@QAEXXZ 0x4e9e80
?Delete@CAdoRecordSet@@QAEHW4AffectEnum@ADODB@@@Z 0x4e36f0
?Execute@CAdoCommand@@QAE?AV?$_com_ptr_t@V?$_com_IIID@U_Recordset@ADODB@@$1?_GUID_00000556_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@J@Z 0x4e0fd0
?Execute@CAdoConnection@@QAE?AV?$_com_ptr_t@V?$_com_IIID@U_Recordset@ADODB@@$1?_GUID_00000556_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@PBDJ@Z 0x4df460
?Execute@CDBConnCollect@@QAE?AV?$_com_ptr_t@V?$_com_IIID@U_Recordset@ADODB@@$1?_GUID_00000556_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@PADPBD@Z 0x4dcf20
?Find@CAdoRecordSet@@QAEHPBDW4SearchDirectionEnum@ADODB@@@Z 0x4e9630
?FindNext@CAdoRecordSet@@QAEHXZ 0x4e9890
?GetAbsolutePage@CAdoRecordSet@@QAEJXZ 0x4e4640
?GetAbsolutePosition@CAdoRecordSet@@QAEJXZ 0x4e4760
?GetArrayInt@CRWConfig@@QAEHPAD0H@Z 0x4ef130
?GetArrayString@CRWConfig@@QAEPADPAD0H@Z 0x4ef050
?GetArrayString@CRWConfig@@QAEPADPAD0HH@Z 0x4ef090
?GetBookmark@CAdoRecordSet@@QAE?AV_variant_t@@XZ 0x4e9220
?GetBool@CRWConfig@@QAE_NPAD0@Z 0x4ef030
?GetChunk@CAdoRecordSet@@QAEHJAAVCBitmap@@@Z 0x4e8c90
?GetChunk@CAdoRecordSet@@QAEHJPAX@Z 0x4e8c10
?GetChunk@CAdoRecordSet@@QAEHPBDAAVCBitmap@@@Z 0x4e8d00
?GetChunk@CAdoRecordSet@@QAEHPBDPAX@Z 0x4e8c50
?GetChunk@CAdoRecordSet@@QAEHV?$_com_ptr_t@V?$_com_IIID@UField@ADODB@@$1?_GUID_00000569_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@PAX@Z 0x4e8a00
?GetCollect@CAdoRecordSet@@QAEHJAAE@Z 0x4e7380
?GetCollect@CAdoRecordSet@@QAEHJAAF@Z 0x4e7580
?GetCollect@CAdoRecordSet@@QAEHJAAH@Z 0x4e7790
?GetCollect@CAdoRecordSet@@QAEHJAAJ@Z 0x4e79a0
?GetCollect@CAdoRecordSet@@QAEHJAAK@Z 0x4e7bb0
?GetCollect@CAdoRecordSet@@QAEHJAAM@Z 0x4e7e60
?GetCollect@CAdoRecordSet@@QAEHJAAN@Z 0x4e8160
?GetCollect@CAdoRecordSet@@QAEHJAAVCOleCurrency@@@Z 0x4e6f60
?GetCollect@CAdoRecordSet@@QAEHJAAVCOleDateTime@@@Z 0x4e6cb0
?GetCollect@CAdoRecordSet@@QAEHJAAVCString@@@Z 0x4e8370
?GetCollect@CAdoRecordSet@@QAEHJAA_N@Z 0x4e7180
?GetCollect@CAdoRecordSet@@QAEHPBDAAE@Z 0x4e7470
?GetCollect@CAdoRecordSet@@QAEHPBDAAF@Z 0x4e7680
?GetCollect@CAdoRecordSet@@QAEHPBDAAH@Z 0x4e7890
?GetCollect@CAdoRecordSet@@QAEHPBDAAJ@Z 0x4e7aa0
?GetCollect@CAdoRecordSet@@QAEHPBDAAK@Z 0x4e7d00
?GetCollect@CAdoRecordSet@@QAEHPBDAAM@Z 0x4e7fe0
?GetCollect@CAdoRecordSet@@QAEHPBDAAN@Z 0x4e8260
?GetCollect@CAdoRecordSet@@QAEHPBDAAVCOleCurrency@@@Z 0x4e7060
?GetCollect@CAdoRecordSet@@QAEHPBDAAVCOleDateTime@@@Z 0x4e6e40
?GetCollect@CAdoRecordSet@@QAEHPBDAAVCString@@@Z 0x4e84e0
?GetCollect@CAdoRecordSet@@QAEHPBDAA_N@Z 0x4e7270
?GetCommand@CAdoCommand@@QAEAAV?$_com_ptr_t@V?$_com_IIID@U_Command@ADODB@@$1?_GUID_b08400bd_f9d1_4d02_b856_71d5dba123e9@@3U__s_GUID@@A@@@@XZ 0x4e20e0
?GetConnByName@CDBConnCollect@@QAEPAVCCSConnection@@PAD@Z 0x4dced0
?GetConnectTimeOut@CAdoConnection@@QAEJXZ 0x4dfe50
?GetConnection@CAdoConnection@@QAEAAV?$_com_ptr_t@V?$_com_IIID@U_Connection@ADODB@@$1?_GUID_00000550_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@XZ 0x401950
?GetConnection@CAdoRecordSet@@QAEPAVCAdoConnection@@XZ 0x401680
?GetConnectionText@CAdoConnection@@QAE?AVCString@@XZ 0x401960
?GetCursorLocation@CAdoRecordSet@@QAE?AW4CursorLocationEnum@ADODB@@XZ 0x4e48b0
?GetCursorType@CAdoRecordSet@@QAE?AW4CursorTypeEnum@ADODB@@XZ 0x4e4a30
?GetDefaultDatabase@CAdoConnection@@QAE?AVCString@@XZ 0x4dffc0
?GetEditMode@CAdoRecordSet@@QAE?AW4EditModeEnum@ADODB@@XZ 0x4e4310
?GetError@CAdoConnection@@QAE?AV?$_com_ptr_t@V?$_com_IIID@UError@ADODB@@$1?_GUID_00000500_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@J@Z 0x4dfcf0
?GetErrors@CAdoConnection@@QAE?AV?$_com_ptr_t@V?$_com_IIID@UErrors@ADODB@@$1?_GUID_00000501_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@XZ 0x4dfc20
?GetField@CAdoRecordSet@@QAE?AV?$_com_ptr_t@V?$_com_IIID@UField@ADODB@@$1?_GUID_00000569_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@J@Z 0x4e5c20
?GetField@CAdoRecordSet@@QAE?AV?$_com_ptr_t@V?$_com_IIID@UField@ADODB@@$1?_GUID_00000569_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@PBD@Z 0x4e5d30
?GetFieldActualSize@CAdoRecordSet@@QAEJJ@Z 0x4e53b0
?GetFieldActualSize@CAdoRecordSet@@QAEJPBD@Z 0x4e5500
?GetFieldAttributes@CAdoRecordSet@@QAEJJ@Z 0x4e4e50
?GetFieldAttributes@CAdoRecordSet@@QAEJPBD@Z 0x4e4fa0
?GetFieldDefineSize@CAdoRecordSet@@QAEJJ@Z 0x4e5100
?GetFieldDefineSize@CAdoRecordSet@@QAEJPBD@Z 0x4e5250
?GetFieldName@CAdoRecordSet@@QAE?AVCString@@J@Z 0x4e4b90
?GetFieldType@CAdoRecordSet@@QAE?AW4DataTypeEnum@ADODB@@J@Z 0x4e5660
?GetFieldType@CAdoRecordSet@@QAE?AW4DataTypeEnum@ADODB@@PBD@Z 0x4e57b0
?GetFields@CAdoRecordSet@@QAE?AV?$_com_ptr_t@V?$_com_IIID@UFields@ADODB@@$1?_GUID_00000564_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@XZ 0x4e4ae0
?GetFieldsCount@CAdoRecordSet@@QAEJXZ 0x4e3f70
?GetInt@CRWConfig@@QAEHPAD0@Z 0x4eefb0
?GetLastError@CAdoRecordSet@@QAE?AVCString@@XZ 0x4e94e0
?GetLastErrorText@CAdoConnection@@QAE?AVCString@@XZ 0x4df6a0
?GetMaxRecordCount@CAdoRecordSet@@QAEJXZ 0x4e4040
?GetMode@CAdoConnection@@QAE?AW4ConnectModeEnum@ADODB@@XZ 0x4e0700
?GetPageCount@CAdoRecordSet@@QAEJXZ 0x4e43f0
?GetPageSize@CAdoRecordSet@@QAEJXZ 0x4e4520
?GetParameter@CAdoCommand@@QAE?AV?$_com_ptr_t@V?$_com_IIID@U_Parameter@ADODB@@$1?_GUID_0000050c_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@J@Z 0x4e1c40
?GetParameters@CAdoCommand@@QAE?AV?$_com_ptr_t@V?$_com_IIID@UParameters@ADODB@@$1?_GUID_0000050d_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@XZ 0x4e1870
?GetParamter@CAdoCommand@@QAE?AV?$_com_ptr_t@V?$_com_IIID@U_Parameter@ADODB@@$1?_GUID_0000050c_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@PBD@Z 0x4e1a90
?GetProviderName@CAdoConnection@@QAE?AVCString@@XZ 0x4e01b0
?GetRecordCount@CAdoRecordSet@@QAEJXZ 0x4e3e10
?GetRecordset@CAdoRecordSet@@QAEAAV?$_com_ptr_t@V?$_com_IIID@U_Recordset@ADODB@@$1?_GUID_00000556_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@XZ 0x4e94d0
?GetSQLText@CAdoRecordSet@@QAE?AVCString@@XZ 0x401650
?GetState@CAdoCommand@@QAEJXZ 0x4e1700
?GetState@CAdoConnection@@QAEJXZ 0x4e0590
?GetState@CAdoRecordSet@@QAEJXZ 0x4e3c20
?GetStatus@CAdoRecordSet@@QAEJXZ 0x4e3d60
?GetString@CRWConfig@@QAEPADPAD0@Z 0x4eef60
?GetValue@CAdoCommand@@QAE?AV_variant_t@@J@Z 0x4e1d60
?GetValue@CAdoCommand@@QAE?AV_variant_t@@PBD@Z 0x4e1f30
?GetVersion@CAdoConnection@@QAE?AVCString@@XZ 0x4e03a0
?Init@CDBConnCollect@@QAE_NXZ 0x4dcba0
?IsBOF@CAdoRecordSet@@QAEHXZ 0x4e41b0
?IsEOF@CAdoRecordSet@@QAEHXZ 0x4e4260
?IsFieldNull@CAdoRecordSet@@QAEHJ@Z 0x4e5ae0
?IsFieldNull@CAdoRecordSet@@QAEHPBD@Z 0x4e5910
?IsOpen@CAdoConnection@@QAEHXZ 0x4e0640
?IsOpen@CAdoRecordSet@@QAEHXZ 0x4e3cd0
?Load@CAdoRecordSet@@QAEHPBD@Z 0x4e2f40
?LoadCert@CSslClientSocket@@IAEPAUx509_st@@PADH0@Z 0x4f18a0
?LoadKey@CSslClientSocket@@IAEPAUevp_pkey_st@@PADH00@Z 0x4f1a10
?Move@CAdoRecordSet@@QAEHJV_variant_t@@@Z 0x4e3ab0
?MoveFirst@CAdoRecordSet@@QAEHXZ 0x4e37b0
?MoveLast@CAdoRecordSet@@QAEHXZ 0x4e3870
?MoveNext@CAdoRecordSet@@QAEHXZ 0x4e39f0
?MovePrevious@CAdoRecordSet@@QAEHXZ 0x4e3930
?OnAccept@CListenSock@@UAEXH@Z 0x4eaa80
?OnClose@CClientSock@@UAEXH@Z 0x4e9ff0
?OnClose@CListenSock@@UAEXH@Z 0x58cd60
?OnClose@CSslClientSocket@@UAEXH@Z 0x4f23d0
?OnConnect@CClientSock@@UAEXH@Z 0x4e9fa0
?OnReceive@CClientSock@@UAEXH@Z 0x4e9fe0
?OnReceive@CSslClientSocket@@UAEXH@Z 0x4f2210
?OnSend@CClientSock@@UAEXH@Z 0x4ea030
?OnTimer@CClientObject@@UAEXXZ 0x401ad0
?Open@CAdoConnection@@QAEHPBDJ@Z 0x4ded70
?Open@CAdoRecordSet@@QAEHPBDJW4CursorTypeEnum@ADODB@@W4LockTypeEnum@3@@Z 0x4e29c0
?OpenSchema@CAdoConnection@@QAE?AV?$_com_ptr_t@V?$_com_IIID@U_Recordset@ADODB@@$1?_GUID_00000556_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@W4SchemaEnum@ADODB@@@Z 0x4e0870
?OpenUDLFile@CAdoConnection@@QAEHPBDJ@Z 0x4df2f0
?PutCollect@CAdoRecordSet@@QAEHJABE@Z 0x4e61d0
?PutCollect@CAdoRecordSet@@QAEHJABF@Z 0x4e62d0
?PutCollect@CAdoRecordSet@@QAEHJABH@Z 0x4e63d0
?PutCollect@CAdoRecordSet@@QAEHJABJ@Z 0x4e64d0
?PutCollect@CAdoRecordSet@@QAEHJABK@Z 0x4e65d0
?PutCollect@CAdoRecordSet@@QAEHJABM@Z 0x4e66f0
?PutCollect@CAdoRecordSet@@QAEHJABN@Z 0x4e67f0
?PutCollect@CAdoRecordSet@@QAEHJABVCOleCurrency@@@Z 0x4e6a10
?PutCollect@CAdoRecordSet@@QAEHJABVCOleDateTime@@@Z 0x4e68f0
?PutCollect@CAdoRecordSet@@QAEHJABVCString@@@Z 0x4e6b70
?PutCollect@CAdoRecordSet@@QAEHJABV_variant_t@@@Z 0x4e5e60
?PutCollect@CAdoRecordSet@@QAEHJAB_N@Z 0x4e60d0
?PutCollect@CAdoRecordSet@@QAEHPBDABE@Z 0x4e6250
?PutCollect@CAdoRecordSet@@QAEHPBDABF@Z 0x4e6350
?PutCollect@CAdoRecordSet@@QAEHPBDABH@Z 0x4e6450
?PutCollect@CAdoRecordSet@@QAEHPBDABJ@Z 0x4e6550
?PutCollect@CAdoRecordSet@@QAEHPBDABK@Z 0x4e6660
?PutCollect@CAdoRecordSet@@QAEHPBDABM@Z 0x4e6770
?PutCollect@CAdoRecordSet@@QAEHPBDABN@Z 0x4e6870
?PutCollect@CAdoRecordSet@@QAEHPBDABVCOleCurrency@@@Z 0x4e6ac0
?PutCollect@CAdoRecordSet@@QAEHPBDABVCOleDateTime@@@Z 0x4e6980
?PutCollect@CAdoRecordSet@@QAEHPBDABVCString@@@Z 0x4e6c10
?PutCollect@CAdoRecordSet@@QAEHPBDABV_variant_t@@@Z 0x4e5f80
?PutCollect@CAdoRecordSet@@QAEHPBDAB_N@Z 0x4e6150
?ReadInt@CRWReg@@QAEHPAD@Z 0x4ef240
?ReadString@CRWReg@@QAE?AVCString@@PADH@Z 0x4ef300
?ReadString@CRWReg@@QAEPADPAD@Z 0x4ef2a0
?Receive@CSslClientSocket@@UAEHPAXHH@Z 0x4f2260
?RecordBinding@CAdoRecordSet@@QAEHAAVCADORecordBinding@@@Z 0x4e9990
?Release@CAdoCommand@@IAEXXZ 0x4e0f40
?Release@CAdoConnection@@IAEXXZ 0x4df420
?Release@CAdoRecordSet@@IAEXXZ 0x4e3220
?Release@CDBConnCollect@@QAEXXZ 0x4dce80
?Requery@CAdoRecordSet@@QAEHJ@Z 0x4e2ba0
?RestoreID@CClientObject@@QAEXPAEH_NH1@Z 0x4e9e00
?Resync@CAdoRecordSet@@QAEHW4AffectEnum@ADODB@@W4ResyncEnum@3@@Z 0x4e2c60
?RollbackTrans@CAdoConnection@@QAEHXZ 0x4e0b20
?SSlConnect@CSslClientSocket@@QAEHPAD@Z 0x4f1ff0
?SSlReceive@CSslClientSocket@@QAEHPADH@Z 0x4f2180
?SSlSend@CSslClientSocket@@QAEHPADH@Z 0x4f20a0
?SSlShouDown@CSslClientSocket@@QAEXXZ 0x4f2050
?Save@CAdoRecordSet@@QAEHPBDW4PersistFormatEnum@ADODB@@@Z 0x4e2d20
?SaveID@CClientObject@@QAEXPAEH_N1@Z 0x4e9d80
?Send@CClientObject@@QAEHPAXH@Z 0x4e9d10
?Send@CClientSock@@UAEHPAXH@Z 0x4e9fc0
?Send@CSslClientSocket@@UAEHPAXH@Z 0x4f2240
?SetAbsolutePage@CAdoRecordSet@@QAEHH@Z 0x4e45b0
?SetAbsolutePosition@CAdoRecordSet@@QAEHH@Z 0x4e46d0
?SetAdoConnection@CAdoRecordSet@@QAEXPAVCAdoConnection@@@Z 0x4e94c0
?SetArrayInt@CRWConfig@@QAEXPAD0HH@Z 0x4ef170
?SetArrayString@CRWConfig@@QAEXPAD0H0@Z 0x4ef0e0
?SetBookmark@CAdoRecordSet@@QAEHV_variant_t@@@Z 0x4e9390
?SetBool@CRWConfig@@QAEXPAD0_N@Z 0x4ef010
?SetCacheSize@CAdoRecordSet@@QAEHABJ@Z 0x4e4480
?SetCommandText@CAdoCommand@@QAEHPBD@Z 0x4e13a0
?SetCommandTimeOut@CAdoCommand@@QAEHJ@Z 0x4e17b0
?SetCommandType@CAdoCommand@@QAEHW4CommandTypeEnum@ADODB@@@Z 0x4e1640
?SetConnectTimeOut@CAdoConnection@@QAEHJ@Z 0x4dff00
?SetConnection@CAdoCommand@@QAEHPAVCAdoConnection@@@Z 0x4e1540
?SetCursorLocation@CAdoRecordSet@@QAEHW4CursorLocationEnum@ADODB@@@Z 0x4e47f0
?SetCursorType@CAdoRecordSet@@QAEHW4CursorTypeEnum@ADODB@@@Z 0x4e4970
?SetFilter@CAdoRecordSet@@QAEHPBD@Z 0x4e8f70
?SetInt@CRWConfig@@QAEXPAD0H@Z 0x4eefd0
?SetMaxRecordCount@CAdoRecordSet@@QAEHJ@Z 0x4e40f0
?SetMode@CAdoConnection@@QAEHW4ConnectModeEnum@ADODB@@@Z 0x4e07b0
?SetRecordset@CAdoRecordSet@@QAEXV?$_com_ptr_t@V?$_com_IIID@U_Recordset@ADODB@@$1?_GUID_00000556_0000_0010_8000_00aa006d2ea4@@3U__s_GUID@@A@@@@@Z 0x4e3f00
?SetSQLText@CAdoRecordSet@@QAEXPBD@Z 0x401670
?SetServer@CClientObject@@QAEXPADH_N@Z 0x4e9cc0
?SetSort@CAdoRecordSet@@QAEHPBD@Z 0x4e9080
?SetString@CRWConfig@@QAEXPAD00@Z 0x4eef90
?SetType@CClientObject@@QAEXW4ENUM_OBJECT_TYPE@1@@Z 0x401b00
?SockConnect@CSslClientSocket@@QAEHPAUssl_method_st@@PADH1H11PBDI1@Z 0x4f1b40
?Start@CClientObject@@UAE_NXZ 0x4d77b0
?Start@CListenObject@@UAE_NXZ 0x4d77b0
?StartTimer@CClientObject@@QAEXXZ 0x4e9d30
?Stop@CClientObject@@UAE_NXZ 0x4e9d00
?Stop@CListenObject@@UAE_NXZ 0x4d77b0
?Supports@CAdoRecordSet@@QAEHW4CursorOptionEnum@ADODB@@@Z 0x4e8ed0
?Update@CAdoRecordSet@@QAEHXZ 0x4e3380
?UpdateBatch@CAdoRecordSet@@QAEHW4AffectEnum@ADODB@@@Z 0x4e34b0
?WaitforAbortRecv@CSslClientSocket@@QAEXXZ 0x4f23f0
?WaitforAbortSend@CSslClientSocket@@QAEXXZ 0x4f23e0
?WriteInt@CRWReg@@QAEXPADH@Z 0x4ef3f0
?WriteString@CRWReg@@QAEXPAD0@Z 0x4ef410
?load_cert@CSslClientSocket@@IAEPAUx509_st@@PAUbio_st@@HPAD1@Z 0x4f17f0
?load_key@CSslClientSocket@@IAEPAUevp_pkey_st@@PAUbio_st@@HPAD1@Z 0x4f1960