.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ---- -------------.
! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV !
`-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
ATM MALWARE NOTICE
c5b43b02a62d424a4e8a63b23bef8b022c08a889a15a6ad7f5bf1fd4fe73291f
Date...........: 2016-08-02
Family.........: ATMSpitter
File name......: ATMSpitter v2_1
File size......: 52.50 KB
Type file......: EXE/Windows
Virscan........: VT - HA
Documentation..: https://usa.visa.com/dam/VCOM/global/partner-with-us/documents/visa-technical-analysis-atm-jackpottingmalware.pdf
Additional note: ATMSpitter v2 XFS, Date check (2017) at 0x40996B (fill with NOP's) and 0x409972
(replace JE by JMP)
Entropy:
Binary Histogram:
=== SCREENSHOT ===
=== PEDUMP REPORT ===
=== MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 128 0x80
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 8 8
TimeDateStamp: "2016-11-19 16:56:05"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 783 0x30f RELOCS_STRIPPED, EXECUTABLE_IMAGE
LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED
32BIT_MACHINE, DEBUG_STRIPPED
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 2.23
SizeOfCode: 37888 0x9400
SizeOfInitializedData: 52736 0xce00
SizeOfUninitializedData: 3072 0xc00
AddressOfEntryPoint: 5488 0x1570
BaseOfCode: 4096 0x1000
BaseOfData: 45056 0xb000
ImageBase: 4194304 0x400000
SectionAlignment: 4096 0x1000
FileAlignment: 512 0x200
OperatingSystemVersion: 4.0
ImageVersion: 1.0
SubsystemVersion: 4.0
Reserved1: 0 0
SizeOfImage: 81920 0x14000
SizeOfHeaders: 1024 0x400
CheckSum: 81974 0x14036
Subsystem: 3 3 WINDOWS_CUI
DllCharacteristics: 0 0
SizeOfStackReserve: 2097152 0x200000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 0 size:0x 0
IMPORT rva:0x 11000 size:0x 88c
RESOURCE rva:0x 0 size:0x 0
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x 0 size:0x 0
DEBUG rva:0x 0 size:0x 0
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 13000 size:0x 18
LOAD_CONFIG rva:0x 0 size:0x 0
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x 111cc size:0x 140
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 0 size:0x 0
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 1000 93b4 9400 400 0 0 0 0 60500060 R-X CODE IDATA
.data b000 28 200 9800 0 0 0 0 c0300040 RW- IDATA
.rdata c000 1244 1400 9a00 0 0 0 0 40600040 R-- IDATA
.eh_fram e000 152c 1600 ae00 0 0 0 0 40300040 R-- IDATA
.bss 10000 a30 0 0 0 0 0 0 c0600080 RW- UDATA
.idata 11000 88c a00 c400 0 0 0 0 c0300040 RW- IDATA
.CRT 12000 18 200 ce00 0 0 0 0 c0300040 RW- IDATA
.tls 13000 20 200 d000 0 0 0 0 c0300040 RW- IDATA
=== TLS ===
RAW_START RAW_END INDEX CALLBKS ZEROFILL FLAGS
413019 41301c 41002c 412004 0 0
[?] can't find file_offset of VA 0x1002c
=== IMPORTS ===
MODULE_NAME HINT ORD FUNCTION_NAME
kernel32.dll 52 CloseHandle
kernel32.dll 87 CreateFileA
kernel32.dll cf DeleteCriticalSection
kernel32.dll ec EnterCriticalSection
kernel32.dll 117 ExitProcess
kernel32.dll 184 GetCommandLineA
kernel32.dll 1ec GetFileSize
kernel32.dll 1fe GetLastError
kernel32.dll 211 GetModuleHandleA
kernel32.dll 241 GetProcAddress
kernel32.dll 273 GetSystemTime
kernel32.dll 2de InitializeCriticalSection
kernel32.dll 2e8 InterlockedExchange
kernel32.dll 2fb IsDBCSLeadByteEx
kernel32.dll 32e LeaveCriticalSection
kernel32.dll 35c MultiByteToWideChar
kernel32.dll 3b3 ReadFile
kernel32.dll 436 SetFilePointer
kernel32.dll 474 SetUnhandledExceptionFilter
kernel32.dll 480 Sleep
kernel32.dll 495 TlsGetValue
kernel32.dll 4bd VirtualProtect
kernel32.dll 4bf VirtualQuery
kernel32.dll 4df WideCharToMultiByte
kernel32.dll 4f3 WriteFile
kernel32.dll 51b lstrlenA
msvcrt.dll 50 _strdup
msvcrt.dll 52 _stricoll
msvcrt.dll 3b __getmainargs
msvcrt.dll 46 __mb_cur_max
msvcrt.dll 52 __p__environ
msvcrt.dll 54 __p__fmode
msvcrt.dll 69 __set_app_type
msvcrt.dll 9a _cexit
msvcrt.dll c0 _errno
msvcrt.dll d7 _findclose
msvcrt.dll d8 _findfirst
msvcrt.dll de _findnext
msvcrt.dll fe _fullpath
msvcrt.dll 128 _iob
msvcrt.dll 1a1 _onexit
msvcrt.dll 1d2 _setmode
msvcrt.dll 27f abort
msvcrt.dll 286 atexit
msvcrt.dll 288 atoi
msvcrt.dll 28b calloc
msvcrt.dll 2a4 fputc
msvcrt.dll 2a9 free
msvcrt.dll 2b1 fwrite
msvcrt.dll 2b5 getenv
msvcrt.dll 2c4 isspace
msvcrt.dll 2d7 localeconv
msvcrt.dll 2dc malloc
msvcrt.dll 2de mbstowcs
msvcrt.dll 2e2 memcpy
msvcrt.dll 2f2 realloc
msvcrt.dll 2f8 setlocale
msvcrt.dll 2fa signal
msvcrt.dll 302 strchr
msvcrt.dll 303 strcmp
msvcrt.dll 304 strcoll
msvcrt.dll 309 strlen
msvcrt.dll 30c strncpy
msvcrt.dll 31e tolower
msvcrt.dll 324 vfprintf
msvcrt.dll 331 wcslen
msvcrt.dll 33c wcstombs
user32.dll 280 wvsprintfA
MSXFS.dll 22 WFSStartUp
MSXFS.dll 1f WFSOpen
MSXFS.dll 19 WFSExecute
MSXFS.dll 15 WFSClose
MSXFS.dll 14 WFSCleanUp
MSXFS.dll 1b WFSGetInfo
MSXFS.dll 1a WFSFreeResult
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
000000000178 000000400178 0 .text
0000000001A0 0000004001A0 0 .data
0000000001C8 0000004001C8 0 .rdata
0000000001EF 0000004001EF 0 @.eh_fram,
000000000216 000000400216 0 0@.bss
000000000240 000000400240 0 .idata
000000000D42 000000401942 0 SUBKf
000000000D7D 00000040197D 0 VALUf
000000000DBA 0000004019BA 0 EMPTf
000000000DF1 0000004019F1 0 _LONf
000000000E2A 000000401A2A 0 ITEMf
000000000E61 000000401A61 0 O_LOf
000000000E95 000000401A95 0 READf
000000000EC5 000000401AC5 0 _ERRf
000000000EF9 000000401AF9 0 _ERRf
000000000F6A 000000401B6A 0 HANDf
000000000FA3 000000401BA3 0 BUFFf
0000000010AC 000000401CAC 0 VIDEf
000000001173 000000401D73 0 REQ_f
0000000011A7 000000401DA7 0 RESUf
000000001213 000000401E13 0 TIMEf
00000000124A 000000401E4A 0 ELEVf
000000001275 000000401E75 0 LOCKf
000000001303 000000401F03 0 THREf
000000001354 000000401F54 0 LOCKf
0000000013E3 000000401FE3 0 STERf
000000001417 000000402017 0 OGREf
00000000144B 00000040204B 0 EMORf
000000001482 000000402082 0 FOUNf
00000000151A 00000040211A 0 _HIGf
0000000015D3 0000004021D3 0 OMMAf
000000001615 000000402215 0 _SRVf
000000001673 000000402273 0 _ERRf
0000000016CE 0000004022CE 0 _ERRf
00000000179F 00000040239F 0 ERROf
00000000185A 00000040245A 0 CYMIf
000000001891 000000402491 0 NSABf
0000000018FE 0000004024FE 0 ITIOf
00000000196C 00000040256C 0 OTOPf
0000000019DA 0000004025DA 0 LOSEf
000000001A71 000000402671 0 ACTIf
000000001B2A 00000040272A 0 OITEf
000000001B9C 00000040279C 0 NKNOf
000000001BD3 0000004027D3 0 STAKf
000000001C98 000000402898 0 SITIf
000000001CDA 0000004028DA 0 CTARf
000000001D9A 00000040299A 0 TAKEf
000000001DCA 0000004029CA 0 SLEFf
00000000303E 000000403C3E 0 <\t?</t;
000000005609 000000406209 0 D$p9D$0
0000000062ED 000000406EED 0 )D$,)
0000000066A9 0000004072A9 0 L$\9L$
0000000072AE 000000407EAE 0 9l$Xv,
00000000732C 000000407F2C 0 9|$Xv7
0000000089F3 0000004095F3 0 r/9D$
0000000091B1 000000409DB1 0 INOPf
0000000091F7 000000409DF7 0 EMPTf
000000009235 000000409E35 0 MANIf
000000009247 000000409E47 0 NOREf
File pos Mem pos ID Text
======== ======= == ====
000000009297 000000409E97 0 COINf
0000000092AC 000000409EAC 0 COINf
000000009313 000000409F13 0 NOVAf
000000009A00 00000040C000 0 libgcc_s_dw2-1.dll
000000009A13 00000040C013 0 __register_frame_info
000000009A29 00000040C029 0 libgcj-13.dll
000000009A37 00000040C037 0 _Jv_RegisterClasses
000000009A4B 00000040C04B 0 __deregister_frame_info
000000009A64 00000040C064 0 disp.txt
000000009FB4 00000040C5B4 0 Usage: %s <Service Logical Name> <Operation>
000000009FE4 00000040C5E4 0 Operation: info/disp/sht/retr/calc
00000000A008 00000040C608 0 Usage for disp operation: %s <Service Logical Name> disp <Cassette Number> <Banknotes Count> <Sleep(seconds)>
00000000A07C 00000040C67C 0 Usage: %s <Service Logical Name> disp <Cassette Number> <Banknotes Count>
00000000A0C8 00000040C6C8 0 Error! Banknotes Count (per dispense) should be from 1 to 60
00000000A108 00000040C708 0 Error! Cassette Slot Number should be from 1 to 16
00000000A141 00000040C741 0 Can't open log file!
00000000A157 00000040C757 0 Total Cash Amount: %d
00000000A16E 00000040C76E 0 Total Dispenses Count: %d
00000000A18C 00000040C78C 0 WFSOpen failed with error: WFS_ERR_INTERNAL_ERROR :-)
00000000A1C4 00000040C7C4 0 WFSStartUp failed with error: %s
00000000A1E8 00000040C7E8 0 WFSOpen failed with error: %s
00000000A20C 00000040C80C 0 Getting cash units information...
00000000A230 00000040C830 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s
00000000A270 00000040C870 0 Slot Type Status Ccy Value Count
00000000A294 00000040C894 0 ---------------------------------------------
00000000A2C3 00000040C8C3 0 REJECT
00000000A2CA 00000040C8CA 0 COUPON
00000000A2D1 00000040C8D1 0 REPCON
00000000A2D8 00000040C8D8 0 RECYCL
00000000A2DF 00000040C8DF 0 %d %-7s %-5s %.3s %-5d %-4d
00000000A2FC 00000040C8FC 0 WFSFreeResult failed with error: %s
00000000A324 00000040C924 0 Error! Total count of slots is %d, selected slot # %d !
00000000A360 00000040C960 0 Executing dispense operation # %d of %d for %d banknotes...
00000000A3A0 00000040C9A0 0 WFSExecute (WFS_CMD_CDM_DISPENSE) failed with error: %s
00000000A3D9 00000040C9D9 0 %d:%.3s
00000000A3E5 00000040C9E5 0 Total Dispensed Now: %d %.3s
00000000A408 00000040CA08 0 WFSExecute (WFS_CMD_CDM_OPEN_SHUTTER) failed with error: %s
00000000A448 00000040CA48 0 Shutter successfully opened. Waiting %d seconds...
00000000A47C 00000040CA7C 0 WFSExecute failed with error: %s
00000000A49E 00000040CA9E 0 Shutter successfully closed.
00000000A4C4 00000040CAC4 0 WFSExecute (WFS_CMD_CDM_RETRACT) failed with error: %s
00000000A4FC 00000040CAFC 0 Success.
00000000A508 00000040CB08 0 WFSClose failed with error: %s
00000000A528 00000040CB28 0 WFSCleanUp failed with error: %s
00000000A54A 00000040CB4A 0 Finished.
00000000A5B4 00000040CBB4 0 Mingw runtime failure:
00000000A5CC 00000040CBCC 0 VirtualQuery failed for %d bytes at address %p
00000000A600 00000040CC00 0 Unknown pseudo relocation protocol version %d.
00000000A634 00000040CC34 0 Unknown pseudo relocation bit size %d.
00000000A662 00000040CC62 0 glob-1.0-mingw32
00000000A692 00000040CC92 0 (null)
00000000A699 00000040CC99 0 PRINTF_EXPONENT_DIGITS
00000000A820 00000040CE20 0 Infinity
00000000A847 00000040CE47 0 ?aCoc
00000000A867 00000040CE67 0 <2ZGU
00000000AA00 00000040D000 0 GCC: (GNU) 4.8.1
00000000AA14 00000040D014 0 GCC: (GNU) 4.8.1
00000000AA28 00000040D028 0 GCC: (GNU) 4.8.1
00000000AA3C 00000040D03C 0 GCC: (GNU) 4.8.1
00000000AA50 00000040D050 0 GCC: (GNU) 4.8.1
File pos Mem pos ID Text
======== ======= == ====
00000000AA64 00000040D064 0 GCC: (GNU) 4.8.1
00000000AA78 00000040D078 0 GCC: (GNU) 4.8.1
00000000AA8C 00000040D08C 0 GCC: (GNU) 4.8.1
00000000AAA0 00000040D0A0 0 GCC: (GNU) 4.8.1
00000000AAB4 00000040D0B4 0 GCC: (GNU) 4.8.1
00000000AAC8 00000040D0C8 0 GCC: (GNU) 4.8.1
00000000AADC 00000040D0DC 0 GCC: (GNU) 4.8.1
00000000AAF0 00000040D0F0 0 GCC: (GNU) 4.8.1
00000000AB04 00000040D104 0 GCC: (GNU) 4.8.1
00000000AB18 00000040D118 0 GCC: (GNU) 4.8.1
00000000AB2C 00000040D12C 0 GCC: (GNU) 4.8.1
00000000AB40 00000040D140 0 GCC: (GNU) 4.8.1
00000000AB54 00000040D154 0 GCC: (GNU) 4.8.1
00000000AB68 00000040D168 0 GCC: (GNU) 4.8.1
00000000AB7C 00000040D17C 0 GCC: (GNU) 4.8.1
00000000AB90 00000040D190 0 GCC: (GNU) 4.8.1
00000000ABA4 00000040D1A4 0 GCC: (GNU) 4.8.1
00000000ABB8 00000040D1B8 0 GCC: (GNU) 4.8.1
00000000ABCC 00000040D1CC 0 GCC: (GNU) 4.8.1
00000000ABE0 00000040D1E0 0 GCC: (GNU) 4.8.1
00000000ABF4 00000040D1F4 0 GCC: (GNU) 4.8.1
00000000AC08 00000040D208 0 GCC: (GNU) 4.8.1
00000000AC1C 00000040D21C 0 GCC: (GNU) 4.8.1
00000000AC30 00000040D230 0 GCC: (GNU) 4.8.1
00000000C70E 00000041130E 0 CloseHandle
00000000C71C 00000041131C 0 CreateFileA
00000000C72A 00000041132A 0 DeleteCriticalSection
00000000C742 000000411342 0 EnterCriticalSection
00000000C75A 00000041135A 0 ExitProcess
00000000C768 000000411368 0 GetCommandLineA
00000000C77A 00000041137A 0 GetFileSize
00000000C788 000000411388 0 GetLastError
00000000C798 000000411398 0 GetModuleHandleA
00000000C7AC 0000004113AC 0 GetProcAddress
00000000C7BE 0000004113BE 0 GetSystemTime
00000000C7CE 0000004113CE 0 InitializeCriticalSection
00000000C7EA 0000004113EA 0 InterlockedExchange
00000000C800 000000411400 0 IsDBCSLeadByteEx
00000000C814 000000411414 0 LeaveCriticalSection
00000000C82C 00000041142C 0 MultiByteToWideChar
00000000C842 000000411442 0 ReadFile
00000000C84E 00000041144E 0 SetFilePointer
00000000C860 000000411460 0 SetUnhandledExceptionFilter
00000000C87E 00000041147E 0 Sleep
00000000C886 000000411486 0 TlsGetValue
00000000C894 000000411494 0 VirtualProtect
00000000C8A6 0000004114A6 0 VirtualQuery
00000000C8B6 0000004114B6 0 WideCharToMultiByte
00000000C8CC 0000004114CC 0 WriteFile
00000000C8D8 0000004114D8 0 lstrlenA
00000000C8E4 0000004114E4 0 _strdup
00000000C8EE 0000004114EE 0 _stricoll
00000000C8FA 0000004114FA 0 __getmainargs
00000000C90A 00000041150A 0 __mb_cur_max
00000000C91A 00000041151A 0 __p__environ
00000000C92A 00000041152A 0 __p__fmode
00000000C938 000000411538 0 __set_app_type
00000000C94A 00000041154A 0 _cexit
00000000C954 000000411554 0 _errno
00000000C95E 00000041155E 0 _findclose
File pos Mem pos ID Text
======== ======= == ====
00000000C96C 00000041156C 0 _findfirst
00000000C97A 00000041157A 0 _findnext
00000000C986 000000411586 0 _fullpath
00000000C99A 00000041159A 0 _onexit
00000000C9A4 0000004115A4 0 _setmode
00000000C9B0 0000004115B0 0 abort
00000000C9B8 0000004115B8 0 atexit
00000000C9CA 0000004115CA 0 calloc
00000000C9D4 0000004115D4 0 fputc
00000000C9E4 0000004115E4 0 fwrite
00000000C9EE 0000004115EE 0 getenv
00000000C9F8 0000004115F8 0 isspace
00000000CA02 000000411602 0 localeconv
00000000CA10 000000411610 0 malloc
00000000CA1A 00000041161A 0 mbstowcs
00000000CA26 000000411626 0 memcpy
00000000CA30 000000411630 0 realloc
00000000CA3A 00000041163A 0 setlocale
00000000CA46 000000411646 0 signal
00000000CA50 000000411650 0 strchr
00000000CA5A 00000041165A 0 strcmp
00000000CA64 000000411664 0 strcoll
00000000CA6E 00000041166E 0 strlen
00000000CA78 000000411678 0 strncpy
00000000CA82 000000411682 0 tolower
00000000CA8C 00000041168C 0 vfprintf
00000000CA98 000000411698 0 wcslen
00000000CAA2 0000004116A2 0 wcstombs
00000000CAAE 0000004116AE 0 wvsprintfA
00000000CABA 0000004116BA 0 MSXFS.dll
00000000CAC6 0000004116C6 0 WFSStartUp
00000000CADA 0000004116DA 0 WFSOpen
00000000CAEA 0000004116EA 0 WFSExecute
00000000CAFE 0000004116FE 0 WFSClose
00000000CB0E 00000041170E 0 WFSCleanUp
00000000CB22 000000411722 0 WFSGetInfo
00000000CB36 000000411736 0 WFSFreeResult
00000000CBB0 0000004117B0 0 kernel32.dll
00000000CBC8 0000004117C8 0 msvcrt.dll
00000000CC70 000000411870 0 msvcrt.dll
00000000CC80 000000411880 0 user32.dll
00000000A683 00000040CC83 0 f(null)
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
000000000178 000000400178 0 .text
0000000001A0 0000004001A0 0 .data
0000000001C8 0000004001C8 0 .rdata
0000000001EF 0000004001EF 0 @.eh_fram,
000000000216 000000400216 0 0@.bss
000000000240 000000400240 0 .idata
000000000D42 000000401942 0 SUBKf
000000000D7D 00000040197D 0 VALUf
000000000DBA 0000004019BA 0 EMPTf
000000000DF1 0000004019F1 0 _LONf
000000000E2A 000000401A2A 0 ITEMf
000000000E61 000000401A61 0 O_LOf
000000000E95 000000401A95 0 READf
000000000EC5 000000401AC5 0 _ERRf
000000000EF9 000000401AF9 0 _ERRf
000000000F6A 000000401B6A 0 HANDf
000000000FA3 000000401BA3 0 BUFFf
File pos Mem pos ID Text
======== ======= == ====
0000000010AC 000000401CAC 0 VIDEf
000000001173 000000401D73 0 REQ_f
0000000011A7 000000401DA7 0 RESUf
000000001213 000000401E13 0 TIMEf
00000000124A 000000401E4A 0 ELEVf
000000001275 000000401E75 0 LOCKf
000000001303 000000401F03 0 THREf
000000001354 000000401F54 0 LOCKf
0000000013E3 000000401FE3 0 STERf
000000001417 000000402017 0 OGREf
00000000144B 00000040204B 0 EMORf
000000001482 000000402082 0 FOUNf
00000000151A 00000040211A 0 _HIGf
0000000015D3 0000004021D3 0 OMMAf
000000001615 000000402215 0 _SRVf
000000001673 000000402273 0 _ERRf
0000000016CE 0000004022CE 0 _ERRf
00000000179F 00000040239F 0 ERROf
00000000185A 00000040245A 0 CYMIf
000000001891 000000402491 0 NSABf
0000000018FE 0000004024FE 0 ITIOf
00000000196C 00000040256C 0 OTOPf
0000000019DA 0000004025DA 0 LOSEf
000000001A71 000000402671 0 ACTIf
000000001B2A 00000040272A 0 OITEf
000000001B9C 00000040279C 0 NKNOf
000000001BD3 0000004027D3 0 STAKf
000000001C98 000000402898 0 SITIf
000000001CDA 0000004028DA 0 CTARf
000000001D9A 00000040299A 0 TAKEf
000000001DCA 0000004029CA 0 SLEFf
00000000303E 000000403C3E 0 <\t?</t;
000000005609 000000406209 0 D$p9D$0
0000000062ED 000000406EED 0 )D$,)
0000000066A9 0000004072A9 0 L$\9L$
0000000072AE 000000407EAE 0 9l$Xv,
00000000732C 000000407F2C 0 9|$Xv7
0000000089F3 0000004095F3 0 r/9D$
0000000091B1 000000409DB1 0 INOPf
0000000091F7 000000409DF7 0 EMPTf
000000009235 000000409E35 0 MANIf
000000009247 000000409E47 0 NOREf
000000009297 000000409E97 0 COINf
0000000092AC 000000409EAC 0 COINf
000000009313 000000409F13 0 NOVAf
000000009A00 00000040C000 0 libgcc_s_dw2-1.dll
000000009A13 00000040C013 0 __register_frame_info
000000009A29 00000040C029 0 libgcj-13.dll
000000009A37 00000040C037 0 _Jv_RegisterClasses
000000009A4B 00000040C04B 0 __deregister_frame_info
000000009A64 00000040C064 0 disp.txt
000000009FB4 00000040C5B4 0 Usage: %s <Service Logical Name> <Operation>
000000009FE4 00000040C5E4 0 Operation: info/disp/sht/retr/calc
00000000A008 00000040C608 0 Usage for disp operation: %s <Service Logical Name> disp <Cassette Number> <Banknotes Count> <Sleep(seconds)>
00000000A07C 00000040C67C 0 Usage: %s <Service Logical Name> disp <Cassette Number> <Banknotes Count>
00000000A0C8 00000040C6C8 0 Error! Banknotes Count (per dispense) should be from 1 to 60
00000000A108 00000040C708 0 Error! Cassette Slot Number should be from 1 to 16
00000000A141 00000040C741 0 Can't open log file!
00000000A157 00000040C757 0 Total Cash Amount: %d
00000000A16E 00000040C76E 0 Total Dispenses Count: %d
File pos Mem pos ID Text
======== ======= == ====
00000000A18C 00000040C78C 0 WFSOpen failed with error: WFS_ERR_INTERNAL_ERROR :-)
00000000A1C4 00000040C7C4 0 WFSStartUp failed with error: %s
00000000A1E8 00000040C7E8 0 WFSOpen failed with error: %s
00000000A20C 00000040C80C 0 Getting cash units information...
00000000A230 00000040C830 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s
00000000A270 00000040C870 0 Slot Type Status Ccy Value Count
00000000A294 00000040C894 0 ---------------------------------------------
00000000A2C3 00000040C8C3 0 REJECT
00000000A2CA 00000040C8CA 0 COUPON
00000000A2D1 00000040C8D1 0 REPCON
00000000A2D8 00000040C8D8 0 RECYCL
00000000A2DF 00000040C8DF 0 %d %-7s %-5s %.3s %-5d %-4d
00000000A2FC 00000040C8FC 0 WFSFreeResult failed with error: %s
00000000A324 00000040C924 0 Error! Total count of slots is %d, selected slot # %d !
00000000A360 00000040C960 0 Executing dispense operation # %d of %d for %d banknotes...
00000000A3A0 00000040C9A0 0 WFSExecute (WFS_CMD_CDM_DISPENSE) failed with error: %s
00000000A3D9 00000040C9D9 0 %d:%.3s
00000000A3E5 00000040C9E5 0 Total Dispensed Now: %d %.3s
00000000A408 00000040CA08 0 WFSExecute (WFS_CMD_CDM_OPEN_SHUTTER) failed with error: %s
00000000A448 00000040CA48 0 Shutter successfully opened. Waiting %d seconds...
00000000A47C 00000040CA7C 0 WFSExecute failed with error: %s
00000000A49E 00000040CA9E 0 Shutter successfully closed.
00000000A4C4 00000040CAC4 0 WFSExecute (WFS_CMD_CDM_RETRACT) failed with error: %s
00000000A4FC 00000040CAFC 0 Success.
00000000A508 00000040CB08 0 WFSClose failed with error: %s
00000000A528 00000040CB28 0 WFSCleanUp failed with error: %s
00000000A54A 00000040CB4A 0 Finished.
00000000A5B4 00000040CBB4 0 Mingw runtime failure:
00000000A5CC 00000040CBCC 0 VirtualQuery failed for %d bytes at address %p
00000000A600 00000040CC00 0 Unknown pseudo relocation protocol version %d.
00000000A634 00000040CC34 0 Unknown pseudo relocation bit size %d.
00000000A662 00000040CC62 0 glob-1.0-mingw32
00000000A692 00000040CC92 0 (null)
00000000A699 00000040CC99 0 PRINTF_EXPONENT_DIGITS
00000000A820 00000040CE20 0 Infinity
00000000A847 00000040CE47 0 ?aCoc
00000000A867 00000040CE67 0 <2ZGU
00000000AA00 00000040D000 0 GCC: (GNU) 4.8.1
00000000AA14 00000040D014 0 GCC: (GNU) 4.8.1
00000000AA28 00000040D028 0 GCC: (GNU) 4.8.1
00000000AA3C 00000040D03C 0 GCC: (GNU) 4.8.1
00000000AA50 00000040D050 0 GCC: (GNU) 4.8.1
00000000AA64 00000040D064 0 GCC: (GNU) 4.8.1
00000000AA78 00000040D078 0 GCC: (GNU) 4.8.1
00000000AA8C 00000040D08C 0 GCC: (GNU) 4.8.1
00000000AAA0 00000040D0A0 0 GCC: (GNU) 4.8.1
00000000AAB4 00000040D0B4 0 GCC: (GNU) 4.8.1
00000000AAC8 00000040D0C8 0 GCC: (GNU) 4.8.1
00000000AADC 00000040D0DC 0 GCC: (GNU) 4.8.1
00000000AAF0 00000040D0F0 0 GCC: (GNU) 4.8.1
00000000AB04 00000040D104 0 GCC: (GNU) 4.8.1
00000000AB18 00000040D118 0 GCC: (GNU) 4.8.1
00000000AB2C 00000040D12C 0 GCC: (GNU) 4.8.1
00000000AB40 00000040D140 0 GCC: (GNU) 4.8.1
00000000AB54 00000040D154 0 GCC: (GNU) 4.8.1
00000000AB68 00000040D168 0 GCC: (GNU) 4.8.1
00000000AB7C 00000040D17C 0 GCC: (GNU) 4.8.1
00000000AB90 00000040D190 0 GCC: (GNU) 4.8.1
00000000ABA4 00000040D1A4 0 GCC: (GNU) 4.8.1
00000000ABB8 00000040D1B8 0 GCC: (GNU) 4.8.1
File pos Mem pos ID Text
======== ======= == ====
00000000ABCC 00000040D1CC 0 GCC: (GNU) 4.8.1
00000000ABE0 00000040D1E0 0 GCC: (GNU) 4.8.1
00000000ABF4 00000040D1F4 0 GCC: (GNU) 4.8.1
00000000AC08 00000040D208 0 GCC: (GNU) 4.8.1
00000000AC1C 00000040D21C 0 GCC: (GNU) 4.8.1
00000000AC30 00000040D230 0 GCC: (GNU) 4.8.1
00000000C70E 00000041130E 0 CloseHandle
00000000C71C 00000041131C 0 CreateFileA
00000000C72A 00000041132A 0 DeleteCriticalSection
00000000C742 000000411342 0 EnterCriticalSection
00000000C75A 00000041135A 0 ExitProcess
00000000C768 000000411368 0 GetCommandLineA
00000000C77A 00000041137A 0 GetFileSize
00000000C788 000000411388 0 GetLastError
00000000C798 000000411398 0 GetModuleHandleA
00000000C7AC 0000004113AC 0 GetProcAddress
00000000C7BE 0000004113BE 0 GetSystemTime
00000000C7CE 0000004113CE 0 InitializeCriticalSection
00000000C7EA 0000004113EA 0 InterlockedExchange
00000000C800 000000411400 0 IsDBCSLeadByteEx
00000000C814 000000411414 0 LeaveCriticalSection
00000000C82C 00000041142C 0 MultiByteToWideChar
00000000C842 000000411442 0 ReadFile
00000000C84E 00000041144E 0 SetFilePointer
00000000C860 000000411460 0 SetUnhandledExceptionFilter
00000000C87E 00000041147E 0 Sleep
00000000C886 000000411486 0 TlsGetValue
00000000C894 000000411494 0 VirtualProtect
00000000C8A6 0000004114A6 0 VirtualQuery
00000000C8B6 0000004114B6 0 WideCharToMultiByte
00000000C8CC 0000004114CC 0 WriteFile
00000000C8D8 0000004114D8 0 lstrlenA
00000000C8E4 0000004114E4 0 _strdup
00000000C8EE 0000004114EE 0 _stricoll
00000000C8FA 0000004114FA 0 __getmainargs
00000000C90A 00000041150A 0 __mb_cur_max
00000000C91A 00000041151A 0 __p__environ
00000000C92A 00000041152A 0 __p__fmode
00000000C938 000000411538 0 __set_app_type
00000000C94A 00000041154A 0 _cexit
00000000C954 000000411554 0 _errno
00000000C95E 00000041155E 0 _findclose
00000000C96C 00000041156C 0 _findfirst
00000000C97A 00000041157A 0 _findnext
00000000C986 000000411586 0 _fullpath
00000000C99A 00000041159A 0 _onexit
00000000C9A4 0000004115A4 0 _setmode
00000000C9B0 0000004115B0 0 abort
00000000C9B8 0000004115B8 0 atexit
00000000C9CA 0000004115CA 0 calloc
00000000C9D4 0000004115D4 0 fputc
00000000C9E4 0000004115E4 0 fwrite
00000000C9EE 0000004115EE 0 getenv
00000000C9F8 0000004115F8 0 isspace
00000000CA02 000000411602 0 localeconv
00000000CA10 000000411610 0 malloc
00000000CA1A 00000041161A 0 mbstowcs
00000000CA26 000000411626 0 memcpy
00000000CA30 000000411630 0 realloc
00000000CA3A 00000041163A 0 setlocale
File pos Mem pos ID Text
======== ======= == ====
00000000CA46 000000411646 0 signal
00000000CA50 000000411650 0 strchr
00000000CA5A 00000041165A 0 strcmp
00000000CA64 000000411664 0 strcoll
00000000CA6E 00000041166E 0 strlen
00000000CA78 000000411678 0 strncpy
00000000CA82 000000411682 0 tolower
00000000CA8C 00000041168C 0 vfprintf
00000000CA98 000000411698 0 wcslen
00000000CAA2 0000004116A2 0 wcstombs
00000000CAAE 0000004116AE 0 wvsprintfA
00000000CABA 0000004116BA 0 MSXFS.dll
00000000CAC6 0000004116C6 0 WFSStartUp
00000000CADA 0000004116DA 0 WFSOpen
00000000CAEA 0000004116EA 0 WFSExecute
00000000CAFE 0000004116FE 0 WFSClose
00000000CB0E 00000041170E 0 WFSCleanUp
00000000CB22 000000411722 0 WFSGetInfo
00000000CB36 000000411736 0 WFSFreeResult
00000000CBB0 0000004117B0 0 kernel32.dll
00000000CBC8 0000004117C8 0 msvcrt.dll
00000000CC70 000000411870 0 msvcrt.dll
00000000CC80 000000411880 0 user32.dll
00000000A683 00000040CC83 0 f(null)