.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ---- -------------.
! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV !
`-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
ATM MALWARE NOTICE
eeb8390e885612e1f0b8f8922baa4ebc9ba420224b30370d08b45f3453949937
Date...........: 2018-09-05
Family.........: Atmosphere
File name......: -
File size......: 84.00 KB
Type file......: DLL/Windows
Virscan........: VT - HA
Additional note: dropped by 956968e6f4bf611137ea0e747891ba8dc200ca809c252ef249294912fb3dbe3c
Entropy:
Binary Histogram:
=== PEDUMP REPORT ===
=== MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 248 0xf8
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== RICH Header ===
LIB_ID VERSION TIMES_USED
12 c 7291 1c7b 1 1
14 e 7299 1c83 1 1
0 0 0 0 4 4
10 a 8168 1fe8 8 8
19 13 8034 1f62 4 4
93 5d 2179 883 3 3
1 1 0 0 119 77
11 b 8168 1fe8 35 23
4 4 8168 1fe8 5 5
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 4 4
TimeDateStamp: "2018-04-07 10:47:34"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 8462 0x210e EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 6.0
SizeOfCode: 57344 0xe000
SizeOfInitializedData: 24576 0x6000
SizeOfUninitializedData: 0 0
AddressOfEntryPoint: 57019 0xdebb
BaseOfCode: 4096 0x1000
BaseOfData: 61440 0xf000
ImageBase: 268435456 0x10000000
SectionAlignment: 4096 0x1000
FileAlignment: 4096 0x1000
OperatingSystemVersion: 4.0
ImageVersion: 45.2
SubsystemVersion: 4.0
Reserved1: 0 0
SizeOfImage: 86016 0x15000
SizeOfHeaders: 4096 0x1000
CheckSum: 0 0
Subsystem: 2 2 WINDOWS_GUI
DllCharacteristics: 0 0
SizeOfStackReserve: 1048576 0x100000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 11970 size:0x 44
IMPORT rva:0x 10ab8 size:0x 78
RESOURCE rva:0x 0 size:0x 0
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x 13000 size:0x fec
DEBUG rva:0x 0 size:0x 0
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 0 size:0x 0
LOAD_CONFIG rva:0x 0 size:0x 0
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x f000 size:0x 1ac
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 0 size:0x 0
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 1000 dcb4 e000 1000 0 0 0 0 60000020 R-X CODE
.rdata f000 29b4 3000 f000 0 0 0 0 40000040 R-- IDATA
.data 12000 cfc 1000 12000 0 0 0 0 c0000040 RW- IDATA
.reloc 13000 1e72 2000 13000 0 0 0 0 42000040 R-- IDATA DISCARDABLE
=== RESOURCES ===
MODULE_NAME HINT ORD FUNCTION_NAME
KERNEL32.dll 2e CloseHandle
KERNEL32.dll 2ab ReadFile
KERNEL32.dll 15b GetFileSize
KERNEL32.dll 4d CreateFileA
KERNEL32.dll 397 WriteFile
KERNEL32.dll 310 SetFilePointer
KERNEL32.dll 16b GetLocalTime
KERNEL32.dll 175 GetModuleFileNameA
KERNEL32.dll 7c DeleteFileA
KERNEL32.dll 69 CreateThread
KERNEL32.dll 352 TerminateThread
KERNEL32.dll 349 Sleep
KERNEL32.dll 34b SuspendThread
KERNEL32.dll 2c7 ResumeThread
KERNEL32.dll 198 GetProcAddress
KERNEL32.dll 248 LoadLibraryA
KERNEL32.dll 177 GetModuleHandleA
KERNEL32.dll 378 VirtualFree
KERNEL32.dll 375 VirtualAlloc
KERNEL32.dll d3 FindNextFileA
KERNEL32.dll c9 FindFirstFileA
KERNEL32.dll 385 WaitForSingleObject
KERNEL32.dll 37b VirtualProtect
KERNEL32.dll 13a GetCurrentProcess
KERNEL32.dll e6 FlushInstructionCache
KERNEL32.dll 37d VirtualQuery
KERNEL32.dll 21c InterlockedCompareExchange
KERNEL32.dll 21f InterlockedExchange
KERNEL32.dll 20a HeapDestroy
KERNEL32.dll 20c HeapFree
KERNEL32.dll 280 OpenThread
KERNEL32.dll 208 HeapCreate
KERNEL32.dll 334 SetThreadContext
KERNEL32.dll 1cd GetThreadContext
KERNEL32.dll 355 Thread32Next
KERNEL32.dll 210 HeapReAlloc
KERNEL32.dll 206 HeapAlloc
KERNEL32.dll 13e GetCurrentThreadId
KERNEL32.dll 13b GetCurrentProcessId
KERNEL32.dll 354 Thread32First
KERNEL32.dll 6c CreateToolhelp32Snapshot
USER32.dll 1be MessageBoxA
MSVCP60.dll 3f2 ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
MSVCP60.dll 411 ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
MSVCP60.dll 40d ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
MSVCP60.dll 420 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
MSVCP60.dll ac ??0bad_exception@std@@QAE@ABV01@@Z
MSVCP60.dll 111 ??1bad_exception@std@@UAE@XZ
MSVCP60.dll ad ??0bad_exception@std@@QAE@PBD@Z
MSVCP60.dll 49 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
MSVCP60.dll 338 ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
MSVCP60.dll 406 ?_Xran@std@@YAXXZ
MSVCP60.dll 7a7 ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
MSVCP60.dll 542 ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
MSVCP60.dll 3e9 ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
MSVCP60.dll 54c ?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
MSVCP60.dll 55c ?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
MSVCP60.dll 725 ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
MSVCP60.dll 10b ??1_Lockit@std@@QAE@XZ
MSVCP60.dll a2 ??0_Lockit@std@@QAE@XZ
MSVCP60.dll 34a ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
MSVCP60.dll 3f8 ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
MSVCP60.dll 661 ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
MSVCP60.dll 529 ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
MSVCP60.dll 405 ?_Xlen@std@@YAXXZ
MSVCP60.dll 392 ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
MSVCP60.dll 32d ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
MSVCP60.dll e9 ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
MSVCP60.dll 10d ??1_Winit@std@@QAE@XZ
MSVCP60.dll a5 ??0_Winit@std@@QAE@XZ
MSVCP60.dll 109 ??1Init@ios_base@std@@QAE@XZ
MSVCP60.dll 9e ??0Init@ios_base@std@@QAE@XZ
MSVCP60.dll 41c ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
SHLWAPI.dll 1b PathFileExistsA
SHLWAPI.dll b PathAppendA
MSVCRT.dll 1e1 _vsnprintf
MSVCRT.dll f ??2@YAPAXI@Z
MSVCRT.dll 24c fclose
MSVCRT.dll 2d9 vfprintf
MSVCRT.dll 257 fopen
MSVCRT.dll 9 ??0exception@@QAE@XZ
MSVCRT.dll 25a fputs
MSVCRT.dll 25d fread
MSVCRT.dll 2a6 rand
MSVCRT.dll f1 _ftol
MSVCRT.dll 297 memcpy
MSVCRT.dll 299 memset
MSVCRT.dll 55 __dllonexit
MSVCRT.dll 186 _onexit
MSVCRT.dll e ??1type_info@@UAE@XZ
MSVCRT.dll 10f _initterm
MSVCRT.dll 291 malloc
MSVCRT.dll 9d _adjust_fdiv
MSVCRT.dll d ??1exception@@UAE@XZ
MSVCRT.dll 30 ?what@exception@@UBEPBDXZ
MSVCRT.dll 41 _CxxThrowException
MSVCRT.dll 2a7 realloc
MSVCRT.dll 25e free
MSVCRT.dll 8 ??0exception@@QAE@ABV0@@Z
MSVCRT.dll 298 memmove
MSVCRT.dll 23d atoi
MSVCRT.dll 49 __CxxFrameHandler
=== EXPORTS ===
# module "Library.dll"
# flags=0x0 ts="2018-04-07 10:47:34" version=0.0 ord_base=1
# nFuncs=1 nNames=1
ORD ENTRY_VA NAME
1 afa0 iinit
=== Packer / Compiler ===
MS Visual C++ 6.0 DLL
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00001000004D 0 !This program cannot be run in DOS mode.
0000000001F0 0000100001F0 0 .text
000000000218 000010000218 0 .rdata
00000000023F 00001000023F 0 @.data
000000000268 000010000268 0 .reloc
000000001BB9 000010001BB9 0 L$(SUV
000000001BC0 000010001BC0 0 D$8W3
000000001BF5 000010001BF5 0 D$HPQVU
0000000020C9 0000100020C9 0 D$<SUVW
000000002834 000010002834 0 d$hPUQ
000000002C43 000010002C43 0 L$(QV
000000002C76 000010002C76 0 D$ VP
000000002D32 000010002D32 0 D$$UP
000000002F7B 000010002F7B 0 l$ VW
0000000031BB 0000100031BB 0 l$,VW
0000000032E9 0000100032E9 0 L$$SUV
0000000032F0 0000100032F0 0 D$4WPQ
00000000331F 00001000331F 0 D$DPQVS
000000003820 000010003820 0 D$@_][
000000003A49 000010003A49 0 T$(PR
000000003BB9 000010003BB9 0 D$$SUVW
000000003E36 000010003E36 0 d}9SV
000000003F7C 000010003F7C 0 L$<QR
000000004049 000010004049 0 L$<Qj
0000000040D7 0000100040D7 0 VWhd"
000000004467 000010004467 0 D$,SP
00000000450A 00001000450A 0 L$8QR
000000004572 000010004572 0 $SUVW
0000000047A4 0000100047A4 0 L$ hP
000000004865 000010004865 0 QSUVW
000000004B19 000010004B19 0 L$$SUV
000000004B20 000010004B20 0 D$4WPQ
000000004B4F 000010004B4F 0 D$DPQVS
000000004D49 000010004D49 0 L$$SUV
000000004D50 000010004D50 0 D$4WPQ
000000004D7F 000010004D7F 0 D$DPQVS
000000004E79 000010004E79 0 L$$SUV
000000004E80 000010004E80 0 D$4WPQ
000000004EAF 000010004EAF 0 D$DPQVS
0000000050AC 0000100050AC 0 L$ QW
00000000512F 00001000512F 0 U4RQU
0000000055BC 0000100055BC 0 SUVW3
0000000055F8 0000100055F8 0 L$$Qj
0000000058DC 0000100058DC 0 IQhH$
00000000592B 00001000592B 0 IQhD$
00000000597A 00001000597A 0 IQh@$
0000000059C9 0000100059C9 0 IQh<$
000000005A18 000010005A18 0 IQh8$
000000005A67 000010005A67 0 IQh4$
000000005AB6 000010005AB6 0 IQh0$
000000005B05 000010005B05 0 IQh,$
000000005B51 000010005B51 0 IQh($
000000005BC8 000010005BC8 0 SUVW3
000000005CF9 000010005CF9 0 D$|VW3
000000005D39 000010005D39 0 D$@hX$
000000005E1E 000010005E1E 0 |$(t-
000000005E89 000010005E89 0 D$LSUV3
0000000060F2 0000100060F2 0 L$$PQ
0000000061E9 0000100061E9 0 D$8SUV3
000000006258 000010006258 0 \$<QSR
File pos Mem pos ID Text
======== ======= == ====
000000006277 000010006277 0 T$$QPR
0000000063C9 0000100063C9 0 D$8SUV3
00000000643F 00001000643F 0 \$<QRV
00000000645B 00001000645B 0 T$$PSR
00000000699B 00001000699B 0 SUVW3
000000006A3C 000010006A3C 0 L$0RVW
000000006A69 000010006A69 0 L$PQP
000000006B6A 000010006B6A 0 D$PPW
000000006D45 000010006D45 0 |$ QPW
000000006DD9 000010006DD9 0 D$8UVWj
000000006E74 000010006E74 0 L$HQP
000000007107 000010007107 0 ,SUVW
000000007123 000010007123 0 l$Dt#
0000000071DD 0000100071DD 0 d$(Ph
0000000074B7 0000100074B7 0 @SUVW
000000007665 000010007665 0 D$X VP
0000000079AC 0000100079AC 0 t$hWj
000000007A3E 000010007A3E 0 IQhP$
000000007AF3 000010007AF3 0 D$ PQ
00000000825A 00001000825A 0 T$$QWVR
00000000829C 00001000829C 0 L$$PWVQ
0000000082E3 0000100082E3 0 D$,VP
00000000894A 00001000894A 0 T$$QWVR
00000000898C 00001000898C 0 L$$PWVQ
0000000089D3 0000100089D3 0 D$,VP
00000000A007 00001000A007 0 0SUVW
00000000A03C 00001000A03C 0 D$ h '
00000000A474 00001000A474 0 d$8Ph8'
00000000A49D 00001000A49D 0 t$(to
00000000AA68 00001000AA68 0 SUVW3
00000000AB41 00001000AB41 0 |$0t1
00000000AB74 00001000AB74 0 \$$hh!
00000000B188 00001000B188 0 QRh (
00000000B21D 00001000B21D 0 SVh4(
00000000DEE8 00001000DEE8 0 t WVS
00000000DF15 00001000DF15 0 u7WPS
00000000DF26 00001000DF26 0 u&WVS
000000010CDE 000010010CDE 0 CloseHandle
000000010CEC 000010010CEC 0 ReadFile
000000010CF8 000010010CF8 0 GetFileSize
000000010D06 000010010D06 0 CreateFileA
000000010D14 000010010D14 0 WriteFile
000000010D20 000010010D20 0 SetFilePointer
000000010D32 000010010D32 0 GetLocalTime
000000010D42 000010010D42 0 GetModuleFileNameA
000000010D58 000010010D58 0 DeleteFileA
000000010D66 000010010D66 0 VirtualQuery
000000010D76 000010010D76 0 CreateThread
000000010D86 000010010D86 0 TerminateThread
000000010D98 000010010D98 0 Sleep
000000010DA0 000010010DA0 0 SuspendThread
000000010DB0 000010010DB0 0 ResumeThread
000000010DC0 000010010DC0 0 GetProcAddress
000000010DD2 000010010DD2 0 LoadLibraryA
000000010DE2 000010010DE2 0 GetModuleHandleA
000000010DF6 000010010DF6 0 VirtualFree
000000010E04 000010010E04 0 VirtualAlloc
000000010E14 000010010E14 0 FindNextFileA
000000010E24 000010010E24 0 FindFirstFileA
000000010E36 000010010E36 0 WaitForSingleObject
File pos Mem pos ID Text
======== ======= == ====
000000010E4C 000010010E4C 0 VirtualProtect
000000010E5C 000010010E5C 0 KERNEL32.dll
000000010E6C 000010010E6C 0 MessageBoxA
000000010E78 000010010E78 0 USER32.dll
000000010E84 000010010E84 0 ADVAPI32.dll
000000010E94 000010010E94 0 ??0Init@ios_base@std@@QAE@XZ
000000010EB4 000010010EB4 0 ??1Init@ios_base@std@@QAE@XZ
000000010ED4 000010010ED4 0 ??0_Winit@std@@QAE@XZ
000000010EEC 000010010EEC 0 ??1_Winit@std@@QAE@XZ
000000010F04 000010010F04 0 ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
000000010F4E 000010010F4E 0 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
000000010FAA 000010010FAA 0 ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
000000011006 000010011006 0 ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
000000011058 000010011058 0 ?_Xlen@std@@YAXXZ
00000001106C 00001001106C 0 ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
0000000110C0 0000100110C0 0 ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
00000001110A 00001001110A 0 ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
00000001115A 00001001115A 0 ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
0000000111A8 0000100111A8 0 ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
0000000111F6 0000100111F6 0 ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
00000001124E 00001001124E 0 ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
0000000112AA 0000100112AA 0 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
000000011302 000010011302 0 ??0bad_exception@std@@QAE@ABV01@@Z
000000011328 000010011328 0 ??1bad_exception@std@@UAE@XZ
000000011348 000010011348 0 ??0bad_exception@std@@QAE@PBD@Z
00000001136A 00001001136A 0 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
0000000113C6 0000100113C6 0 ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
000000011414 000010011414 0 ?_Xran@std@@YAXXZ
000000011428 000010011428 0 ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
00000001147E 00001001147E 0 ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
0000000114D0 0000100114D0 0 ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
000000011524 000010011524 0 ?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
000000011582 000010011582 0 ?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
0000000115E0 0000100115E0 0 ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
000000011632 000010011632 0 ??1_Lockit@std@@QAE@XZ
00000001164C 00001001164C 0 ??0_Lockit@std@@QAE@XZ
000000011664 000010011664 0 MSVCP60.dll
000000011672 000010011672 0 PathFileExistsA
000000011684 000010011684 0 PathAppendA
000000011690 000010011690 0 SHLWAPI.dll
00000001169E 00001001169E 0 __CxxFrameHandler
0000000116BA 0000100116BA 0 memmove
0000000116C4 0000100116C4 0 ??0exception@@QAE@ABV0@@Z
0000000116E8 0000100116E8 0 realloc
0000000116F2 0000100116F2 0 _CxxThrowException
000000011708 000010011708 0 ?what@exception@@UBEPBDXZ
000000011724 000010011724 0 ??1exception@@UAE@XZ
00000001173C 00001001173C 0 _vsnprintf
00000001174A 00001001174A 0 ??2@YAPAXI@Z
00000001175A 00001001175A 0 fclose
000000011764 000010011764 0 vfprintf
000000011770 000010011770 0 fopen
000000011778 000010011778 0 ??0exception@@QAE@XZ
000000011790 000010011790 0 fputs
000000011798 000010011798 0 fread
0000000117A8 0000100117A8 0 _ftol
0000000117B0 0000100117B0 0 memcpy
0000000117BA 0000100117BA 0 memset
0000000117C4 0000100117C4 0 __dllonexit
0000000117D2 0000100117D2 0 _onexit
File pos Mem pos ID Text
======== ======= == ====
0000000117DA 0000100117DA 0 MSVCRT.dll
0000000117E8 0000100117E8 0 ??1type_info@@UAE@XZ
000000011800 000010011800 0 _initterm
00000001180C 00001001180C 0 malloc
000000011816 000010011816 0 _adjust_fdiv
000000011826 000010011826 0 HeapCreate
000000011834 000010011834 0 InterlockedCompareExchange
000000011852 000010011852 0 InterlockedExchange
000000011868 000010011868 0 HeapDestroy
000000011876 000010011876 0 HeapFree
000000011882 000010011882 0 OpenThread
000000011890 000010011890 0 SetThreadContext
0000000118A4 0000100118A4 0 GetThreadContext
0000000118B8 0000100118B8 0 Thread32Next
0000000118C8 0000100118C8 0 HeapReAlloc
0000000118D6 0000100118D6 0 HeapAlloc
0000000118E2 0000100118E2 0 GetCurrentThreadId
0000000118F8 0000100118F8 0 GetCurrentProcessId
00000001190E 00001001190E 0 Thread32First
00000001191E 00001001191E 0 CreateToolhelp32Snapshot
00000001193A 00001001193A 0 FlushInstructionCache
000000011952 000010011952 0 GetCurrentProcess
0000000119A2 0000100119A2 0 Library.dll
0000000119AE 0000100119AE 0 iinit
000000012050 000010012050 0 .?AVexception@@
000000012068 000010012068 0 .?AVException@@
000000012080 000010012080 0 .?AVArgumentOutOfRangeException@@
0000000120B8 0000100120B8 0 .?AVbad_exception@std@@
0000000120D0 0000100120D0 0 bad exception
0000000120F0 0000100120F0 0 .?AVIOException@@
000000012110 000010012110 0 .?AVFileNotFoundException@@
000000012130 000010012130 0 Logger is now on new TraceLevel: %s
000000012154 000010012154 0 UNKNOWN
000000012160 000010012160 0 TRACE
000000012168 000010012168 0 NOTICE
000000012170 000010012170 0 WARNING
000000012178 000010012178 0 ERROR
000000012180 000010012180 0 FATAL
000000012188 000010012188 0 [%s]: %s
0000000121A0 0000100121A0 0 .?AVThreadException@@
0000000121B8 0000100121B8 0 Can't resume thread
0000000121CC 0000100121CC 0 MessageBoxTimeoutA
0000000121E0 0000100121E0 0 user32.dll
0000000121EC 0000100121EC 0 [%04d/%02d/%02d %02d:%02d:%02d.%03d] %s
000000012214 000010012214 0 determining pin pad
000000012230 000010012230 0 .?AVXfsException@@
000000012244 000010012244 0 Settings cash units info END.
000000012264 000010012264 0 Settings cash units info.
000000012280 000010012280 0 ca5h units info received
00000001229C 00001001229C 0 try to set %d
0000000122AC 0000100122AC 0 n0 p1npad
0000000122C0 0000100122C0 0 .?AVXfsGetInfoException@@
0000000122DC 0000100122DC 0 Xfs::QueryCashUnitsFromAtm4
0000000122F8 0000100122F8 0 Xfs::QueryCashUnitsFromAtm3
000000012314 000010012314 0 Xfs::QueryCashUnitsFromAtm2
000000012330 000010012330 0 LFS found info about <%d> ca5h un1t5
000000012360 000010012360 0 .?AVXfsDispenseException@@
000000012388 000010012388 0 .?AVHookLibException@@
0000000123A0 0000100123A0 0 WFMFreeBuffer
0000000123B0 0000100123B0 0 WFMAllocateMore
File pos Mem pos ID Text
======== ======= == ====
0000000123C0 0000100123C0 0 WFMAllocateBuffer
0000000123D4 0000100123D4 0 WFSExecute
0000000123E0 0000100123E0 0 WFSFreeResult
0000000123F0 0000100123F0 0 WFSStartUp
0000000123FC 0000100123FC 0 WFSGetInfo
000000012408 000010012408 0 no xf5 module found
00000001241C 00001001241C 0 msxfs.dll
000000012458 000010012458 0 |INDEX:%d|Values:%d|Money count:%d|
000000012480 000010012480 0 Founded < %d > commands
00000001249C 00001001249C 0 Command file deleted successfully
0000000124C0 0000100124C0 0 Reading command from a %s
0000000124DC 0000100124DC 0 %s\%s
0000000124E4 0000100124E4 0 FileCommandProvider::ReadXfsCommandFromFile ->
000000012520 000010012520 0 .?AVArgumentException@@
000000012538 000010012538 0 exception
000000012548 000010012548 0 CommandProcessor created
000000012564 000010012564 0 DEFAULT command processed
000000012580 000010012580 0 NONE command processed
000000012598 000010012598 0 System error!
0000000125A8 0000100125A8 0 Dispense failed. CODE:%d
0000000125C4 0000100125C4 0 Multi Dispensing start
0000000125DC 0000100125DC 0 Dispense failed. Unknown reason.
000000012600 000010012600 0 Dispense failed. %d
000000012614 000010012614 0 Manual Dispensing
000000012628 000010012628 0 Display Balance -> exception, code:%d
000000012650 000010012650 0 Display Balance 1try -> exception, code:%d
00000001267C 00001001267C 0 CommandProcessor::ProcessCommand ->
0000000126A0 0000100126A0 0 SetMaximumDispenseSize:%d
0000000126BC 0000100126BC 0 NULL command processed
0000000126D4 0000100126D4 0 ICommandProcessor::ProcessCommand -> start method
000000012708 000010012708 0 Processing command #%d
000000012720 000010012720 0 Received
00000001272D 00001001272D 0 commands
000000012738 000010012738 0 exception cauch: %d
00000001274C 00001001274C 0 Exiting
000000012754 000010012754 0 Pausing
00000001275C 00001001275C 0 trying to dispense
000000012770 000010012770 0 R2CommandProcessor::ProcessGetRealBalance()1
0000000127A0 0000100127A0 0 cur disp service is |%d|
0000000127BC 0000100127BC 0 try toi set %d
0000000127CC 0000100127CC 0 ___log.txt
0000000127D8 0000100127D8 0 Deleting resources
0000000127F8 0000100127F8 0 .?AVXfsLoaderException@@
000000012814 000010012814 0 uncatched
000000012820 000010012820 0 %s:%d
000000012828 000010012828 0 c:\atm\1
000000012834 000010012834 0 void CreateAllResources()
000000012850 000010012850 0 Xfs init error
000000012860 000010012860 0 Critical system error!
000000012878 000010012878 0 resources created
00000001288C 00001001288C 0 MH_UNKNOWN
000000012898 000010012898 0 MH_OK
0000000128A0 0000100128A0 0 MH_ERROR_ALREADY_INITIALIZED
0000000128C0 0000100128C0 0 MH_ERROR_NOT_INITIALIZED
0000000128DC 0000100128DC 0 MH_ERROR_ALREADY_CREATED
0000000128F8 0000100128F8 0 MH_ERROR_NOT_CREATED
000000012910 000010012910 0 MH_ERROR_ENABLED
000000012924 000010012924 0 MH_ERROR_DISABLED
000000012938 000010012938 0 MH_ERROR_NOT_EXECUTABLE
000000012950 000010012950 0 MH_ERROR_UNSUPPORTED_FUNCTION
File pos Mem pos ID Text
======== ======= == ====
000000012970 000010012970 0 MH_ERROR_MEMORY_ALLOC
000000012988 000010012988 0 MH_ERROR_MEMORY_PROTECT
0000000129A0 0000100129A0 0 MH_ERROR_MODULE_NOT_FOUND
0000000129BC 0000100129BC 0 MH_ERROR_FUNCTION_NOT_FOUND
0000000129D8 0000100129D8 0 (unknown)
000000012A32 000010012A32 0 YYYYY
000000012A3E 000010012A3E 0 YYYYYYYYYYYY
000000012A4C 000010012A4C 0 }YPPPPYYYYa
000000012A62 000010012A62 0 YYYYYYYYYYY
000000012B14 000010012B14 0 JJJJKRJJJJOLJJJJJJJJUE@JJJEYMFJ]JJJJJJJJJJJJJJacgNJJkmJJEmJJDEJJ
000000012BF8 000010012BF8 0 .?AVtype_info@@
00000001300B 00001001300B 0 0!01070Q0W0a0q0w0
000000013021 000010013021 0 1-1K1]1
00000001302D 00001001302D 0 2,2i2
000000013039 000010013039 0 363B3
000000013055 000010013055 0 :";V;q;
000000013073 000010013073 0 =(=1=I=R=u={=
000000013087 000010013087 0 =">(>Z>r>
00000001309F 00001001309F 0 ?!?1?7?Q?W?a?q?w?
0000000130C7 0000100130C7 0 0;0M0f0m0{0
0000000130E9 0000100130E9 0 3*313I3h3
0000000130F9 0000100130F9 0 3#4m4
00000001310D 00001001310D 0 636B6f6z6
000000013123 000010013123 0 7*7V7g7
000000013145 000010013145 0 9,:::
00000001315B 00001001315B 0 >.>3>A>
000000013163 000010013163 0 >m>s>
000000013175 000010013175 0 ?+?c?
00000001318F 00001001318F 0 0N0_0
00000001319B 00001001319B 0 1%111=1J1Q1W1
0000000131BF 0000100131BF 0 2(3?3b3
0000000131C9 0000100131C9 0 4(4_4
0000000131DB 0000100131DB 0 435T5}5
00000001320B 00001001320B 0 8L8{8
000000013217 000010013217 0 979K9i9r9
00000001322F 00001001322F 0 9":c:
000000013245 000010013245 0 :3;O;n;
00000001324D 00001001324D 0 ;C<V<
000000013257 000010013257 0 = =%=6=
000000013263 000010013263 0 >e>m>
000000013287 000010013287 0 1+2v2
0000000132A3 0000100132A3 0 4&4J4[4u4
0000000132AD 0000100132AD 0 4K5]5
0000000132B3 0000100132B3 0 5@7M7
0000000132C3 0000100132C3 0 8+8=8S8n8
0000000132CD 0000100132CD 0 9'91979
0000000132E1 0000100132E1 0 ;X;o;
0000000132E9 0000100132E9 0 ;9<K<
000000013321 000010013321 0 7*7/777=7D7J7Q7W7
000000013333 000010013333 0 7d7k7q7x7~7
000000013345 000010013345 0 8 8%898q8y8
000000013363 000010013363 0 9.969;9a9f9}9
000000013383 000010013383 0 :#:(:N:S:j:r:w:
0000000133A5 0000100133A5 0 ;8;=;T;\;a;
0000000133B7 0000100133B7 0 <!<s<
0000000133C5 0000100133C5 0 ===S=f=k=z=
0000000133F5 0000100133F5 0 0<0T0
000000013403 000010013403 0 1)1/1@1Y1
00000001340F 00001001340F 0 2 2C2d2j2
000000013427 000010013427 0 3/353B3
File pos Mem pos ID Text
======== ======= == ====
000000013433 000010013433 0 4#4(4K4Q4g4m4
000000013459 000010013459 0 6 606<6
000000013469 000010013469 0 737F7t7
00000001347F 00001001347F 0 8?8D8T8Z8j8
000000013497 000010013497 0 :/:5:D:W:d:p:
0000000134A7 0000100134A7 0 ;';N;q;
0000000134C1 0000100134C1 0 >b>o>{>
0000000134DB 0000100134DB 0 ?#?)?;?
0000000134F1 0000100134F1 0 011P1
0000000134F7 0000100134F7 0 1#2)2:2?2P2
000000013507 000010013507 0 3$3F3U3y3
00000001351D 00001001351D 0 4/4;4e4v4
00000001352B 00001001352B 0 525}5
00000001353B 00001001353B 0 7%7@7e7p7
000000013553 000010013553 0 8W8\8c8k8z8
00000001356D 00001001356D 0 9#9+9:9H9
00000001357B 00001001357B 0 9$:):A:I:
00000001358F 00001001358F 0 ;)<V<
0000000135A3 0000100135A3 0 =@=N=l=
0000000135B3 0000100135B3 0 =%>*>H>P>\>e>k>
0000000135CB 0000100135CB 0 ? ?,?5?;?i?
0000000135E5 0000100135E5 0 0#0F0U0g0
0000000135EF 0000100135EF 0 0(1C1f1u1
0000000135FD 0000100135FD 0 2J233_3p3
000000013609 000010013609 0 3[4v4
00000001362B 00001001362B 0 8=8c8
00000001363B 00001001363B 0 9:9#:O:
000000013647 000010013647 0 :K;f;|;
000000013653 000010013653 0 ;=<v<
000000013669 000010013669 0 >-?S?q?z?
000000013689 000010013689 0 0]1m1
000000013693 000010013693 0 1[2k2
0000000136B1 0000100136B1 0 5%555
0000000136BB 0000100136BB 0 6%656j6
0000000136D7 0000100136D7 0 738K8]8
0000000136E7 0000100136E7 0 9$9A9
0000000136F9 0000100136F9 0 :A;q;z;
000000013709 000010013709 0 <F<d<
000000013713 000010013713 0 <B=P=
000000013721 000010013721 0 >$>5>I>
00000001375C 00001001375C 0 @0Z0w0
000000013771 000010013771 0 3'4y4(5,5054585<5@5D5H5L5P5T5X5\5
00000001379F 00001001379F 0 626V6l6
0000000137B7 0000100137B7 0 868T8
0000000137BF 0000100137BF 0 969f9
0000000137C7 0000100137C7 0 9$:S:
0000000137D9 0000100137D9 0 ;-;x;};
0000000137E3 0000100137E3 0 ;C<x<
0000000137EB 0000100137EB 0 <"=1=Q=q=
000000013805 000010013805 0 >7?q?
00000001382B 00001001382B 0 1%1V1a1u1
000000013849 000010013849 0 2 2.2<2]2b2{2
00000001386F 00001001386F 0 4'4k4
000000013883 000010013883 0 5#5u5
0000000138A7 0000100138A7 0 7/7@7T7Z7l7r7
0000000138BB 0000100138BB 0 828A8F8L8
0000000138DB 0000100138DB 0 9"9,969@9
0000000138F3 0000100138F3 0 ;%;_;><f=u=
000000013924 000010013924 0 A0%222R2[2d2p2w2|2
000000013965 000010013965 0 4&4.454A4J4Q4a4h4q4
File pos Mem pos ID Text
======== ======= == ====
00000001398F 00001001398F 0 6 7-7
000000013997 000010013997 0 7H8M8T8[8b8i8p8w8~8
0000000139DD 0000100139DD 0 9(:3:E:
0000000139FB 0000100139FB 0 294f4
000000013A09 000010013A09 0 697@7
000000013A47 000010013A47 0 >">(>3>@>H>V>[>
000000013A57 000010013A57 0 >e>p>}>
000000013A69 000010013A69 0 >>?Z?
000000013A6F 000010013A6F 0 ?f?l?r?
000000013A8C 000010013A8C 0 0)0E0V0[0u0z0
000000013AA5 000010013AA5 0 161;1Y1y1
000000013AB9 000010013AB9 0 292Y2y2
000000013AC7 000010013AC7 0 2 3%323I3i3
000000013AE3 000010013AE3 0 4 4)424;4D4M4V4[4u4
000000013B03 000010013B03 0 595U5
000000013B09 000010013B09 0 5o5t5
000000013B35 000010013B35 0 7H7M7
000000013B49 000010013B49 0 8#858:8U8Z8u8~8
000000013B6F 000010013B6F 0 959:9U9Z9u9z9
000000013B89 000010013B89 0 91:Y:y:
000000013B97 000010013B97 0 : ;w;
000000013BA7 000010013BA7 0 ;+<8<Q<u<z<
000000013BF7 000010013BF7 0 2 2$2(2,2024282<2@2D2H2L2P2T2X2\2
000000013C19 000010013C19 0 2d2h2l2p2t2x2|2
000000013C6B 000010013C6B 0 3(3<3L3P3\3p3|3
000000013C93 000010013C93 0 4(44484D4L4T4h4t4
000000013CBF 000010013CBF 0 5$505L5T5\5h5
000000013CE1 000010013CE1 0 6$606L6T6
000000013CFF 000010013CFF 0 7,747@7\7d7x7
000000013D21 000010013D21 0 8 8(8D8
000000013D3D 000010013D3D 0 9$9(9,949<9H9P9l9
000000013D69 000010013D69 0 :0:<:@:D:H:T:\:h:
000000013D8B 000010013D8B 0 ;,;4;@;\;d;p;
000000013DB1 000010013DB1 0 <$<,<8<T<\<d<p<
000000013DD9 000010013DD9 0 =$=0=L=T=\=d=p=
000000013DFD 000010013DFD 0 >,><>P>d>p>
000000013E1F 000010013E1F 0 ?4?<?H?d?l?t?|?
000000013E53 000010013E53 0 0$0,040<0P0\0
000000013E61 000010013E61 0 0d0l0t0
000000013E7F 000010013E7F 0 1,181@1\1d1
000000013E9B 000010013E9B 0 2 2<2D2P2l2x2
000000013EB7 000010013EB7 0 343@3\3h3
000000013ECF 000010013ECF 0 3 4,444D4P4X4l4|4
000000013EED 000010013EED 0 5$5,545<5D5T5\5d5t5
000000013F15 000010013F15 0 646P6\6d6p6x6
000000013F33 000010013F33 0 7$70787T7p7|7
000000013F59 000010013F59 0 8 8(8D8
000000013F7B 000010013F7B 0 9$9,949D9P9l9t9|9
000000013F97 000010013F97 0 :$:4:D:P:l:t:|:
000000013FC5 000010013FC5 0 0 0$0(0H0
00000000004D 00001000004D 0 !This program cannot be run in DOS mode.
0000000001F0 0000100001F0 0 .text
000000000218 000010000218 0 .rdata
00000000023F 00001000023F 0 @.data
000000000268 000010000268 0 .reloc
000000001BB9 000010001BB9 0 L$(SUV
000000001BC0 000010001BC0 0 D$8W3
000000001BF5 000010001BF5 0 D$HPQVU
0000000020C9 0000100020C9 0 D$<SUVW
000000002834 000010002834 0 d$hPUQ
File pos Mem pos ID Text
======== ======= == ====
000000002C43 000010002C43 0 L$(QV
000000002C76 000010002C76 0 D$ VP
000000002D32 000010002D32 0 D$$UP
000000002F7B 000010002F7B 0 l$ VW
0000000031BB 0000100031BB 0 l$,VW
0000000032E9 0000100032E9 0 L$$SUV
0000000032F0 0000100032F0 0 D$4WPQ
00000000331F 00001000331F 0 D$DPQVS
000000003820 000010003820 0 D$@_][
000000003A49 000010003A49 0 T$(PR
000000003BB9 000010003BB9 0 D$$SUVW
000000003E36 000010003E36 0 d}9SV
000000003F7C 000010003F7C 0 L$<QR
000000004049 000010004049 0 L$<Qj
0000000040D7 0000100040D7 0 VWhd"
000000004467 000010004467 0 D$,SP
00000000450A 00001000450A 0 L$8QR
000000004572 000010004572 0 $SUVW
0000000047A4 0000100047A4 0 L$ hP
000000004865 000010004865 0 QSUVW
000000004B19 000010004B19 0 L$$SUV
000000004B20 000010004B20 0 D$4WPQ
000000004B4F 000010004B4F 0 D$DPQVS
000000004D49 000010004D49 0 L$$SUV
000000004D50 000010004D50 0 D$4WPQ
000000004D7F 000010004D7F 0 D$DPQVS
000000004E79 000010004E79 0 L$$SUV
000000004E80 000010004E80 0 D$4WPQ
000000004EAF 000010004EAF 0 D$DPQVS
0000000050AC 0000100050AC 0 L$ QW
00000000512F 00001000512F 0 U4RQU
0000000055BC 0000100055BC 0 SUVW3
0000000055F8 0000100055F8 0 L$$Qj
0000000058DC 0000100058DC 0 IQhH$
00000000592B 00001000592B 0 IQhD$
00000000597A 00001000597A 0 IQh@$
0000000059C9 0000100059C9 0 IQh<$
000000005A18 000010005A18 0 IQh8$
000000005A67 000010005A67 0 IQh4$
000000005AB6 000010005AB6 0 IQh0$
000000005B05 000010005B05 0 IQh,$
000000005B51 000010005B51 0 IQh($
000000005BC8 000010005BC8 0 SUVW3
000000005CF9 000010005CF9 0 D$|VW3
000000005D39 000010005D39 0 D$@hX$
000000005E1E 000010005E1E 0 |$(t-
000000005E89 000010005E89 0 D$LSUV3
0000000060F2 0000100060F2 0 L$$PQ
0000000061E9 0000100061E9 0 D$8SUV3
000000006258 000010006258 0 \$<QSR
000000006277 000010006277 0 T$$QPR
0000000063C9 0000100063C9 0 D$8SUV3
00000000643F 00001000643F 0 \$<QRV
00000000645B 00001000645B 0 T$$PSR
00000000699B 00001000699B 0 SUVW3
000000006A3C 000010006A3C 0 L$0RVW
000000006A69 000010006A69 0 L$PQP
000000006B6A 000010006B6A 0 D$PPW
000000006D45 000010006D45 0 |$ QPW
000000006DD9 000010006DD9 0 D$8UVWj
File pos Mem pos ID Text
======== ======= == ====
000000006E74 000010006E74 0 L$HQP
000000007107 000010007107 0 ,SUVW
000000007123 000010007123 0 l$Dt#
0000000071DD 0000100071DD 0 d$(Ph
0000000074B7 0000100074B7 0 @SUVW
000000007665 000010007665 0 D$X VP
0000000079AC 0000100079AC 0 t$hWj
000000007A3E 000010007A3E 0 IQhP$
000000007AF3 000010007AF3 0 D$ PQ
00000000825A 00001000825A 0 T$$QWVR
00000000829C 00001000829C 0 L$$PWVQ
0000000082E3 0000100082E3 0 D$,VP
00000000894A 00001000894A 0 T$$QWVR
00000000898C 00001000898C 0 L$$PWVQ
0000000089D3 0000100089D3 0 D$,VP
00000000A007 00001000A007 0 0SUVW
00000000A03C 00001000A03C 0 D$ h '
00000000A474 00001000A474 0 d$8Ph8'
00000000A49D 00001000A49D 0 t$(to
00000000AA68 00001000AA68 0 SUVW3
00000000AB41 00001000AB41 0 |$0t1
00000000AB74 00001000AB74 0 \$$hh!
00000000B188 00001000B188 0 QRh (
00000000B21D 00001000B21D 0 SVh4(
00000000DEE8 00001000DEE8 0 t WVS
00000000DF15 00001000DF15 0 u7WPS
00000000DF26 00001000DF26 0 u&WVS
000000010CDE 000010010CDE 0 CloseHandle
000000010CEC 000010010CEC 0 ReadFile
000000010CF8 000010010CF8 0 GetFileSize
000000010D06 000010010D06 0 CreateFileA
000000010D14 000010010D14 0 WriteFile
000000010D20 000010010D20 0 SetFilePointer
000000010D32 000010010D32 0 GetLocalTime
000000010D42 000010010D42 0 GetModuleFileNameA
000000010D58 000010010D58 0 DeleteFileA
000000010D66 000010010D66 0 VirtualQuery
000000010D76 000010010D76 0 CreateThread
000000010D86 000010010D86 0 TerminateThread
000000010D98 000010010D98 0 Sleep
000000010DA0 000010010DA0 0 SuspendThread
000000010DB0 000010010DB0 0 ResumeThread
000000010DC0 000010010DC0 0 GetProcAddress
000000010DD2 000010010DD2 0 LoadLibraryA
000000010DE2 000010010DE2 0 GetModuleHandleA
000000010DF6 000010010DF6 0 VirtualFree
000000010E04 000010010E04 0 VirtualAlloc
000000010E14 000010010E14 0 FindNextFileA
000000010E24 000010010E24 0 FindFirstFileA
000000010E36 000010010E36 0 WaitForSingleObject
000000010E4C 000010010E4C 0 VirtualProtect
000000010E5C 000010010E5C 0 KERNEL32.dll
000000010E6C 000010010E6C 0 MessageBoxA
000000010E78 000010010E78 0 USER32.dll
000000010E84 000010010E84 0 ADVAPI32.dll
000000010E94 000010010E94 0 ??0Init@ios_base@std@@QAE@XZ
000000010EB4 000010010EB4 0 ??1Init@ios_base@std@@QAE@XZ
000000010ED4 000010010ED4 0 ??0_Winit@std@@QAE@XZ
000000010EEC 000010010EEC 0 ??1_Winit@std@@QAE@XZ
000000010F04 000010010F04 0 ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
File pos Mem pos ID Text
======== ======= == ====
000000010F4E 000010010F4E 0 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
000000010FAA 000010010FAA 0 ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
000000011006 000010011006 0 ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
000000011058 000010011058 0 ?_Xlen@std@@YAXXZ
00000001106C 00001001106C 0 ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
0000000110C0 0000100110C0 0 ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
00000001110A 00001001110A 0 ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
00000001115A 00001001115A 0 ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
0000000111A8 0000100111A8 0 ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
0000000111F6 0000100111F6 0 ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
00000001124E 00001001124E 0 ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
0000000112AA 0000100112AA 0 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
000000011302 000010011302 0 ??0bad_exception@std@@QAE@ABV01@@Z
000000011328 000010011328 0 ??1bad_exception@std@@UAE@XZ
000000011348 000010011348 0 ??0bad_exception@std@@QAE@PBD@Z
00000001136A 00001001136A 0 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
0000000113C6 0000100113C6 0 ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
000000011414 000010011414 0 ?_Xran@std@@YAXXZ
000000011428 000010011428 0 ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
00000001147E 00001001147E 0 ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
0000000114D0 0000100114D0 0 ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
000000011524 000010011524 0 ?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
000000011582 000010011582 0 ?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
0000000115E0 0000100115E0 0 ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
000000011632 000010011632 0 ??1_Lockit@std@@QAE@XZ
00000001164C 00001001164C 0 ??0_Lockit@std@@QAE@XZ
000000011664 000010011664 0 MSVCP60.dll
000000011672 000010011672 0 PathFileExistsA
000000011684 000010011684 0 PathAppendA
000000011690 000010011690 0 SHLWAPI.dll
00000001169E 00001001169E 0 __CxxFrameHandler
0000000116BA 0000100116BA 0 memmove
0000000116C4 0000100116C4 0 ??0exception@@QAE@ABV0@@Z
0000000116E8 0000100116E8 0 realloc
0000000116F2 0000100116F2 0 _CxxThrowException
000000011708 000010011708 0 ?what@exception@@UBEPBDXZ
000000011724 000010011724 0 ??1exception@@UAE@XZ
00000001173C 00001001173C 0 _vsnprintf
00000001174A 00001001174A 0 ??2@YAPAXI@Z
00000001175A 00001001175A 0 fclose
000000011764 000010011764 0 vfprintf
000000011770 000010011770 0 fopen
000000011778 000010011778 0 ??0exception@@QAE@XZ
000000011790 000010011790 0 fputs
000000011798 000010011798 0 fread
0000000117A8 0000100117A8 0 _ftol
0000000117B0 0000100117B0 0 memcpy
0000000117BA 0000100117BA 0 memset
0000000117C4 0000100117C4 0 __dllonexit
0000000117D2 0000100117D2 0 _onexit
0000000117DA 0000100117DA 0 MSVCRT.dll
0000000117E8 0000100117E8 0 ??1type_info@@UAE@XZ
000000011800 000010011800 0 _initterm
00000001180C 00001001180C 0 malloc
000000011816 000010011816 0 _adjust_fdiv
000000011826 000010011826 0 HeapCreate
000000011834 000010011834 0 InterlockedCompareExchange
000000011852 000010011852 0 InterlockedExchange
000000011868 000010011868 0 HeapDestroy
000000011876 000010011876 0 HeapFree
File pos Mem pos ID Text
======== ======= == ====
000000011882 000010011882 0 OpenThread
000000011890 000010011890 0 SetThreadContext
0000000118A4 0000100118A4 0 GetThreadContext
0000000118B8 0000100118B8 0 Thread32Next
0000000118C8 0000100118C8 0 HeapReAlloc
0000000118D6 0000100118D6 0 HeapAlloc
0000000118E2 0000100118E2 0 GetCurrentThreadId
0000000118F8 0000100118F8 0 GetCurrentProcessId
00000001190E 00001001190E 0 Thread32First
00000001191E 00001001191E 0 CreateToolhelp32Snapshot
00000001193A 00001001193A 0 FlushInstructionCache
000000011952 000010011952 0 GetCurrentProcess
0000000119A2 0000100119A2 0 Library.dll
0000000119AE 0000100119AE 0 iinit
000000012050 000010012050 0 .?AVexception@@
000000012068 000010012068 0 .?AVException@@
000000012080 000010012080 0 .?AVArgumentOutOfRangeException@@
0000000120B8 0000100120B8 0 .?AVbad_exception@std@@
0000000120D0 0000100120D0 0 bad exception
0000000120F0 0000100120F0 0 .?AVIOException@@
000000012110 000010012110 0 .?AVFileNotFoundException@@
000000012130 000010012130 0 Logger is now on new TraceLevel: %s
000000012154 000010012154 0 UNKNOWN
000000012160 000010012160 0 TRACE
000000012168 000010012168 0 NOTICE
000000012170 000010012170 0 WARNING
000000012178 000010012178 0 ERROR
000000012180 000010012180 0 FATAL
000000012188 000010012188 0 [%s]: %s
0000000121A0 0000100121A0 0 .?AVThreadException@@
0000000121B8 0000100121B8 0 Can't resume thread
0000000121CC 0000100121CC 0 MessageBoxTimeoutA
0000000121E0 0000100121E0 0 user32.dll
0000000121EC 0000100121EC 0 [%04d/%02d/%02d %02d:%02d:%02d.%03d] %s
000000012214 000010012214 0 determining pin pad
000000012230 000010012230 0 .?AVXfsException@@
000000012244 000010012244 0 Settings cash units info END.
000000012264 000010012264 0 Settings cash units info.
000000012280 000010012280 0 ca5h units info received
00000001229C 00001001229C 0 try to set %d
0000000122AC 0000100122AC 0 n0 p1npad
0000000122C0 0000100122C0 0 .?AVXfsGetInfoException@@
0000000122DC 0000100122DC 0 Xfs::QueryCashUnitsFromAtm4
0000000122F8 0000100122F8 0 Xfs::QueryCashUnitsFromAtm3
000000012314 000010012314 0 Xfs::QueryCashUnitsFromAtm2
000000012330 000010012330 0 LFS found info about <%d> ca5h un1t5
000000012360 000010012360 0 .?AVXfsDispenseException@@
000000012388 000010012388 0 .?AVHookLibException@@
0000000123A0 0000100123A0 0 WFMFreeBuffer
0000000123B0 0000100123B0 0 WFMAllocateMore
0000000123C0 0000100123C0 0 WFMAllocateBuffer
0000000123D4 0000100123D4 0 WFSExecute
0000000123E0 0000100123E0 0 WFSFreeResult
0000000123F0 0000100123F0 0 WFSStartUp
0000000123FC 0000100123FC 0 WFSGetInfo
000000012408 000010012408 0 no xf5 module found
00000001241C 00001001241C 0 msxfs.dll
000000012458 000010012458 0 |INDEX:%d|Values:%d|Money count:%d|
000000012480 000010012480 0 Founded < %d > commands
00000001249C 00001001249C 0 Command file deleted successfully
File pos Mem pos ID Text
======== ======= == ====
0000000124C0 0000100124C0 0 Reading command from a %s
0000000124DC 0000100124DC 0 %s\%s
0000000124E4 0000100124E4 0 FileCommandProvider::ReadXfsCommandFromFile ->
000000012520 000010012520 0 .?AVArgumentException@@
000000012538 000010012538 0 exception
000000012548 000010012548 0 CommandProcessor created
000000012564 000010012564 0 DEFAULT command processed
000000012580 000010012580 0 NONE command processed
000000012598 000010012598 0 System error!
0000000125A8 0000100125A8 0 Dispense failed. CODE:%d
0000000125C4 0000100125C4 0 Multi Dispensing start
0000000125DC 0000100125DC 0 Dispense failed. Unknown reason.
000000012600 000010012600 0 Dispense failed. %d
000000012614 000010012614 0 Manual Dispensing
000000012628 000010012628 0 Display Balance -> exception, code:%d
000000012650 000010012650 0 Display Balance 1try -> exception, code:%d
00000001267C 00001001267C 0 CommandProcessor::ProcessCommand ->
0000000126A0 0000100126A0 0 SetMaximumDispenseSize:%d
0000000126BC 0000100126BC 0 NULL command processed
0000000126D4 0000100126D4 0 ICommandProcessor::ProcessCommand -> start method
000000012708 000010012708 0 Processing command #%d
000000012720 000010012720 0 Received
00000001272D 00001001272D 0 commands
000000012738 000010012738 0 exception cauch: %d
00000001274C 00001001274C 0 Exiting
000000012754 000010012754 0 Pausing
00000001275C 00001001275C 0 trying to dispense
000000012770 000010012770 0 R2CommandProcessor::ProcessGetRealBalance()1
0000000127A0 0000100127A0 0 cur disp service is |%d|
0000000127BC 0000100127BC 0 try toi set %d
0000000127CC 0000100127CC 0 ___log.txt
0000000127D8 0000100127D8 0 Deleting resources
0000000127F8 0000100127F8 0 .?AVXfsLoaderException@@
000000012814 000010012814 0 uncatched
000000012820 000010012820 0 %s:%d
000000012828 000010012828 0 c:\atm\1
000000012834 000010012834 0 void CreateAllResources()
000000012850 000010012850 0 Xfs init error
000000012860 000010012860 0 Critical system error!
000000012878 000010012878 0 resources created
00000001288C 00001001288C 0 MH_UNKNOWN
000000012898 000010012898 0 MH_OK
0000000128A0 0000100128A0 0 MH_ERROR_ALREADY_INITIALIZED
0000000128C0 0000100128C0 0 MH_ERROR_NOT_INITIALIZED
0000000128DC 0000100128DC 0 MH_ERROR_ALREADY_CREATED
0000000128F8 0000100128F8 0 MH_ERROR_NOT_CREATED
000000012910 000010012910 0 MH_ERROR_ENABLED
000000012924 000010012924 0 MH_ERROR_DISABLED
000000012938 000010012938 0 MH_ERROR_NOT_EXECUTABLE
000000012950 000010012950 0 MH_ERROR_UNSUPPORTED_FUNCTION
000000012970 000010012970 0 MH_ERROR_MEMORY_ALLOC
000000012988 000010012988 0 MH_ERROR_MEMORY_PROTECT
0000000129A0 0000100129A0 0 MH_ERROR_MODULE_NOT_FOUND
0000000129BC 0000100129BC 0 MH_ERROR_FUNCTION_NOT_FOUND
0000000129D8 0000100129D8 0 (unknown)
000000012A32 000010012A32 0 YYYYY
000000012A3E 000010012A3E 0 YYYYYYYYYYYY
000000012A4C 000010012A4C 0 }YPPPPYYYYa
000000012A62 000010012A62 0 YYYYYYYYYYY
000000012B14 000010012B14 0 JJJJKRJJJJOLJJJJJJJJUE@JJJEYMFJ]JJJJJJJJJJJJJJacgNJJkmJJEmJJDEJJ
File pos Mem pos ID Text
======== ======= == ====
000000012BF8 000010012BF8 0 .?AVtype_info@@
00000001300B 00001001300B 0 0!01070Q0W0a0q0w0
000000013021 000010013021 0 1-1K1]1
00000001302D 00001001302D 0 2,2i2
000000013039 000010013039 0 363B3
000000013055 000010013055 0 :";V;q;
000000013073 000010013073 0 =(=1=I=R=u={=
000000013087 000010013087 0 =">(>Z>r>
00000001309F 00001001309F 0 ?!?1?7?Q?W?a?q?w?
0000000130C7 0000100130C7 0 0;0M0f0m0{0
0000000130E9 0000100130E9 0 3*313I3h3
0000000130F9 0000100130F9 0 3#4m4
00000001310D 00001001310D 0 636B6f6z6
000000013123 000010013123 0 7*7V7g7
000000013145 000010013145 0 9,:::
00000001315B 00001001315B 0 >.>3>A>
000000013163 000010013163 0 >m>s>
000000013175 000010013175 0 ?+?c?
00000001318F 00001001318F 0 0N0_0
00000001319B 00001001319B 0 1%111=1J1Q1W1
0000000131BF 0000100131BF 0 2(3?3b3
0000000131C9 0000100131C9 0 4(4_4
0000000131DB 0000100131DB 0 435T5}5
00000001320B 00001001320B 0 8L8{8
000000013217 000010013217 0 979K9i9r9
00000001322F 00001001322F 0 9":c:
000000013245 000010013245 0 :3;O;n;
00000001324D 00001001324D 0 ;C<V<
000000013257 000010013257 0 = =%=6=
000000013263 000010013263 0 >e>m>
000000013287 000010013287 0 1+2v2
0000000132A3 0000100132A3 0 4&4J4[4u4
0000000132AD 0000100132AD 0 4K5]5
0000000132B3 0000100132B3 0 5@7M7
0000000132C3 0000100132C3 0 8+8=8S8n8
0000000132CD 0000100132CD 0 9'91979
0000000132E1 0000100132E1 0 ;X;o;
0000000132E9 0000100132E9 0 ;9<K<
000000013321 000010013321 0 7*7/777=7D7J7Q7W7
000000013333 000010013333 0 7d7k7q7x7~7
000000013345 000010013345 0 8 8%898q8y8
000000013363 000010013363 0 9.969;9a9f9}9
000000013383 000010013383 0 :#:(:N:S:j:r:w:
0000000133A5 0000100133A5 0 ;8;=;T;\;a;
0000000133B7 0000100133B7 0 <!<s<
0000000133C5 0000100133C5 0 ===S=f=k=z=
0000000133F5 0000100133F5 0 0<0T0
000000013403 000010013403 0 1)1/1@1Y1
00000001340F 00001001340F 0 2 2C2d2j2
000000013427 000010013427 0 3/353B3
000000013433 000010013433 0 4#4(4K4Q4g4m4
000000013459 000010013459 0 6 606<6
000000013469 000010013469 0 737F7t7
00000001347F 00001001347F 0 8?8D8T8Z8j8
000000013497 000010013497 0 :/:5:D:W:d:p:
0000000134A7 0000100134A7 0 ;';N;q;
0000000134C1 0000100134C1 0 >b>o>{>
0000000134DB 0000100134DB 0 ?#?)?;?
0000000134F1 0000100134F1 0 011P1
0000000134F7 0000100134F7 0 1#2)2:2?2P2
File pos Mem pos ID Text
======== ======= == ====
000000013507 000010013507 0 3$3F3U3y3
00000001351D 00001001351D 0 4/4;4e4v4
00000001352B 00001001352B 0 525}5
00000001353B 00001001353B 0 7%7@7e7p7
000000013553 000010013553 0 8W8\8c8k8z8
00000001356D 00001001356D 0 9#9+9:9H9
00000001357B 00001001357B 0 9$:):A:I:
00000001358F 00001001358F 0 ;)<V<
0000000135A3 0000100135A3 0 =@=N=l=
0000000135B3 0000100135B3 0 =%>*>H>P>\>e>k>
0000000135CB 0000100135CB 0 ? ?,?5?;?i?
0000000135E5 0000100135E5 0 0#0F0U0g0
0000000135EF 0000100135EF 0 0(1C1f1u1
0000000135FD 0000100135FD 0 2J233_3p3
000000013609 000010013609 0 3[4v4
00000001362B 00001001362B 0 8=8c8
00000001363B 00001001363B 0 9:9#:O:
000000013647 000010013647 0 :K;f;|;
000000013653 000010013653 0 ;=<v<
000000013669 000010013669 0 >-?S?q?z?
000000013689 000010013689 0 0]1m1
000000013693 000010013693 0 1[2k2
0000000136B1 0000100136B1 0 5%555
0000000136BB 0000100136BB 0 6%656j6
0000000136D7 0000100136D7 0 738K8]8
0000000136E7 0000100136E7 0 9$9A9
0000000136F9 0000100136F9 0 :A;q;z;
000000013709 000010013709 0 <F<d<
000000013713 000010013713 0 <B=P=
000000013721 000010013721 0 >$>5>I>
00000001375C 00001001375C 0 @0Z0w0
000000013771 000010013771 0 3'4y4(5,5054585<5@5D5H5L5P5T5X5\5
00000001379F 00001001379F 0 626V6l6
0000000137B7 0000100137B7 0 868T8
0000000137BF 0000100137BF 0 969f9
0000000137C7 0000100137C7 0 9$:S:
0000000137D9 0000100137D9 0 ;-;x;};
0000000137E3 0000100137E3 0 ;C<x<
0000000137EB 0000100137EB 0 <"=1=Q=q=
000000013805 000010013805 0 >7?q?
00000001382B 00001001382B 0 1%1V1a1u1
000000013849 000010013849 0 2 2.2<2]2b2{2
00000001386F 00001001386F 0 4'4k4
000000013883 000010013883 0 5#5u5
0000000138A7 0000100138A7 0 7/7@7T7Z7l7r7
0000000138BB 0000100138BB 0 828A8F8L8
0000000138DB 0000100138DB 0 9"9,969@9
0000000138F3 0000100138F3 0 ;%;_;><f=u=
000000013924 000010013924 0 A0%222R2[2d2p2w2|2
000000013965 000010013965 0 4&4.454A4J4Q4a4h4q4
00000001398F 00001001398F 0 6 7-7
000000013997 000010013997 0 7H8M8T8[8b8i8p8w8~8
0000000139DD 0000100139DD 0 9(:3:E:
0000000139FB 0000100139FB 0 294f4
000000013A09 000010013A09 0 697@7
000000013A47 000010013A47 0 >">(>3>@>H>V>[>
000000013A57 000010013A57 0 >e>p>}>
000000013A69 000010013A69 0 >>?Z?
000000013A6F 000010013A6F 0 ?f?l?r?
000000013A8C 000010013A8C 0 0)0E0V0[0u0z0
File pos Mem pos ID Text
======== ======= == ====
000000013AA5 000010013AA5 0 161;1Y1y1
000000013AB9 000010013AB9 0 292Y2y2
000000013AC7 000010013AC7 0 2 3%323I3i3
000000013AE3 000010013AE3 0 4 4)424;4D4M4V4[4u4
000000013B03 000010013B03 0 595U5
000000013B09 000010013B09 0 5o5t5
000000013B35 000010013B35 0 7H7M7
000000013B49 000010013B49 0 8#858:8U8Z8u8~8
000000013B6F 000010013B6F 0 959:9U9Z9u9z9
000000013B89 000010013B89 0 91:Y:y:
000000013B97 000010013B97 0 : ;w;
000000013BA7 000010013BA7 0 ;+<8<Q<u<z<
000000013BF7 000010013BF7 0 2 2$2(2,2024282<2@2D2H2L2P2T2X2\2
000000013C19 000010013C19 0 2d2h2l2p2t2x2|2
000000013C6B 000010013C6B 0 3(3<3L3P3\3p3|3
000000013C93 000010013C93 0 4(44484D4L4T4h4t4
000000013CBF 000010013CBF 0 5$505L5T5\5h5
000000013CE1 000010013CE1 0 6$606L6T6
000000013CFF 000010013CFF 0 7,747@7\7d7x7
000000013D21 000010013D21 0 8 8(8D8
000000013D3D 000010013D3D 0 9$9(9,949<9H9P9l9
000000013D69 000010013D69 0 :0:<:@:D:H:T:\:h:
000000013D8B 000010013D8B 0 ;,;4;@;\;d;p;
000000013DB1 000010013DB1 0 <$<,<8<T<\<d<p<
000000013DD9 000010013DD9 0 =$=0=L=T=\=d=p=
000000013DFD 000010013DFD 0 >,><>P>d>p>
000000013E1F 000010013E1F 0 ?4?<?H?d?l?t?|?
000000013E53 000010013E53 0 0$0,040<0P0\0
000000013E61 000010013E61 0 0d0l0t0
000000013E7F 000010013E7F 0 1,181@1\1d1
000000013E9B 000010013E9B 0 2 2<2D2P2l2x2
000000013EB7 000010013EB7 0 343@3\3h3
000000013ECF 000010013ECF 0 3 4,444D4P4X4l4|4
000000013EED 000010013EED 0 5$5,545<5D5T5\5d5t5
000000013F15 000010013F15 0 646P6\6d6p6x6
000000013F33 000010013F33 0 7$70787T7p7|7
000000013F59 000010013F59 0 8 8(8D8
000000013F7B 000010013F7B 0 9$9,949D9P9l9t9|9
000000013F97 000010013F97 0 :$:4:D:P:l:t:|:
000000013FC5 000010013FC5 0 0 0$0(0H0