.- - -----÷M ÷E ÷N ÷U ÷------------------------------------------------------------- --- ---- -------------.
! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV !
`-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
ATM MALWARE NOTICE
5f70c76b6771b7c56bc5da34e424eb9a090cedeb807c795795a88c415a2e772c
Date...........: 2017-07-17
Family.........: DispCash.10
File name......: cuinfo.exe
File size......: 49.00 KB
Type file......: EXE/Windows
Virscan........: VT HA Additional note: Might be 'legitimate' but as this file is questionable we added it to the wall.
Used for obtaining information on the number of banknote in casettes.
Apparently used by Cobalt group, "Cobalt evolution and joint operations" (group-ib, may 2018)
Entropy:
Binary Histogram:
=== SCREENSHOT ===
=== PEDUMP REPORT ===
Click to see === MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 128 0x80
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 8 8
TimeDateStamp: "2015-07-13 22:43:23"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 783 0x30f RELOCS_STRIPPED, EXECUTABLE_IMAGE
LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED
32BIT_MACHINE, DEBUG_STRIPPED
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 2.23
SizeOfCode: 35840 0x8c00
SizeOfInitializedData: 49152 0xc000
SizeOfUninitializedData: 3072 0xc00
AddressOfEntryPoint: 5488 0x1570
BaseOfCode: 4096 0x1000
BaseOfData: 40960 0xa000
ImageBase: 4194304 0x400000
SectionAlignment: 4096 0x1000
FileAlignment: 512 0x200
OperatingSystemVersion: 4.0
ImageVersion: 1.0
SubsystemVersion: 4.0
Reserved1: 0 0
SizeOfImage: 73728 0x12000
SizeOfHeaders: 1024 0x400
CheckSum: 93371 0x16cbb
Subsystem: 3 3 WINDOWS_CUI
DllCharacteristics: 0 0
SizeOfStackReserve: 2097152 0x200000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 0 size:0x 0
IMPORT rva:0x f000 size:0x 790
RESOURCE rva:0x 0 size:0x 0
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x 0 size:0x 0
DEBUG rva:0x 0 size:0x 0
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 11000 size:0x 18
LOAD_CONFIG rva:0x 0 size:0x 0
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x f194 size:0x 11c
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 0 size:0x 0
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 1000 8b74 8c00 400 0 0 0 0 60500060 R-X CODE IDATA
.data a000 28 200 9000 0 0 0 0 c0300040 RW- IDATA
.rdata b000 fc4 1000 9200 0 0 0 0 40600040 R-- IDATA
.eh_fram c000 1500 1600 a200 0 0 0 0 40300040 R-- IDATA
.bss e000 a30 0 0 0 0 0 0 c0600080 RW- UDATA
.idata f000 790 800 b800 0 0 0 0 c0300040 RW- IDATA
.CRT 10000 18 200 c000 0 0 0 0 c0300040 RW- IDATA
.tls 11000 20 200 c200 0 0 0 0 c0300040 RW- IDATA
=== TLS ===
RAW_START RAW_END INDEX CALLBKS ZEROFILL FLAGS
411019 41101c 40e02c 410004 0 0
[?] can't find file_offset of VA 0xe02c
=== IMPORTS ===
MODULE_NAME HINT ORD FUNCTION_NAME
kernel32.dll cf DeleteCriticalSection
kernel32.dll ec EnterCriticalSection
kernel32.dll 117 ExitProcess
kernel32.dll 184 GetCommandLineA
kernel32.dll 1fe GetLastError
kernel32.dll 211 GetModuleHandleA
kernel32.dll 241 GetProcAddress
kernel32.dll 2de InitializeCriticalSection
kernel32.dll 2e8 InterlockedExchange
kernel32.dll 2fb IsDBCSLeadByteEx
kernel32.dll 32e LeaveCriticalSection
kernel32.dll 35c MultiByteToWideChar
kernel32.dll 474 SetUnhandledExceptionFilter
kernel32.dll 480 Sleep
kernel32.dll 495 TlsGetValue
kernel32.dll 4bd VirtualProtect
kernel32.dll 4bf VirtualQuery
kernel32.dll 4df WideCharToMultiByte
msvcrt.dll 50 _strdup
msvcrt.dll 52 _stricoll
msvcrt.dll 3b __getmainargs
msvcrt.dll 46 __mb_cur_max
msvcrt.dll 52 __p__environ
msvcrt.dll 54 __p__fmode
msvcrt.dll 69 __set_app_type
msvcrt.dll 9a _cexit
msvcrt.dll c0 _errno
msvcrt.dll d7 _findclose
msvcrt.dll d8 _findfirst
msvcrt.dll de _findnext
msvcrt.dll fe _fullpath
msvcrt.dll 128 _iob
msvcrt.dll 1a1 _onexit
msvcrt.dll 1d2 _setmode
msvcrt.dll 27f abort
msvcrt.dll 286 atexit
msvcrt.dll 288 atoi
msvcrt.dll 28b calloc
msvcrt.dll 2a4 fputc
msvcrt.dll 2a9 free
msvcrt.dll 2b1 fwrite
msvcrt.dll 2b5 getenv
msvcrt.dll 2c4 isspace
msvcrt.dll 2d7 localeconv
msvcrt.dll 2dc malloc
msvcrt.dll 2de mbstowcs
msvcrt.dll 2e2 memcpy
msvcrt.dll 2f2 realloc
msvcrt.dll 2f8 setlocale
msvcrt.dll 2fa signal
msvcrt.dll 302 strchr
msvcrt.dll 304 strcoll
msvcrt.dll 309 strlen
msvcrt.dll 30c strncpy
msvcrt.dll 318 system
msvcrt.dll 31e tolower
msvcrt.dll 324 vfprintf
msvcrt.dll 331 wcslen
msvcrt.dll 33c wcstombs
MSXFS.dll 22 WFSStartUp
MSXFS.dll 1f WFSOpen
MSXFS.dll 1e WFSLock
MSXFS.dll 1a WFSFreeResult
MSXFS.dll 1b WFSGetInfo
MSXFS.dll 14 WFSCleanUp
MSXFS.dll 15 WFSClose
MSXFS.dll 24 WFSUnlock
=== Strings ===
Click to see
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
000000000178 000000400178 0 .text
0000000001A0 0000004001A0 0 .data
0000000001C8 0000004001C8 0 .rdata
0000000001EF 0000004001EF 0 @.eh_fram
000000000216 000000400216 0 0@.bss
000000000240 000000400240 0 .idata
000000000C52 000000401852 0 SUBKf
000000000C8D 00000040188D 0 VALUf
000000000CCA 0000004018CA 0 EMPTf
000000000D01 000000401901 0 _LONf
000000000D3A 00000040193A 0 ITEMf
000000000D71 000000401971 0 O_LOf
000000000DA5 0000004019A5 0 READf
000000000DD5 0000004019D5 0 _ERRf
000000000E09 000000401A09 0 _ERRf
000000000E7A 000000401A7A 0 HANDf
000000000EB3 000000401AB3 0 BUFFf
000000000FBC 000000401BBC 0 VIDEf
000000001083 000000401C83 0 REQ_f
0000000010B7 000000401CB7 0 RESUf
000000001123 000000401D23 0 TIMEf
00000000115A 000000401D5A 0 ELEVf
000000001185 000000401D85 0 LOCKf
000000001213 000000401E13 0 THREf
000000001264 000000401E64 0 LOCKf
0000000012F3 000000401EF3 0 STERf
000000001327 000000401F27 0 OGREf
00000000135B 000000401F5B 0 EMORf
000000001392 000000401F92 0 FOUNf
00000000142A 00000040202A 0 _HIGf
0000000014E3 0000004020E3 0 OMMAf
000000001525 000000402125 0 _SRVf
000000001583 000000402183 0 _ERRf
0000000015DE 0000004021DE 0 _ERRf
0000000016AF 0000004022AF 0 ERROf
00000000176A 00000040236A 0 CYMIf
0000000017A1 0000004023A1 0 NSABf
00000000180E 00000040240E 0 ITIOf
00000000187C 00000040247C 0 OTOPf
0000000018EA 0000004024EA 0 LOSEf
000000001981 000000402581 0 ACTIf
000000001A3A 00000040263A 0 OITEf
000000001AAC 0000004026AC 0 NKNOf
000000001AE3 0000004026E3 0 STAKf
000000001BA8 0000004027A8 0 SITIf
000000001BEA 0000004027EA 0 CTARf
000000001CAA 0000004028AA 0 TAKEf
000000001CDA 0000004028DA 0 SLEFf
000000002F4E 000000403B4E 0 <\t?</t;
000000005519 000000406119 0 D$p9D$0
0000000061FD 000000406DFD 0 )D$,)
0000000065B9 0000004071B9 0 L$\9L$
0000000071BE 000000407DBE 0 9l$Xv,
00000000723C 000000407E3C 0 9|$Xv7
0000000088B3 0000004094B3 0 r/9D$
000000008DF3 0000004099F3 0 EMPTf
000000009200 00000040B000 0 libgcc_s_dw2-1.dll
000000009213 00000040B013 0 __register_frame_info
000000009229 00000040B029 0 libgcj-13.dll
File pos Mem pos ID Text
======== ======= == ====
000000009237 00000040B037 0 _Jv_RegisterClasses
00000000924B 00000040B04B 0 __deregister_frame_info
0000000097A8 00000040B5A8 0 Usage: %s <Service Logical Name>
0000000097CC 00000040B5CC 0 WFSStartUp failed with error: %s
0000000097F0 00000040B5F0 0 WFSVERSION:
0000000097FC 00000040B5FC 0 wVersion: 0x%X
00000000980C 00000040B60C 0 wLowVersion: 0x%X
00000000981F 00000040B61F 0 wHighVersion: 0x%X
000000009833 00000040B633 0 szDescription: %s
000000009846 00000040B646 0 szSystemStatus: %s
00000000985C 00000040B65C 0 WFSOpen(%s) failed with error: %s
00000000987F 00000040B67F 0 pause
000000009888 00000040B688 0 WFSLock failed with error: %s
0000000098A8 00000040B6A8 0 WFSFreeResult failed with error: %s
0000000098D0 00000040B6D0 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s
00000000990F 00000040B70F 0 REJECTCASSETTE
00000000991E 00000040B71E 0 BILLCASSETTE
00000000992B 00000040B72B 0 COINCYLINDER
000000009938 00000040B738 0 COINDISPENSER
000000009946 00000040B746 0 RETRACTCASSETTE
000000009956 00000040B756 0 COUPON
00000000995D 00000040B75D 0 DOCUMENT
000000009966 00000040B766 0 REPCONTAINER
000000009973 00000040B773 0 RECYCLINGCASSETTE
000000009985 00000040B785 0 NOTAPPLICABLE
000000009993 00000040B793 0 NOVALUES
00000000999C 00000040B79C 0 NOREFERENCE
0000000099A8 00000040B7A8 0 MANIPULATED
0000000099B4 00000040B7B4 0 INOPERATIVE
0000000099C0 00000040B7C0 0 ----------------------------
0000000099E0 00000040B7E0 0 Cash Unit # %d
0000000099EF 00000040B7EF 0 Type: %s
0000000099F8 00000040B7F8 0 Status: %s
000000009A03 00000040B803 0 Currency ID: %.3s
000000009A15 00000040B815 0 Note Value: %u
000000009A24 00000040B824 0 Notes Count: %u
000000009A34 00000040B834 0 Notes Initial Count: %u
000000009A4C 00000040B84C 0 Notes Minimum Count: %u
000000009A64 00000040B864 0 Notes Maximum Count: %u
000000009A80 00000040B880 0 WFSUnlock failed with error: %s
000000009AA4 00000040B8A4 0 WFSClose failed with error: %s
000000009AC4 00000040B8C4 0 WFSCleanUp failed with error: %s
000000009AE7 00000040B8E7 0 Success
000000009B4C 00000040B94C 0 Mingw runtime failure:
000000009B64 00000040B964 0 VirtualQuery failed for %d bytes at address %p
000000009B98 00000040B998 0 Unknown pseudo relocation protocol version %d.
000000009BCC 00000040B9CC 0 Unknown pseudo relocation bit size %d.
000000009BFA 00000040B9FA 0 glob-1.0-mingw32
000000009C2A 00000040BA2A 0 (null)
000000009C31 00000040BA31 0 PRINTF_EXPONENT_DIGITS
000000009DB8 00000040BBB8 0 Infinity
000000009DDF 00000040BBDF 0 ?aCoc
000000009DFF 00000040BBFF 0 <2ZGU
000000009F80 00000040BD80 0 GCC: (GNU) 4.8.1
000000009F94 00000040BD94 0 GCC: (GNU) 4.8.1
000000009FA8 00000040BDA8 0 GCC: (GNU) 4.8.1
000000009FBC 00000040BDBC 0 GCC: (GNU) 4.8.1
000000009FD0 00000040BDD0 0 GCC: (GNU) 4.8.1
000000009FE4 00000040BDE4 0 GCC: (GNU) 4.8.1
000000009FF8 00000040BDF8 0 GCC: (GNU) 4.8.1
File pos Mem pos ID Text
======== ======= == ====
00000000A00C 00000040BE0C 0 GCC: (GNU) 4.8.1
00000000A020 00000040BE20 0 GCC: (GNU) 4.8.1
00000000A034 00000040BE34 0 GCC: (GNU) 4.8.1
00000000A048 00000040BE48 0 GCC: (GNU) 4.8.1
00000000A05C 00000040BE5C 0 GCC: (GNU) 4.8.1
00000000A070 00000040BE70 0 GCC: (GNU) 4.8.1
00000000A084 00000040BE84 0 GCC: (GNU) 4.8.1
00000000A098 00000040BE98 0 GCC: (GNU) 4.8.1
00000000A0AC 00000040BEAC 0 GCC: (GNU) 4.8.1
00000000A0C0 00000040BEC0 0 GCC: (GNU) 4.8.1
00000000A0D4 00000040BED4 0 GCC: (GNU) 4.8.1
00000000A0E8 00000040BEE8 0 GCC: (GNU) 4.8.1
00000000A0FC 00000040BEFC 0 GCC: (GNU) 4.8.1
00000000A110 00000040BF10 0 GCC: (GNU) 4.8.1
00000000A124 00000040BF24 0 GCC: (GNU) 4.8.1
00000000A138 00000040BF38 0 GCC: (GNU) 4.8.1
00000000A14C 00000040BF4C 0 GCC: (GNU) 4.8.1
00000000A160 00000040BF60 0 GCC: (GNU) 4.8.1
00000000A174 00000040BF74 0 GCC: (GNU) 4.8.1
00000000A188 00000040BF88 0 GCC: (GNU) 4.8.1
00000000A19C 00000040BF9C 0 GCC: (GNU) 4.8.1
00000000A1B0 00000040BFB0 0 GCC: (GNU) 4.8.1
00000000BAB2 00000040F2B2 0 DeleteCriticalSection
00000000BACA 00000040F2CA 0 EnterCriticalSection
00000000BAE2 00000040F2E2 0 ExitProcess
00000000BAF0 00000040F2F0 0 GetCommandLineA
00000000BB02 00000040F302 0 GetLastError
00000000BB12 00000040F312 0 GetModuleHandleA
00000000BB26 00000040F326 0 GetProcAddress
00000000BB38 00000040F338 0 InitializeCriticalSection
00000000BB54 00000040F354 0 InterlockedExchange
00000000BB6A 00000040F36A 0 IsDBCSLeadByteEx
00000000BB7E 00000040F37E 0 LeaveCriticalSection
00000000BB96 00000040F396 0 MultiByteToWideChar
00000000BBAC 00000040F3AC 0 SetUnhandledExceptionFilter
00000000BBCA 00000040F3CA 0 Sleep
00000000BBD2 00000040F3D2 0 TlsGetValue
00000000BBE0 00000040F3E0 0 VirtualProtect
00000000BBF2 00000040F3F2 0 VirtualQuery
00000000BC02 00000040F402 0 WideCharToMultiByte
00000000BC18 00000040F418 0 _strdup
00000000BC22 00000040F422 0 _stricoll
00000000BC2E 00000040F42E 0 __getmainargs
00000000BC3E 00000040F43E 0 __mb_cur_max
00000000BC4E 00000040F44E 0 __p__environ
00000000BC5E 00000040F45E 0 __p__fmode
00000000BC6C 00000040F46C 0 __set_app_type
00000000BC7E 00000040F47E 0 _cexit
00000000BC88 00000040F488 0 _errno
00000000BC92 00000040F492 0 _findclose
00000000BCA0 00000040F4A0 0 _findfirst
00000000BCAE 00000040F4AE 0 _findnext
00000000BCBA 00000040F4BA 0 _fullpath
00000000BCCE 00000040F4CE 0 _onexit
00000000BCD8 00000040F4D8 0 _setmode
00000000BCE4 00000040F4E4 0 abort
00000000BCEC 00000040F4EC 0 atexit
00000000BCFE 00000040F4FE 0 calloc
00000000BD08 00000040F508 0 fputc
00000000BD18 00000040F518 0 fwrite
File pos Mem pos ID Text
======== ======= == ====
00000000BD22 00000040F522 0 getenv
00000000BD2C 00000040F52C 0 isspace
00000000BD36 00000040F536 0 localeconv
00000000BD44 00000040F544 0 malloc
00000000BD4E 00000040F54E 0 mbstowcs
00000000BD5A 00000040F55A 0 memcpy
00000000BD64 00000040F564 0 realloc
00000000BD6E 00000040F56E 0 setlocale
00000000BD7A 00000040F57A 0 signal
00000000BD84 00000040F584 0 strchr
00000000BD8E 00000040F58E 0 strcoll
00000000BD98 00000040F598 0 strlen
00000000BDA2 00000040F5A2 0 strncpy
00000000BDAC 00000040F5AC 0 system
00000000BDB6 00000040F5B6 0 tolower
00000000BDC0 00000040F5C0 0 vfprintf
00000000BDCC 00000040F5CC 0 wcslen
00000000BDD6 00000040F5D6 0 wcstombs
00000000BDE0 00000040F5E0 0 MSXFS.dll
00000000BDEE 00000040F5EE 0 WFSStartUp
00000000BE02 00000040F602 0 WFSOpen
00000000BE12 00000040F612 0 WFSLock
00000000BE22 00000040F622 0 WFSFreeResult
00000000BE36 00000040F636 0 WFSGetInfo
00000000BE4A 00000040F64A 0 WFSCleanUp
00000000BE5E 00000040F65E 0 WFSClose
00000000BE6E 00000040F66E 0 WFSUnlock
00000000BEC4 00000040F6C4 0 kernel32.dll
00000000BEDC 00000040F6DC 0 msvcrt.dll
00000000BF84 00000040F784 0 msvcrt.dll
000000009C1B 00000040BA1B 0 f(null)
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
000000000178 000000400178 0 .text
0000000001A0 0000004001A0 0 .data
0000000001C8 0000004001C8 0 .rdata
0000000001EF 0000004001EF 0 @.eh_fram
000000000216 000000400216 0 0@.bss
000000000240 000000400240 0 .idata
000000000C52 000000401852 0 SUBKf
000000000C8D 00000040188D 0 VALUf
000000000CCA 0000004018CA 0 EMPTf
000000000D01 000000401901 0 _LONf
000000000D3A 00000040193A 0 ITEMf
000000000D71 000000401971 0 O_LOf
000000000DA5 0000004019A5 0 READf
000000000DD5 0000004019D5 0 _ERRf
000000000E09 000000401A09 0 _ERRf
000000000E7A 000000401A7A 0 HANDf
000000000EB3 000000401AB3 0 BUFFf
000000000FBC 000000401BBC 0 VIDEf
000000001083 000000401C83 0 REQ_f
0000000010B7 000000401CB7 0 RESUf
000000001123 000000401D23 0 TIMEf
00000000115A 000000401D5A 0 ELEVf
000000001185 000000401D85 0 LOCKf
000000001213 000000401E13 0 THREf
000000001264 000000401E64 0 LOCKf
0000000012F3 000000401EF3 0 STERf
000000001327 000000401F27 0 OGREf
00000000135B 000000401F5B 0 EMORf
File pos Mem pos ID Text
======== ======= == ====
000000001392 000000401F92 0 FOUNf
00000000142A 00000040202A 0 _HIGf
0000000014E3 0000004020E3 0 OMMAf
000000001525 000000402125 0 _SRVf
000000001583 000000402183 0 _ERRf
0000000015DE 0000004021DE 0 _ERRf
0000000016AF 0000004022AF 0 ERROf
00000000176A 00000040236A 0 CYMIf
0000000017A1 0000004023A1 0 NSABf
00000000180E 00000040240E 0 ITIOf
00000000187C 00000040247C 0 OTOPf
0000000018EA 0000004024EA 0 LOSEf
000000001981 000000402581 0 ACTIf
000000001A3A 00000040263A 0 OITEf
000000001AAC 0000004026AC 0 NKNOf
000000001AE3 0000004026E3 0 STAKf
000000001BA8 0000004027A8 0 SITIf
000000001BEA 0000004027EA 0 CTARf
000000001CAA 0000004028AA 0 TAKEf
000000001CDA 0000004028DA 0 SLEFf
000000002F4E 000000403B4E 0 <\t?</t;
000000005519 000000406119 0 D$p9D$0
0000000061FD 000000406DFD 0 )D$,)
0000000065B9 0000004071B9 0 L$\9L$
0000000071BE 000000407DBE 0 9l$Xv,
00000000723C 000000407E3C 0 9|$Xv7
0000000088B3 0000004094B3 0 r/9D$
000000008DF3 0000004099F3 0 EMPTf
000000009200 00000040B000 0 libgcc_s_dw2-1.dll
000000009213 00000040B013 0 __register_frame_info
000000009229 00000040B029 0 libgcj-13.dll
000000009237 00000040B037 0 _Jv_RegisterClasses
00000000924B 00000040B04B 0 __deregister_frame_info
0000000097A8 00000040B5A8 0 Usage: %s <Service Logical Name>
0000000097CC 00000040B5CC 0 WFSStartUp failed with error: %s
0000000097F0 00000040B5F0 0 WFSVERSION:
0000000097FC 00000040B5FC 0 wVersion: 0x%X
00000000980C 00000040B60C 0 wLowVersion: 0x%X
00000000981F 00000040B61F 0 wHighVersion: 0x%X
000000009833 00000040B633 0 szDescription: %s
000000009846 00000040B646 0 szSystemStatus: %s
00000000985C 00000040B65C 0 WFSOpen(%s) failed with error: %s
00000000987F 00000040B67F 0 pause
000000009888 00000040B688 0 WFSLock failed with error: %s
0000000098A8 00000040B6A8 0 WFSFreeResult failed with error: %s
0000000098D0 00000040B6D0 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s
00000000990F 00000040B70F 0 REJECTCASSETTE
00000000991E 00000040B71E 0 BILLCASSETTE
00000000992B 00000040B72B 0 COINCYLINDER
000000009938 00000040B738 0 COINDISPENSER
000000009946 00000040B746 0 RETRACTCASSETTE
000000009956 00000040B756 0 COUPON
00000000995D 00000040B75D 0 DOCUMENT
000000009966 00000040B766 0 REPCONTAINER
000000009973 00000040B773 0 RECYCLINGCASSETTE
000000009985 00000040B785 0 NOTAPPLICABLE
000000009993 00000040B793 0 NOVALUES
00000000999C 00000040B79C 0 NOREFERENCE
0000000099A8 00000040B7A8 0 MANIPULATED
0000000099B4 00000040B7B4 0 INOPERATIVE
File pos Mem pos ID Text
======== ======= == ====
0000000099C0 00000040B7C0 0 ----------------------------
0000000099E0 00000040B7E0 0 Cash Unit # %d
0000000099EF 00000040B7EF 0 Type: %s
0000000099F8 00000040B7F8 0 Status: %s
000000009A03 00000040B803 0 Currency ID: %.3s
000000009A15 00000040B815 0 Note Value: %u
000000009A24 00000040B824 0 Notes Count: %u
000000009A34 00000040B834 0 Notes Initial Count: %u
000000009A4C 00000040B84C 0 Notes Minimum Count: %u
000000009A64 00000040B864 0 Notes Maximum Count: %u
000000009A80 00000040B880 0 WFSUnlock failed with error: %s
000000009AA4 00000040B8A4 0 WFSClose failed with error: %s
000000009AC4 00000040B8C4 0 WFSCleanUp failed with error: %s
000000009AE7 00000040B8E7 0 Success
000000009B4C 00000040B94C 0 Mingw runtime failure:
000000009B64 00000040B964 0 VirtualQuery failed for %d bytes at address %p
000000009B98 00000040B998 0 Unknown pseudo relocation protocol version %d.
000000009BCC 00000040B9CC 0 Unknown pseudo relocation bit size %d.
000000009BFA 00000040B9FA 0 glob-1.0-mingw32
000000009C2A 00000040BA2A 0 (null)
000000009C31 00000040BA31 0 PRINTF_EXPONENT_DIGITS
000000009DB8 00000040BBB8 0 Infinity
000000009DDF 00000040BBDF 0 ?aCoc
000000009DFF 00000040BBFF 0 <2ZGU
000000009F80 00000040BD80 0 GCC: (GNU) 4.8.1
000000009F94 00000040BD94 0 GCC: (GNU) 4.8.1
000000009FA8 00000040BDA8 0 GCC: (GNU) 4.8.1
000000009FBC 00000040BDBC 0 GCC: (GNU) 4.8.1
000000009FD0 00000040BDD0 0 GCC: (GNU) 4.8.1
000000009FE4 00000040BDE4 0 GCC: (GNU) 4.8.1
000000009FF8 00000040BDF8 0 GCC: (GNU) 4.8.1
00000000A00C 00000040BE0C 0 GCC: (GNU) 4.8.1
00000000A020 00000040BE20 0 GCC: (GNU) 4.8.1
00000000A034 00000040BE34 0 GCC: (GNU) 4.8.1
00000000A048 00000040BE48 0 GCC: (GNU) 4.8.1
00000000A05C 00000040BE5C 0 GCC: (GNU) 4.8.1
00000000A070 00000040BE70 0 GCC: (GNU) 4.8.1
00000000A084 00000040BE84 0 GCC: (GNU) 4.8.1
00000000A098 00000040BE98 0 GCC: (GNU) 4.8.1
00000000A0AC 00000040BEAC 0 GCC: (GNU) 4.8.1
00000000A0C0 00000040BEC0 0 GCC: (GNU) 4.8.1
00000000A0D4 00000040BED4 0 GCC: (GNU) 4.8.1
00000000A0E8 00000040BEE8 0 GCC: (GNU) 4.8.1
00000000A0FC 00000040BEFC 0 GCC: (GNU) 4.8.1
00000000A110 00000040BF10 0 GCC: (GNU) 4.8.1
00000000A124 00000040BF24 0 GCC: (GNU) 4.8.1
00000000A138 00000040BF38 0 GCC: (GNU) 4.8.1
00000000A14C 00000040BF4C 0 GCC: (GNU) 4.8.1
00000000A160 00000040BF60 0 GCC: (GNU) 4.8.1
00000000A174 00000040BF74 0 GCC: (GNU) 4.8.1
00000000A188 00000040BF88 0 GCC: (GNU) 4.8.1
00000000A19C 00000040BF9C 0 GCC: (GNU) 4.8.1
00000000A1B0 00000040BFB0 0 GCC: (GNU) 4.8.1
00000000BAB2 00000040F2B2 0 DeleteCriticalSection
00000000BACA 00000040F2CA 0 EnterCriticalSection
00000000BAE2 00000040F2E2 0 ExitProcess
00000000BAF0 00000040F2F0 0 GetCommandLineA
00000000BB02 00000040F302 0 GetLastError
00000000BB12 00000040F312 0 GetModuleHandleA
00000000BB26 00000040F326 0 GetProcAddress
File pos Mem pos ID Text
======== ======= == ====
00000000BB38 00000040F338 0 InitializeCriticalSection
00000000BB54 00000040F354 0 InterlockedExchange
00000000BB6A 00000040F36A 0 IsDBCSLeadByteEx
00000000BB7E 00000040F37E 0 LeaveCriticalSection
00000000BB96 00000040F396 0 MultiByteToWideChar
00000000BBAC 00000040F3AC 0 SetUnhandledExceptionFilter
00000000BBCA 00000040F3CA 0 Sleep
00000000BBD2 00000040F3D2 0 TlsGetValue
00000000BBE0 00000040F3E0 0 VirtualProtect
00000000BBF2 00000040F3F2 0 VirtualQuery
00000000BC02 00000040F402 0 WideCharToMultiByte
00000000BC18 00000040F418 0 _strdup
00000000BC22 00000040F422 0 _stricoll
00000000BC2E 00000040F42E 0 __getmainargs
00000000BC3E 00000040F43E 0 __mb_cur_max
00000000BC4E 00000040F44E 0 __p__environ
00000000BC5E 00000040F45E 0 __p__fmode
00000000BC6C 00000040F46C 0 __set_app_type
00000000BC7E 00000040F47E 0 _cexit
00000000BC88 00000040F488 0 _errno
00000000BC92 00000040F492 0 _findclose
00000000BCA0 00000040F4A0 0 _findfirst
00000000BCAE 00000040F4AE 0 _findnext
00000000BCBA 00000040F4BA 0 _fullpath
00000000BCCE 00000040F4CE 0 _onexit
00000000BCD8 00000040F4D8 0 _setmode
00000000BCE4 00000040F4E4 0 abort
00000000BCEC 00000040F4EC 0 atexit
00000000BCFE 00000040F4FE 0 calloc
00000000BD08 00000040F508 0 fputc
00000000BD18 00000040F518 0 fwrite
00000000BD22 00000040F522 0 getenv
00000000BD2C 00000040F52C 0 isspace
00000000BD36 00000040F536 0 localeconv
00000000BD44 00000040F544 0 malloc
00000000BD4E 00000040F54E 0 mbstowcs
00000000BD5A 00000040F55A 0 memcpy
00000000BD64 00000040F564 0 realloc
00000000BD6E 00000040F56E 0 setlocale
00000000BD7A 00000040F57A 0 signal
00000000BD84 00000040F584 0 strchr
00000000BD8E 00000040F58E 0 strcoll
00000000BD98 00000040F598 0 strlen
00000000BDA2 00000040F5A2 0 strncpy
00000000BDAC 00000040F5AC 0 system
00000000BDB6 00000040F5B6 0 tolower
00000000BDC0 00000040F5C0 0 vfprintf
00000000BDCC 00000040F5CC 0 wcslen
00000000BDD6 00000040F5D6 0 wcstombs
00000000BDE0 00000040F5E0 0 MSXFS.dll
00000000BDEE 00000040F5EE 0 WFSStartUp
00000000BE02 00000040F602 0 WFSOpen
00000000BE12 00000040F612 0 WFSLock
00000000BE22 00000040F622 0 WFSFreeResult
00000000BE36 00000040F636 0 WFSGetInfo
00000000BE4A 00000040F64A 0 WFSCleanUp
00000000BE5E 00000040F65E 0 WFSClose
00000000BE6E 00000040F66E 0 WFSUnlock
00000000BEC4 00000040F6C4 0 kernel32.dll
00000000BEDC 00000040F6DC 0 msvcrt.dll
File pos Mem pos ID Text
======== ======= == ====
00000000BF84 00000040F784 0 msvcrt.dll
000000009C1B 00000040BA1B 0 f(null)
=== DOWNLOAD ===
Mirror provided by vx-underground.org, thx! 
Binary Histogram:
=== SCREENSHOT ===
=== PEDUMP REPORT ===
=== MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 128 0x80
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 8 8
TimeDateStamp: "2015-07-13 22:43:23"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 783 0x30f RELOCS_STRIPPED, EXECUTABLE_IMAGE
LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED
32BIT_MACHINE, DEBUG_STRIPPED
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 2.23
SizeOfCode: 35840 0x8c00
SizeOfInitializedData: 49152 0xc000
SizeOfUninitializedData: 3072 0xc00
AddressOfEntryPoint: 5488 0x1570
BaseOfCode: 4096 0x1000
BaseOfData: 40960 0xa000
ImageBase: 4194304 0x400000
SectionAlignment: 4096 0x1000
FileAlignment: 512 0x200
OperatingSystemVersion: 4.0
ImageVersion: 1.0
SubsystemVersion: 4.0
Reserved1: 0 0
SizeOfImage: 73728 0x12000
SizeOfHeaders: 1024 0x400
CheckSum: 93371 0x16cbb
Subsystem: 3 3 WINDOWS_CUI
DllCharacteristics: 0 0
SizeOfStackReserve: 2097152 0x200000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 0 size:0x 0
IMPORT rva:0x f000 size:0x 790
RESOURCE rva:0x 0 size:0x 0
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x 0 size:0x 0
DEBUG rva:0x 0 size:0x 0
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 11000 size:0x 18
LOAD_CONFIG rva:0x 0 size:0x 0
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x f194 size:0x 11c
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 0 size:0x 0
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 1000 8b74 8c00 400 0 0 0 0 60500060 R-X CODE IDATA
.data a000 28 200 9000 0 0 0 0 c0300040 RW- IDATA
.rdata b000 fc4 1000 9200 0 0 0 0 40600040 R-- IDATA
.eh_fram c000 1500 1600 a200 0 0 0 0 40300040 R-- IDATA
.bss e000 a30 0 0 0 0 0 0 c0600080 RW- UDATA
.idata f000 790 800 b800 0 0 0 0 c0300040 RW- IDATA
.CRT 10000 18 200 c000 0 0 0 0 c0300040 RW- IDATA
.tls 11000 20 200 c200 0 0 0 0 c0300040 RW- IDATA
=== TLS ===
RAW_START RAW_END INDEX CALLBKS ZEROFILL FLAGS
411019 41101c 40e02c 410004 0 0
[?] can't find file_offset of VA 0xe02c
=== IMPORTS ===
MODULE_NAME HINT ORD FUNCTION_NAME
kernel32.dll cf DeleteCriticalSection
kernel32.dll ec EnterCriticalSection
kernel32.dll 117 ExitProcess
kernel32.dll 184 GetCommandLineA
kernel32.dll 1fe GetLastError
kernel32.dll 211 GetModuleHandleA
kernel32.dll 241 GetProcAddress
kernel32.dll 2de InitializeCriticalSection
kernel32.dll 2e8 InterlockedExchange
kernel32.dll 2fb IsDBCSLeadByteEx
kernel32.dll 32e LeaveCriticalSection
kernel32.dll 35c MultiByteToWideChar
kernel32.dll 474 SetUnhandledExceptionFilter
kernel32.dll 480 Sleep
kernel32.dll 495 TlsGetValue
kernel32.dll 4bd VirtualProtect
kernel32.dll 4bf VirtualQuery
kernel32.dll 4df WideCharToMultiByte
msvcrt.dll 50 _strdup
msvcrt.dll 52 _stricoll
msvcrt.dll 3b __getmainargs
msvcrt.dll 46 __mb_cur_max
msvcrt.dll 52 __p__environ
msvcrt.dll 54 __p__fmode
msvcrt.dll 69 __set_app_type
msvcrt.dll 9a _cexit
msvcrt.dll c0 _errno
msvcrt.dll d7 _findclose
msvcrt.dll d8 _findfirst
msvcrt.dll de _findnext
msvcrt.dll fe _fullpath
msvcrt.dll 128 _iob
msvcrt.dll 1a1 _onexit
msvcrt.dll 1d2 _setmode
msvcrt.dll 27f abort
msvcrt.dll 286 atexit
msvcrt.dll 288 atoi
msvcrt.dll 28b calloc
msvcrt.dll 2a4 fputc
msvcrt.dll 2a9 free
msvcrt.dll 2b1 fwrite
msvcrt.dll 2b5 getenv
msvcrt.dll 2c4 isspace
msvcrt.dll 2d7 localeconv
msvcrt.dll 2dc malloc
msvcrt.dll 2de mbstowcs
msvcrt.dll 2e2 memcpy
msvcrt.dll 2f2 realloc
msvcrt.dll 2f8 setlocale
msvcrt.dll 2fa signal
msvcrt.dll 302 strchr
msvcrt.dll 304 strcoll
msvcrt.dll 309 strlen
msvcrt.dll 30c strncpy
msvcrt.dll 318 system
msvcrt.dll 31e tolower
msvcrt.dll 324 vfprintf
msvcrt.dll 331 wcslen
msvcrt.dll 33c wcstombs
MSXFS.dll 22 WFSStartUp
MSXFS.dll 1f WFSOpen
MSXFS.dll 1e WFSLock
MSXFS.dll 1a WFSFreeResult
MSXFS.dll 1b WFSGetInfo
MSXFS.dll 14 WFSCleanUp
MSXFS.dll 15 WFSClose
MSXFS.dll 24 WFSUnlock
=== Strings ===
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
000000000178 000000400178 0 .text
0000000001A0 0000004001A0 0 .data
0000000001C8 0000004001C8 0 .rdata
0000000001EF 0000004001EF 0 @.eh_fram
000000000216 000000400216 0 0@.bss
000000000240 000000400240 0 .idata
000000000C52 000000401852 0 SUBKf
000000000C8D 00000040188D 0 VALUf
000000000CCA 0000004018CA 0 EMPTf
000000000D01 000000401901 0 _LONf
000000000D3A 00000040193A 0 ITEMf
000000000D71 000000401971 0 O_LOf
000000000DA5 0000004019A5 0 READf
000000000DD5 0000004019D5 0 _ERRf
000000000E09 000000401A09 0 _ERRf
000000000E7A 000000401A7A 0 HANDf
000000000EB3 000000401AB3 0 BUFFf
000000000FBC 000000401BBC 0 VIDEf
000000001083 000000401C83 0 REQ_f
0000000010B7 000000401CB7 0 RESUf
000000001123 000000401D23 0 TIMEf
00000000115A 000000401D5A 0 ELEVf
000000001185 000000401D85 0 LOCKf
000000001213 000000401E13 0 THREf
000000001264 000000401E64 0 LOCKf
0000000012F3 000000401EF3 0 STERf
000000001327 000000401F27 0 OGREf
00000000135B 000000401F5B 0 EMORf
000000001392 000000401F92 0 FOUNf
00000000142A 00000040202A 0 _HIGf
0000000014E3 0000004020E3 0 OMMAf
000000001525 000000402125 0 _SRVf
000000001583 000000402183 0 _ERRf
0000000015DE 0000004021DE 0 _ERRf
0000000016AF 0000004022AF 0 ERROf
00000000176A 00000040236A 0 CYMIf
0000000017A1 0000004023A1 0 NSABf
00000000180E 00000040240E 0 ITIOf
00000000187C 00000040247C 0 OTOPf
0000000018EA 0000004024EA 0 LOSEf
000000001981 000000402581 0 ACTIf
000000001A3A 00000040263A 0 OITEf
000000001AAC 0000004026AC 0 NKNOf
000000001AE3 0000004026E3 0 STAKf
000000001BA8 0000004027A8 0 SITIf
000000001BEA 0000004027EA 0 CTARf
000000001CAA 0000004028AA 0 TAKEf
000000001CDA 0000004028DA 0 SLEFf
000000002F4E 000000403B4E 0 <\t?</t;
000000005519 000000406119 0 D$p9D$0
0000000061FD 000000406DFD 0 )D$,)
0000000065B9 0000004071B9 0 L$\9L$
0000000071BE 000000407DBE 0 9l$Xv,
00000000723C 000000407E3C 0 9|$Xv7
0000000088B3 0000004094B3 0 r/9D$
000000008DF3 0000004099F3 0 EMPTf
000000009200 00000040B000 0 libgcc_s_dw2-1.dll
000000009213 00000040B013 0 __register_frame_info
000000009229 00000040B029 0 libgcj-13.dll
File pos Mem pos ID Text
======== ======= == ====
000000009237 00000040B037 0 _Jv_RegisterClasses
00000000924B 00000040B04B 0 __deregister_frame_info
0000000097A8 00000040B5A8 0 Usage: %s <Service Logical Name>
0000000097CC 00000040B5CC 0 WFSStartUp failed with error: %s
0000000097F0 00000040B5F0 0 WFSVERSION:
0000000097FC 00000040B5FC 0 wVersion: 0x%X
00000000980C 00000040B60C 0 wLowVersion: 0x%X
00000000981F 00000040B61F 0 wHighVersion: 0x%X
000000009833 00000040B633 0 szDescription: %s
000000009846 00000040B646 0 szSystemStatus: %s
00000000985C 00000040B65C 0 WFSOpen(%s) failed with error: %s
00000000987F 00000040B67F 0 pause
000000009888 00000040B688 0 WFSLock failed with error: %s
0000000098A8 00000040B6A8 0 WFSFreeResult failed with error: %s
0000000098D0 00000040B6D0 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s
00000000990F 00000040B70F 0 REJECTCASSETTE
00000000991E 00000040B71E 0 BILLCASSETTE
00000000992B 00000040B72B 0 COINCYLINDER
000000009938 00000040B738 0 COINDISPENSER
000000009946 00000040B746 0 RETRACTCASSETTE
000000009956 00000040B756 0 COUPON
00000000995D 00000040B75D 0 DOCUMENT
000000009966 00000040B766 0 REPCONTAINER
000000009973 00000040B773 0 RECYCLINGCASSETTE
000000009985 00000040B785 0 NOTAPPLICABLE
000000009993 00000040B793 0 NOVALUES
00000000999C 00000040B79C 0 NOREFERENCE
0000000099A8 00000040B7A8 0 MANIPULATED
0000000099B4 00000040B7B4 0 INOPERATIVE
0000000099C0 00000040B7C0 0 ----------------------------
0000000099E0 00000040B7E0 0 Cash Unit # %d
0000000099EF 00000040B7EF 0 Type: %s
0000000099F8 00000040B7F8 0 Status: %s
000000009A03 00000040B803 0 Currency ID: %.3s
000000009A15 00000040B815 0 Note Value: %u
000000009A24 00000040B824 0 Notes Count: %u
000000009A34 00000040B834 0 Notes Initial Count: %u
000000009A4C 00000040B84C 0 Notes Minimum Count: %u
000000009A64 00000040B864 0 Notes Maximum Count: %u
000000009A80 00000040B880 0 WFSUnlock failed with error: %s
000000009AA4 00000040B8A4 0 WFSClose failed with error: %s
000000009AC4 00000040B8C4 0 WFSCleanUp failed with error: %s
000000009AE7 00000040B8E7 0 Success
000000009B4C 00000040B94C 0 Mingw runtime failure:
000000009B64 00000040B964 0 VirtualQuery failed for %d bytes at address %p
000000009B98 00000040B998 0 Unknown pseudo relocation protocol version %d.
000000009BCC 00000040B9CC 0 Unknown pseudo relocation bit size %d.
000000009BFA 00000040B9FA 0 glob-1.0-mingw32
000000009C2A 00000040BA2A 0 (null)
000000009C31 00000040BA31 0 PRINTF_EXPONENT_DIGITS
000000009DB8 00000040BBB8 0 Infinity
000000009DDF 00000040BBDF 0 ?aCoc
000000009DFF 00000040BBFF 0 <2ZGU
000000009F80 00000040BD80 0 GCC: (GNU) 4.8.1
000000009F94 00000040BD94 0 GCC: (GNU) 4.8.1
000000009FA8 00000040BDA8 0 GCC: (GNU) 4.8.1
000000009FBC 00000040BDBC 0 GCC: (GNU) 4.8.1
000000009FD0 00000040BDD0 0 GCC: (GNU) 4.8.1
000000009FE4 00000040BDE4 0 GCC: (GNU) 4.8.1
000000009FF8 00000040BDF8 0 GCC: (GNU) 4.8.1
File pos Mem pos ID Text
======== ======= == ====
00000000A00C 00000040BE0C 0 GCC: (GNU) 4.8.1
00000000A020 00000040BE20 0 GCC: (GNU) 4.8.1
00000000A034 00000040BE34 0 GCC: (GNU) 4.8.1
00000000A048 00000040BE48 0 GCC: (GNU) 4.8.1
00000000A05C 00000040BE5C 0 GCC: (GNU) 4.8.1
00000000A070 00000040BE70 0 GCC: (GNU) 4.8.1
00000000A084 00000040BE84 0 GCC: (GNU) 4.8.1
00000000A098 00000040BE98 0 GCC: (GNU) 4.8.1
00000000A0AC 00000040BEAC 0 GCC: (GNU) 4.8.1
00000000A0C0 00000040BEC0 0 GCC: (GNU) 4.8.1
00000000A0D4 00000040BED4 0 GCC: (GNU) 4.8.1
00000000A0E8 00000040BEE8 0 GCC: (GNU) 4.8.1
00000000A0FC 00000040BEFC 0 GCC: (GNU) 4.8.1
00000000A110 00000040BF10 0 GCC: (GNU) 4.8.1
00000000A124 00000040BF24 0 GCC: (GNU) 4.8.1
00000000A138 00000040BF38 0 GCC: (GNU) 4.8.1
00000000A14C 00000040BF4C 0 GCC: (GNU) 4.8.1
00000000A160 00000040BF60 0 GCC: (GNU) 4.8.1
00000000A174 00000040BF74 0 GCC: (GNU) 4.8.1
00000000A188 00000040BF88 0 GCC: (GNU) 4.8.1
00000000A19C 00000040BF9C 0 GCC: (GNU) 4.8.1
00000000A1B0 00000040BFB0 0 GCC: (GNU) 4.8.1
00000000BAB2 00000040F2B2 0 DeleteCriticalSection
00000000BACA 00000040F2CA 0 EnterCriticalSection
00000000BAE2 00000040F2E2 0 ExitProcess
00000000BAF0 00000040F2F0 0 GetCommandLineA
00000000BB02 00000040F302 0 GetLastError
00000000BB12 00000040F312 0 GetModuleHandleA
00000000BB26 00000040F326 0 GetProcAddress
00000000BB38 00000040F338 0 InitializeCriticalSection
00000000BB54 00000040F354 0 InterlockedExchange
00000000BB6A 00000040F36A 0 IsDBCSLeadByteEx
00000000BB7E 00000040F37E 0 LeaveCriticalSection
00000000BB96 00000040F396 0 MultiByteToWideChar
00000000BBAC 00000040F3AC 0 SetUnhandledExceptionFilter
00000000BBCA 00000040F3CA 0 Sleep
00000000BBD2 00000040F3D2 0 TlsGetValue
00000000BBE0 00000040F3E0 0 VirtualProtect
00000000BBF2 00000040F3F2 0 VirtualQuery
00000000BC02 00000040F402 0 WideCharToMultiByte
00000000BC18 00000040F418 0 _strdup
00000000BC22 00000040F422 0 _stricoll
00000000BC2E 00000040F42E 0 __getmainargs
00000000BC3E 00000040F43E 0 __mb_cur_max
00000000BC4E 00000040F44E 0 __p__environ
00000000BC5E 00000040F45E 0 __p__fmode
00000000BC6C 00000040F46C 0 __set_app_type
00000000BC7E 00000040F47E 0 _cexit
00000000BC88 00000040F488 0 _errno
00000000BC92 00000040F492 0 _findclose
00000000BCA0 00000040F4A0 0 _findfirst
00000000BCAE 00000040F4AE 0 _findnext
00000000BCBA 00000040F4BA 0 _fullpath
00000000BCCE 00000040F4CE 0 _onexit
00000000BCD8 00000040F4D8 0 _setmode
00000000BCE4 00000040F4E4 0 abort
00000000BCEC 00000040F4EC 0 atexit
00000000BCFE 00000040F4FE 0 calloc
00000000BD08 00000040F508 0 fputc
00000000BD18 00000040F518 0 fwrite
File pos Mem pos ID Text
======== ======= == ====
00000000BD22 00000040F522 0 getenv
00000000BD2C 00000040F52C 0 isspace
00000000BD36 00000040F536 0 localeconv
00000000BD44 00000040F544 0 malloc
00000000BD4E 00000040F54E 0 mbstowcs
00000000BD5A 00000040F55A 0 memcpy
00000000BD64 00000040F564 0 realloc
00000000BD6E 00000040F56E 0 setlocale
00000000BD7A 00000040F57A 0 signal
00000000BD84 00000040F584 0 strchr
00000000BD8E 00000040F58E 0 strcoll
00000000BD98 00000040F598 0 strlen
00000000BDA2 00000040F5A2 0 strncpy
00000000BDAC 00000040F5AC 0 system
00000000BDB6 00000040F5B6 0 tolower
00000000BDC0 00000040F5C0 0 vfprintf
00000000BDCC 00000040F5CC 0 wcslen
00000000BDD6 00000040F5D6 0 wcstombs
00000000BDE0 00000040F5E0 0 MSXFS.dll
00000000BDEE 00000040F5EE 0 WFSStartUp
00000000BE02 00000040F602 0 WFSOpen
00000000BE12 00000040F612 0 WFSLock
00000000BE22 00000040F622 0 WFSFreeResult
00000000BE36 00000040F636 0 WFSGetInfo
00000000BE4A 00000040F64A 0 WFSCleanUp
00000000BE5E 00000040F65E 0 WFSClose
00000000BE6E 00000040F66E 0 WFSUnlock
00000000BEC4 00000040F6C4 0 kernel32.dll
00000000BEDC 00000040F6DC 0 msvcrt.dll
00000000BF84 00000040F784 0 msvcrt.dll
000000009C1B 00000040BA1B 0 f(null)
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
000000000178 000000400178 0 .text
0000000001A0 0000004001A0 0 .data
0000000001C8 0000004001C8 0 .rdata
0000000001EF 0000004001EF 0 @.eh_fram
000000000216 000000400216 0 0@.bss
000000000240 000000400240 0 .idata
000000000C52 000000401852 0 SUBKf
000000000C8D 00000040188D 0 VALUf
000000000CCA 0000004018CA 0 EMPTf
000000000D01 000000401901 0 _LONf
000000000D3A 00000040193A 0 ITEMf
000000000D71 000000401971 0 O_LOf
000000000DA5 0000004019A5 0 READf
000000000DD5 0000004019D5 0 _ERRf
000000000E09 000000401A09 0 _ERRf
000000000E7A 000000401A7A 0 HANDf
000000000EB3 000000401AB3 0 BUFFf
000000000FBC 000000401BBC 0 VIDEf
000000001083 000000401C83 0 REQ_f
0000000010B7 000000401CB7 0 RESUf
000000001123 000000401D23 0 TIMEf
00000000115A 000000401D5A 0 ELEVf
000000001185 000000401D85 0 LOCKf
000000001213 000000401E13 0 THREf
000000001264 000000401E64 0 LOCKf
0000000012F3 000000401EF3 0 STERf
000000001327 000000401F27 0 OGREf
00000000135B 000000401F5B 0 EMORf
File pos Mem pos ID Text
======== ======= == ====
000000001392 000000401F92 0 FOUNf
00000000142A 00000040202A 0 _HIGf
0000000014E3 0000004020E3 0 OMMAf
000000001525 000000402125 0 _SRVf
000000001583 000000402183 0 _ERRf
0000000015DE 0000004021DE 0 _ERRf
0000000016AF 0000004022AF 0 ERROf
00000000176A 00000040236A 0 CYMIf
0000000017A1 0000004023A1 0 NSABf
00000000180E 00000040240E 0 ITIOf
00000000187C 00000040247C 0 OTOPf
0000000018EA 0000004024EA 0 LOSEf
000000001981 000000402581 0 ACTIf
000000001A3A 00000040263A 0 OITEf
000000001AAC 0000004026AC 0 NKNOf
000000001AE3 0000004026E3 0 STAKf
000000001BA8 0000004027A8 0 SITIf
000000001BEA 0000004027EA 0 CTARf
000000001CAA 0000004028AA 0 TAKEf
000000001CDA 0000004028DA 0 SLEFf
000000002F4E 000000403B4E 0 <\t?</t;
000000005519 000000406119 0 D$p9D$0
0000000061FD 000000406DFD 0 )D$,)
0000000065B9 0000004071B9 0 L$\9L$
0000000071BE 000000407DBE 0 9l$Xv,
00000000723C 000000407E3C 0 9|$Xv7
0000000088B3 0000004094B3 0 r/9D$
000000008DF3 0000004099F3 0 EMPTf
000000009200 00000040B000 0 libgcc_s_dw2-1.dll
000000009213 00000040B013 0 __register_frame_info
000000009229 00000040B029 0 libgcj-13.dll
000000009237 00000040B037 0 _Jv_RegisterClasses
00000000924B 00000040B04B 0 __deregister_frame_info
0000000097A8 00000040B5A8 0 Usage: %s <Service Logical Name>
0000000097CC 00000040B5CC 0 WFSStartUp failed with error: %s
0000000097F0 00000040B5F0 0 WFSVERSION:
0000000097FC 00000040B5FC 0 wVersion: 0x%X
00000000980C 00000040B60C 0 wLowVersion: 0x%X
00000000981F 00000040B61F 0 wHighVersion: 0x%X
000000009833 00000040B633 0 szDescription: %s
000000009846 00000040B646 0 szSystemStatus: %s
00000000985C 00000040B65C 0 WFSOpen(%s) failed with error: %s
00000000987F 00000040B67F 0 pause
000000009888 00000040B688 0 WFSLock failed with error: %s
0000000098A8 00000040B6A8 0 WFSFreeResult failed with error: %s
0000000098D0 00000040B6D0 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s
00000000990F 00000040B70F 0 REJECTCASSETTE
00000000991E 00000040B71E 0 BILLCASSETTE
00000000992B 00000040B72B 0 COINCYLINDER
000000009938 00000040B738 0 COINDISPENSER
000000009946 00000040B746 0 RETRACTCASSETTE
000000009956 00000040B756 0 COUPON
00000000995D 00000040B75D 0 DOCUMENT
000000009966 00000040B766 0 REPCONTAINER
000000009973 00000040B773 0 RECYCLINGCASSETTE
000000009985 00000040B785 0 NOTAPPLICABLE
000000009993 00000040B793 0 NOVALUES
00000000999C 00000040B79C 0 NOREFERENCE
0000000099A8 00000040B7A8 0 MANIPULATED
0000000099B4 00000040B7B4 0 INOPERATIVE
File pos Mem pos ID Text
======== ======= == ====
0000000099C0 00000040B7C0 0 ----------------------------
0000000099E0 00000040B7E0 0 Cash Unit # %d
0000000099EF 00000040B7EF 0 Type: %s
0000000099F8 00000040B7F8 0 Status: %s
000000009A03 00000040B803 0 Currency ID: %.3s
000000009A15 00000040B815 0 Note Value: %u
000000009A24 00000040B824 0 Notes Count: %u
000000009A34 00000040B834 0 Notes Initial Count: %u
000000009A4C 00000040B84C 0 Notes Minimum Count: %u
000000009A64 00000040B864 0 Notes Maximum Count: %u
000000009A80 00000040B880 0 WFSUnlock failed with error: %s
000000009AA4 00000040B8A4 0 WFSClose failed with error: %s
000000009AC4 00000040B8C4 0 WFSCleanUp failed with error: %s
000000009AE7 00000040B8E7 0 Success
000000009B4C 00000040B94C 0 Mingw runtime failure:
000000009B64 00000040B964 0 VirtualQuery failed for %d bytes at address %p
000000009B98 00000040B998 0 Unknown pseudo relocation protocol version %d.
000000009BCC 00000040B9CC 0 Unknown pseudo relocation bit size %d.
000000009BFA 00000040B9FA 0 glob-1.0-mingw32
000000009C2A 00000040BA2A 0 (null)
000000009C31 00000040BA31 0 PRINTF_EXPONENT_DIGITS
000000009DB8 00000040BBB8 0 Infinity
000000009DDF 00000040BBDF 0 ?aCoc
000000009DFF 00000040BBFF 0 <2ZGU
000000009F80 00000040BD80 0 GCC: (GNU) 4.8.1
000000009F94 00000040BD94 0 GCC: (GNU) 4.8.1
000000009FA8 00000040BDA8 0 GCC: (GNU) 4.8.1
000000009FBC 00000040BDBC 0 GCC: (GNU) 4.8.1
000000009FD0 00000040BDD0 0 GCC: (GNU) 4.8.1
000000009FE4 00000040BDE4 0 GCC: (GNU) 4.8.1
000000009FF8 00000040BDF8 0 GCC: (GNU) 4.8.1
00000000A00C 00000040BE0C 0 GCC: (GNU) 4.8.1
00000000A020 00000040BE20 0 GCC: (GNU) 4.8.1
00000000A034 00000040BE34 0 GCC: (GNU) 4.8.1
00000000A048 00000040BE48 0 GCC: (GNU) 4.8.1
00000000A05C 00000040BE5C 0 GCC: (GNU) 4.8.1
00000000A070 00000040BE70 0 GCC: (GNU) 4.8.1
00000000A084 00000040BE84 0 GCC: (GNU) 4.8.1
00000000A098 00000040BE98 0 GCC: (GNU) 4.8.1
00000000A0AC 00000040BEAC 0 GCC: (GNU) 4.8.1
00000000A0C0 00000040BEC0 0 GCC: (GNU) 4.8.1
00000000A0D4 00000040BED4 0 GCC: (GNU) 4.8.1
00000000A0E8 00000040BEE8 0 GCC: (GNU) 4.8.1
00000000A0FC 00000040BEFC 0 GCC: (GNU) 4.8.1
00000000A110 00000040BF10 0 GCC: (GNU) 4.8.1
00000000A124 00000040BF24 0 GCC: (GNU) 4.8.1
00000000A138 00000040BF38 0 GCC: (GNU) 4.8.1
00000000A14C 00000040BF4C 0 GCC: (GNU) 4.8.1
00000000A160 00000040BF60 0 GCC: (GNU) 4.8.1
00000000A174 00000040BF74 0 GCC: (GNU) 4.8.1
00000000A188 00000040BF88 0 GCC: (GNU) 4.8.1
00000000A19C 00000040BF9C 0 GCC: (GNU) 4.8.1
00000000A1B0 00000040BFB0 0 GCC: (GNU) 4.8.1
00000000BAB2 00000040F2B2 0 DeleteCriticalSection
00000000BACA 00000040F2CA 0 EnterCriticalSection
00000000BAE2 00000040F2E2 0 ExitProcess
00000000BAF0 00000040F2F0 0 GetCommandLineA
00000000BB02 00000040F302 0 GetLastError
00000000BB12 00000040F312 0 GetModuleHandleA
00000000BB26 00000040F326 0 GetProcAddress
File pos Mem pos ID Text
======== ======= == ====
00000000BB38 00000040F338 0 InitializeCriticalSection
00000000BB54 00000040F354 0 InterlockedExchange
00000000BB6A 00000040F36A 0 IsDBCSLeadByteEx
00000000BB7E 00000040F37E 0 LeaveCriticalSection
00000000BB96 00000040F396 0 MultiByteToWideChar
00000000BBAC 00000040F3AC 0 SetUnhandledExceptionFilter
00000000BBCA 00000040F3CA 0 Sleep
00000000BBD2 00000040F3D2 0 TlsGetValue
00000000BBE0 00000040F3E0 0 VirtualProtect
00000000BBF2 00000040F3F2 0 VirtualQuery
00000000BC02 00000040F402 0 WideCharToMultiByte
00000000BC18 00000040F418 0 _strdup
00000000BC22 00000040F422 0 _stricoll
00000000BC2E 00000040F42E 0 __getmainargs
00000000BC3E 00000040F43E 0 __mb_cur_max
00000000BC4E 00000040F44E 0 __p__environ
00000000BC5E 00000040F45E 0 __p__fmode
00000000BC6C 00000040F46C 0 __set_app_type
00000000BC7E 00000040F47E 0 _cexit
00000000BC88 00000040F488 0 _errno
00000000BC92 00000040F492 0 _findclose
00000000BCA0 00000040F4A0 0 _findfirst
00000000BCAE 00000040F4AE 0 _findnext
00000000BCBA 00000040F4BA 0 _fullpath
00000000BCCE 00000040F4CE 0 _onexit
00000000BCD8 00000040F4D8 0 _setmode
00000000BCE4 00000040F4E4 0 abort
00000000BCEC 00000040F4EC 0 atexit
00000000BCFE 00000040F4FE 0 calloc
00000000BD08 00000040F508 0 fputc
00000000BD18 00000040F518 0 fwrite
00000000BD22 00000040F522 0 getenv
00000000BD2C 00000040F52C 0 isspace
00000000BD36 00000040F536 0 localeconv
00000000BD44 00000040F544 0 malloc
00000000BD4E 00000040F54E 0 mbstowcs
00000000BD5A 00000040F55A 0 memcpy
00000000BD64 00000040F564 0 realloc
00000000BD6E 00000040F56E 0 setlocale
00000000BD7A 00000040F57A 0 signal
00000000BD84 00000040F584 0 strchr
00000000BD8E 00000040F58E 0 strcoll
00000000BD98 00000040F598 0 strlen
00000000BDA2 00000040F5A2 0 strncpy
00000000BDAC 00000040F5AC 0 system
00000000BDB6 00000040F5B6 0 tolower
00000000BDC0 00000040F5C0 0 vfprintf
00000000BDCC 00000040F5CC 0 wcslen
00000000BDD6 00000040F5D6 0 wcstombs
00000000BDE0 00000040F5E0 0 MSXFS.dll
00000000BDEE 00000040F5EE 0 WFSStartUp
00000000BE02 00000040F602 0 WFSOpen
00000000BE12 00000040F612 0 WFSLock
00000000BE22 00000040F622 0 WFSFreeResult
00000000BE36 00000040F636 0 WFSGetInfo
00000000BE4A 00000040F64A 0 WFSCleanUp
00000000BE5E 00000040F65E 0 WFSClose
00000000BE6E 00000040F66E 0 WFSUnlock
00000000BEC4 00000040F6C4 0 kernel32.dll
00000000BEDC 00000040F6DC 0 msvcrt.dll
File pos Mem pos ID Text
======== ======= == ====
00000000BF84 00000040F784 0 msvcrt.dll
000000009C1B 00000040BA1B 0 f(null)
=== DOWNLOAD ===
Mirror provided by vx-underground.org, thx!