.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ---- -------------.
! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV !
`-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
ATM MALWARE NOTICE
f6609bb3c3197ace26ebdeb372ba657ac84b05a3e9e265b5211e1ea42da70dbe
Date...........: 2018-01-28
Family.........: HelloWorld
File name......: HelloWorld.exe
File size......: 98.50 KB
Type file......: EXE/Windows
Virscan........: VT - HA
Additional note: wipe every drives after dispensing and if the environment don't meet criteria.
Entropy:
Binary Histogram:
=== SCREENSHOT ===
=== PEDUMP REPORT ===
=== MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 248 0xf8
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== RICH Header ===
LIB_ID VERSION TIMES_USED
199 c7 41118 a09e 1 1
225 e1 21005 520d 34 22
223 df 21005 520d 18 12
224 e0 21005 520d 121 79
203 cb 65501 ffdd 7 7
1 1 0 0 123 7b
229 e5 30501 7725 5 5
220 dc 30501 7725 1 1
219 db 21005 520d 1 1
222 de 30501 7725 1 1
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 5 5
TimeDateStamp: "2017-10-22 22:25:55"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 258 0x102 EXECUTABLE_IMAGE, 32BIT_MACHINE
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 12.0
SizeOfCode: 62464 0xf400
SizeOfInitializedData: 49664 0xc200
SizeOfUninitializedData: 0 0
AddressOfEntryPoint: 16312 0x3fb8
BaseOfCode: 4096 0x1000
BaseOfData: 69632 0x11000
ImageBase: 4194304 0x400000
SectionAlignment: 4096 0x1000
FileAlignment: 512 0x200
OperatingSystemVersion: 5.1
ImageVersion: 0.0
SubsystemVersion: 5.1
Reserved1: 0 0
SizeOfImage: 131072 0x20000
SizeOfHeaders: 1024 0x400
CheckSum: 0 0
Subsystem: 2 2 WINDOWS_GUI
DllCharacteristics: 33088 0x8140 DYNAMIC_BASE, NX_COMPAT
TERMINAL_SERVER_AWARE
SizeOfStackReserve: 1048576 0x100000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 15df0 size:0x 11c
IMPORT rva:0x 15f0c size:0x 50
RESOURCE rva:0x 1d000 size:0x 1e0
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x 1e000 size:0x 1048
DEBUG rva:0x 0 size:0x 0
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 0 size:0x 0
LOAD_CONFIG rva:0x 15a88 size:0x 40
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x 11000 size:0x 1c0
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 0 size:0x 0
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 1000 f352 f400 400 0 0 0 0 60000020 R-X CODE
.rdata 11000 58cc 5a00 f800 0 0 0 0 40000040 R-- IDATA
.data 17000 5340 2400 15200 0 0 0 0 c0000040 RW- IDATA
.rsrc 1d000 1e0 200 17600 0 0 0 0 40000040 R-- IDATA
.reloc 1e000 1048 1200 17800 0 0 0 0 42000040 R-- IDATA DISCARDABLE
=== RESOURCES ===
FILE_OFFSET CP LANG SIZE TYPE NAME
0x17660 0 0x409 381 MANIFEST #1
=== IMPORTS ===
MODULE_NAME HINT ORD FUNCTION_NAME
KERNEL32.dll 7f CloseHandle
KERNEL32.dll 310 GetWindowsDirectoryW
KERNEL32.dll 10a DeleteFileW
KERNEL32.dll 3b2 LocalFree
KERNEL32.dll 155 ExpandEnvironmentStringsW
KERNEL32.dll e8 CreateThread
KERNEL32.dll 151 ExitProcess
KERNEL32.dll 608 lstrlenA
KERNEL32.dll 19e FreeLibrary
KERNEL32.dll 29d GetProcAddress
KERNEL32.dll 3a5 LoadLibraryA
KERNEL32.dll 267 GetModuleHandleW
KERNEL32.dll 336 HeapReAlloc
KERNEL32.dll 5de WriteConsoleW
KERNEL32.dll 520 SetStdHandle
KERNEL32.dll 3fa OutputDebugStringW
KERNEL32.dll 4ac RtlUnwind
KERNEL32.dll 3a7 LoadLibraryExW
KERNEL32.dll 17f FindNextFileW
KERNEL32.dll 396 LCMapStringW
KERNEL32.dll 4fc SetFilePointerEx
KERNEL32.dll 1ee GetConsoleMode
KERNEL32.dll 1dc GetConsoleCP
KERNEL32.dll 3a2 LeaveCriticalSection
KERNEL32.dll 125 EnterCriticalSection
KERNEL32.dll 572 TlsFree
KERNEL32.dll 574 TlsSetValue
KERNEL32.dll 573 TlsGetValue
KERNEL32.dll 168 FindClose
KERNEL32.dll 250 GetLastError
KERNEL32.dll 23c GetFileSizeEx
KERNEL32.dll 192 FlushFileBuffers
KERNEL32.dll c2 CreateFileW
KERNEL32.dll 550 Sleep
KERNEL32.dll 5df WriteFile
KERNEL32.dll 2a2 GetProcessHeap
KERNEL32.dll 333 HeapFree
KERNEL32.dll 209 GetCurrentProcess
KERNEL32.dll 32f HeapAlloc
KERNEL32.dll 173 FindFirstFileW
KERNEL32.dll 2d6 GetSystemTimeAsFileTime
KERNEL32.dll 1c8 GetCommandLineA
KERNEL32.dll 367 IsDebuggerPresent
KERNEL32.dll 36d IsProcessorFeaturePresent
KERNEL32.dll 121 EncodePointer
KERNEL32.dll fe DecodePointer
KERNEL32.dll 372 IsValidCodePage
KERNEL32.dll 1a4 GetACP
KERNEL32.dll 286 GetOEMCP
KERNEL32.dll 1b3 GetCPInfo
KERNEL32.dll 2c5 GetStringTypeW
KERNEL32.dll 50a SetLastError
KERNEL32.dll 20e GetCurrentThreadId
KERNEL32.dll 266 GetModuleHandleExW
KERNEL32.dll 3d1 MultiByteToWideChar
KERNEL32.dll 5cb WideCharToMultiByte
KERNEL32.dll 2c0 GetStdHandle
KERNEL32.dll 23e GetFileType
KERNEL32.dll 105 DeleteCriticalSection
KERNEL32.dll 2be GetStartupInfoW
KERNEL32.dll 262 GetModuleFileNameA
KERNEL32.dll 263 GetModuleFileNameW
KERNEL32.dll 42d QueryPerformanceCounter
KERNEL32.dll 20a GetCurrentProcessId
KERNEL32.dll 227 GetEnvironmentStringsW
KERNEL32.dll 19d FreeEnvironmentStringsW
KERNEL32.dll 580 UnhandledExceptionFilter
KERNEL32.dll 541 SetUnhandledExceptionFilter
KERNEL32.dll 348 InitializeCriticalSectionAndSpinCount
KERNEL32.dll 55f TerminateProcess
KERNEL32.dll 571 TlsAlloc
KERNEL32.dll 338 HeapSize
USER32.dll e9 EndPaint
USER32.dll ad DestroyWindow
USER32.dll 173 GetMessageW
USER32.dll 271 PostQuitMessage
USER32.dll 105 FillRect
USER32.dll d6 DrawTextW
USER32.dll 221 LoadCursorW
USER32.dll 2d4 SetFocus
USER32.dll 2b7 SendMessageA
USER32.dll e BeginPaint
USER32.dll 33f TranslateMessage
USER32.dll 289 RegisterClassExW
USER32.dll 223 LoadIconW
USER32.dll 2f3 SetRect
USER32.dll 70 CreateWindowExA
USER32.dll 30d SetWindowLongW
USER32.dll 285 RedrawWindow
USER32.dll 320 ShowWindow
USER32.dll 71 CreateWindowExW
USER32.dll 24d MessageBoxW
USER32.dll 2bc SendMessageW
USER32.dll 357 UpdateWindow
USER32.dll 1e CallWindowProcW
USER32.dll a1 DefWindowProcW
USER32.dll b5 DispatchMessageW
ADVAPI32.dll 254 RegCloseKey
ADVAPI32.dll 1f AdjustTokenPrivileges
ADVAPI32.dll 273 RegEnumKeyExW
ADVAPI32.dll 285 RegOpenKeyExW
ADVAPI32.dll 133 FreeSid
ADVAPI32.dll 2cf SetEntriesInAclW
ADVAPI32.dll 20 AllocateAndInitializeSid
ADVAPI32.dll 1ad LookupPrivilegeValueW
ADVAPI32.dll 2da SetNamedSecurityInfoW
ADVAPI32.dll 268 RegDeleteKeyW
ADVAPI32.dll 16f GetTokenInformation
ADVAPI32.dll 212 OpenProcessToken
=== EXPORTS ===
# module "dispenser_NO_TOKEN.exe"
# flags=0x0 ts="2017-10-22 22:25:54" version=0.0 ord_base=1
# nFuncs=9 nNames=9
ORD ENTRY_VA NAME
1 2f3b ChooseColorA
2 2f3b ChooseFontA
3 2f3e Dispense
4 2f3b FindTextA
5 2f3b GetOpenFileNameA
6 2f3b GetSaveFileNameA
7 2f3b PrintDlgA
8 2f3b WNetAddConnection2A
9 2f3b WNetCancelConnection2A
=== Packer / Compiler ===
MS Visual C++ 6.0 - 8.0
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
0000000000DE 0000004000DE 0 twRich
0000000001F0 0000004001F0 0 .text
000000000218 000000400218 0 .rdata
00000000023F 00000040023F 0 @.data
000000000268 000000400268 0 .rsrc
00000000028F 00000040028F 0 @.reloc
000000000824 000000401424 0 PSSSSSS
0000000008B5 0000004014B5 0 u(SSS
000000000BFA 0000004017FA 0 PhDSA
000000000C14 000000401814 0 PhpSA
000000000C62 000000401862 0 Ph TA
000000000C7C 00000040187C 0 PhhTA
000000001289 000000401E89 0 Ph\VA
0000000015DF 0000004021DF 0 RVhPWA
000000001841 000000402441 0 D$8SVWj 3
00000000184C 00000040244C 0 D$@CSCCY3
000000001860 000000402460 0 D$@NG
0000000018EC 0000004024EC 0 u2hdXA
000000001B81 000000402781 0 VVVh0$@
000000001C77 000000402877 0 Qjdjd
000000001DE9 0000004029E9 0 D$ PS
000000001F34 000000402B34 0 D$ PS
000000001FF0 000000402BF0 0 j2jdZ
0000000021C4 000000402DC4 0 D$\PQQ
00000000227C 000000402E7C 0 SWSSh
0000000032F6 000000403EF6 0 PPPPPPPP
0000000037D0 0000004043D0 0 PPPPP
000000003B10 000000404710 0 t/HHt
000000003B53 000000404753 0 j*Xf;
000000003BB1 0000004047B1 0 j*Xf;
000000003C08 000000404808 0 htHjlZ;
000000003D4B 00000040494B 0 HHtXHHt
000000003F88 000000404B88 0 nt'joZ;
000000004028 000000404C28 0 jgXf;
0000000040FF 000000404CFF 0 YYjgXf9
0000000042B5 000000404EB5 0 >0t<NAj0X
000000004396 000000404F96 0 Wj0XP
0000000044A2 0000004050A2 0 Wj XP
000000004963 000000405563 0 t/HHt
000000004BAF 0000004057AF 0 HHtVHHt
0000000050A6 000000405CA6 0 >0t-N
00000000544F 00000040604F 0 5ntel
00000000545F 00000040605F 0 5Genu
000000006217 000000406E17 0 ~pjCXf
000000006AD1 0000004076D1 0 j@j _W
000000006B91 000000407791 0 } j@W
000000006F3C 000000407B3C 0 < t8< t4
000000007016 000000407C16 0 t@VSP
000000007071 000000407C71 0 PPPPP
0000000071A3 000000407DA3 0 <v5hJ
00000000728B 000000407E8B 0 SSSSS
0000000073EA 000000407FEA 0 SPPP+
0000000073F3 000000407FF3 0 FVWPP
000000007419 000000408019 0 SVWPP
00000000755B 00000040815B 0 VWhD!A
000000008B0C 00000040970C 0 ~';_t|%3
000000008B20 000000409720 0 wtVj
000000008B35 000000409735 0 ;_tr.
000000008B56 000000409756 0 GWVj
File pos Mem pos ID Text
======== ======= == ====
000000008D2B 00000040992B 0 v N+D$
000000008E3C 000000409A3C 0 QVWSj
0000000096D6 00000040A2D6 0 PP9E u
0000000099AD 00000040A5AD 0 jA[jZZ+
000000009AE9 00000040A6E9 0 PWWWWV
000000009B84 00000040A784 0 PSSSSV
00000000A25F 00000040AE5F 0 URPQQh
00000000BDBD 00000040C9BD 0 +t"HHt
00000000BE13 00000040CA13 0 9] t"
00000000C9D0 00000040D5D0 0 ,SVWj0X
00000000CB04 00000040D704 0 u'j0X
00000000CC2E 00000040D82E 0 Wj0XPV
00000000CCCD 00000040D8CD 0 PjdSQ
00000000CE36 00000040DA36 0 -jd[;
00000000CE8B 00000040DA8B 0 WWWWW
00000000D3DE 00000040DFDE 0 VVVVV
00000000D463 00000040E063 0 SVWUj
00000000D504 00000040E104 0 ;t$,v-
00000000D589 00000040E189 0 UQPXY]Y[
00000000E4F2 00000040F0F2 0 PPPPP
00000000E5A6 00000040F1A6 0 v N+D$
00000000E8DF 00000040F4DF 0 u0h0NA
00000000E8EE 00000040F4EE 0 u!h8NA
00000000F1CA 00000040FDCA 0 SSSSS
00000000FA08 000000411208 0 (null)
00000000FA41 000000411241 0 ( 8PX
00000000FA49 000000411249 0 700WP
00000000FA61 000000411261 0 xpxxxx
00000000FAD8 0000004112D8 0 Sunday
00000000FAE0 0000004112E0 0 Monday
00000000FAE8 0000004112E8 0 Tuesday
00000000FAF0 0000004112F0 0 Wednesday
00000000FAFC 0000004112FC 0 Thursday
00000000FB08 000000411308 0 Friday
00000000FB10 000000411310 0 Saturday
00000000FB4C 00000041134C 0 January
00000000FB54 000000411354 0 February
00000000FB60 000000411360 0 March
00000000FB68 000000411368 0 April
00000000FB80 000000411380 0 August
00000000FB88 000000411388 0 September
00000000FB94 000000411394 0 October
00000000FB9C 00000041139C 0 November
00000000FBA8 0000004113A8 0 December
00000000FBBC 0000004113BC 0 MM/dd/yy
00000000FBC8 0000004113C8 0 dddd, MMMM dd, yyyy
00000000FBDC 0000004113DC 0 HH:mm:ss
00000000FED0 0000004116D0 0 CorExitProcess
000000010960 000000412160 0 FlsAlloc
00000001096C 00000041216C 0 FlsFree
000000010974 000000412174 0 FlsGetValue
000000010980 000000412180 0 FlsSetValue
00000001098C 00000041218C 0 InitializeCriticalSectionEx
0000000109A8 0000004121A8 0 CreateEventExW
0000000109B8 0000004121B8 0 CreateSemaphoreExW
0000000109CC 0000004121CC 0 SetThreadStackGuarantee
0000000109E4 0000004121E4 0 CreateThreadpoolTimer
0000000109FC 0000004121FC 0 SetThreadpoolTimer
000000010A10 000000412210 0 WaitForThreadpoolTimerCallbacks
000000010A30 000000412230 0 CloseThreadpoolTimer
File pos Mem pos ID Text
======== ======= == ====
000000010A48 000000412248 0 CreateThreadpoolWait
000000010A60 000000412260 0 SetThreadpoolWait
000000010A74 000000412274 0 CloseThreadpoolWait
000000010A88 000000412288 0 FlushProcessWriteBuffers
000000010AA4 0000004122A4 0 FreeLibraryWhenCallbackReturns
000000010AC4 0000004122C4 0 GetCurrentProcessorNumber
000000010AE0 0000004122E0 0 GetLogicalProcessorInformation
000000010B00 000000412300 0 CreateSymbolicLinkW
000000010B14 000000412314 0 SetDefaultDllDirectories
000000010B30 000000412330 0 EnumSystemLocalesEx
000000010B44 000000412344 0 CompareStringEx
000000010B54 000000412354 0 GetDateFormatEx
000000010B64 000000412364 0 GetLocaleInfoEx
000000010B74 000000412374 0 GetTimeFormatEx
000000010B84 000000412384 0 GetUserDefaultLocaleName
000000010BA0 0000004123A0 0 IsValidLocaleName
000000010BB4 0000004123B4 0 LCMapStringEx
000000010BC4 0000004123C4 0 GetCurrentPackageId
000000010BD8 0000004123D8 0 GetTickCount64
000000010BE8 0000004123E8 0 GetFileInformationByHandleExW
000000010C08 000000412408 0 SetFileInformationByHandleW
0000000111D0 0000004129D0 0 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]
000000011211 000000412A11 0 abcdefghijklmnopqrstuvwxyz{|}~
000000011350 000000412B50 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]
000000011391 000000412B91 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0000000134CD 000000414CCD 0 ('8PW
0000000134D6 000000414CD6 0 700PP
0000000134F1 000000414CF1 0 xppwpp
000000013527 000000414D27 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]
000000013568 000000414D68 0 abcdefghijklmnopqrstuvwxyz{|}~
0000000135A4 000000414DA4 0 MessageBoxW
0000000135B0 000000414DB0 0 GetActiveWindow
0000000135C0 000000414DC0 0 GetLastActivePopup
0000000135D4 000000414DD4 0 GetUserObjectInformationW
0000000135F0 000000414DF0 0 GetProcessWindowStation
000000013610 000000414E10 0 e+000
000000013628 000000414E28 0 1#SNAN
000000013630 000000414E30 0 1#IND
000000013638 000000414E38 0 1#INF
000000013640 000000414E40 0 1#QNAN
000000013880 000000415080 0 Deleting:
000000013D88 000000415588 0 CscCngOpen
000000013D94 000000415594 0 CscCngClose
000000013DA0 0000004155A0 0 CscCngLock
000000013DAC 0000004155AC 0 CscCngUnlock
000000013DBC 0000004155BC 0 CscCngDispense
000000013DCC 0000004155CC 0 CscCngTransport
000000013DDC 0000004155DC 0 CscCngStatusRead
000000013DF0 0000004155F0 0 CscCngReset
000000013E04 000000415604 0 Locking CSCCNG...
000000013E18 000000415618 0 Unlocking CSCCNG...
000000013E2C 00000041562C 0 Resetting csccng
000000013E40 000000415640 0 Resetted csccng
000000013E50 000000415650 0 %d,%02d;
000000013E5C 00000041565C 0 Dispensing (%s)...
000000013E70 000000415670 0 Dispense failed
000000013E84 000000415684 0 Success, transporting now. Raw response: %s
000000013EB4 0000004156B4 0 transport waitpos failed
000000013ED0 0000004156D0 0 Transporting to customer...
000000013EEC 0000004156EC 0 transport offer failed
File pos Mem pos ID Text
======== ======= == ====
000000013F04 000000415704 0 money not taken
000000013F18 000000415718 0 locking failed
000000013F28 000000415728 0 MaxNotes: %d
000000013F38 000000415738 0 %dSTA
000000013F40 000000415740 0 %dVAL
000000013F48 000000415748 0 %dACT
000000013F50 000000415750 0 CAS%d: %d, %d
000000013F60 000000415760 0 MAX_NOTES
000000013F6C 00000041576C 0 loading cscwcng.dll
000000013F80 000000415780 0 trying cscwcng.dll ...
000000013F98 000000415798 0 cscwcng.dll
000000013FA4 0000004157A4 0 failed finding cscwcng.dll
000000013FC0 0000004157C0 0 trying C:\CSCW32\DLL\cscwcng.dll ...
000000013FE8 0000004157E8 0 C:\CSCW32\DLL\cscwcng.dll
000000014004 000000415804 0 failed finding C:\CSCW32\DLL\cscwcng.dll
000000014030 000000415830 0 trying C:\DLL\cscwcng.dll ...
000000014050 000000415850 0 C:\DLL\cscwcng.dll
000000014064 000000415864 0 failed finding C:\DLL\cscwcng.dll
000000014088 000000415888 0 Loaded cscwcng.dll!
0000000140A0 0000004158A0 0 failed resolving functions in cscwcng.dll!
0000000140CC 0000004158CC 0 Connecting...
0000000140DC 0000004158DC 0 Failed opening CSCCNG
0000000140F4 0000004158F4 0 Connected
000000014100 000000415900 0 Finished dispensing, bestCassete:%d, billcount:%d.
000000014134 000000415934 0 User left, cleaning up.
00000001414C 00000041594C 0 Disconnecting...
000000014160 000000415960 0 Failed disconnecting
000000014178 000000415978 0 Disconnected
000000014188 000000415988 0 BUTTON
000000014190 000000415990 0 STATIC
0000000141CC 0000004159CC 0 ENTER
0000000141DC 0000004159DC 0 %010u
000000014672 000000415E72 0 dispenser_NO_TOKEN.exe
000000014689 000000415E89 0 ChooseColorA
000000014696 000000415E96 0 ChooseFontA
0000000146A2 000000415EA2 0 Dispense
0000000146AB 000000415EAB 0 FindTextA
0000000146B5 000000415EB5 0 GetOpenFileNameA
0000000146C6 000000415EC6 0 GetSaveFileNameA
0000000146D7 000000415ED7 0 PrintDlgA
0000000146E1 000000415EE1 0 WNetAddConnection2A
0000000146F5 000000415EF5 0 WNetCancelConnection2A
00000001491E 00000041611E 0 FindFirstFileW
000000014930 000000416130 0 HeapAlloc
00000001493C 00000041613C 0 GetCurrentProcess
000000014950 000000416150 0 HeapFree
00000001495C 00000041615C 0 GetProcessHeap
00000001496E 00000041616E 0 WriteFile
00000001497A 00000041617A 0 Sleep
000000014982 000000416182 0 CreateFileW
000000014990 000000416190 0 FlushFileBuffers
0000000149A4 0000004161A4 0 GetFileSizeEx
0000000149B4 0000004161B4 0 GetLastError
0000000149C4 0000004161C4 0 FindClose
0000000149D0 0000004161D0 0 FindNextFileW
0000000149E0 0000004161E0 0 CloseHandle
0000000149EE 0000004161EE 0 GetWindowsDirectoryW
000000014A06 000000416206 0 DeleteFileW
000000014A14 000000416214 0 LocalFree
000000014A20 000000416220 0 ExpandEnvironmentStringsW
File pos Mem pos ID Text
======== ======= == ====
000000014A3C 00000041623C 0 CreateThread
000000014A4C 00000041624C 0 ExitProcess
000000014A5A 00000041625A 0 lstrlenA
000000014A66 000000416266 0 FreeLibrary
000000014A74 000000416274 0 GetProcAddress
000000014A86 000000416286 0 LoadLibraryA
000000014A96 000000416296 0 GetModuleHandleW
000000014AA8 0000004162A8 0 KERNEL32.dll
000000014AB8 0000004162B8 0 DispatchMessageW
000000014ACC 0000004162CC 0 DefWindowProcW
000000014ADE 0000004162DE 0 CallWindowProcW
000000014AF0 0000004162F0 0 UpdateWindow
000000014B00 000000416300 0 SendMessageW
000000014B10 000000416310 0 MessageBoxW
000000014B1E 00000041631E 0 CreateWindowExW
000000014B30 000000416330 0 ShowWindow
000000014B3E 00000041633E 0 RedrawWindow
000000014B4E 00000041634E 0 SetWindowLongW
000000014B60 000000416360 0 CreateWindowExA
000000014B72 000000416372 0 SetRect
000000014B7C 00000041637C 0 LoadIconW
000000014B88 000000416388 0 RegisterClassExW
000000014B9C 00000041639C 0 TranslateMessage
000000014BB0 0000004163B0 0 BeginPaint
000000014BBE 0000004163BE 0 SendMessageA
000000014BCE 0000004163CE 0 SetFocus
000000014BDA 0000004163DA 0 LoadCursorW
000000014BE8 0000004163E8 0 DrawTextW
000000014BF4 0000004163F4 0 FillRect
000000014C00 000000416400 0 PostQuitMessage
000000014C12 000000416412 0 GetMessageW
000000014C20 000000416420 0 DestroyWindow
000000014C30 000000416430 0 EndPaint
000000014C3A 00000041643A 0 USER32.dll
000000014C48 000000416448 0 OpenProcessToken
000000014C5C 00000041645C 0 GetTokenInformation
000000014C72 000000416472 0 RegDeleteKeyW
000000014C82 000000416482 0 SetNamedSecurityInfoW
000000014C9A 00000041649A 0 LookupPrivilegeValueW
000000014CB2 0000004164B2 0 AllocateAndInitializeSid
000000014CCE 0000004164CE 0 SetEntriesInAclW
000000014CE2 0000004164E2 0 FreeSid
000000014CEC 0000004164EC 0 RegOpenKeyExW
000000014CFC 0000004164FC 0 RegEnumKeyExW
000000014D0C 00000041650C 0 AdjustTokenPrivileges
000000014D24 000000416524 0 RegCloseKey
000000014D30 000000416530 0 ADVAPI32.dll
000000014D40 000000416540 0 GetSystemTimeAsFileTime
000000014D5A 00000041655A 0 GetCommandLineA
000000014D6C 00000041656C 0 IsDebuggerPresent
000000014D80 000000416580 0 IsProcessorFeaturePresent
000000014D9C 00000041659C 0 EncodePointer
000000014DAC 0000004165AC 0 DecodePointer
000000014DBC 0000004165BC 0 IsValidCodePage
000000014DCE 0000004165CE 0 GetACP
000000014DD8 0000004165D8 0 GetOEMCP
000000014DE4 0000004165E4 0 GetCPInfo
000000014DF0 0000004165F0 0 GetStringTypeW
000000014E02 000000416602 0 SetLastError
000000014E12 000000416612 0 GetCurrentThreadId
File pos Mem pos ID Text
======== ======= == ====
000000014E28 000000416628 0 GetModuleHandleExW
000000014E3E 00000041663E 0 MultiByteToWideChar
000000014E54 000000416654 0 WideCharToMultiByte
000000014E6A 00000041666A 0 GetStdHandle
000000014E7A 00000041667A 0 GetFileType
000000014E88 000000416688 0 DeleteCriticalSection
000000014EA0 0000004166A0 0 GetStartupInfoW
000000014EB2 0000004166B2 0 GetModuleFileNameA
000000014EC8 0000004166C8 0 GetModuleFileNameW
000000014EDE 0000004166DE 0 QueryPerformanceCounter
000000014EF8 0000004166F8 0 GetCurrentProcessId
000000014F0E 00000041670E 0 GetEnvironmentStringsW
000000014F28 000000416728 0 FreeEnvironmentStringsW
000000014F42 000000416742 0 UnhandledExceptionFilter
000000014F5E 00000041675E 0 SetUnhandledExceptionFilter
000000014F7C 00000041677C 0 InitializeCriticalSectionAndSpinCount
000000014FA4 0000004167A4 0 TerminateProcess
000000014FB8 0000004167B8 0 TlsAlloc
000000014FC4 0000004167C4 0 TlsGetValue
000000014FD2 0000004167D2 0 TlsSetValue
000000014FE0 0000004167E0 0 TlsFree
000000014FEA 0000004167EA 0 EnterCriticalSection
000000015002 000000416802 0 LeaveCriticalSection
00000001501A 00000041681A 0 GetConsoleCP
00000001502A 00000041682A 0 GetConsoleMode
00000001503C 00000041683C 0 SetFilePointerEx
000000015050 000000416850 0 LCMapStringW
000000015060 000000416860 0 LoadLibraryExW
000000015072 000000416872 0 RtlUnwind
00000001507E 00000041687E 0 OutputDebugStringW
000000015094 000000416894 0 SetStdHandle
0000000150A4 0000004168A4 0 WriteConsoleW
0000000150B4 0000004168B4 0 HeapReAlloc
0000000150C2 0000004168C2 0 HeapSize
0000000153EA 0000004171EA 0
0000000154D1 0000004172D1 0 abcdefghijklmnopqrstuvwxyz
0000000154F1 0000004172F1 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ
00000001560A 00000041740A 0
0000000156EA 0000004174EA 0 abcdefghijklmnopqrstuvwxyz
00000001570A 00000041750A 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ
0000000161D6 000000417FD6 0 z?aUY
000000016218 000000418018 0 zc%C1
00000001626B 00000041806B 0 -64OS
00000001636C 00000041816C 0 k L-zh!
00000001702C 000000418E2C 0 nothing
000000017660 00000041D060 0 <?xml version='1.0' encoding='UTF-8' standalone='yes'?>
000000017699 00000041D099 0 <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
0000000176E4 00000041D0E4 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
00000001771C 00000041D11C 0 <security>
00000001772C 00000041D12C 0 <requestedPrivileges>
000000017749 00000041D149 0 <requestedExecutionLevel level='asInvoker' uiAccess='false' />
000000017791 00000041D191 0 </requestedPrivileges>
0000000177AF 00000041D1AF 0 </security>
0000000177C0 00000041D1C0 0 </trustInfo>
0000000177D0 00000041D1D0 0 </assembly>
000000017811 00000041E011 0 1 1\1c1
000000017823 00000041E023 0 242r2
00000001782D 00000041E02D 0 2V3e3
00000001784D 00000041E04D 0 515h5
000000017855 00000041E055 0 5*6:6B6g6
File pos Mem pos ID Text
======== ======= == ====
00000001786D 00000041E06D 0 7%7*787=7K7P7a7h7t7z7
00000001788D 00000041E08D 0 808J8d8~8
00000001789F 00000041E09F 0 9&9O9Y9m9s9
0000000178C3 00000041E0C3 0 : :':-:2:9:?:D:K:Q:V:]:c:h:o:u:z:
0000000178F3 00000041E0F3 0 :*;@;)<q<
00000001791B 00000041E11B 0 ?/?8???x?
000000017935 00000041E135 0 0.1m1
00000001793D 00000041E13D 0 1g2q2
000000017949 00000041E149 0 3:4h4x4
00000001796D 00000041E16D 0 5!5-5A5M5S5_5
000000017981 00000041E181 0 546R6t6
0000000179A3 00000041E1A3 0 7"7*727:7B7J7R7Z7b7n7w7}7
0000000179CB 00000041E1CB 0 8 8M8X8
0000000179DB 00000041E1DB 0 9)9:9K9\9m9~9
0000000179F7 00000041E1F7 0 :/:4:V:]:s:x:
000000017A13 00000041E213 0 ;(;/;;;O;\;g;
000000017A3B 00000041E23B 0 <&<.<B<M<\<d<x<
000000017A61 00000041E261 0 =2=<=P=V=e=
000000017A77 00000041E277 0 > >>>O>[>
000000017A81 00000041E281 0 >h>x>
000000017AB9 00000041E2B9 0 141u1
000000017AC1 00000041E2C1 0 :'=.=D=N=r?
000000017AE1 00000041E2E1 0 0d0i0s0
000000017AEB 00000041E2EB 0 1>1E1X1
000000017B19 00000041E319 0 2!2+2;2K2[2d2{2]3
000000017B3B 00000041E33B 0 6 :L;
000000017B58 00000041E358 0 <1@1D1H1L1P1T1X1A2u2
000000017B71 00000041E371 0 3;4B4h4o4
000000017B7F 00000041E37F 0 5i8V9
000000017BAF 00000041E3AF 0 0'0V0
000000017BBF 00000041E3BF 0 1$1=1G1T1
000000017BE7 00000041E3E7 0 5/5>5H5U5_5o5
000000017C13 00000041E413 0 939N9V9d9i9x9
000000017C25 00000041E425 0 :>:Q:
000000017C3B 00000041E43B 0 <"=*=
000000017C4D 00000041E44D 0 >->o>
000000017C59 00000041E459 0 ? ?1?
000000017C68 00000041E468 0 g1z1:2
000000017C77 00000041E477 0 3+434F4Q4V4f4r4w4
000000017C8F 00000041E48F 0 4c5z5
000000017CA7 00000041E4A7 0 6-626>6C6b6
000000017CBB 00000041E4BB 0 7 7A7M7
000000017CC9 00000041E4C9 0 7A8G8N8
000000017CD5 00000041E4D5 0 8?9s9
000000017CEF 00000041E4EF 0 ;3<?<K<Z<e<
000000017D01 00000041E501 0 <"=:=D=
000000017D09 00000041E509 0 =g=m={=
000000017D21 00000041E521 0 >'>v>
000000017D33 00000041E533 0 ?(?1?>?m?u?
000000017D54 00000041E554 0 040?0P0V0f0n0t0
000000017D79 00000041E579 0 1"1+131K1
000000017D83 00000041E583 0 1d1j1q1z1
000000017DBF 00000041E5BF 0 2%2*20282=2C2K2P2V2
000000017DD3 00000041E5D3 0 2c2i2q2v2|2
000000017E0F 00000041E60F 0 3!3'3/343:3B3G3M3U3Z3
000000017E25 00000041E625 0 3h3m3s3{3
000000017E57 00000041E657 0 4'434@4I4
000000017E75 00000041E675 0 6!7;7H7W7a7s7
000000017E93 00000041E693 0 7)868?8c8
000000017EA3 00000041E6A3 0 9H9b9
File pos Mem pos ID Text
======== ======= == ====
000000017EAF 00000041E6AF 0 :=;F;d;
000000017EBD 00000041E6BD 0 <1=:=
000000017EC3 00000041E6C3 0 >">5>I>
000000017EDD 00000041E6DD 0 1_1h1
000000017EE5 00000041E6E5 0 1!2e2
000000017EFD 00000041E6FD 0 575h5
000000017F13 00000041E713 0 8+8L8
000000017F1F 00000041E71F 0 9f9L:h:
000000017F31 00000041E731 0 ;);2;>;I;p;
000000017F45 00000041E745 0 <&<,<F<X<j<|<
000000017F63 00000041E763 0 ===O=a=s=
000000017F83 00000041E783 0 3@4R4
000000017F8B 00000041E78B 0 5B5P5V5
000000017F95 00000041E795 0 6b7G8Q8W8k8w8
000000017FC9 00000041E7C9 0 9B9H9M9
000000017FE5 00000041E7E5 0 ;#;+;
000000017FFB 00000041E7FB 0 <#<)<5<:<?<D<M<
00000001801B 00000041E81B 0 =o=y=
000000018025 00000041E825 0 >F>e>q>|?
00000001803B 00000041E83B 0 2?2P2V2b2r2x2
000000018069 00000041E869 0 3%3+343:3D3O3
00000001808B 00000041E88B 0 6-686Z6
000000018097 00000041E897 0 7Q7]7
0000000180A5 00000041E8A5 0 7"868z8
0000000180BF 00000041E8BF 0 :(;.;:;q;
0000000180F5 00000041E8F5 0 1@2b3j3
000000018101 00000041E901 0 5>6F6R6a6
000000018111 00000041E911 0 7&;8;
00000001812F 00000041E92F 0 ?+?9?
000000018141 00000041E941 0 1#1+1014181a1
000000018167 00000041E967 0 2 2$2
00000001817D 00000041E97D 0 3A3H3L3P3T3X3\3
0000000181B0 00000041E9B0 0 Q0W0l0
0000000181B9 00000041E9B9 0 0U1o1x1
0000000181CD 00000041E9CD 0 3d3u3
0000000181F7 00000041E9F7 0 :5:<:@:D:H:L:P:T:X:
000000018215 00000041EA15 0 ;%;@;G;L;P;T;u;
000000018237 00000041EA37 0 ;><D<H<L<P<
000000018279 00000041EA79 0 2%252g2
0000000182B7 00000041EAB7 0 7$7,747<7D7L7T7\7d7l7t7|7
0000000182E0 00000041EAE0 0 4<<<D<L<T<\<d<l<t<|<
00000001831B 00000041EB1B 0 =$=,=4=<=D=L=T=\=d=l=t=|=
00000001835B 00000041EB5B 0 >$>,>4><>D>L>T>\>d>l>t>|>
00000001839B 00000041EB9B 0 ?$?,?4?<?D?L?T?\?d?l?t?|?
0000000183E3 00000041EBE3 0 0$0,040<0D0L0T0\0d0l0t0|0
000000018423 00000041EC23 0 1$1,141<1D1L1T1\1d1l1t1|1
000000018463 00000041EC63 0 2$2,242<2D2L2T2\2d2l2t2|2
0000000184A3 00000041ECA3 0 3$3,343<3D3L3P3X3
0000000184B5 00000041ECB5 0 3h3p3x3
0000000184E3 00000041ECE3 0 4 4(40484@4H4P4X4
0000000184F5 00000041ECF5 0 4h4p4x4
000000018523 00000041ED23 0 5 5(50585@5H5P5X5
000000018535 00000041ED35 0 5h5p5x5
000000018563 00000041ED63 0 6 6(60686@6H6P6X6
000000018575 00000041ED75 0 6h6p6x6
0000000185A3 00000041EDA3 0 7 7(70787@7H7P7X7
0000000185B5 00000041EDB5 0 7h7p7x7
0000000185E3 00000041EDE3 0 8 8(80888@8H8P8X8
0000000185F5 00000041EDF5 0 8h8p8x8
000000018623 00000041EE23 0 9 9(90989@9H9P9X9
File pos Mem pos ID Text
======== ======= == ====
000000018635 00000041EE35 0 9h9p9x9
000000018663 00000041EE63 0 : :(:0:8:@:H:P:X:
0000000186B5 00000041EEB5 0 5 5$5(5,5054585<5@5D5H5L5P5T5X5\5
0000000186D7 00000041EED7 0 5d5h5l5p5t5x5|5
0000000186F1 00000041EEF1 0 ;(;H;h;
000000018705 00000041EF05 0 <8<X<x<
000000018719 00000041EF19 0 =8=D=
00000001876D 00000041EF6D 0 7 7$7(7,7074787<7@7D7H7L7P7T7X7\7
00000001878F 00000041EF8F 0 7l7p7t7x7|7
0000000187E9 00000041EFE9 0 8D8T8d8t8
000000018801 00000041F001 0 8@9H9
000000018823 00000041F023 0 = =$=(=,=0=4=@=D=H=L=P=T=X=\=d=h=p=
00000000FA10 000000411210 0 (null)
00000000FA8B 00000041128B 0 Aja-JP
00000000FA98 000000411298 0 zh-CN
00000000FAA4 0000004112A4 0 ko-KR
00000000FAB0 0000004112B0 0 zh-TW
00000000FC20 000000411420 0 Sunday
00000000FC30 000000411430 0 Monday
00000000FC40 000000411440 0 Tuesday
00000000FC50 000000411450 0 Wednesday
00000000FC64 000000411464 0 Thursday
00000000FC78 000000411478 0 Friday
00000000FC88 000000411488 0 Saturday
00000000FCFC 0000004114FC 0 January
00000000FD0C 00000041150C 0 February
00000000FD20 000000411520 0 March
00000000FD2C 00000041152C 0 April
00000000FD50 000000411550 0 August
00000000FD60 000000411560 0 September
00000000FD74 000000411574 0 October
00000000FD84 000000411584 0 November
00000000FD98 000000411598 0 December
00000000FDBC 0000004115BC 0 MM/dd/yy
00000000FDD0 0000004115D0 0 dddd, MMMM dd, yyyy
00000000FDF8 0000004115F8 0 HH:mm:ss
00000000FE0C 00000041160C 0 en-US
00000000FEB8 0000004116B8 0 mscoree.dll
000000010860 000000412060 0 runtime error
0000000108A0 0000004120A0 0 Program:
0000000108B4 0000004120B4 0 <program name unknown>
0000000108F8 0000004120F8 0 Microsoft Visual C++ Runtime Library
000000010944 000000412144 0 kernel32.dll
000000012288 000000413A88 0 zh-CHS
00000001248C 000000413C8C 0 ar-SA
000000012498 000000413C98 0 bg-BG
0000000124A4 000000413CA4 0 ca-ES
0000000124B0 000000413CB0 0 cs-CZ
0000000124BC 000000413CBC 0 da-DK
0000000124C8 000000413CC8 0 de-DE
0000000124D4 000000413CD4 0 el-GR
0000000124E0 000000413CE0 0 fi-FI
0000000124EC 000000413CEC 0 fr-FR
0000000124F8 000000413CF8 0 he-IL
000000012504 000000413D04 0 hu-HU
000000012510 000000413D10 0 is-IS
00000001251C 000000413D1C 0 it-IT
000000012528 000000413D28 0 nl-NL
000000012534 000000413D34 0 nb-NO
000000012540 000000413D40 0 pl-PL
File pos Mem pos ID Text
======== ======= == ====
00000001254C 000000413D4C 0 pt-BR
000000012558 000000413D58 0 ro-RO
000000012564 000000413D64 0 ru-RU
000000012570 000000413D70 0 hr-HR
00000001257C 000000413D7C 0 sk-SK
000000012588 000000413D88 0 sq-AL
000000012594 000000413D94 0 sv-SE
0000000125A0 000000413DA0 0 th-TH
0000000125AC 000000413DAC 0 tr-TR
0000000125B8 000000413DB8 0 ur-PK
0000000125C4 000000413DC4 0 id-ID
0000000125D0 000000413DD0 0 uk-UA
0000000125DC 000000413DDC 0 be-BY
0000000125E8 000000413DE8 0 sl-SI
0000000125F4 000000413DF4 0 et-EE
000000012600 000000413E00 0 lv-LV
00000001260C 000000413E0C 0 lt-LT
000000012618 000000413E18 0 fa-IR
000000012624 000000413E24 0 vi-VN
000000012630 000000413E30 0 hy-AM
00000001263C 000000413E3C 0 az-AZ-Latn
000000012654 000000413E54 0 eu-ES
000000012660 000000413E60 0 mk-MK
00000001266C 000000413E6C 0 tn-ZA
000000012678 000000413E78 0 xh-ZA
000000012684 000000413E84 0 zu-ZA
000000012690 000000413E90 0 af-ZA
00000001269C 000000413E9C 0 ka-GE
0000000126A8 000000413EA8 0 fo-FO
0000000126B4 000000413EB4 0 hi-IN
0000000126C0 000000413EC0 0 mt-MT
0000000126CC 000000413ECC 0 se-NO
0000000126D8 000000413ED8 0 ms-MY
0000000126E4 000000413EE4 0 kk-KZ
0000000126F0 000000413EF0 0 ky-KG
0000000126FC 000000413EFC 0 sw-KE
000000012708 000000413F08 0 uz-UZ-Latn
000000012720 000000413F20 0 tt-RU
00000001272C 000000413F2C 0 bn-IN
000000012738 000000413F38 0 pa-IN
000000012744 000000413F44 0 gu-IN
000000012750 000000413F50 0 ta-IN
00000001275C 000000413F5C 0 te-IN
000000012768 000000413F68 0 kn-IN
000000012774 000000413F74 0 ml-IN
000000012780 000000413F80 0 mr-IN
00000001278C 000000413F8C 0 sa-IN
000000012798 000000413F98 0 mn-MN
0000000127A4 000000413FA4 0 cy-GB
0000000127B0 000000413FB0 0 gl-ES
0000000127BC 000000413FBC 0 kok-IN
0000000127CC 000000413FCC 0 syr-SY
0000000127DC 000000413FDC 0 div-MV
0000000127EC 000000413FEC 0 quz-BO
0000000127FC 000000413FFC 0 ns-ZA
000000012808 000000414008 0 mi-NZ
000000012814 000000414014 0 ar-IQ
000000012820 000000414020 0 de-CH
00000001282C 00000041402C 0 en-GB
000000012838 000000414038 0 es-MX
File pos Mem pos ID Text
======== ======= == ====
000000012844 000000414044 0 fr-BE
000000012850 000000414050 0 it-CH
00000001285C 00000041405C 0 nl-BE
000000012868 000000414068 0 nn-NO
000000012874 000000414074 0 pt-PT
000000012880 000000414080 0 sr-SP-Latn
000000012898 000000414098 0 sv-FI
0000000128A4 0000004140A4 0 az-AZ-Cyrl
0000000128BC 0000004140BC 0 se-SE
0000000128C8 0000004140C8 0 ms-BN
0000000128D4 0000004140D4 0 uz-UZ-Cyrl
0000000128EC 0000004140EC 0 quz-EC
0000000128FC 0000004140FC 0 ar-EG
000000012908 000000414108 0 zh-HK
000000012914 000000414114 0 de-AT
000000012920 000000414120 0 en-AU
00000001292C 00000041412C 0 es-ES
000000012938 000000414138 0 fr-CA
000000012944 000000414144 0 sr-SP-Cyrl
00000001295C 00000041415C 0 se-FI
000000012968 000000414168 0 quz-PE
000000012978 000000414178 0 ar-LY
000000012984 000000414184 0 zh-SG
000000012990 000000414190 0 de-LU
00000001299C 00000041419C 0 en-CA
0000000129A8 0000004141A8 0 es-GT
0000000129B4 0000004141B4 0 fr-CH
0000000129C0 0000004141C0 0 hr-BA
0000000129CC 0000004141CC 0 smj-NO
0000000129DC 0000004141DC 0 ar-DZ
0000000129E8 0000004141E8 0 zh-MO
0000000129F4 0000004141F4 0 de-LI
000000012A00 000000414200 0 en-NZ
000000012A0C 00000041420C 0 es-CR
000000012A18 000000414218 0 fr-LU
000000012A24 000000414224 0 bs-BA-Latn
000000012A3C 00000041423C 0 smj-SE
000000012A4C 00000041424C 0 ar-MA
000000012A58 000000414258 0 en-IE
000000012A64 000000414264 0 es-PA
000000012A70 000000414270 0 fr-MC
000000012A7C 00000041427C 0 sr-BA-Latn
000000012A94 000000414294 0 sma-NO
000000012AA4 0000004142A4 0 ar-TN
000000012AB0 0000004142B0 0 en-ZA
000000012ABC 0000004142BC 0 es-DO
000000012AC8 0000004142C8 0 sr-BA-Cyrl
000000012AE0 0000004142E0 0 sma-SE
000000012AF0 0000004142F0 0 ar-OM
000000012AFC 0000004142FC 0 en-JM
000000012B08 000000414308 0 es-VE
000000012B14 000000414314 0 sms-FI
000000012B24 000000414324 0 ar-YE
000000012B30 000000414330 0 en-CB
000000012B3C 00000041433C 0 es-CO
000000012B48 000000414348 0 smn-FI
000000012B58 000000414358 0 ar-SY
000000012B64 000000414364 0 en-BZ
000000012B70 000000414370 0 es-PE
000000012B7C 00000041437C 0 ar-JO
File pos Mem pos ID Text
======== ======= == ====
000000012B88 000000414388 0 en-TT
000000012B94 000000414394 0 es-AR
000000012BA0 0000004143A0 0 ar-LB
000000012BAC 0000004143AC 0 en-ZW
000000012BB8 0000004143B8 0 es-EC
000000012BC4 0000004143C4 0 ar-KW
000000012BD0 0000004143D0 0 en-PH
000000012BDC 0000004143DC 0 es-CL
000000012BE8 0000004143E8 0 ar-AE
000000012BF4 0000004143F4 0 es-UY
000000012C00 000000414400 0 ar-BH
000000012C0C 00000041440C 0 es-PY
000000012C18 000000414418 0 ar-QA
000000012C24 000000414424 0 es-BO
000000012C30 000000414430 0 es-SV
000000012C3C 00000041443C 0 es-HN
000000012C48 000000414448 0 es-NI
000000012C54 000000414454 0 es-PR
000000012C60 000000414460 0 zh-CHT
000000012C78 000000414478 0 af-za
000000012C84 000000414484 0 ar-ae
000000012C90 000000414490 0 ar-bh
000000012C9C 00000041449C 0 ar-dz
000000012CA8 0000004144A8 0 ar-eg
000000012CB4 0000004144B4 0 ar-iq
000000012CC0 0000004144C0 0 ar-jo
000000012CCC 0000004144CC 0 ar-kw
000000012CD8 0000004144D8 0 ar-lb
000000012CE4 0000004144E4 0 ar-ly
000000012CF0 0000004144F0 0 ar-ma
000000012CFC 0000004144FC 0 ar-om
000000012D08 000000414508 0 ar-qa
000000012D14 000000414514 0 ar-sa
000000012D20 000000414520 0 ar-sy
000000012D2C 00000041452C 0 ar-tn
000000012D38 000000414538 0 ar-ye
000000012D44 000000414544 0 az-az-cyrl
000000012D5C 00000041455C 0 az-az-latn
000000012D74 000000414574 0 be-by
000000012D80 000000414580 0 bg-bg
000000012D8C 00000041458C 0 bn-in
000000012D98 000000414598 0 bs-ba-latn
000000012DB0 0000004145B0 0 ca-es
000000012DBC 0000004145BC 0 cs-cz
000000012DC8 0000004145C8 0 cy-gb
000000012DD4 0000004145D4 0 da-dk
000000012DE0 0000004145E0 0 de-at
000000012DEC 0000004145EC 0 de-ch
000000012DF8 0000004145F8 0 de-de
000000012E04 000000414604 0 de-li
000000012E10 000000414610 0 de-lu
000000012E1C 00000041461C 0 div-mv
000000012E2C 00000041462C 0 el-gr
000000012E38 000000414638 0 en-au
000000012E44 000000414644 0 en-bz
000000012E50 000000414650 0 en-ca
000000012E5C 00000041465C 0 en-cb
000000012E68 000000414668 0 en-gb
000000012E74 000000414674 0 en-ie
000000012E80 000000414680 0 en-jm
File pos Mem pos ID Text
======== ======= == ====
000000012E8C 00000041468C 0 en-nz
000000012E98 000000414698 0 en-ph
000000012EA4 0000004146A4 0 en-tt
000000012EB0 0000004146B0 0 en-us
000000012EBC 0000004146BC 0 en-za
000000012EC8 0000004146C8 0 en-zw
000000012ED4 0000004146D4 0 es-ar
000000012EE0 0000004146E0 0 es-bo
000000012EEC 0000004146EC 0 es-cl
000000012EF8 0000004146F8 0 es-co
000000012F04 000000414704 0 es-cr
000000012F10 000000414710 0 es-do
000000012F1C 00000041471C 0 es-ec
000000012F28 000000414728 0 es-es
000000012F34 000000414734 0 es-gt
000000012F40 000000414740 0 es-hn
000000012F4C 00000041474C 0 es-mx
000000012F58 000000414758 0 es-ni
000000012F64 000000414764 0 es-pa
000000012F70 000000414770 0 es-pe
000000012F7C 00000041477C 0 es-pr
000000012F88 000000414788 0 es-py
000000012F94 000000414794 0 es-sv
000000012FA0 0000004147A0 0 es-uy
000000012FAC 0000004147AC 0 es-ve
000000012FB8 0000004147B8 0 et-ee
000000012FC4 0000004147C4 0 eu-es
000000012FD0 0000004147D0 0 fa-ir
000000012FDC 0000004147DC 0 fi-fi
000000012FE8 0000004147E8 0 fo-fo
000000012FF4 0000004147F4 0 fr-be
000000013000 000000414800 0 fr-ca
00000001300C 00000041480C 0 fr-ch
000000013018 000000414818 0 fr-fr
000000013024 000000414824 0 fr-lu
000000013030 000000414830 0 fr-mc
00000001303C 00000041483C 0 gl-es
000000013048 000000414848 0 gu-in
000000013054 000000414854 0 he-il
000000013060 000000414860 0 hi-in
00000001306C 00000041486C 0 hr-ba
000000013078 000000414878 0 hr-hr
000000013084 000000414884 0 hu-hu
000000013090 000000414890 0 hy-am
00000001309C 00000041489C 0 id-id
0000000130A8 0000004148A8 0 is-is
0000000130B4 0000004148B4 0 it-ch
0000000130C0 0000004148C0 0 it-it
0000000130CC 0000004148CC 0 ja-jp
0000000130D8 0000004148D8 0 ka-ge
0000000130E4 0000004148E4 0 kk-kz
0000000130F0 0000004148F0 0 kn-in
0000000130FC 0000004148FC 0 kok-in
00000001310C 00000041490C 0 ko-kr
000000013118 000000414918 0 ky-kg
000000013124 000000414924 0 lt-lt
000000013130 000000414930 0 lv-lv
00000001313C 00000041493C 0 mi-nz
000000013148 000000414948 0 mk-mk
000000013154 000000414954 0 ml-in
File pos Mem pos ID Text
======== ======= == ====
000000013160 000000414960 0 mn-mn
00000001316C 00000041496C 0 mr-in
000000013178 000000414978 0 ms-bn
000000013184 000000414984 0 ms-my
000000013190 000000414990 0 mt-mt
00000001319C 00000041499C 0 nb-no
0000000131A8 0000004149A8 0 nl-be
0000000131B4 0000004149B4 0 nl-nl
0000000131C0 0000004149C0 0 nn-no
0000000131CC 0000004149CC 0 ns-za
0000000131D8 0000004149D8 0 pa-in
0000000131E4 0000004149E4 0 pl-pl
0000000131F0 0000004149F0 0 pt-br
0000000131FC 0000004149FC 0 pt-pt
000000013208 000000414A08 0 quz-bo
000000013218 000000414A18 0 quz-ec
000000013228 000000414A28 0 quz-pe
000000013238 000000414A38 0 ro-ro
000000013244 000000414A44 0 ru-ru
000000013250 000000414A50 0 sa-in
00000001325C 000000414A5C 0 se-fi
000000013268 000000414A68 0 se-no
000000013274 000000414A74 0 se-se
000000013280 000000414A80 0 sk-sk
00000001328C 000000414A8C 0 sl-si
000000013298 000000414A98 0 sma-no
0000000132A8 000000414AA8 0 sma-se
0000000132B8 000000414AB8 0 smj-no
0000000132C8 000000414AC8 0 smj-se
0000000132D8 000000414AD8 0 smn-fi
0000000132E8 000000414AE8 0 sms-fi
0000000132F8 000000414AF8 0 sq-al
000000013304 000000414B04 0 sr-ba-cyrl
00000001331C 000000414B1C 0 sr-ba-latn
000000013334 000000414B34 0 sr-sp-cyrl
00000001334C 000000414B4C 0 sr-sp-latn
000000013364 000000414B64 0 sv-fi
000000013370 000000414B70 0 sv-se
00000001337C 000000414B7C 0 sw-ke
000000013388 000000414B88 0 syr-sy
000000013398 000000414B98 0 ta-in
0000000133A4 000000414BA4 0 te-in
0000000133B0 000000414BB0 0 th-th
0000000133BC 000000414BBC 0 tn-za
0000000133C8 000000414BC8 0 tr-tr
0000000133D4 000000414BD4 0 tt-ru
0000000133E0 000000414BE0 0 uk-ua
0000000133EC 000000414BEC 0 ur-pk
0000000133F8 000000414BF8 0 uz-uz-cyrl
000000013410 000000414C10 0 uz-uz-latn
000000013428 000000414C28 0 vi-vn
000000013434 000000414C34 0 xh-za
000000013440 000000414C40 0 zh-chs
000000013450 000000414C50 0 zh-cht
000000013460 000000414C60 0 zh-cn
00000001346C 000000414C6C 0 zh-hk
000000013478 000000414C78 0 zh-mo
000000013484 000000414C84 0 zh-sg
000000013490 000000414C90 0 zh-tw
00000001349C 000000414C9C 0 zu-za
File pos Mem pos ID Text
======== ======= == ====
00000001358B 000000414D8B 0 @USER32.DLL
000000013618 000000414E18 0 CONOUT$
00000001366C 000000414E6C 0 .AVCHD
0000000136A0 000000414EA0 0 .COLLAB
0000000136C8 000000414EC8 0 .MPEG
000000013728 000000414F28 0 .WRAP
0000000137C0 000000414FC0 0 .WEBM
0000000137D8 000000414FD8 0 .JPEG
0000000137FC 000000414FFC 0 .TIFF
00000001384C 00000041504C 0 .DB.TRX
000000013874 000000415074 0 .EVTX
00000001389C 00000041509C 0 %s\%s
0000000138B4 0000004150B4 0 SeTakeOwnershipPrivilege
0000000138E8 0000004150E8 0 SYSTEM\CurrentControlSet\Enum\STORAGE\RemovableMedia
000000013954 000000415154 0 MACHINE
000000013968 000000415168 0 SYSTEM\CurrentControlSet\Enum\USB
0000000139B0 0000004151B0 0 SYSTEM\CurrentControlSet\Enum\USBSTOR
000000013A00 000000415200 0 SYSTEM\CurrentControlSet\Control\DeviceClasses
000000013A60 000000415260 0 %SystemRoot%\Prefetch
000000013A8C 00000041528C 0 %Windir%\Minidump
000000013AB0 0000004152B0 0 %ProgramData%\Microsoft\Windows\WER
000000013AF8 0000004152F8 0 %LocalAppData%\Microsoft\Windows\WER
000000013B44 000000415344 0 %Windir%\setupapi.log
000000013B70 000000415370 0 %Windir%\setupapi.log.old
000000013BA4 0000004153A4 0 %Windir%\inf\setupapi.app.log
000000013BE0 0000004153E0 0 %Windir%\inf\setupapi.dev.log
000000013C20 000000415420 0 %Windir%\inf\setupapi.offline.log
000000013C68 000000415468 0 %Windir%\inf\setupapi.upgrade.log
0000000141E4 0000004159E4 0 Win32 Guided Tour
000000014208 000000415A08 0 Call to RegisterClassEx failed!
000000014248 000000415A48 0 Call to CreateWindow failed!
0000000163D1 0000004181D1 0 No error
0000000167D0 0000004185D0 0 No cassetes
000000016BD0 0000004189D0 0 le meme about cutting cookie dough
000000016C18 000000418A18 0 No status
000000017018 000000418E18 0 win32app
000000017040 000000418E40 0 No device status
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
0000000000DE 0000004000DE 0 twRich
0000000001F0 0000004001F0 0 .text
000000000218 000000400218 0 .rdata
00000000023F 00000040023F 0 @.data
000000000268 000000400268 0 .rsrc
00000000028F 00000040028F 0 @.reloc
000000000824 000000401424 0 PSSSSSS
0000000008B5 0000004014B5 0 u(SSS
000000000BFA 0000004017FA 0 PhDSA
000000000C14 000000401814 0 PhpSA
000000000C62 000000401862 0 Ph TA
000000000C7C 00000040187C 0 PhhTA
000000001289 000000401E89 0 Ph\VA
0000000015DF 0000004021DF 0 RVhPWA
000000001841 000000402441 0 D$8SVWj 3
00000000184C 00000040244C 0 D$@CSCCY3
000000001860 000000402460 0 D$@NG
0000000018EC 0000004024EC 0 u2hdXA
000000001B81 000000402781 0 VVVh0$@
000000001C77 000000402877 0 Qjdjd
000000001DE9 0000004029E9 0 D$ PS
000000001F34 000000402B34 0 D$ PS
File pos Mem pos ID Text
======== ======= == ====
000000001FF0 000000402BF0 0 j2jdZ
0000000021C4 000000402DC4 0 D$\PQQ
00000000227C 000000402E7C 0 SWSSh
0000000032F6 000000403EF6 0 PPPPPPPP
0000000037D0 0000004043D0 0 PPPPP
000000003B10 000000404710 0 t/HHt
000000003B53 000000404753 0 j*Xf;
000000003BB1 0000004047B1 0 j*Xf;
000000003C08 000000404808 0 htHjlZ;
000000003D4B 00000040494B 0 HHtXHHt
000000003F88 000000404B88 0 nt'joZ;
000000004028 000000404C28 0 jgXf;
0000000040FF 000000404CFF 0 YYjgXf9
0000000042B5 000000404EB5 0 >0t<NAj0X
000000004396 000000404F96 0 Wj0XP
0000000044A2 0000004050A2 0 Wj XP
000000004963 000000405563 0 t/HHt
000000004BAF 0000004057AF 0 HHtVHHt
0000000050A6 000000405CA6 0 >0t-N
00000000544F 00000040604F 0 5ntel
00000000545F 00000040605F 0 5Genu
000000006217 000000406E17 0 ~pjCXf
000000006AD1 0000004076D1 0 j@j _W
000000006B91 000000407791 0 } j@W
000000006F3C 000000407B3C 0 < t8< t4
000000007016 000000407C16 0 t@VSP
000000007071 000000407C71 0 PPPPP
0000000071A3 000000407DA3 0 <v5hJ
00000000728B 000000407E8B 0 SSSSS
0000000073EA 000000407FEA 0 SPPP+
0000000073F3 000000407FF3 0 FVWPP
000000007419 000000408019 0 SVWPP
00000000755B 00000040815B 0 VWhD!A
000000008B0C 00000040970C 0 ~';_t|%3
000000008B20 000000409720 0 wtVj
000000008B35 000000409735 0 ;_tr.
000000008B56 000000409756 0 GWVj
000000008D2B 00000040992B 0 v N+D$
000000008E3C 000000409A3C 0 QVWSj
0000000096D6 00000040A2D6 0 PP9E u
0000000099AD 00000040A5AD 0 jA[jZZ+
000000009AE9 00000040A6E9 0 PWWWWV
000000009B84 00000040A784 0 PSSSSV
00000000A25F 00000040AE5F 0 URPQQh
00000000BDBD 00000040C9BD 0 +t"HHt
00000000BE13 00000040CA13 0 9] t"
00000000C9D0 00000040D5D0 0 ,SVWj0X
00000000CB04 00000040D704 0 u'j0X
00000000CC2E 00000040D82E 0 Wj0XPV
00000000CCCD 00000040D8CD 0 PjdSQ
00000000CE36 00000040DA36 0 -jd[;
00000000CE8B 00000040DA8B 0 WWWWW
00000000D3DE 00000040DFDE 0 VVVVV
00000000D463 00000040E063 0 SVWUj
00000000D504 00000040E104 0 ;t$,v-
00000000D589 00000040E189 0 UQPXY]Y[
00000000E4F2 00000040F0F2 0 PPPPP
00000000E5A6 00000040F1A6 0 v N+D$
00000000E8DF 00000040F4DF 0 u0h0NA
00000000E8EE 00000040F4EE 0 u!h8NA
File pos Mem pos ID Text
======== ======= == ====
00000000F1CA 00000040FDCA 0 SSSSS
00000000FA08 000000411208 0 (null)
00000000FA41 000000411241 0 ( 8PX
00000000FA49 000000411249 0 700WP
00000000FA61 000000411261 0 xpxxxx
00000000FAD8 0000004112D8 0 Sunday
00000000FAE0 0000004112E0 0 Monday
00000000FAE8 0000004112E8 0 Tuesday
00000000FAF0 0000004112F0 0 Wednesday
00000000FAFC 0000004112FC 0 Thursday
00000000FB08 000000411308 0 Friday
00000000FB10 000000411310 0 Saturday
00000000FB4C 00000041134C 0 January
00000000FB54 000000411354 0 February
00000000FB60 000000411360 0 March
00000000FB68 000000411368 0 April
00000000FB80 000000411380 0 August
00000000FB88 000000411388 0 September
00000000FB94 000000411394 0 October
00000000FB9C 00000041139C 0 November
00000000FBA8 0000004113A8 0 December
00000000FBBC 0000004113BC 0 MM/dd/yy
00000000FBC8 0000004113C8 0 dddd, MMMM dd, yyyy
00000000FBDC 0000004113DC 0 HH:mm:ss
00000000FED0 0000004116D0 0 CorExitProcess
000000010960 000000412160 0 FlsAlloc
00000001096C 00000041216C 0 FlsFree
000000010974 000000412174 0 FlsGetValue
000000010980 000000412180 0 FlsSetValue
00000001098C 00000041218C 0 InitializeCriticalSectionEx
0000000109A8 0000004121A8 0 CreateEventExW
0000000109B8 0000004121B8 0 CreateSemaphoreExW
0000000109CC 0000004121CC 0 SetThreadStackGuarantee
0000000109E4 0000004121E4 0 CreateThreadpoolTimer
0000000109FC 0000004121FC 0 SetThreadpoolTimer
000000010A10 000000412210 0 WaitForThreadpoolTimerCallbacks
000000010A30 000000412230 0 CloseThreadpoolTimer
000000010A48 000000412248 0 CreateThreadpoolWait
000000010A60 000000412260 0 SetThreadpoolWait
000000010A74 000000412274 0 CloseThreadpoolWait
000000010A88 000000412288 0 FlushProcessWriteBuffers
000000010AA4 0000004122A4 0 FreeLibraryWhenCallbackReturns
000000010AC4 0000004122C4 0 GetCurrentProcessorNumber
000000010AE0 0000004122E0 0 GetLogicalProcessorInformation
000000010B00 000000412300 0 CreateSymbolicLinkW
000000010B14 000000412314 0 SetDefaultDllDirectories
000000010B30 000000412330 0 EnumSystemLocalesEx
000000010B44 000000412344 0 CompareStringEx
000000010B54 000000412354 0 GetDateFormatEx
000000010B64 000000412364 0 GetLocaleInfoEx
000000010B74 000000412374 0 GetTimeFormatEx
000000010B84 000000412384 0 GetUserDefaultLocaleName
000000010BA0 0000004123A0 0 IsValidLocaleName
000000010BB4 0000004123B4 0 LCMapStringEx
000000010BC4 0000004123C4 0 GetCurrentPackageId
000000010BD8 0000004123D8 0 GetTickCount64
000000010BE8 0000004123E8 0 GetFileInformationByHandleExW
000000010C08 000000412408 0 SetFileInformationByHandleW
0000000111D0 0000004129D0 0 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]
000000011211 000000412A11 0 abcdefghijklmnopqrstuvwxyz{|}~
File pos Mem pos ID Text
======== ======= == ====
000000011350 000000412B50 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]
000000011391 000000412B91 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0000000134CD 000000414CCD 0 ('8PW
0000000134D6 000000414CD6 0 700PP
0000000134F1 000000414CF1 0 xppwpp
000000013527 000000414D27 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]
000000013568 000000414D68 0 abcdefghijklmnopqrstuvwxyz{|}~
0000000135A4 000000414DA4 0 MessageBoxW
0000000135B0 000000414DB0 0 GetActiveWindow
0000000135C0 000000414DC0 0 GetLastActivePopup
0000000135D4 000000414DD4 0 GetUserObjectInformationW
0000000135F0 000000414DF0 0 GetProcessWindowStation
000000013610 000000414E10 0 e+000
000000013628 000000414E28 0 1#SNAN
000000013630 000000414E30 0 1#IND
000000013638 000000414E38 0 1#INF
000000013640 000000414E40 0 1#QNAN
000000013880 000000415080 0 Deleting:
000000013D88 000000415588 0 CscCngOpen
000000013D94 000000415594 0 CscCngClose
000000013DA0 0000004155A0 0 CscCngLock
000000013DAC 0000004155AC 0 CscCngUnlock
000000013DBC 0000004155BC 0 CscCngDispense
000000013DCC 0000004155CC 0 CscCngTransport
000000013DDC 0000004155DC 0 CscCngStatusRead
000000013DF0 0000004155F0 0 CscCngReset
000000013E04 000000415604 0 Locking CSCCNG...
000000013E18 000000415618 0 Unlocking CSCCNG...
000000013E2C 00000041562C 0 Resetting csccng
000000013E40 000000415640 0 Resetted csccng
000000013E50 000000415650 0 %d,%02d;
000000013E5C 00000041565C 0 Dispensing (%s)...
000000013E70 000000415670 0 Dispense failed
000000013E84 000000415684 0 Success, transporting now. Raw response: %s
000000013EB4 0000004156B4 0 transport waitpos failed
000000013ED0 0000004156D0 0 Transporting to customer...
000000013EEC 0000004156EC 0 transport offer failed
000000013F04 000000415704 0 money not taken
000000013F18 000000415718 0 locking failed
000000013F28 000000415728 0 MaxNotes: %d
000000013F38 000000415738 0 %dSTA
000000013F40 000000415740 0 %dVAL
000000013F48 000000415748 0 %dACT
000000013F50 000000415750 0 CAS%d: %d, %d
000000013F60 000000415760 0 MAX_NOTES
000000013F6C 00000041576C 0 loading cscwcng.dll
000000013F80 000000415780 0 trying cscwcng.dll ...
000000013F98 000000415798 0 cscwcng.dll
000000013FA4 0000004157A4 0 failed finding cscwcng.dll
000000013FC0 0000004157C0 0 trying C:\CSCW32\DLL\cscwcng.dll ...
000000013FE8 0000004157E8 0 C:\CSCW32\DLL\cscwcng.dll
000000014004 000000415804 0 failed finding C:\CSCW32\DLL\cscwcng.dll
000000014030 000000415830 0 trying C:\DLL\cscwcng.dll ...
000000014050 000000415850 0 C:\DLL\cscwcng.dll
000000014064 000000415864 0 failed finding C:\DLL\cscwcng.dll
000000014088 000000415888 0 Loaded cscwcng.dll!
0000000140A0 0000004158A0 0 failed resolving functions in cscwcng.dll!
0000000140CC 0000004158CC 0 Connecting...
0000000140DC 0000004158DC 0 Failed opening CSCCNG
0000000140F4 0000004158F4 0 Connected
File pos Mem pos ID Text
======== ======= == ====
000000014100 000000415900 0 Finished dispensing, bestCassete:%d, billcount:%d.
000000014134 000000415934 0 User left, cleaning up.
00000001414C 00000041594C 0 Disconnecting...
000000014160 000000415960 0 Failed disconnecting
000000014178 000000415978 0 Disconnected
000000014188 000000415988 0 BUTTON
000000014190 000000415990 0 STATIC
0000000141CC 0000004159CC 0 ENTER
0000000141DC 0000004159DC 0 %010u
000000014672 000000415E72 0 dispenser_NO_TOKEN.exe
000000014689 000000415E89 0 ChooseColorA
000000014696 000000415E96 0 ChooseFontA
0000000146A2 000000415EA2 0 Dispense
0000000146AB 000000415EAB 0 FindTextA
0000000146B5 000000415EB5 0 GetOpenFileNameA
0000000146C6 000000415EC6 0 GetSaveFileNameA
0000000146D7 000000415ED7 0 PrintDlgA
0000000146E1 000000415EE1 0 WNetAddConnection2A
0000000146F5 000000415EF5 0 WNetCancelConnection2A
00000001491E 00000041611E 0 FindFirstFileW
000000014930 000000416130 0 HeapAlloc
00000001493C 00000041613C 0 GetCurrentProcess
000000014950 000000416150 0 HeapFree
00000001495C 00000041615C 0 GetProcessHeap
00000001496E 00000041616E 0 WriteFile
00000001497A 00000041617A 0 Sleep
000000014982 000000416182 0 CreateFileW
000000014990 000000416190 0 FlushFileBuffers
0000000149A4 0000004161A4 0 GetFileSizeEx
0000000149B4 0000004161B4 0 GetLastError
0000000149C4 0000004161C4 0 FindClose
0000000149D0 0000004161D0 0 FindNextFileW
0000000149E0 0000004161E0 0 CloseHandle
0000000149EE 0000004161EE 0 GetWindowsDirectoryW
000000014A06 000000416206 0 DeleteFileW
000000014A14 000000416214 0 LocalFree
000000014A20 000000416220 0 ExpandEnvironmentStringsW
000000014A3C 00000041623C 0 CreateThread
000000014A4C 00000041624C 0 ExitProcess
000000014A5A 00000041625A 0 lstrlenA
000000014A66 000000416266 0 FreeLibrary
000000014A74 000000416274 0 GetProcAddress
000000014A86 000000416286 0 LoadLibraryA
000000014A96 000000416296 0 GetModuleHandleW
000000014AA8 0000004162A8 0 KERNEL32.dll
000000014AB8 0000004162B8 0 DispatchMessageW
000000014ACC 0000004162CC 0 DefWindowProcW
000000014ADE 0000004162DE 0 CallWindowProcW
000000014AF0 0000004162F0 0 UpdateWindow
000000014B00 000000416300 0 SendMessageW
000000014B10 000000416310 0 MessageBoxW
000000014B1E 00000041631E 0 CreateWindowExW
000000014B30 000000416330 0 ShowWindow
000000014B3E 00000041633E 0 RedrawWindow
000000014B4E 00000041634E 0 SetWindowLongW
000000014B60 000000416360 0 CreateWindowExA
000000014B72 000000416372 0 SetRect
000000014B7C 00000041637C 0 LoadIconW
000000014B88 000000416388 0 RegisterClassExW
000000014B9C 00000041639C 0 TranslateMessage
File pos Mem pos ID Text
======== ======= == ====
000000014BB0 0000004163B0 0 BeginPaint
000000014BBE 0000004163BE 0 SendMessageA
000000014BCE 0000004163CE 0 SetFocus
000000014BDA 0000004163DA 0 LoadCursorW
000000014BE8 0000004163E8 0 DrawTextW
000000014BF4 0000004163F4 0 FillRect
000000014C00 000000416400 0 PostQuitMessage
000000014C12 000000416412 0 GetMessageW
000000014C20 000000416420 0 DestroyWindow
000000014C30 000000416430 0 EndPaint
000000014C3A 00000041643A 0 USER32.dll
000000014C48 000000416448 0 OpenProcessToken
000000014C5C 00000041645C 0 GetTokenInformation
000000014C72 000000416472 0 RegDeleteKeyW
000000014C82 000000416482 0 SetNamedSecurityInfoW
000000014C9A 00000041649A 0 LookupPrivilegeValueW
000000014CB2 0000004164B2 0 AllocateAndInitializeSid
000000014CCE 0000004164CE 0 SetEntriesInAclW
000000014CE2 0000004164E2 0 FreeSid
000000014CEC 0000004164EC 0 RegOpenKeyExW
000000014CFC 0000004164FC 0 RegEnumKeyExW
000000014D0C 00000041650C 0 AdjustTokenPrivileges
000000014D24 000000416524 0 RegCloseKey
000000014D30 000000416530 0 ADVAPI32.dll
000000014D40 000000416540 0 GetSystemTimeAsFileTime
000000014D5A 00000041655A 0 GetCommandLineA
000000014D6C 00000041656C 0 IsDebuggerPresent
000000014D80 000000416580 0 IsProcessorFeaturePresent
000000014D9C 00000041659C 0 EncodePointer
000000014DAC 0000004165AC 0 DecodePointer
000000014DBC 0000004165BC 0 IsValidCodePage
000000014DCE 0000004165CE 0 GetACP
000000014DD8 0000004165D8 0 GetOEMCP
000000014DE4 0000004165E4 0 GetCPInfo
000000014DF0 0000004165F0 0 GetStringTypeW
000000014E02 000000416602 0 SetLastError
000000014E12 000000416612 0 GetCurrentThreadId
000000014E28 000000416628 0 GetModuleHandleExW
000000014E3E 00000041663E 0 MultiByteToWideChar
000000014E54 000000416654 0 WideCharToMultiByte
000000014E6A 00000041666A 0 GetStdHandle
000000014E7A 00000041667A 0 GetFileType
000000014E88 000000416688 0 DeleteCriticalSection
000000014EA0 0000004166A0 0 GetStartupInfoW
000000014EB2 0000004166B2 0 GetModuleFileNameA
000000014EC8 0000004166C8 0 GetModuleFileNameW
000000014EDE 0000004166DE 0 QueryPerformanceCounter
000000014EF8 0000004166F8 0 GetCurrentProcessId
000000014F0E 00000041670E 0 GetEnvironmentStringsW
000000014F28 000000416728 0 FreeEnvironmentStringsW
000000014F42 000000416742 0 UnhandledExceptionFilter
000000014F5E 00000041675E 0 SetUnhandledExceptionFilter
000000014F7C 00000041677C 0 InitializeCriticalSectionAndSpinCount
000000014FA4 0000004167A4 0 TerminateProcess
000000014FB8 0000004167B8 0 TlsAlloc
000000014FC4 0000004167C4 0 TlsGetValue
000000014FD2 0000004167D2 0 TlsSetValue
000000014FE0 0000004167E0 0 TlsFree
000000014FEA 0000004167EA 0 EnterCriticalSection
000000015002 000000416802 0 LeaveCriticalSection
File pos Mem pos ID Text
======== ======= == ====
00000001501A 00000041681A 0 GetConsoleCP
00000001502A 00000041682A 0 GetConsoleMode
00000001503C 00000041683C 0 SetFilePointerEx
000000015050 000000416850 0 LCMapStringW
000000015060 000000416860 0 LoadLibraryExW
000000015072 000000416872 0 RtlUnwind
00000001507E 00000041687E 0 OutputDebugStringW
000000015094 000000416894 0 SetStdHandle
0000000150A4 0000004168A4 0 WriteConsoleW
0000000150B4 0000004168B4 0 HeapReAlloc
0000000150C2 0000004168C2 0 HeapSize
0000000153EA 0000004171EA 0
0000000154D1 0000004172D1 0 abcdefghijklmnopqrstuvwxyz
0000000154F1 0000004172F1 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ
00000001560A 00000041740A 0
0000000156EA 0000004174EA 0 abcdefghijklmnopqrstuvwxyz
00000001570A 00000041750A 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ
0000000161D6 000000417FD6 0 z?aUY
000000016218 000000418018 0 zc%C1
00000001626B 00000041806B 0 -64OS
00000001636C 00000041816C 0 k L-zh!
00000001702C 000000418E2C 0 nothing
000000017660 00000041D060 0 <?xml version='1.0' encoding='UTF-8' standalone='yes'?>
000000017699 00000041D099 0 <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
0000000176E4 00000041D0E4 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
00000001771C 00000041D11C 0 <security>
00000001772C 00000041D12C 0 <requestedPrivileges>
000000017749 00000041D149 0 <requestedExecutionLevel level='asInvoker' uiAccess='false' />
000000017791 00000041D191 0 </requestedPrivileges>
0000000177AF 00000041D1AF 0 </security>
0000000177C0 00000041D1C0 0 </trustInfo>
0000000177D0 00000041D1D0 0 </assembly>
000000017811 00000041E011 0 1 1\1c1
000000017823 00000041E023 0 242r2
00000001782D 00000041E02D 0 2V3e3
00000001784D 00000041E04D 0 515h5
000000017855 00000041E055 0 5*6:6B6g6
00000001786D 00000041E06D 0 7%7*787=7K7P7a7h7t7z7
00000001788D 00000041E08D 0 808J8d8~8
00000001789F 00000041E09F 0 9&9O9Y9m9s9
0000000178C3 00000041E0C3 0 : :':-:2:9:?:D:K:Q:V:]:c:h:o:u:z:
0000000178F3 00000041E0F3 0 :*;@;)<q<
00000001791B 00000041E11B 0 ?/?8???x?
000000017935 00000041E135 0 0.1m1
00000001793D 00000041E13D 0 1g2q2
000000017949 00000041E149 0 3:4h4x4
00000001796D 00000041E16D 0 5!5-5A5M5S5_5
000000017981 00000041E181 0 546R6t6
0000000179A3 00000041E1A3 0 7"7*727:7B7J7R7Z7b7n7w7}7
0000000179CB 00000041E1CB 0 8 8M8X8
0000000179DB 00000041E1DB 0 9)9:9K9\9m9~9
0000000179F7 00000041E1F7 0 :/:4:V:]:s:x:
000000017A13 00000041E213 0 ;(;/;;;O;\;g;
000000017A3B 00000041E23B 0 <&<.<B<M<\<d<x<
000000017A61 00000041E261 0 =2=<=P=V=e=
000000017A77 00000041E277 0 > >>>O>[>
000000017A81 00000041E281 0 >h>x>
000000017AB9 00000041E2B9 0 141u1
000000017AC1 00000041E2C1 0 :'=.=D=N=r?
000000017AE1 00000041E2E1 0 0d0i0s0
File pos Mem pos ID Text
======== ======= == ====
000000017AEB 00000041E2EB 0 1>1E1X1
000000017B19 00000041E319 0 2!2+2;2K2[2d2{2]3
000000017B3B 00000041E33B 0 6 :L;
000000017B58 00000041E358 0 <1@1D1H1L1P1T1X1A2u2
000000017B71 00000041E371 0 3;4B4h4o4
000000017B7F 00000041E37F 0 5i8V9
000000017BAF 00000041E3AF 0 0'0V0
000000017BBF 00000041E3BF 0 1$1=1G1T1
000000017BE7 00000041E3E7 0 5/5>5H5U5_5o5
000000017C13 00000041E413 0 939N9V9d9i9x9
000000017C25 00000041E425 0 :>:Q:
000000017C3B 00000041E43B 0 <"=*=
000000017C4D 00000041E44D 0 >->o>
000000017C59 00000041E459 0 ? ?1?
000000017C68 00000041E468 0 g1z1:2
000000017C77 00000041E477 0 3+434F4Q4V4f4r4w4
000000017C8F 00000041E48F 0 4c5z5
000000017CA7 00000041E4A7 0 6-626>6C6b6
000000017CBB 00000041E4BB 0 7 7A7M7
000000017CC9 00000041E4C9 0 7A8G8N8
000000017CD5 00000041E4D5 0 8?9s9
000000017CEF 00000041E4EF 0 ;3<?<K<Z<e<
000000017D01 00000041E501 0 <"=:=D=
000000017D09 00000041E509 0 =g=m={=
000000017D21 00000041E521 0 >'>v>
000000017D33 00000041E533 0 ?(?1?>?m?u?
000000017D54 00000041E554 0 040?0P0V0f0n0t0
000000017D79 00000041E579 0 1"1+131K1
000000017D83 00000041E583 0 1d1j1q1z1
000000017DBF 00000041E5BF 0 2%2*20282=2C2K2P2V2
000000017DD3 00000041E5D3 0 2c2i2q2v2|2
000000017E0F 00000041E60F 0 3!3'3/343:3B3G3M3U3Z3
000000017E25 00000041E625 0 3h3m3s3{3
000000017E57 00000041E657 0 4'434@4I4
000000017E75 00000041E675 0 6!7;7H7W7a7s7
000000017E93 00000041E693 0 7)868?8c8
000000017EA3 00000041E6A3 0 9H9b9
000000017EAF 00000041E6AF 0 :=;F;d;
000000017EBD 00000041E6BD 0 <1=:=
000000017EC3 00000041E6C3 0 >">5>I>
000000017EDD 00000041E6DD 0 1_1h1
000000017EE5 00000041E6E5 0 1!2e2
000000017EFD 00000041E6FD 0 575h5
000000017F13 00000041E713 0 8+8L8
000000017F1F 00000041E71F 0 9f9L:h:
000000017F31 00000041E731 0 ;);2;>;I;p;
000000017F45 00000041E745 0 <&<,<F<X<j<|<
000000017F63 00000041E763 0 ===O=a=s=
000000017F83 00000041E783 0 3@4R4
000000017F8B 00000041E78B 0 5B5P5V5
000000017F95 00000041E795 0 6b7G8Q8W8k8w8
000000017FC9 00000041E7C9 0 9B9H9M9
000000017FE5 00000041E7E5 0 ;#;+;
000000017FFB 00000041E7FB 0 <#<)<5<:<?<D<M<
00000001801B 00000041E81B 0 =o=y=
000000018025 00000041E825 0 >F>e>q>|?
00000001803B 00000041E83B 0 2?2P2V2b2r2x2
000000018069 00000041E869 0 3%3+343:3D3O3
00000001808B 00000041E88B 0 6-686Z6
000000018097 00000041E897 0 7Q7]7
File pos Mem pos ID Text
======== ======= == ====
0000000180A5 00000041E8A5 0 7"868z8
0000000180BF 00000041E8BF 0 :(;.;:;q;
0000000180F5 00000041E8F5 0 1@2b3j3
000000018101 00000041E901 0 5>6F6R6a6
000000018111 00000041E911 0 7&;8;
00000001812F 00000041E92F 0 ?+?9?
000000018141 00000041E941 0 1#1+1014181a1
000000018167 00000041E967 0 2 2$2
00000001817D 00000041E97D 0 3A3H3L3P3T3X3\3
0000000181B0 00000041E9B0 0 Q0W0l0
0000000181B9 00000041E9B9 0 0U1o1x1
0000000181CD 00000041E9CD 0 3d3u3
0000000181F7 00000041E9F7 0 :5:<:@:D:H:L:P:T:X:
000000018215 00000041EA15 0 ;%;@;G;L;P;T;u;
000000018237 00000041EA37 0 ;><D<H<L<P<
000000018279 00000041EA79 0 2%252g2
0000000182B7 00000041EAB7 0 7$7,747<7D7L7T7\7d7l7t7|7
0000000182E0 00000041EAE0 0 4<<<D<L<T<\<d<l<t<|<
00000001831B 00000041EB1B 0 =$=,=4=<=D=L=T=\=d=l=t=|=
00000001835B 00000041EB5B 0 >$>,>4><>D>L>T>\>d>l>t>|>
00000001839B 00000041EB9B 0 ?$?,?4?<?D?L?T?\?d?l?t?|?
0000000183E3 00000041EBE3 0 0$0,040<0D0L0T0\0d0l0t0|0
000000018423 00000041EC23 0 1$1,141<1D1L1T1\1d1l1t1|1
000000018463 00000041EC63 0 2$2,242<2D2L2T2\2d2l2t2|2
0000000184A3 00000041ECA3 0 3$3,343<3D3L3P3X3
0000000184B5 00000041ECB5 0 3h3p3x3
0000000184E3 00000041ECE3 0 4 4(40484@4H4P4X4
0000000184F5 00000041ECF5 0 4h4p4x4
000000018523 00000041ED23 0 5 5(50585@5H5P5X5
000000018535 00000041ED35 0 5h5p5x5
000000018563 00000041ED63 0 6 6(60686@6H6P6X6
000000018575 00000041ED75 0 6h6p6x6
0000000185A3 00000041EDA3 0 7 7(70787@7H7P7X7
0000000185B5 00000041EDB5 0 7h7p7x7
0000000185E3 00000041EDE3 0 8 8(80888@8H8P8X8
0000000185F5 00000041EDF5 0 8h8p8x8
000000018623 00000041EE23 0 9 9(90989@9H9P9X9
000000018635 00000041EE35 0 9h9p9x9
000000018663 00000041EE63 0 : :(:0:8:@:H:P:X:
0000000186B5 00000041EEB5 0 5 5$5(5,5054585<5@5D5H5L5P5T5X5\5
0000000186D7 00000041EED7 0 5d5h5l5p5t5x5|5
0000000186F1 00000041EEF1 0 ;(;H;h;
000000018705 00000041EF05 0 <8<X<x<
000000018719 00000041EF19 0 =8=D=
00000001876D 00000041EF6D 0 7 7$7(7,7074787<7@7D7H7L7P7T7X7\7
00000001878F 00000041EF8F 0 7l7p7t7x7|7
0000000187E9 00000041EFE9 0 8D8T8d8t8
000000018801 00000041F001 0 8@9H9
000000018823 00000041F023 0 = =$=(=,=0=4=@=D=H=L=P=T=X=\=d=h=p=
00000000FA10 000000411210 0 (null)
00000000FA8B 00000041128B 0 Aja-JP
00000000FA98 000000411298 0 zh-CN
00000000FAA4 0000004112A4 0 ko-KR
00000000FAB0 0000004112B0 0 zh-TW
00000000FC20 000000411420 0 Sunday
00000000FC30 000000411430 0 Monday
00000000FC40 000000411440 0 Tuesday
00000000FC50 000000411450 0 Wednesday
00000000FC64 000000411464 0 Thursday
00000000FC78 000000411478 0 Friday
File pos Mem pos ID Text
======== ======= == ====
00000000FC88 000000411488 0 Saturday
00000000FCFC 0000004114FC 0 January
00000000FD0C 00000041150C 0 February
00000000FD20 000000411520 0 March
00000000FD2C 00000041152C 0 April
00000000FD50 000000411550 0 August
00000000FD60 000000411560 0 September
00000000FD74 000000411574 0 October
00000000FD84 000000411584 0 November
00000000FD98 000000411598 0 December
00000000FDBC 0000004115BC 0 MM/dd/yy
00000000FDD0 0000004115D0 0 dddd, MMMM dd, yyyy
00000000FDF8 0000004115F8 0 HH:mm:ss
00000000FE0C 00000041160C 0 en-US
00000000FEB8 0000004116B8 0 mscoree.dll
000000010860 000000412060 0 runtime error
0000000108A0 0000004120A0 0 Program:
0000000108B4 0000004120B4 0 <program name unknown>
0000000108F8 0000004120F8 0 Microsoft Visual C++ Runtime Library
000000010944 000000412144 0 kernel32.dll
000000012288 000000413A88 0 zh-CHS
00000001248C 000000413C8C 0 ar-SA
000000012498 000000413C98 0 bg-BG
0000000124A4 000000413CA4 0 ca-ES
0000000124B0 000000413CB0 0 cs-CZ
0000000124BC 000000413CBC 0 da-DK
0000000124C8 000000413CC8 0 de-DE
0000000124D4 000000413CD4 0 el-GR
0000000124E0 000000413CE0 0 fi-FI
0000000124EC 000000413CEC 0 fr-FR
0000000124F8 000000413CF8 0 he-IL
000000012504 000000413D04 0 hu-HU
000000012510 000000413D10 0 is-IS
00000001251C 000000413D1C 0 it-IT
000000012528 000000413D28 0 nl-NL
000000012534 000000413D34 0 nb-NO
000000012540 000000413D40 0 pl-PL
00000001254C 000000413D4C 0 pt-BR
000000012558 000000413D58 0 ro-RO
000000012564 000000413D64 0 ru-RU
000000012570 000000413D70 0 hr-HR
00000001257C 000000413D7C 0 sk-SK
000000012588 000000413D88 0 sq-AL
000000012594 000000413D94 0 sv-SE
0000000125A0 000000413DA0 0 th-TH
0000000125AC 000000413DAC 0 tr-TR
0000000125B8 000000413DB8 0 ur-PK
0000000125C4 000000413DC4 0 id-ID
0000000125D0 000000413DD0 0 uk-UA
0000000125DC 000000413DDC 0 be-BY
0000000125E8 000000413DE8 0 sl-SI
0000000125F4 000000413DF4 0 et-EE
000000012600 000000413E00 0 lv-LV
00000001260C 000000413E0C 0 lt-LT
000000012618 000000413E18 0 fa-IR
000000012624 000000413E24 0 vi-VN
000000012630 000000413E30 0 hy-AM
00000001263C 000000413E3C 0 az-AZ-Latn
000000012654 000000413E54 0 eu-ES
000000012660 000000413E60 0 mk-MK
File pos Mem pos ID Text
======== ======= == ====
00000001266C 000000413E6C 0 tn-ZA
000000012678 000000413E78 0 xh-ZA
000000012684 000000413E84 0 zu-ZA
000000012690 000000413E90 0 af-ZA
00000001269C 000000413E9C 0 ka-GE
0000000126A8 000000413EA8 0 fo-FO
0000000126B4 000000413EB4 0 hi-IN
0000000126C0 000000413EC0 0 mt-MT
0000000126CC 000000413ECC 0 se-NO
0000000126D8 000000413ED8 0 ms-MY
0000000126E4 000000413EE4 0 kk-KZ
0000000126F0 000000413EF0 0 ky-KG
0000000126FC 000000413EFC 0 sw-KE
000000012708 000000413F08 0 uz-UZ-Latn
000000012720 000000413F20 0 tt-RU
00000001272C 000000413F2C 0 bn-IN
000000012738 000000413F38 0 pa-IN
000000012744 000000413F44 0 gu-IN
000000012750 000000413F50 0 ta-IN
00000001275C 000000413F5C 0 te-IN
000000012768 000000413F68 0 kn-IN
000000012774 000000413F74 0 ml-IN
000000012780 000000413F80 0 mr-IN
00000001278C 000000413F8C 0 sa-IN
000000012798 000000413F98 0 mn-MN
0000000127A4 000000413FA4 0 cy-GB
0000000127B0 000000413FB0 0 gl-ES
0000000127BC 000000413FBC 0 kok-IN
0000000127CC 000000413FCC 0 syr-SY
0000000127DC 000000413FDC 0 div-MV
0000000127EC 000000413FEC 0 quz-BO
0000000127FC 000000413FFC 0 ns-ZA
000000012808 000000414008 0 mi-NZ
000000012814 000000414014 0 ar-IQ
000000012820 000000414020 0 de-CH
00000001282C 00000041402C 0 en-GB
000000012838 000000414038 0 es-MX
000000012844 000000414044 0 fr-BE
000000012850 000000414050 0 it-CH
00000001285C 00000041405C 0 nl-BE
000000012868 000000414068 0 nn-NO
000000012874 000000414074 0 pt-PT
000000012880 000000414080 0 sr-SP-Latn
000000012898 000000414098 0 sv-FI
0000000128A4 0000004140A4 0 az-AZ-Cyrl
0000000128BC 0000004140BC 0 se-SE
0000000128C8 0000004140C8 0 ms-BN
0000000128D4 0000004140D4 0 uz-UZ-Cyrl
0000000128EC 0000004140EC 0 quz-EC
0000000128FC 0000004140FC 0 ar-EG
000000012908 000000414108 0 zh-HK
000000012914 000000414114 0 de-AT
000000012920 000000414120 0 en-AU
00000001292C 00000041412C 0 es-ES
000000012938 000000414138 0 fr-CA
000000012944 000000414144 0 sr-SP-Cyrl
00000001295C 00000041415C 0 se-FI
000000012968 000000414168 0 quz-PE
000000012978 000000414178 0 ar-LY
000000012984 000000414184 0 zh-SG
File pos Mem pos ID Text
======== ======= == ====
000000012990 000000414190 0 de-LU
00000001299C 00000041419C 0 en-CA
0000000129A8 0000004141A8 0 es-GT
0000000129B4 0000004141B4 0 fr-CH
0000000129C0 0000004141C0 0 hr-BA
0000000129CC 0000004141CC 0 smj-NO
0000000129DC 0000004141DC 0 ar-DZ
0000000129E8 0000004141E8 0 zh-MO
0000000129F4 0000004141F4 0 de-LI
000000012A00 000000414200 0 en-NZ
000000012A0C 00000041420C 0 es-CR
000000012A18 000000414218 0 fr-LU
000000012A24 000000414224 0 bs-BA-Latn
000000012A3C 00000041423C 0 smj-SE
000000012A4C 00000041424C 0 ar-MA
000000012A58 000000414258 0 en-IE
000000012A64 000000414264 0 es-PA
000000012A70 000000414270 0 fr-MC
000000012A7C 00000041427C 0 sr-BA-Latn
000000012A94 000000414294 0 sma-NO
000000012AA4 0000004142A4 0 ar-TN
000000012AB0 0000004142B0 0 en-ZA
000000012ABC 0000004142BC 0 es-DO
000000012AC8 0000004142C8 0 sr-BA-Cyrl
000000012AE0 0000004142E0 0 sma-SE
000000012AF0 0000004142F0 0 ar-OM
000000012AFC 0000004142FC 0 en-JM
000000012B08 000000414308 0 es-VE
000000012B14 000000414314 0 sms-FI
000000012B24 000000414324 0 ar-YE
000000012B30 000000414330 0 en-CB
000000012B3C 00000041433C 0 es-CO
000000012B48 000000414348 0 smn-FI
000000012B58 000000414358 0 ar-SY
000000012B64 000000414364 0 en-BZ
000000012B70 000000414370 0 es-PE
000000012B7C 00000041437C 0 ar-JO
000000012B88 000000414388 0 en-TT
000000012B94 000000414394 0 es-AR
000000012BA0 0000004143A0 0 ar-LB
000000012BAC 0000004143AC 0 en-ZW
000000012BB8 0000004143B8 0 es-EC
000000012BC4 0000004143C4 0 ar-KW
000000012BD0 0000004143D0 0 en-PH
000000012BDC 0000004143DC 0 es-CL
000000012BE8 0000004143E8 0 ar-AE
000000012BF4 0000004143F4 0 es-UY
000000012C00 000000414400 0 ar-BH
000000012C0C 00000041440C 0 es-PY
000000012C18 000000414418 0 ar-QA
000000012C24 000000414424 0 es-BO
000000012C30 000000414430 0 es-SV
000000012C3C 00000041443C 0 es-HN
000000012C48 000000414448 0 es-NI
000000012C54 000000414454 0 es-PR
000000012C60 000000414460 0 zh-CHT
000000012C78 000000414478 0 af-za
000000012C84 000000414484 0 ar-ae
000000012C90 000000414490 0 ar-bh
000000012C9C 00000041449C 0 ar-dz
File pos Mem pos ID Text
======== ======= == ====
000000012CA8 0000004144A8 0 ar-eg
000000012CB4 0000004144B4 0 ar-iq
000000012CC0 0000004144C0 0 ar-jo
000000012CCC 0000004144CC 0 ar-kw
000000012CD8 0000004144D8 0 ar-lb
000000012CE4 0000004144E4 0 ar-ly
000000012CF0 0000004144F0 0 ar-ma
000000012CFC 0000004144FC 0 ar-om
000000012D08 000000414508 0 ar-qa
000000012D14 000000414514 0 ar-sa
000000012D20 000000414520 0 ar-sy
000000012D2C 00000041452C 0 ar-tn
000000012D38 000000414538 0 ar-ye
000000012D44 000000414544 0 az-az-cyrl
000000012D5C 00000041455C 0 az-az-latn
000000012D74 000000414574 0 be-by
000000012D80 000000414580 0 bg-bg
000000012D8C 00000041458C 0 bn-in
000000012D98 000000414598 0 bs-ba-latn
000000012DB0 0000004145B0 0 ca-es
000000012DBC 0000004145BC 0 cs-cz
000000012DC8 0000004145C8 0 cy-gb
000000012DD4 0000004145D4 0 da-dk
000000012DE0 0000004145E0 0 de-at
000000012DEC 0000004145EC 0 de-ch
000000012DF8 0000004145F8 0 de-de
000000012E04 000000414604 0 de-li
000000012E10 000000414610 0 de-lu
000000012E1C 00000041461C 0 div-mv
000000012E2C 00000041462C 0 el-gr
000000012E38 000000414638 0 en-au
000000012E44 000000414644 0 en-bz
000000012E50 000000414650 0 en-ca
000000012E5C 00000041465C 0 en-cb
000000012E68 000000414668 0 en-gb
000000012E74 000000414674 0 en-ie
000000012E80 000000414680 0 en-jm
000000012E8C 00000041468C 0 en-nz
000000012E98 000000414698 0 en-ph
000000012EA4 0000004146A4 0 en-tt
000000012EB0 0000004146B0 0 en-us
000000012EBC 0000004146BC 0 en-za
000000012EC8 0000004146C8 0 en-zw
000000012ED4 0000004146D4 0 es-ar
000000012EE0 0000004146E0 0 es-bo
000000012EEC 0000004146EC 0 es-cl
000000012EF8 0000004146F8 0 es-co
000000012F04 000000414704 0 es-cr
000000012F10 000000414710 0 es-do
000000012F1C 00000041471C 0 es-ec
000000012F28 000000414728 0 es-es
000000012F34 000000414734 0 es-gt
000000012F40 000000414740 0 es-hn
000000012F4C 00000041474C 0 es-mx
000000012F58 000000414758 0 es-ni
000000012F64 000000414764 0 es-pa
000000012F70 000000414770 0 es-pe
000000012F7C 00000041477C 0 es-pr
000000012F88 000000414788 0 es-py
000000012F94 000000414794 0 es-sv
File pos Mem pos ID Text
======== ======= == ====
000000012FA0 0000004147A0 0 es-uy
000000012FAC 0000004147AC 0 es-ve
000000012FB8 0000004147B8 0 et-ee
000000012FC4 0000004147C4 0 eu-es
000000012FD0 0000004147D0 0 fa-ir
000000012FDC 0000004147DC 0 fi-fi
000000012FE8 0000004147E8 0 fo-fo
000000012FF4 0000004147F4 0 fr-be
000000013000 000000414800 0 fr-ca
00000001300C 00000041480C 0 fr-ch
000000013018 000000414818 0 fr-fr
000000013024 000000414824 0 fr-lu
000000013030 000000414830 0 fr-mc
00000001303C 00000041483C 0 gl-es
000000013048 000000414848 0 gu-in
000000013054 000000414854 0 he-il
000000013060 000000414860 0 hi-in
00000001306C 00000041486C 0 hr-ba
000000013078 000000414878 0 hr-hr
000000013084 000000414884 0 hu-hu
000000013090 000000414890 0 hy-am
00000001309C 00000041489C 0 id-id
0000000130A8 0000004148A8 0 is-is
0000000130B4 0000004148B4 0 it-ch
0000000130C0 0000004148C0 0 it-it
0000000130CC 0000004148CC 0 ja-jp
0000000130D8 0000004148D8 0 ka-ge
0000000130E4 0000004148E4 0 kk-kz
0000000130F0 0000004148F0 0 kn-in
0000000130FC 0000004148FC 0 kok-in
00000001310C 00000041490C 0 ko-kr
000000013118 000000414918 0 ky-kg
000000013124 000000414924 0 lt-lt
000000013130 000000414930 0 lv-lv
00000001313C 00000041493C 0 mi-nz
000000013148 000000414948 0 mk-mk
000000013154 000000414954 0 ml-in
000000013160 000000414960 0 mn-mn
00000001316C 00000041496C 0 mr-in
000000013178 000000414978 0 ms-bn
000000013184 000000414984 0 ms-my
000000013190 000000414990 0 mt-mt
00000001319C 00000041499C 0 nb-no
0000000131A8 0000004149A8 0 nl-be
0000000131B4 0000004149B4 0 nl-nl
0000000131C0 0000004149C0 0 nn-no
0000000131CC 0000004149CC 0 ns-za
0000000131D8 0000004149D8 0 pa-in
0000000131E4 0000004149E4 0 pl-pl
0000000131F0 0000004149F0 0 pt-br
0000000131FC 0000004149FC 0 pt-pt
000000013208 000000414A08 0 quz-bo
000000013218 000000414A18 0 quz-ec
000000013228 000000414A28 0 quz-pe
000000013238 000000414A38 0 ro-ro
000000013244 000000414A44 0 ru-ru
000000013250 000000414A50 0 sa-in
00000001325C 000000414A5C 0 se-fi
000000013268 000000414A68 0 se-no
000000013274 000000414A74 0 se-se
File pos Mem pos ID Text
======== ======= == ====
000000013280 000000414A80 0 sk-sk
00000001328C 000000414A8C 0 sl-si
000000013298 000000414A98 0 sma-no
0000000132A8 000000414AA8 0 sma-se
0000000132B8 000000414AB8 0 smj-no
0000000132C8 000000414AC8 0 smj-se
0000000132D8 000000414AD8 0 smn-fi
0000000132E8 000000414AE8 0 sms-fi
0000000132F8 000000414AF8 0 sq-al
000000013304 000000414B04 0 sr-ba-cyrl
00000001331C 000000414B1C 0 sr-ba-latn
000000013334 000000414B34 0 sr-sp-cyrl
00000001334C 000000414B4C 0 sr-sp-latn
000000013364 000000414B64 0 sv-fi
000000013370 000000414B70 0 sv-se
00000001337C 000000414B7C 0 sw-ke
000000013388 000000414B88 0 syr-sy
000000013398 000000414B98 0 ta-in
0000000133A4 000000414BA4 0 te-in
0000000133B0 000000414BB0 0 th-th
0000000133BC 000000414BBC 0 tn-za
0000000133C8 000000414BC8 0 tr-tr
0000000133D4 000000414BD4 0 tt-ru
0000000133E0 000000414BE0 0 uk-ua
0000000133EC 000000414BEC 0 ur-pk
0000000133F8 000000414BF8 0 uz-uz-cyrl
000000013410 000000414C10 0 uz-uz-latn
000000013428 000000414C28 0 vi-vn
000000013434 000000414C34 0 xh-za
000000013440 000000414C40 0 zh-chs
000000013450 000000414C50 0 zh-cht
000000013460 000000414C60 0 zh-cn
00000001346C 000000414C6C 0 zh-hk
000000013478 000000414C78 0 zh-mo
000000013484 000000414C84 0 zh-sg
000000013490 000000414C90 0 zh-tw
00000001349C 000000414C9C 0 zu-za
00000001358B 000000414D8B 0 @USER32.DLL
000000013618 000000414E18 0 CONOUT$
00000001366C 000000414E6C 0 .AVCHD
0000000136A0 000000414EA0 0 .COLLAB
0000000136C8 000000414EC8 0 .MPEG
000000013728 000000414F28 0 .WRAP
0000000137C0 000000414FC0 0 .WEBM
0000000137D8 000000414FD8 0 .JPEG
0000000137FC 000000414FFC 0 .TIFF
00000001384C 00000041504C 0 .DB.TRX
000000013874 000000415074 0 .EVTX
00000001389C 00000041509C 0 %s\%s
0000000138B4 0000004150B4 0 SeTakeOwnershipPrivilege
0000000138E8 0000004150E8 0 SYSTEM\CurrentControlSet\Enum\STORAGE\RemovableMedia
000000013954 000000415154 0 MACHINE
000000013968 000000415168 0 SYSTEM\CurrentControlSet\Enum\USB
0000000139B0 0000004151B0 0 SYSTEM\CurrentControlSet\Enum\USBSTOR
000000013A00 000000415200 0 SYSTEM\CurrentControlSet\Control\DeviceClasses
000000013A60 000000415260 0 %SystemRoot%\Prefetch
000000013A8C 00000041528C 0 %Windir%\Minidump
000000013AB0 0000004152B0 0 %ProgramData%\Microsoft\Windows\WER
000000013AF8 0000004152F8 0 %LocalAppData%\Microsoft\Windows\WER
000000013B44 000000415344 0 %Windir%\setupapi.log
File pos Mem pos ID Text
======== ======= == ====
000000013B70 000000415370 0 %Windir%\setupapi.log.old
000000013BA4 0000004153A4 0 %Windir%\inf\setupapi.app.log
000000013BE0 0000004153E0 0 %Windir%\inf\setupapi.dev.log
000000013C20 000000415420 0 %Windir%\inf\setupapi.offline.log
000000013C68 000000415468 0 %Windir%\inf\setupapi.upgrade.log
0000000141E4 0000004159E4 0 Win32 Guided Tour
000000014208 000000415A08 0 Call to RegisterClassEx failed!
000000014248 000000415A48 0 Call to CreateWindow failed!
0000000163D1 0000004181D1 0 No error
0000000167D0 0000004185D0 0 No cassetes
000000016BD0 0000004189D0 0 le meme about cutting cookie dough
000000016C18 000000418A18 0 No status
000000017018 000000418E18 0 win32app
000000017040 000000418E40 0 No device status