|
[+] Initiate stack address at 0xfffdd000 |
|
[+] Loading sample.exe to 0x400000 |
|
[+] PE entry point at 0x404161 |
|
[+] TEB addr is 0x6000 |
|
[+] PEB addr is 0x6044 |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/ntdll.dll to 0x10000000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/ntdll.dll |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/kernel32.dll to 0x101a3000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/kernel32.dll |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/user32.dll to 0x10288000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/user32.dll |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/oleaut32.dll to 0x1041b000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/oleaut32.dll |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/advapi32.dll to 0x104b1000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/advapi32.dll |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cef20 name: advapi32::OpenProcessToken |
|
[x] import 0x00410fb0 = advapi32::OpenProcessToken |
|
idaapi.set_name(0x00410fb0, "advapi32::OpenProcessToken") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10045360 name: ntdll::RtlAllocateHeap |
|
[x] import 0x00410fb4 = ntdll::RtlAllocateHeap |
|
idaapi.set_name(0x00410fb4, "ntdll::RtlAllocateHeap") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4cd0 name: kernel32::GetCommandLineW |
|
[x] import 0x00410fb8 = kernel32::GetCommandLineW |
|
idaapi.set_name(0x00410fb8, "kernel32::GetCommandLineW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1005eba0 name: ntdll::RtlTimeToTimeFields |
|
[x] import 0x00410fbc = ntdll::RtlTimeToTimeFields |
|
idaapi.set_name(0x00410fbc, "ntdll::RtlTimeToTimeFields") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c60d0 name: kernel32::DeleteFileW |
|
[x] import 0x00410fc0 = kernel32::DeleteFileW |
|
idaapi.set_name(0x00410fc0, "kernel32::DeleteFileW") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cf0e0 name: advapi32::RegSetValueExW |
|
[x] import 0x00410fc4 = advapi32::RegSetValueExW |
|
idaapi.set_name(0x00410fc4, "advapi32::RegSetValueExW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c33c0 name: kernel32::LocalAlloc |
|
[x] import 0x00410fc8 = kernel32::LocalAlloc |
|
idaapi.set_name(0x00410fc8, "kernel32::LocalAlloc") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4870 name: kernel32::GetSystemInfo |
|
[x] import 0x00410fcc = kernel32::GetSystemInfo |
|
idaapi.set_name(0x00410fcc, "kernel32::GetSystemInfo") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/shlwapi.dll to 0x1052a000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/shlwapi.dll |
|
LoadLibraryA(lpLibFileName = "shlwapi.dll") = 0x1052a000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1053ed60 name: shlwapi::PathFindExtensionW |
|
[x] import 0x00410fd0 = shlwapi::PathFindExtensionW |
|
idaapi.set_name(0x00410fd0, "shlwapi::PathFindExtensionW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5f80 name: kernel32::OpenMutexW |
|
[x] import 0x00410fd4 = kernel32::OpenMutexW |
|
idaapi.set_name(0x00410fd4, "kernel32::OpenMutexW") |
|
LoadLibraryA(lpLibFileName = "shlwapi.dll") = 0x1052a000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1053ee50 name: shlwapi::PathFindFileNameW |
|
[x] import 0x00410fd8 = shlwapi::PathFindFileNameW |
|
idaapi.set_name(0x00410fd8, "shlwapi::PathFindFileNameW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6290 name: kernel32::GetFileAttributesExW |
|
[x] import 0x00410fdc = kernel32::GetFileAttributesExW |
|
idaapi.set_name(0x00410fdc, "kernel32::GetFileAttributesExW") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/gdi32.dll to 0x1056f000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/gdi32.dll |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10575e50 name: gdi32::SetBkColor |
|
[x] import 0x00410fe0 = gdi32::SetBkColor |
|
idaapi.set_name(0x00410fe0, "gdi32::SetBkColor") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10573680 name: gdi32::CreateFontW |
|
[x] import 0x00410fe4 = gdi32::CreateFontW |
|
idaapi.set_name(0x00410fe4, "gdi32::CreateFontW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101bc870 name: kernel32::TerminateProcess |
|
[x] import 0x00410fe8 = kernel32::TerminateProcess |
|
idaapi.set_name(0x00410fe8, "kernel32::TerminateProcess") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c36e0 name: kernel32::Process32NextW |
|
[x] import 0x00410fec = kernel32::Process32NextW |
|
idaapi.set_name(0x00410fec, "kernel32::Process32NextW") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10574250 name: gdi32::SetPixel |
|
[x] import 0x00410ff0 = gdi32::SetPixel |
|
idaapi.set_name(0x00410ff0, "gdi32::SetPixel") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/crypt32.dll to 0x10592000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/crypt32.dll |
|
LoadLibraryA(lpLibFileName = "crypt32.dll") = 0x10592000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x105beff0 name: crypt32::CryptBinaryToStringW |
|
[x] import 0x00410ff4 = crypt32::CryptBinaryToStringW |
|
idaapi.set_name(0x00410ff4, "crypt32::CryptBinaryToStringW") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/winhttp.dll to 0x10691000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/winhttp.dll |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106bb260 name: winhttp::WinHttpReceiveResponse |
|
[x] import 0x00410ff8 = winhttp::WinHttpReceiveResponse |
|
idaapi.set_name(0x00410ff8, "winhttp::WinHttpReceiveResponse") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1004f920 name: ntdll::RtlDeleteCriticalSection |
|
[x] import 0x00410ffc = ntdll::RtlDeleteCriticalSection |
|
idaapi.set_name(0x00410ffc, "ntdll::RtlDeleteCriticalSection") |
|
LoadLibraryA(lpLibFileName = "user32.dll") = 0x10288000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x102c3760 name: user32::GetDC |
|
[x] import 0x00411000 = user32::GetDC |
|
idaapi.set_name(0x00411000, "user32::GetDC") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104d05a0 name: advapi32::CloseServiceHandle |
|
[x] import 0x00411004 = advapi32::CloseServiceHandle |
|
idaapi.set_name(0x00411004, "advapi32::CloseServiceHandle") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104d0730 name: advapi32::ImpersonateLoggedOnUser |
|
[x] import 0x00411008 = advapi32::ImpersonateLoggedOnUser |
|
idaapi.set_name(0x00411008, "advapi32::ImpersonateLoggedOnUser") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/winmm.dll to 0x10753000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/winmm.dll |
|
LoadLibraryA(lpLibFileName = "winmm.dll") = 0x10753000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x107577a0 name: winmm::timeGetTime |
|
[x] import 0x0041100c = winmm::timeGetTime |
|
idaapi.set_name(0x0041100c, "winmm::timeGetTime") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x105757e0 name: gdi32::DeleteDC |
|
[x] import 0x00411010 = gdi32::DeleteDC |
|
idaapi.set_name(0x00411010, "gdi32::DeleteDC") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1003dde0 name: ntdll::RtlLeaveCriticalSection |
|
[x] import 0x00411014 = ntdll::RtlLeaveCriticalSection |
|
idaapi.set_name(0x00411014, "ntdll::RtlLeaveCriticalSection") |
|
LoadLibraryA(lpLibFileName = "oleaut32.dll") = 0x1041b000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1043a6a0 name: oleaut32::SysAllocString |
|
[x] import 0x00411018 = oleaut32::SysAllocString |
|
idaapi.set_name(0x00411018, "oleaut32::SysAllocString") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6100 name: kernel32::FindClose |
|
[x] import 0x0041101c = kernel32::FindClose |
|
idaapi.set_name(0x0041101c, "kernel32::FindClose") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10071800 name: ntdll::ZwOpenFile |
|
[x] import 0x00411020 = ntdll::ZwOpenFile |
|
idaapi.set_name(0x00411020, "ntdll::ZwOpenFile") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x100e2dd0 name: ntdll::RtlGetLastWin32Error |
|
[x] import 0x00411024 = ntdll::RtlGetLastWin32Error |
|
idaapi.set_name(0x00411024, "ntdll::RtlGetLastWin32Error") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10073b70 name: ntdll::RtlInitUnicodeString |
|
[x] import 0x00411028 = ntdll::RtlInitUnicodeString |
|
idaapi.set_name(0x00411028, "ntdll::RtlInitUnicodeString") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10574ea0 name: gdi32::GetStockObject |
|
[x] import 0x0041102c = gdi32::GetStockObject |
|
idaapi.set_name(0x0041102c, "gdi32::GetStockObject") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c22e0 name: kernel32::GetProcessHeap |
|
[x] import 0x00411030 = kernel32::GetProcessHeap |
|
idaapi.set_name(0x00411030, "kernel32::GetProcessHeap") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10575de0 name: gdi32::SetTextColor |
|
[x] import 0x00411034 = gdi32::SetTextColor |
|
idaapi.set_name(0x00411034, "gdi32::SetTextColor") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104d3e50 name: advapi32::EnumServicesStatusExW |
|
[x] import 0x00411038 = advapi32::EnumServicesStatusExW |
|
idaapi.set_name(0x00411038, "advapi32::EnumServicesStatusExW") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106b3ef0 name: winhttp::WinHttpOpen |
|
[x] import 0x0041103c = winhttp::WinHttpOpen |
|
idaapi.set_name(0x0041103c, "winhttp::WinHttpOpen") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104d0640 name: advapi32::OpenSCManagerW |
|
[x] import 0x00411040 = advapi32::OpenSCManagerW |
|
idaapi.set_name(0x00411040, "advapi32::OpenSCManagerW") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cf560 name: advapi32::IsValidSid |
|
[x] import 0x00411044 = advapi32::IsValidSid |
|
idaapi.set_name(0x00411044, "advapi32::IsValidSid") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/rstrtmgr.dll to 0x1077b000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/rstrtmgr.dll |
|
LoadLibraryA(lpLibFileName = "rstrtmgr.dll") = 0x1077b000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x107827e0 name: rstrtmgr::RmEndSession |
|
[x] import 0x00411048 = rstrtmgr::RmEndSession |
|
idaapi.set_name(0x00411048, "rstrtmgr::RmEndSession") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4880 name: kernel32::GetSystemDefaultUILanguage |
|
[x] import 0x0041104c = kernel32::GetSystemDefaultUILanguage |
|
idaapi.set_name(0x0041104c, "kernel32::GetSystemDefaultUILanguage") |
|
LoadLibraryA(lpLibFileName = "crypt32.dll") = 0x10592000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x105d9420 name: crypt32::CryptStringToBinaryW |
|
[x] import 0x00411050 = crypt32::CryptStringToBinaryW |
|
idaapi.set_name(0x00411050, "crypt32::CryptStringToBinaryW") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104e3910 name: advapi32::ControlService |
|
[x] import 0x00411054 = advapi32::ControlService |
|
idaapi.set_name(0x00411054, "advapi32::ControlService") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3550 name: kernel32::GlobalAlloc |
|
[x] import 0x00411058 = kernel32::GlobalAlloc |
|
idaapi.set_name(0x00411058, "kernel32::GlobalAlloc") |
|
LoadLibraryA(lpLibFileName = "shlwapi.dll") = 0x1052a000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10546e30 name: shlwapi::SHDeleteValueW |
|
[x] import 0x0041105c = shlwapi::SHDeleteValueW |
|
idaapi.set_name(0x0041105c, "shlwapi::SHDeleteValueW") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10575ca0 name: gdi32::GetObjectW |
|
[x] import 0x00411060 = gdi32::GetObjectW |
|
idaapi.set_name(0x00411060, "gdi32::GetObjectW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3530 name: kernel32::UnmapViewOfFile |
|
[x] import 0x00411064 = kernel32::UnmapViewOfFile |
|
idaapi.set_name(0x00411064, "kernel32::UnmapViewOfFile") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cfa10 name: advapi32::RevertToSelf |
|
[x] import 0x00411068 = advapi32::RevertToSelf |
|
idaapi.set_name(0x00411068, "advapi32::RevertToSelf") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106b88f0 name: winhttp::WinHttpConnect |
|
[x] import 0x0041106c = winhttp::WinHttpConnect |
|
idaapi.set_name(0x0041106c, "winhttp::WinHttpConnect") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/ole32.dll to 0x107ab000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/ole32.dll |
|
LoadLibraryA(lpLibFileName = "ole32.dll") = 0x107ab000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10861b91 name: ole32::CoSetProxyBlanket |
|
[x] import 0x00411070 = ole32::CoSetProxyBlanket |
|
idaapi.set_name(0x00411070, "ole32::CoSetProxyBlanket") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/shell32.dll to 0x1088e000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/shell32.dll |
|
LoadLibraryA(lpLibFileName = "shell32.dll") = 0x1088e000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1098d550 name: shell32::ShellExecuteExW |
|
[x] import 0x00411074 = shell32::ShellExecuteExW |
|
idaapi.set_name(0x00411074, "shell32::ShellExecuteExW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c2f20 name: kernel32::GlobalFree |
|
[x] import 0x00411078 = kernel32::GlobalFree |
|
idaapi.set_name(0x00411078, "kernel32::GlobalFree") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10071690 name: ntdll::ZwSetInformationProcess |
|
[x] import 0x0041107c = ntdll::ZwSetInformationProcess |
|
idaapi.set_name(0x0041107c, "ntdll::ZwSetInformationProcess") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c7060 name: kernel32::ExitProcess |
|
[x] import 0x00411080 = kernel32::ExitProcess |
|
idaapi.set_name(0x00411080, "kernel32::ExitProcess") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1003e8c0 name: ntdll::RtlEnterCriticalSection |
|
[x] import 0x00411084 = ntdll::RtlEnterCriticalSection |
|
idaapi.set_name(0x00411084, "ntdll::RtlEnterCriticalSection") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104d52c0 name: advapi32::SetFileSecurityW |
|
[x] import 0x00411088 = advapi32::SetFileSecurityW |
|
idaapi.set_name(0x00411088, "advapi32::SetFileSecurityW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x100486e0 name: ntdll::RtlFreeHeap |
|
[x] import 0x0041108c = ntdll::RtlFreeHeap |
|
idaapi.set_name(0x0041108c, "ntdll::RtlFreeHeap") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6510 name: kernel32::WriteFile |
|
[x] import 0x00411090 = kernel32::WriteFile |
|
idaapi.set_name(0x00411090, "kernel32::WriteFile") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6380 name: kernel32::GetTempPathW |
|
[x] import 0x00411094 = kernel32::GetTempPathW |
|
idaapi.set_name(0x00411094, "kernel32::GetTempPathW") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106ac410 name: winhttp::WinHttpCrackUrl |
|
[x] import 0x00411098 = winhttp::WinHttpCrackUrl |
|
idaapi.set_name(0x00411098, "winhttp::WinHttpCrackUrl") |
|
LoadLibraryA(lpLibFileName = "shlwapi.dll") = 0x1052a000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10540020 name: shlwapi::SHDeleteKeyW |
|
[x] import 0x0041109c = shlwapi::SHDeleteKeyW |
|
idaapi.set_name(0x0041109c, "shlwapi::SHDeleteKeyW") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106b97a0 name: winhttp::WinHttpSendRequest |
|
[x] import 0x004110a0 = winhttp::WinHttpSendRequest |
|
idaapi.set_name(0x004110a0, "winhttp::WinHttpSendRequest") |
|
[+] Loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/mpr.dll to 0x10e3e000 |
|
[+] Done with loading /home/dudley/.local/src/qiling/examples/rootfs/x86_windows/Windows/SysWOW64/mpr.dll |
|
LoadLibraryA(lpLibFileName = "mpr.dll") = 0x10e3e000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10e407b0 name: mpr::WNetCloseEnum |
|
[x] import 0x004110a4 = mpr::WNetCloseEnum |
|
idaapi.set_name(0x004110a4, "mpr::WNetCloseEnum") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cf010 name: advapi32::RegCloseKey |
|
[x] import 0x004110a8 = advapi32::RegCloseKey |
|
idaapi.set_name(0x004110a8, "advapi32::RegCloseKey") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10576000 name: gdi32::GetDIBits |
|
[x] import 0x004110ac = gdi32::GetDIBits |
|
idaapi.set_name(0x004110ac, "gdi32::GetDIBits") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x100715c0 name: ntdll::ZwQueryInformationFile |
|
[x] import 0x004110b0 = ntdll::ZwQueryInformationFile |
|
idaapi.set_name(0x004110b0, "ntdll::ZwQueryInformationFile") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5df0 name: kernel32::GetCurrentProcessId |
|
[x] import 0x004110b4 = kernel32::GetCurrentProcessId |
|
idaapi.set_name(0x004110b4, "kernel32::GetCurrentProcessId") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c51e0 name: kernel32::GetQueuedCompletionStatus |
|
[x] import 0x004110b8 = kernel32::GetQueuedCompletionStatus |
|
idaapi.set_name(0x004110b8, "kernel32::GetQueuedCompletionStatus") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c63b0 name: kernel32::GetVolumeInformationW |
|
[x] import 0x004110bc = kernel32::GetVolumeInformationW |
|
idaapi.set_name(0x004110bc, "kernel32::GetVolumeInformationW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5fb0 name: kernel32::ReleaseMutex |
|
[x] import 0x004110c0 = kernel32::ReleaseMutex |
|
idaapi.set_name(0x004110c0, "kernel32::ReleaseMutex") |
|
LoadLibraryA(lpLibFileName = "rstrtmgr.dll") = 0x1077b000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10782a20 name: rstrtmgr::RmRegisterResources |
|
[x] import 0x004110c4 = rstrtmgr::RmRegisterResources |
|
idaapi.set_name(0x004110c4, "rstrtmgr::RmRegisterResources") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10067080 name: ntdll::RtlAdjustPrivilege |
|
[x] import 0x004110c8 = ntdll::RtlAdjustPrivilege |
|
idaapi.set_name(0x004110c8, "ntdll::RtlAdjustPrivilege") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5010 name: kernel32::MoveFileW |
|
[x] import 0x004110cc = kernel32::MoveFileW |
|
idaapi.set_name(0x004110cc, "kernel32::MoveFileW") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106bad60 name: winhttp::WinHttpReadData |
|
[x] import 0x004110d0 = winhttp::WinHttpReadData |
|
idaapi.set_name(0x004110d0, "winhttp::WinHttpReadData") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cf850 name: advapi32::CryptAcquireContextW |
|
[x] import 0x004110d4 = advapi32::CryptAcquireContextW |
|
idaapi.set_name(0x004110d4, "advapi32::CryptAcquireContextW") |
|
LoadLibraryA(lpLibFileName = "mpr.dll") = 0x10e3e000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10e408d0 name: mpr::WNetOpenEnumW |
|
[x] import 0x004110d8 = mpr::WNetOpenEnumW |
|
idaapi.set_name(0x004110d8, "mpr::WNetOpenEnumW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6050 name: kernel32::CompareFileTime |
|
[x] import 0x004110dc = kernel32::CompareFileTime |
|
idaapi.set_name(0x004110dc, "kernel32::CompareFileTime") |
|
LoadLibraryA(lpLibFileName = "user32.dll") = 0x10288000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x102c6450 name: user32::GetKeyboardLayoutList |
|
[x] import 0x004110e0 = user32::GetKeyboardLayoutList |
|
idaapi.set_name(0x004110e0, "user32::GetKeyboardLayoutList") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104d0540 name: advapi32::CryptGenRandom |
|
[x] import 0x004110e4 = advapi32::CryptGenRandom |
|
idaapi.set_name(0x004110e4, "advapi32::CryptGenRandom") |
|
LoadLibraryA(lpLibFileName = "user32.dll") = 0x10288000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x102c63b0 name: user32::GetForegroundWindow |
|
[x] import 0x004110e8 = user32::GetForegroundWindow |
|
idaapi.set_name(0x004110e8, "user32::GetForegroundWindow") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cf580 name: advapi32::AllocateAndInitializeSid |
|
[x] import 0x004110ec = advapi32::AllocateAndInitializeSid |
|
idaapi.set_name(0x004110ec, "advapi32::AllocateAndInitializeSid") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c2490 name: kernel32::LocalFree |
|
[x] import 0x004110f0 = kernel32::LocalFree |
|
idaapi.set_name(0x004110f0, "kernel32::LocalFree") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104ceea0 name: advapi32::RegOpenKeyExW |
|
[x] import 0x004110f4 = advapi32::RegOpenKeyExW |
|
idaapi.set_name(0x004110f4, "advapi32::RegOpenKeyExW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5200 name: kernel32::CreateIoCompletionPort |
|
[x] import 0x004110f8 = kernel32::CreateIoCompletionPort |
|
idaapi.set_name(0x004110f8, "kernel32::CreateIoCompletionPort") |
|
LoadLibraryA(lpLibFileName = "user32.dll") = 0x10288000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x102b1660 name: user32::DrawTextW |
|
[x] import 0x004110fc = user32::DrawTextW |
|
idaapi.set_name(0x004110fc, "user32::DrawTextW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c62c0 name: kernel32::GetFileSize |
|
[x] import 0x00411100 = kernel32::GetFileSize |
|
idaapi.set_name(0x00411100, "kernel32::GetFileSize") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101bc620 name: kernel32::SetThreadExecutionState |
|
[x] import 0x00411104 = kernel32::SetThreadExecutionState |
|
idaapi.set_name(0x00411104, "kernel32::SetThreadExecutionState") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x105747d0 name: gdi32::DeleteObject |
|
[x] import 0x00411108 = gdi32::DeleteObject |
|
idaapi.set_name(0x00411108, "gdi32::DeleteObject") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4300 name: kernel32::GetComputerNameW |
|
[x] import 0x0041110c = kernel32::GetComputerNameW |
|
idaapi.set_name(0x0041110c, "kernel32::GetComputerNameW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c60a0 name: kernel32::CreateFileW |
|
[x] import 0x00411110 = kernel32::CreateFileW |
|
idaapi.set_name(0x00411110, "kernel32::CreateFileW") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cf930 name: advapi32::CheckTokenMembership |
|
[x] import 0x00411114 = advapi32::CheckTokenMembership |
|
idaapi.set_name(0x00411114, "advapi32::CheckTokenMembership") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101bb780 name: kernel32::Wow64DisableWow64FsRedirection |
|
[x] import 0x00411118 = kernel32::Wow64DisableWow64FsRedirection |
|
idaapi.set_name(0x00411118, "kernel32::Wow64DisableWow64FsRedirection") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c24b0 name: kernel32::GetProcAddress |
|
[x] import 0x0041111c = kernel32::GetProcAddress |
|
idaapi.set_name(0x0041111c, "kernel32::GetProcAddress") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4e10 name: kernel32::GetNativeSystemInfo |
|
[x] import 0x00411120 = kernel32::GetNativeSystemInfo |
|
idaapi.set_name(0x00411120, "kernel32::GetNativeSystemInfo") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cf800 name: advapi32::GetUserNameW |
|
[x] import 0x00411124 = advapi32::GetUserNameW |
|
idaapi.set_name(0x00411124, "advapi32::GetUserNameW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6420 name: kernel32::ReadFile |
|
[x] import 0x00411128 = kernel32::ReadFile |
|
idaapi.set_name(0x00411128, "kernel32::ReadFile") |
|
LoadLibraryA(lpLibFileName = "user32.dll") = 0x10288000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x102b9cf0 name: user32::SystemParametersInfoW |
|
[x] import 0x0041112c = user32::SystemParametersInfoW |
|
idaapi.set_name(0x0041112c, "user32::SystemParametersInfoW") |
|
LoadLibraryA(lpLibFileName = "ole32.dll") = 0x107ab000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x108612a1 name: ole32::CoInitializeEx |
|
[x] import 0x00411130 = ole32::CoInitializeEx |
|
idaapi.set_name(0x00411130, "ole32::CoInitializeEx") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c64c0 name: kernel32::SetFilePointerEx |
|
[x] import 0x00411134 = kernel32::SetFilePointerEx |
|
idaapi.set_name(0x00411134, "kernel32::SetFilePointerEx") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4ec0 name: kernel32::GetUserDefaultUILanguage |
|
[x] import 0x00411138 = kernel32::GetUserDefaultUILanguage |
|
idaapi.set_name(0x00411138, "kernel32::GetUserDefaultUILanguage") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cf120 name: advapi32::RegCreateKeyExW |
|
[x] import 0x0041113c = advapi32::RegCreateKeyExW |
|
idaapi.set_name(0x0041113c, "advapi32::RegCreateKeyExW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3860 name: kernel32::GetModuleFileNameW |
|
[x] import 0x00411140 = kernel32::GetModuleFileNameW |
|
idaapi.set_name(0x00411140, "kernel32::GetModuleFileNameW") |
|
LoadLibraryA(lpLibFileName = "shlwapi.dll") = 0x1052a000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1053dd50 name: shlwapi::StrToIntW |
|
[x] import 0x00411144 = shlwapi::StrToIntW |
|
idaapi.set_name(0x00411144, "shlwapi::StrToIntW") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cfdc0 name: advapi32::FreeSid |
|
[x] import 0x00411148 = advapi32::FreeSid |
|
idaapi.set_name(0x00411148, "advapi32::FreeSid") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10575f10 name: gdi32::SetBkMode |
|
[x] import 0x0041114c = gdi32::SetBkMode |
|
idaapi.set_name(0x0041114c, "gdi32::SetBkMode") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1005e1c0 name: ntdll::RtlInitializeCriticalSection |
|
[x] import 0x00411150 = ntdll::RtlInitializeCriticalSection |
|
idaapi.set_name(0x00411150, "ntdll::RtlInitializeCriticalSection") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101bc890 name: kernel32::GetWindowsDirectoryW |
|
[x] import 0x00411154 = kernel32::GetWindowsDirectoryW |
|
idaapi.set_name(0x00411154, "kernel32::GetWindowsDirectoryW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5c90 name: kernel32::MulDiv |
|
[x] import 0x00411158 = kernel32::MulDiv |
|
idaapi.set_name(0x00411158, "kernel32::MulDiv") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c61d0 name: kernel32::FindNextFileW |
|
[x] import 0x0041115c = kernel32::FindNextFileW |
|
idaapi.set_name(0x0041115c, "kernel32::FindNextFileW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6490 name: kernel32::SetFileAttributesW |
|
[x] import 0x00411160 = kernel32::SetFileAttributesW |
|
idaapi.set_name(0x00411160, "kernel32::SetFileAttributesW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5f00 name: kernel32::CreateMutexW |
|
[x] import 0x00411164 = kernel32::CreateMutexW |
|
idaapi.set_name(0x00411164, "kernel32::CreateMutexW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6260 name: kernel32::GetDriveTypeW |
|
[x] import 0x00411168 = kernel32::GetDriveTypeW |
|
idaapi.set_name(0x00411168, "kernel32::GetDriveTypeW") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104d0660 name: advapi32::OpenServiceW |
|
[x] import 0x0041116c = advapi32::OpenServiceW |
|
idaapi.set_name(0x0041116c, "advapi32::OpenServiceW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6230 name: kernel32::GetDiskFreeSpaceExW |
|
[x] import 0x00411170 = kernel32::GetDiskFreeSpaceExW |
|
idaapi.set_name(0x00411170, "kernel32::GetDiskFreeSpaceExW") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106ba050 name: winhttp::WinHttpQueryDataAvailable |
|
[x] import 0x00411174 = winhttp::WinHttpQueryDataAvailable |
|
idaapi.set_name(0x00411174, "winhttp::WinHttpQueryDataAvailable") |
|
LoadLibraryA(lpLibFileName = "rstrtmgr.dll") = 0x1077b000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10782cf0 name: rstrtmgr::RmStartSession |
|
[x] import 0x00411178 = rstrtmgr::RmStartSession |
|
idaapi.set_name(0x00411178, "rstrtmgr::RmStartSession") |
|
|
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101bc910 name: kernel32::MoveFileExW |
|
[x] import 0x0041117c = kernel32::MoveFileExW |
|
idaapi.set_name(0x0041117c, "kernel32::MoveFileExW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3e60 name: kernel32::Sleep |
|
[x] import 0x00411180 = kernel32::Sleep |
|
idaapi.set_name(0x00411180, "kernel32::Sleep") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c51c0 name: kernel32::PostQueuedCompletionStatus |
|
[x] import 0x00411184 = kernel32::PostQueuedCompletionStatus |
|
idaapi.set_name(0x00411184, "kernel32::PostQueuedCompletionStatus") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3570 name: kernel32::SetErrorMode |
|
[x] import 0x00411188 = kernel32::SetErrorMode |
|
idaapi.set_name(0x00411188, "kernel32::SetErrorMode") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6030 name: kernel32::WaitForSingleObject |
|
[x] import 0x0041118c = kernel32::WaitForSingleObject |
|
idaapi.set_name(0x0041118c, "kernel32::WaitForSingleObject") |
|
LoadLibraryA(lpLibFileName = "ole32.dll") = 0x107ab000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1086061d name: ole32::CoCreateInstance |
|
[x] import 0x00411190 = ole32::CoCreateInstance |
|
idaapi.set_name(0x00411190, "ole32::CoCreateInstance") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5de0 name: kernel32::GetCurrentProcess |
|
[x] import 0x00411194 = kernel32::GetCurrentProcess |
|
idaapi.set_name(0x00411194, "kernel32::GetCurrentProcess") |
|
LoadLibraryA(lpLibFileName = "user32.dll") = 0x10288000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x102ac7d0 name: user32::wsprintfW |
|
[x] import 0x00411198 = user32::wsprintfW |
|
idaapi.set_name(0x00411198, "user32::wsprintfW") |
|
LoadLibraryA(lpLibFileName = "shlwapi.dll") = 0x1052a000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1053f480 name: shlwapi::PathAddBackslashW |
|
[x] import 0x0041119c = shlwapi::PathAddBackslashW |
|
idaapi.set_name(0x0041119c, "shlwapi::PathAddBackslashW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c39a0 name: kernel32::HeapCreate |
|
[x] import 0x004111a0 = kernel32::HeapCreate |
|
idaapi.set_name(0x004111a0, "kernel32::HeapCreate") |
|
LoadLibraryA(lpLibFileName = "mpr.dll") = 0x10e3e000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10e40530 name: mpr::WNetEnumResourceW |
|
[x] import 0x004111a4 = mpr::WNetEnumResourceW |
|
idaapi.set_name(0x004111a4, "mpr::WNetEnumResourceW") |
|
LoadLibraryA(lpLibFileName = "oleaut32.dll") = 0x1041b000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10439860 name: oleaut32::SysFreeString |
|
[x] import 0x004111a8 = oleaut32::SysFreeString |
|
idaapi.set_name(0x004111a8, "oleaut32::SysFreeString") |
|
LoadLibraryA(lpLibFileName = "user32.dll") = 0x10288000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x102a82b0 name: user32::FillRect |
|
[x] import 0x004111ac = user32::FillRect |
|
idaapi.set_name(0x004111ac, "user32::FillRect") |
|
LoadLibraryA(lpLibFileName = "ole32.dll") = 0x107ab000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10862167 name: ole32::CreateStreamOnHGlobal |
|
[x] import 0x004111b0 = ole32::CreateStreamOnHGlobal |
|
idaapi.set_name(0x004111b0, "ole32::CreateStreamOnHGlobal") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c62d0 name: kernel32::GetFileSizeEx |
|
[x] import 0x004111b4 = kernel32::GetFileSizeEx |
|
idaapi.set_name(0x004111b4, "kernel32::GetFileSizeEx") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101bb840 name: kernel32::CreateProcessW |
|
[x] import 0x004111b8 = kernel32::CreateProcessW |
|
idaapi.set_name(0x004111b8, "kernel32::CreateProcessW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10075c40 name: ntdll::_snwprintf |
|
[x] import 0x004111bc = ntdll::_snwprintf |
|
idaapi.set_name(0x004111bc, "ntdll::_snwprintf") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3e70 name: kernel32::CreateThread |
|
[x] import 0x004111c0 = kernel32::CreateThread |
|
idaapi.set_name(0x004111c0, "kernel32::CreateThread") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c24f0 name: kernel32::MapViewOfFile |
|
[x] import 0x004111c4 = kernel32::MapViewOfFile |
|
idaapi.set_name(0x004111c4, "kernel32::MapViewOfFile") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4b60 name: kernel32::Process32FirstW |
|
[x] import 0x004111c8 = kernel32::Process32FirstW |
|
idaapi.set_name(0x004111c8, "kernel32::Process32FirstW") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104ceb80 name: advapi32::GetTokenInformation |
|
[x] import 0x004111cc = advapi32::GetTokenInformation |
|
idaapi.set_name(0x004111cc, "advapi32::GetTokenInformation") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101bb760 name: kernel32::Wow64RevertWow64FsRedirection |
|
[x] import 0x004111d0 = kernel32::Wow64RevertWow64FsRedirection |
|
idaapi.set_name(0x004111d0, "kernel32::Wow64RevertWow64FsRedirection") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c0ee0 name: kernel32::MultiByteToWideChar |
|
[x] import 0x004111d4 = kernel32::MultiByteToWideChar |
|
idaapi.set_name(0x004111d4, "kernel32::MultiByteToWideChar") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10575bf0 name: gdi32::SelectObject |
|
[x] import 0x004111d8 = gdi32::SelectObject |
|
idaapi.set_name(0x004111d8, "gdi32::SelectObject") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3b50 name: kernel32::HeapDestroy |
|
[x] import 0x004111dc = kernel32::HeapDestroy |
|
idaapi.set_name(0x004111dc, "kernel32::HeapDestroy") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3400 name: kernel32::CreateFileMappingW |
|
[x] import 0x004111e0 = kernel32::CreateFileMappingW |
|
idaapi.set_name(0x004111e0, "kernel32::CreateFileMappingW") |
|
LoadLibraryA(lpLibFileName = "shlwapi.dll") = 0x1052a000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x1053ef90 name: shlwapi::PathIsDirectoryW |
|
[x] import 0x004111e4 = shlwapi::PathIsDirectoryW |
|
idaapi.set_name(0x004111e4, "shlwapi::PathIsDirectoryW") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104cedd0 name: advapi32::RegQueryValueExW |
|
[x] import 0x004111e8 = advapi32::RegQueryValueExW |
|
idaapi.set_name(0x004111e8, "advapi32::RegQueryValueExW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6160 name: kernel32::FindFirstFileExW |
|
[x] import 0x004111ec = kernel32::FindFirstFileExW |
|
idaapi.set_name(0x004111ec, "kernel32::FindFirstFileExW") |
|
LoadLibraryA(lpLibFileName = "oleaut32.dll") = 0x1041b000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10439610 name: oleaut32::VariantClear |
|
[x] import 0x004111f0 = oleaut32::VariantClear |
|
idaapi.set_name(0x004111f0, "oleaut32::VariantClear") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106b4190 name: winhttp::WinHttpQueryHeaders |
|
[x] import 0x004111f4 = winhttp::WinHttpQueryHeaders |
|
idaapi.set_name(0x004111f4, "winhttp::WinHttpQueryHeaders") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106b77b0 name: winhttp::WinHttpCloseHandle |
|
[x] import 0x004111f8 = winhttp::WinHttpCloseHandle |
|
idaapi.set_name(0x004111f8, "winhttp::WinHttpCloseHandle") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c6180 name: kernel32::FindFirstFileW |
|
[x] import 0x004111fc = kernel32::FindFirstFileW |
|
idaapi.set_name(0x004111fc, "kernel32::FindFirstFileW") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10575ce0 name: gdi32::CreateCompatibleDC |
|
[x] import 0x00411200 = gdi32::CreateCompatibleDC |
|
idaapi.set_name(0x00411200, "gdi32::CreateCompatibleDC") |
|
LoadLibraryA(lpLibFileName = "user32.dll") = 0x10288000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x102c3100 name: user32::ReleaseDC |
|
[x] import 0x00411204 = user32::ReleaseDC |
|
idaapi.set_name(0x00411204, "user32::ReleaseDC") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101d7330 name: kernel32::QueryFullProcessImageNameW |
|
[x] import 0x00411208 = kernel32::QueryFullProcessImageNameW |
|
idaapi.set_name(0x00411208, "kernel32::QueryFullProcessImageNameW") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106ba660 name: winhttp::WinHttpOpenRequest |
|
[x] import 0x0041120c = winhttp::WinHttpOpenRequest |
|
idaapi.set_name(0x0041120c, "winhttp::WinHttpOpenRequest") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10575fc0 name: gdi32::CreateCompatibleBitmap |
|
[x] import 0x00411210 = gdi32::CreateCompatibleBitmap |
|
idaapi.set_name(0x00411210, "gdi32::CreateCompatibleBitmap") |
|
LoadLibraryA(lpLibFileName = "advapi32.dll") = 0x104b1000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x104e41c0 name: advapi32::DeleteService |
|
[x] import 0x00411214 = advapi32::DeleteService |
|
idaapi.set_name(0x00411214, "advapi32::DeleteService") |
|
LoadLibraryA(lpLibFileName = "ole32.dll") = 0x107ab000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x108612e0 name: ole32::CoInitializeSecurity |
|
[x] import 0x00411218 = ole32::CoInitializeSecurity |
|
idaapi.set_name(0x00411218, "ole32::CoInitializeSecurity") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c2320 name: kernel32::VirtualAlloc |
|
[x] import 0x0041121c = kernel32::VirtualAlloc |
|
idaapi.set_name(0x0041121c, "kernel32::VirtualAlloc") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c3590 name: kernel32::OpenProcess |
|
[x] import 0x00411220 = kernel32::OpenProcess |
|
idaapi.set_name(0x00411220, "kernel32::OpenProcess") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c5e40 name: kernel32::CloseHandle |
|
[x] import 0x00411224 = kernel32::CloseHandle |
|
idaapi.set_name(0x00411224, "kernel32::CloseHandle") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4010 name: kernel32::GetSystemDirectoryW |
|
[x] import 0x00411228 = kernel32::GetSystemDirectoryW |
|
idaapi.set_name(0x00411228, "kernel32::GetSystemDirectoryW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x100715a0 name: ntdll::ZwClose |
|
[x] import 0x0041122c = ntdll::ZwClose |
|
idaapi.set_name(0x0041122c, "ntdll::ZwClose") |
|
LoadLibraryA(lpLibFileName = "shell32.dll") = 0x1088e000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x109e8380 name: shell32::CommandLineToArgvW |
|
[x] import 0x00411230 = shell32::CommandLineToArgvW |
|
idaapi.set_name(0x00411230, "shell32::CommandLineToArgvW") |
|
LoadLibraryA(lpLibFileName = "winmm.dll") = 0x10753000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10762870 name: winmm::timeBeginPeriod |
|
[x] import 0x00411234 = winmm::timeBeginPeriod |
|
idaapi.set_name(0x00411234, "winmm::timeBeginPeriod") |
|
LoadLibraryA(lpLibFileName = "gdi32.dll") = 0x1056f000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10574f10 name: gdi32::GetDeviceCaps |
|
[x] import 0x00411238 = gdi32::GetDeviceCaps |
|
idaapi.set_name(0x00411238, "gdi32::GetDeviceCaps") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c7080 name: kernel32::CreateToolhelp32Snapshot |
|
[x] import 0x0041123c = kernel32::CreateToolhelp32Snapshot |
|
idaapi.set_name(0x0041123c, "kernel32::CreateToolhelp32Snapshot") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c0f50 name: kernel32::WideCharToMultiByte |
|
[x] import 0x00411240 = kernel32::WideCharToMultiByte |
|
idaapi.set_name(0x00411240, "kernel32::WideCharToMultiByte") |
|
LoadLibraryA(lpLibFileName = "ole32.dll") = 0x107ab000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x10861d53 name: ole32::CoUninitialize |
|
[x] import 0x00411244 = ole32::CoUninitialize |
|
idaapi.set_name(0x00411244, "ole32::CoUninitialize") |
|
LoadLibraryA(lpLibFileName = "rstrtmgr.dll") = 0x1077b000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x107828b0 name: rstrtmgr::RmGetList |
|
[x] import 0x00411248 = rstrtmgr::RmGetList |
|
idaapi.set_name(0x00411248, "rstrtmgr::RmGetList") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c62a0 name: kernel32::GetFileAttributesW |
|
[x] import 0x0041124c = kernel32::GetFileAttributesW |
|
idaapi.set_name(0x0041124c, "kernel32::GetFileAttributesW") |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x101c4080 name: kernel32::SystemTimeToFileTime |
|
[x] import 0x00411250 = kernel32::SystemTimeToFileTime |
|
idaapi.set_name(0x00411250, "kernel32::SystemTimeToFileTime") |
|
LoadLibraryA(lpLibFileName = "winhttp.dll") = 0x10691000 |
|
[x] __ 0x406a1a: mov dword ptr [esi + 0x410fb0], eax |
|
[x] eax: 0x106b5710 name: winhttp::WinHttpSetOption |
|
[x] import 0x00411254 = winhttp::WinHttpSetOption |
|
idaapi.set_name(0x00411254, "winhttp::WinHttpSetOption") |
