DecryptUnpackRun Timestamp is 67a50bba (Thu Feb 6 21:21:30 2025) Preferred load address is 00400000 Start Length Name Class 0001:00000000 0000030cH .text$mn CODE 0001:0000030c 000004d4H .text$mn$cpp CODE 0001:000007e0 00000820H .text$mn$cpp$s CODE 0001:00001000 000001e0H .text$mn$cpp$u CODE 0001:000011e0 00000000H .text$mn$cpp$v CODE 0001:000011e0 00000006H .text$nm CODE 0001:000011e6 000000d2H .text$zz CODE 0002:00000000 000000b0H .rdata DATA 0002:000000b0 00000000H .edata DATA 0002:000000b0 0000006cH .rdata$zzzdbg DATA 0003:00000000 00000000H .data DATA 0003:00000000 00000008H .bss DATA Address Publics by Value Rva+Base Lib:Object 0000:00000000 ___AbsoluteZero 00000000 0000:00000000 ___arm64x_extra_rfe_table 00000000 0000:00000000 ___arm64x_extra_rfe_table_size 00000000 0000:00000000 ___arm64x_native_entrypoint 00000000 0000:00000000 ___arm64x_redirection_metadata 00000000 0000:00000000 ___arm64x_redirection_metadata_count 00000000 0000:00000000 ___dynamic_value_reloc_table 00000000 0000:00000000 ___enclave_config 00000000 0000:00000000 ___guard_check_icall_a64n_fptr 00000000 0000:00000000 ___guard_eh_cont_count 00000000 0000:00000000 ___guard_eh_cont_table 00000000 0000:00000000 ___guard_fids_count 00000000 0000:00000000 ___guard_fids_table 00000000 0000:00000000 ___guard_flags 00000000 0000:00000000 ___guard_iat_count 00000000 0000:00000000 ___guard_iat_table 00000000 0000:00000000 ___guard_longjmp_count 00000000 0000:00000000 ___guard_longjmp_table 00000000 0000:00000000 ___hybrid_auxiliary_delayload_iat 00000000 0000:00000000 ___hybrid_auxiliary_delayload_iat_copy 00000000 0000:00000000 ___hybrid_auxiliary_iat 00000000 0000:00000000 ___hybrid_auxiliary_iat_copy 00000000 0000:00000000 ___hybrid_code_map 00000000 0000:00000000 ___hybrid_code_map_count 00000000 0000:00000000 ___hybrid_image_info_bitfield 00000000 0000:00000000 ___volatile_metadata 00000000 0000:00000000 ___x64_code_ranges_to_entry_points 00000000 0000:00000000 ___x64_code_ranges_to_entry_points_count 00000000 0000:00000000 ___ImageBase 00400000 0001:00000000 ?epASM@@YGXXZ 00401000 f x86.obj 0001:00000037 ?__Address@@YIPAXPBX@Z 00401037 f x86.obj 0001:0000004a __alloca_probe 0040104a f x86.obj 0001:0000004a __chkstk 0040104a f x86.obj 0001:000000da _CryptHashCertificate2@28 004010da f x86.obj 0001:000000fb _CreateDecompressor@12 004010fb f x86.obj 0001:0000011c _Decompress@24 0040111c f x86.obj 0001:0000013d _CloseDecompressor@4 0040113d f x86.obj 0001:0000015e _VirtualAlloc@16 0040115e f x86.obj 0001:0000017f _GetLastError@0 0040117f f x86.obj 0001:000001a0 _ExitProcess@4 004011a0 f x86.obj 0001:000001c1 _VirtualFree@12 004011c1 f x86.obj 0001:000001e2 _BCryptCloseAlgorithmProvider@8 004011e2 f x86.obj 0001:00000203 _BCryptGenerateSymmetricKey@28 00401203 f x86.obj 0001:00000224 _BCryptOpenAlgorithmProvider@16 00401224 f x86.obj 0001:00000245 _BCryptDecrypt@40 00401245 f x86.obj 0001:00000266 _RtlInitUnicodeString@8 00401266 f x86.obj 0001:00000287 _LdrLoadDll@16 00401287 f x86.obj 0001:000002a8 _LdrGetProcedureAddress@16 004012a8 f x86.obj 0001:000002c9 _RtlAllocateHeap@12 004012c9 f x86.obj 0001:000002ea _RtlFreeHeap@12 004012ea f x86.obj 0001:0000030c ?UnEscape@@YGHPA_W@Z 0040130c f ep.obj 0001:00000356 ?CreateAesKey@@YGJPAPAXPAEK@Z 00401356 f ep.obj 0001:000003a6 ?Unzip@@YGJPBXKPAPAXPAK@Z 004013a6 f ep.obj 0001:00000478 ?ep@@YGXPAU_PEB@@PAEK@Z 00401478 f ep.obj 0001:000005bc ?GetNtBase@@YGPAXXZ 004015bc f ScEntry:GetFuncAddr.obj 0001:000005cf ?get_hmod@@YIPAXPB_W@Z 004015cf f ScEntry:GetFuncAddr.obj 0001:00000619 ?GetFuncAddressEx@@YIPAXPAU_IMAGE_DOS_HEADER@@PBD@Z 00401619 f ScEntry:GetFuncAddr.obj 0001:000007ae ??_U@YAPAXI@Z 004017ae f ScEntry:stdafx.obj 0001:000007c3 ??_V@YAXPAX@Z 004017c3 f ScEntry:stdafx.obj 0001:000007e0 ??_C@_17PJMHNJHG@?$AAA?$AAE?$AAS@FNODOBFM@ 004017e0 ep.obj 0001:000007f0 ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6@FNODOBFM@ 004017f0 ep.obj 0001:000011e0 ?sc_end@@YGPAXXZ 004021e0 f ScEntry:prepare.obj 0001:000011e6 ?ScEntry@@YGXPAU_PEB@@@Z 004021e6 f ScEntry:prepare.obj 0002:00000000 ??_C@_0BF@EKFKPNAI@RtlInitUnicodeString@ 00403000 ScEntry:prepare.obj 0002:00000018 ??_C@_1BI@NEOFKCPM@?$AAp?$AAr?$AAe?$AAp?$AAa?$AAr?$AAe?$AA?4?$AAd?$AAl?$AAl@ 00403018 ScEntry:prepare.obj 0002:00000030 ??_C@_0L@HOFGLFDL@LdrLoadDll@ 00403030 ScEntry:prepare.obj 0002:0000003c ??_C@_0BH@GKPJJDBO@LdrGetProcedureAddress@ 0040303c ScEntry:prepare.obj 0002:00000054 ??_C@_0N@FIGJGHFN@LdrUnloadDll@ 00403054 ScEntry:prepare.obj 0002:00000064 ??_C@_0BD@JDDPIELM@RtlExitUserProcess@ 00403064 ScEntry:prepare.obj 0003:00000000 ___@@_PchSym_@00@UfhvihUsziibUwlxfnvmghUtrgsfyUhxUgnkUdrmDCUivovzhvUwvxibkgfmkzxpifmUhgwzucOlyq@4B2008FD98C1DD4 00404000 stdafx.obj 0003:00000004 ___@@_PchSym_@00@UfhvihUsziibUwlxfnvmghUtrgsfyUhxUgnkUdrmDCUivovzhvUhxvmgibUhgwzucOlyq@4B2008FD98C1DD4 00404004 ScEntry:stdafx.obj entry point at 0001:000011e6 Static symbols 0001:0000000a common_imp_call 0040100a f x86.obj 0001:00000075 protect 00401075 f x86.obj 0001:000005b6 ??0@?BG@??ep@@YGXPAU_PEB@@PAEK@Z@QAE@XZ 004015b6 f ep.obj 0001:00001000 ?_CryptHashCertificate2@28 00402000 x86.obj 0001:00001000 @imp_begin@ 00402000 x86.obj 0001:0000101c @crypt32 0040201c x86.obj 0001:00001038 ?_CreateDecompressor@12 00402038 x86.obj 0001:00001040 ?_Decompress@24 00402040 x86.obj 0001:00001048 ?_CloseDecompressor@4 00402048 x86.obj 0001:00001050 @cabinet 00402050 x86.obj 0001:0000106c ?_VirtualAlloc@16 0040206c x86.obj 0001:00001080 ?_GetLastError@0 00402080 x86.obj 0001:00001094 ?_ExitProcess@4 00402094 x86.obj 0001:000010a4 ?_VirtualFree@12 004020a4 x86.obj 0001:000010b4 @kernel32 004020b4 x86.obj 0001:000010d4 ?_BCryptCloseAlgorithmProvider@8 004020d4 x86.obj 0001:000010f8 ?_BCryptGenerateSymmetricKey@28 004020f8 x86.obj 0001:00001118 ?_BCryptOpenAlgorithmProvider@16 00402118 x86.obj 0001:00001138 ?_BCryptDecrypt@40 00402138 x86.obj 0001:0000114c @bcrypt 0040214c x86.obj 0001:00001168 ?_RtlInitUnicodeString@8 00402168 x86.obj 0001:00001184 ?_LdrLoadDll@16 00402184 x86.obj 0001:00001194 ?_LdrGetProcedureAddress@16 00402194 x86.obj 0001:000011b0 ?_RtlAllocateHeap@12 004021b0 x86.obj 0001:000011c4 ?_RtlFreeHeap@12 004021c4 x86.obj 0001:000011d4 @ntdllp 004021d4 x86.obj