Analysis Date2015-05-28 17:57:29
MD554f2f907409caf28f469d7c4ef5eac5d
SHA164ee786fd7afe7ff6863634bc3b0219b9f03c541

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: dc044fd7fb7f0e20ac833c49484b2636 sha1: b1ccf593d84a7a84b133ee752455412089e5be39 size: 276480
Section.rdata md5: 3dabe1e6675ff074c5fa5189bafe6b87 sha1: e3ef30ea1bcb521f30f984cc8f743fafce31c3e7 size: 59392
Section.data md5: 8170328f1ab86c09a2b4022bbbab5bd9 sha1: 57339cedda8ee146949fe90552b6cb0d49051300 size: 7680
Section.reloc md5: 272cc51df4e72ec5baf448d418c83414 sha1: b462e91aaa1e49ea598b9709fc253afa28185f35 size: 23552
Timestamp2015-05-08 06:45:28
PackerMicrosoft Visual C++ 8
PEhashbc8bb4e045dad040dfc2d6b11c602a2446856d80
IMPhashfd697786cd3f632f2742cf815f3b1932

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\eeuszuhjmyci\wtuqga
Creates FileC:\WINDOWS\eeuszuhjmyci\wtuqga
Creates FileC:\eeuszuhjmyci\zhwq1mg6tg2cbrlimnhc6.exe
Deletes FileC:\WINDOWS\eeuszuhjmyci\wtuqga
Creates ProcessC:\eeuszuhjmyci\zhwq1mg6tg2cbrlimnhc6.exe

Process
↳ C:\eeuszuhjmyci\zhwq1mg6tg2cbrlimnhc6.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Update Driver Computer Firewall ➝
C:\eeuszuhjmyci\tvyfococwo.exe
Creates FileC:\eeuszuhjmyci\wtuqga
Creates FileC:\eeuszuhjmyci\tvyfococwo.exe
Creates FilePIPE\lsarpc
Creates FileC:\WINDOWS\eeuszuhjmyci\wtuqga
Creates FileC:\eeuszuhjmyci\vloapz
Deletes FileC:\WINDOWS\eeuszuhjmyci\wtuqga
Creates ProcessC:\eeuszuhjmyci\tvyfococwo.exe
Creates ServiceError Session Net.Tcp Port Input PNRP - C:\eeuszuhjmyci\tvyfococwo.exe

Process
↳ Pid 808

Process
↳ Pid 856

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1124

Process
↳ Pid 1212

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1864

Process
↳ Pid 1160

Process
↳ C:\eeuszuhjmyci\tvyfococwo.exe

Creates Filepipe\net\NtControlPipe10
Creates FileC:\eeuszuhjmyci\hoxqckgkq.exe
Creates FileC:\eeuszuhjmyci\wtuqga
Creates FileC:\WINDOWS\eeuszuhjmyci\wtuqga
Creates File\Device\Afd\Endpoint
Creates FileC:\eeuszuhjmyci\nynawez0kpw
Creates FileC:\eeuszuhjmyci\vloapz
Deletes FileC:\WINDOWS\eeuszuhjmyci\wtuqga
Creates Processivo6rzjciaov "c:\eeuszuhjmyci\tvyfococwo.exe"

Process
↳ C:\eeuszuhjmyci\tvyfococwo.exe

Creates FileC:\eeuszuhjmyci\wtuqga
Creates FileC:\WINDOWS\eeuszuhjmyci\wtuqga
Deletes FileC:\WINDOWS\eeuszuhjmyci\wtuqga

Process
↳ ivo6rzjciaov "c:\eeuszuhjmyci\tvyfococwo.exe"

Creates FileC:\eeuszuhjmyci\wtuqga
Creates FileC:\WINDOWS\eeuszuhjmyci\wtuqga
Deletes FileC:\WINDOWS\eeuszuhjmyci\wtuqga

Network Details:

DNSleaderperfect.net
Type: A
74.208.214.100
DNSheavyheart.net
Type: A
208.48.81.133
DNSheavyheart.net
Type: A
64.15.205.101
DNSheavyheart.net
Type: A
64.15.205.100
DNSheavyheart.net
Type: A
208.48.81.134
DNSgentleheart.net
Type: A
203.189.109.142
DNSbelongbehind.net
Type: A
95.211.230.75
DNSanswerperfect.net
Type: A
DNSglassperfect.net
Type: A
DNSanswermayor.net
Type: A
DNSglassmayor.net
Type: A
DNSanswerbattle.net
Type: A
DNSglassbattle.net
Type: A
DNSdifficultheart.net
Type: A
DNSheardheart.net
Type: A
DNSdifficultperfect.net
Type: A
DNSheardperfect.net
Type: A
DNSdifficultmayor.net
Type: A
DNSheardmayor.net
Type: A
DNSdifficultbattle.net
Type: A
DNSheardbattle.net
Type: A
DNSpleasantheart.net
Type: A
DNSnecessaryheart.net
Type: A
DNSpleasantperfect.net
Type: A
DNSnecessaryperfect.net
Type: A
DNSpleasantmayor.net
Type: A
DNSnecessarymayor.net
Type: A
DNSpleasantbattle.net
Type: A
DNSnecessarybattle.net
Type: A
DNSorderheart.net
Type: A
DNSrequireheart.net
Type: A
DNSorderperfect.net
Type: A
DNSrequireperfect.net
Type: A
DNSordermayor.net
Type: A
DNSrequiremayor.net
Type: A
DNSorderbattle.net
Type: A
DNSrequirebattle.net
Type: A
DNSleaderheart.net
Type: A
DNSheavenheart.net
Type: A
DNSheavenperfect.net
Type: A
DNSleadermayor.net
Type: A
DNSheavenmayor.net
Type: A
DNSleaderbattle.net
Type: A
DNSheavenbattle.net
Type: A
DNSheavyperfect.net
Type: A
DNSgentleperfect.net
Type: A
DNSheavymayor.net
Type: A
DNSgentlemayor.net
Type: A
DNSheavybattle.net
Type: A
DNSgentlebattle.net
Type: A
DNSvariousheart.net
Type: A
DNSreturnheart.net
Type: A
DNSvariousperfect.net
Type: A
DNSreturnperfect.net
Type: A
DNSvariousmayor.net
Type: A
DNSreturnmayor.net
Type: A
DNSvariousbattle.net
Type: A
DNSreturnbattle.net
Type: A
DNSjourneyunderstand.net
Type: A
DNShusbandunderstand.net
Type: A
DNSjourneybroad.net
Type: A
DNShusbandbroad.net
Type: A
DNSjourneybehind.net
Type: A
DNShusbandbehind.net
Type: A
DNSjourneybutter.net
Type: A
DNShusbandbutter.net
Type: A
DNSdestroyunderstand.net
Type: A
DNSlittleunderstand.net
Type: A
DNSdestroybroad.net
Type: A
DNSlittlebroad.net
Type: A
DNSdestroybehind.net
Type: A
DNSlittlebehind.net
Type: A
DNSdestroybutter.net
Type: A
DNSlittlebutter.net
Type: A
DNSriddenunderstand.net
Type: A
DNSbelongunderstand.net
Type: A
DNSriddenbroad.net
Type: A
DNSbelongbroad.net
Type: A
DNSriddenbehind.net
Type: A
DNSriddenbutter.net
Type: A
DNSbelongbutter.net
Type: A
DNSchairunderstand.net
Type: A
DNSthoseunderstand.net
Type: A
DNSchairbroad.net
Type: A
DNSthosebroad.net
Type: A
DNSchairbehind.net
Type: A
DNSthosebehind.net
Type: A
DNSchairbutter.net
Type: A
HTTP GEThttp://leaderperfect.net/index.php
User-Agent:
HTTP GEThttp://heavyheart.net/index.php
User-Agent:
HTTP GEThttp://gentleheart.net/index.php
User-Agent:
HTTP GEThttp://belongbehind.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 74.208.214.100:80
Flows TCP192.168.1.1:1032 ➝ 208.48.81.133:80
Flows TCP192.168.1.1:1033 ➝ 203.189.109.142:80
Flows TCP192.168.1.1:1034 ➝ 95.211.230.75:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206c   : close..Host: l
0x00000040 (00064)   65616465 72706572 66656374 2e6e6574   eaderperfect.net
0x00000050 (00080)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2068   : close..Host: h
0x00000040 (00064)   65617679 68656172 742e6e65 740d0a0d   eavyheart.net...
0x00000050 (00080)   0a0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2067   : close..Host: g
0x00000040 (00064)   656e746c 65686561 72742e6e 65740d0a   entleheart.net..
0x00000050 (00080)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   656c6f6e 67626568 696e642e 6e65740d   elongbehind.net.
0x00000050 (00080)   0a0d0a0a                              ....


Strings
FetenCeeEnnS
"
 
\
.
.
 
\
  
.
e
. 
00-+ .
-
-1
+-0-E-
-0
\
.
0
0
- 
000
-.
u
                                 
2.exe
- abort() has been called
af-za
af-ZA
April
ar-ae
ar-AE
ar-bh
ar-BH
ar-dz
ar-DZ
ar-eg
ar-EG
ar-iq
ar-IQ
ar-jo
ar-JO
ar-kw
ar-KW
ar-lb
ar-LB
ar-ly
ar-LY
ar-ma
ar-MA
ar-om
ar-OM
ar-qa
ar-QA
ar-sa
ar-SA
ar-sy
ar-SY
ar-tn
ar-TN
ar-ye
ar-YE
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
August
az-az-cyrl
az-AZ-Cyrl
az-az-latn
az-AZ-Latn
.bat
be-by
be-BY
bg-bg
bg-BG
bn-in
bn-IN
bs-ba-latn
bs-BA-Latn
ca-es
ca-ES
.cmd
.com
CONOUT$
- CRT not initialized
cs-cz
cs-CZ
cy-gb
cy-GB
da-dk
da-DK
dddd, MMMM dd, yyyy
de-at
de-AT
December
de-ch
de-CH
de-de
de-DE
de-li
de-LI
de-lu
de-LU
div-mv
div-MV
Dja-JP
DOMAIN error
DR6002
Ejjj
el-gr
el-GR
emscoree.dll
en-au
en-AU
en-bz
en-BZ
en-ca
en-CA
en-cb
en-CB
en-gb
en-GB
en-ie
en-IE
en-jm
en-JM
en-nz
en-NZ
en-ph
en-PH
en-tt
en-TT
en-us
en-US
en-za
en-ZA
en-zw
en-ZW
es-ar
es-AR
es-bo
es-BO
es-cl
es-CL
es-co
es-CO
es-cr
es-CR
es-do
es-DO
es-ec
es-EC
es-es
es-ES
es-gt
es-GT
es-hn
es-HN
es-mx
es-MX
es-ni
es-NI
es-pa
es-PA
es-pe
es-PE
es-pr
es-PR
es-py
es-PY
es-sv
es-SV
es-uy
es-UY
es-ve
es-VE
et-ee
et-EE
eu-es
eu-ES
fa-ir
fa-IR
February
fi-fi
fi-FI
- floating point support not loaded
fo-fo
fo-FO
fr-be
fr-BE
fr-ca
fr-CA
fr-ch
fr-CH
fr-fr
fr-FR
Friday
fr-lu
fr-LU
fr-mc
fr-MC
gl-es
gl-ES
gu-in
gu-IN
         (((((                  H
he-il
he-IL
HH:mm:ss
hi-in
hi-IN
hr-ba
hr-BA
hr-hr
hr-HR
hu-hu
hu-HU
hy-am
hy-AM
id-id
id-ID
- inconsistent onexit begin-end variables
is-is
is-IS
it-ch
it-CH
it-it
it-IT
ja-jp
January
jjjj
jjjjj
July
June
ka-ge
ka-GE
kernel32.dll
kk-kz
kk-KZ
kn-in
kn-IN
kok-in
kok-IN
ko-kr
ko-KR
ky-kg
ky-KG
lt-lt
lt-LT
lv-lv
lv-LV
March
Microsoft Visual C++ Runtime Library
mi-nz
mi-NZ
mk-mk
mk-MK
ml-in
ml-IN
MM/dd/yy
mn-mn
mn-MN
Monday
mr-in
mr-IN
ms-bn
ms-BN
ms-my
ms-MY
mt-mt
mt-MT
nb-no
nb-NO
nl-be
nl-BE
nl-nl
nl-NL
nn-no
nn-NO
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
ns-za
ns-ZA
(null)
October
pa-in
pa-IN
pl-pl
pl-PL
Program: 
<program name unknown>
pt-br
pt-BR
pt-pt
pt-PT
- pure virtual function call
quz-bo
quz-BO
quz-ec
quz-EC
quz-pe
quz-PE
R6008
R6009
R6010
R6016
R6017
R6018
R6019
R6024
R6025
R6026
R6027
R6028
R6030
R6031
R6032
R6033
R6034
ro-ro
ro-RO
runtime error 
Runtime Error!
ru-ru
ru-RU
sa-in
sa-IN
Saturday
se-fi
se-FI
se-no
se-NO
September
se-se
se-SE
SING error
sk-sk
sk-SK
sl-si
sl-SI
sma-no
sma-NO
sma-se
sma-SE
smj-no
smj-NO
smj-se
smj-SE
smn-fi
smn-FI
sms-fi
sms-FI
sq-al
sq-AL
sr-ba-cyrl
sr-BA-Cyrl
sr-ba-latn
sr-BA-Latn
sr-sp-cyrl
sr-SP-Cyrl
sr-sp-latn
sr-SP-Latn
Sunday
sv-fi
sv-FI
sv-se
sv-SE
sw-ke
sw-KE
syr-sy
syr-SY
ta-in
ta-IN
te-in
te-IN
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
th-th
th-TH
Thursday
TLOSS error
tn-za
tn-ZA
tr-tr
tr-TR
tt-ru
tt-RU
Tuesday
uk-ua
uk-UA
- unable to initialize heap
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
ur-pk
ur-PK
USER32.DLL
uz-uz-cyrl
uz-UZ-Cyrl
uz-uz-latn
uz-UZ-Latn
vi-vn
vi-VN
Wednesday
xh-za
xh-ZA
zh-chs
zh-CHS
zh-cht
zh-CHT
zh-cn
zh-CN
zh-hk
zh-HK
zh-mo
zh-MO
zh-sg
zh-SG
zh-tw
zh-TW
zu-za
zu-ZA
<(<?<[<
                          
?%?@?}?
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0(0,0<0@0D0H0P0h0x0|0
0 0'0.050O0k0
0!0)0<0N0Z0b0w0
0'0.0<0U0c0w0
0 0*0=0Y0a0m0
0 0(0<0z0
0!0)010;0D0[0g0o0w0
0#0)02090@0F0S0[0d0
0$0,040
0$0,040<0D0L0T0\0d0l0t0|0
0'0-040L0T0]0m0
0"0*040V0]0z0
0$0,040X0`0
0!0(050?0[0b0z0
0%0-050]0h0u0
00070B0G0N0g0
0"0,080E0K0U0Z0_0j0
0!0+0A0K0c0s0
&0.0;0A0Q0Y0h0|0
0 0(0B0L0\0d0
000R0d0y0
0$0/0R0Z0
001=1^1e1v1
0$040G0O0W0b0n0t0y0
0'060<0L0R0w0
0/070C0K0S0]0r0|0
0-090f0u0
0)0B0P0^0f0q0x0
0,0E0a0i0
0&0F0W0\0k0
0<0G0M0o0
0>0K0W0_0
&0@0N0[0d0l0
0&0S0_0s0
)010C0U0\0u0
'010U0
0$111>1O1^1r1
0+111Z1u1
0	1'121:1B1R1]1
0!1)131A1G1Y1_1e1o1y1
0%1*141
0 1,1F1P1Z1r1
0'121M1U1]1e1m1u1}1
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0)151;1S1f1m1u1
02181F1M1
030L0Y0`0
< <$<(<,<0<4<~<
040<0K0X0g0
;,;0;4;8;<;@;D;l;p;t;x;|;
050=0I0S0[0c0k0s0{0
'050B0J0
&060y0
?(?0?8?D?L?]?u?}?
<0<8<@<H<P<X<o<
=(>0>8>@>N>V>^>n>
090G0b0u0}0
0`9d9h9l9p9t9
=0C0I0O0t0
0D1Q1V1r1|1
:0:D:N:S:[:m:z:
; ;(;0;:;E;
?0?:?@?F?P?T?X?\?`?
: :(:0:f:w:
0H0P0Y0r0|0
: :0:<:I:Z:h:
:0:=:j:y:
:0:<:L:_:k:s:{:
? ?(?0?M?T?~?
0O0Z0b0j0
<0<P<p<
0T,RnH@)
=0=X=`=j=s=
:(:0:Z:z:
1$101?1
1 1(10181@1H1P1X1`1h1p1x1
1"1-1=1
1"111;1M1\1c1t1
1 1(151?1G1O1W1_1j1
1.1:1A1L1Q1r1}1
1"1:1D1R1b1p1~1
1 1?1U1
1+131?1E1Q1Y1a1i1v1
1%131;1I1[1
1'131;1L1T1\1h1p1
1+151<1W1q1
1$151A1I1U1
1*151B1J1Z1g1z1
1 181H1L1\1`1d1l1
1#181H1U1h1n1s1{1
1*191F1R1i1x1
1,191J1s1{1
1<1A1G1Q1X1b1t1
1#1a1m1u1}1
1<1D1e1|1
1*1G1]1
1,1M1T1|1
1,1O1[1c1k1s1
1&1O1f1z1
12181B1t1z1
1!2.2;2r2
1#2.2?2V2_2e2k2q2w2|2
1'282@2K2[2h2
1)2E2W2a2p2
1	2T2q2
131;1Q1
142D2^2
151;1C1}1
181W1v1
>!>1>9>A>Y>a>i>
?1?9?[?g?r?z?
1E1Q1c1p1
1f2l2r2
1F,-B.v
>1>H>n>x>
:1:L:T:b:g:v:
1M1Y1}1
1Q2b2t2}2
1#QNAN
1#SNAN
=$=1=T=b={=
- 1T$f
?1?;?W?^?d?r?x?
:1:W:u:|:
;);1;Z;b;v;
? ?)?1?>?Z?w?
20B0P0X0`0z0
213<3S3
2&212<2P2u2
2+212g2q2y2
2 2(20282@2H2P2X2`2h2p2x2
2 2$2(2,2
2*222:2B2K2T2\2j2r2
222:2D2j2
2%2:2@2L2R2W2_2s2{2
2'2-232X2q2x2
2!2-242<2P2X2d2k2
2 2*252D2L2T2`2g2o2
2#2/262C2R2[2h2x2
2!2)272
2'2/2A2I2Q2]2g2q2}2
2%2<2D2O2W2g2
2"2;2E2]2c2
2#2:2J2W2`2{2
2/2^2o2w2
222Q2Y2a2{2
2"2+2w2
2$232:2U2
2%232S2[2c2k2s2{2
2$242<2W2_2j2r2}2
2$24282H2L2T2l2|2
2&262p2
2+272?2T2v2
2+282B2J2R2]2h2v2{2
2.282D2L2\2d2r2z2
2:2b2n2z2
2.2F2P2`2h2p2x2
2=2j2s2
2,2U2]2e2
2 3(3-323B3O3Z3c3q3~3
2&33383@3T3b3j3r3z3
2"3/373C3o3x3
2/3;3C3O3[3h3w3}3
2/3?3E3`3
2	3%3M3]3k3
2.3:3u3
2)383@3\3q3
2,3C3f3
2?3G3O3d3l3t3|3
<$<*<2<7<=<E<J<P<X<]<c<k<p<v<~<
>2?7?@?L?Q?
283<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
?2?9?P?[?b?p?u?
2B2R2b2r2
=)>2>:>B>J>q>{>
<2<C<[<f<n<u<
;2;;;c;o;|;
2E2_2z2
<	=2=h=
=2=:=P=]=e=
2T2\2d2
?*?2?:?X?k?{?
303G3M3_3g3l3x3
30484J4U4i4q4}4
313W3u3|3
3'303=3Q3
3 303U3e3v3~3
3#31393F3j3s3{3
3 3(30383@3H3P3X3`3h3p3x3
3%3-3[3
3$3)3.333<3
3+333F3V3^3j3r3z3
3#3+3@3M3e3m3v3
3'3/3;3O3p3}3
3!3/3:3T3p3v3~3
3#3+353A3N3[3`3x3
3$3/373?3L3W3j3
3$3>3G3W3
3&3+3G3W3f3u3}3
3/3;3H3P3X3
3"3)3J3Q3{3
3*3:3T3
3 343<3P3X3l3t3|3
3&343D3
3"343I3Q3
334:4=5
3)353;3G3Q3Y3_3s3{3
3*363J3V3q3y3
3"373?3G3O3d3l3|3
3"373M3y3
3:3B3Y3e3m3}3
3;3C3o3v3~3
3!3E3Q3Y3a3l3x3
3=3M3]3
343<3D3T3]3g3p3
3	4%4-4@4L4v4
3#4+4I4V4a4o4v4
3*474T4d4o4{4
3<4D4X4`4h4|4
3:4G4[4
373B3J3T3Z3
393F3Q3Y3a3f3o3
3A4I4V4l4t4
>3>;>C>H>f>
:3;C;W;c;k;r;z;
>'>3>;>f>p>x>
3G5C8l8y8
> >+>3>G>Q>Y>d>p>u>
?+?3???G?S?n?v?
:3:?:G:S:Z:w:
<#=3=I=h=
?3?J?T?p?
=+=3=L=d=n=
;+;3;@;L;T;\;l;|;
3Q4\4|4
?,?3?Q?Y?a?u?
3R3g3m3
<+<3<t<
=)=3=W=a=q=w=
;!;+;3;X;d;l;x;
415I5U5]5e5u5
4(404<4D4c4k4
4 4(40484@4H4P4X4`4h4p4x4
4 4*424A4]4s4
4"4*424A4I4X4
4!4'434@4L4R4^4f4n4v4
4 4@4`4
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
4$444<4B4J4R4[4c4k4t4
4'444\4n4~4
4,444<4V4d4r4
4"4,4<4b4k4
4 4.4A4M4_4w4
4$4:4B4J4P4b4r4~4
4/4?4E4k4u4
4"4<4j4
4'4/4M4
4.464B4N4Y4a4j4q4y4
4=4D4R4
4&4F4e4v4{4
4;4H4f4x4
4=4h4p4
4 5(545<5E5h5u5|5
455=5N5
4+5@5M5\5
464B4[4b4
4@6P7k7
474>4F4N4Y4z4
494I4[4c4k4
=!=)=.=4=<=A=G=O=T=Z=b=g=m=u=z=
;4;A;X;m;y;
:,:4:A:Y:e:
> >&>4>B>P>W>d>m>
4C4K4S4q4
4C4S4[4t4|4
=$=,=4=<=D=
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
;$;,;4;<;D;L;T;\;d;l;t;|;
:$:,:4:<:D:L:T:\:d:l:t:|:
?$?,?4?<?D?L?T?\?d?l?t?|?
<$<,<4<<<D<V<
:,:4:@:e:p:
<!=,=4=<=G=O=V=k=
=$>,>4><>G>T>f>
;);4;@;H;
4H4X4o4
;$;,;4;<;I;};
:":(:4:<:I:u:
<,<4<<<O<W<j<w<
4T4f4n4}4
4V4b4j4u4
4Z4k4r4z4
<.<5<]<
51565>5Q5Y5^5x5
51595T5i5u5}5
516G6P6_6k6
525?5L5o5
535;5C5K5R5o5y5
545J5c5m5u5
5$5054585<5X5\5p5
5&515A5I5Q5]5e5r5
5%535J5U5[5b5j5q5
5)545>5C5K5S5i5
5 5(50585@5H5P5X5`5h5p5x5
5%5,545A5X5c5w5
5 5$5(5,50545~5
5&5.555>5E5K5Z5n5
5%5-555=5G5O5k5s5~5
5,555<5H5\5w5
5#5+5>5\5h5p5x5
5&5.5:5B5N5
5/555V5
5(5:5B5J5^5h5
5 5<5B5J5X5o5
5 5*5B5N5[5c5o5{5
5+5;5V5g5o5
556M609Z9
5 585F5N5]5e5q5
5/5A5o5
5 5B5]5e5k5s5
5-5D5]5i5r5
5(5D5H5d5h5
5-5d5j5
5%5F5m5y5
5 5H5V5e5
5.5M5n5~5
5"5W5v5
5(606Y6e6
5-6A6I6Q6\6h6p6y6
5@6H6d6l6t6
5/6Q6Y6m6
585R5x5
;-;5;A;M;U;a;
.5A!Su*
?5?B?G?U?
:	:!:):5:B:L:X:`:m:|:
:5:<:D:\:n:|:
;!;-;5;D;X;`;h;};
5G5s5{5
5h5s5x5
?5?@?H?M?U?h?t?
?"?.?5?<?I?T?y?
>&>5>J>`>
;5;:;J;v;
?$?-?5?S?
=(=5=;=U=b=j=y=~=
5V6^6l6
5z7:8h8y8
>&>.>6>}>
606<6T6X6x6
64M||9M\R;M
656C6_6v6
657@7a7
6%606<6I6T6^6
6%61676R6h6
6$61696A6O6[6c6x6
6)616V6b6j6r6
6*62696G6Q6Y6p6x6
6(636J6X6`6h6o6w6
6(656?6J6k6u6
6 6(60686@6H6P6X6`6h6p6x6
6$6,646B6R6X6a6n6v6~6
6&6-656?6G6T6s6
6!6.666?6\6b6
6!6.6:6B6M6R6b6s6
6)6.6;6P6]6j6
6-6;6A6R6
6-6;6C6K6W6_6
6-6<6F6S6]6m6
6$6.6G6
6"6'6N;
6)676?6G6N6V6j6r6y6
667M7U7d7t7
6.686@6H6P6]6e6
6$686?6Q6b6w6|6
6+686G6U6]6
6,696A6M6z6
6"696I6Q6Y6c6m6z6
6 6B6J6^6
6'6F6Y6
6>6I6^6f6n6
6-767T7
676E6z6
6"7*757B7J7R7Z7b7x7
6 7'7>7C7l7
6 7(7@7H7S7
6/:7:H:Y:
6+7o7w7
>!>.>6>A>^>z>
=6=B=V=j=
>%?6?B?[?x?
=6>C>K>[>o>~>
6E7'8g8r8x8
=$=*=6=F=L=[=b=r=x=~=
<'<6<?<G<S<g<o<x<
<&<.<6<@<H<U<
6J6e6q6
:.:6:J:V:^:i:{:
:$:6:K:]:d:j:q:{:
=.=6=K=X=t=
;*;6;L;S;a;x;
6M7r7x7
70797B7U7^7
727I7W7_7
747B7M7W7_7
7-727>7U7]7i7s7~7
7'737<7O7Z7b7|7
7#757?7G7e7k7r7
7!767<7G7W7c7m7~7
7"767m7}7
7!7(707;7U7y7
7 7(70787@7H7P7X7`7h7p7x7
%7)7-7175797=7A7E7I7M7Q7U7Y7]7a7e7i7m7q7u7y7}7
7"7*727;7K7R7
7"7@7[7
7!7-777?7G7[7c7k7|7
7&7.7>7F7N7
7!7&797E7M7Y7x7
777C7K7S7[7a7z7
7%7?7F7\7p7
7"7-7g7q7
7+7>7K7
7#7+7Y7
7,787@7p7
7*787S7o7t7
7-797F7S7[7c7r7~7
7<7D7L7T7d7m7u7}7
7,7F7V7c7|7
7>7K7X7`7h7p7}7
7%7N7_7
7-848F8S8`8{8
787L7W7j7w7
7!8-848<8I8\8h8t8|8
7"8-8:8
7$8,898k8
7`8h8x8
7*8H8x8
797A7I7Q7^7
7B7T7e7
>#>*>7>C>I>^>~>
:/:7:?:F:L:T:
?7?G?b?
<,<7<G<O<\<d<
;7;G;s;
>'>7>l>
7@M& BMl
;7;=;X;h;q;y;
808?8I8S8g8~8
818n8z8
848@8H8t8x8
858:8T8j8r8
868`8h8w8
868E8Z8a8m8u8
8#81878<8D8\8n8v8
8%81898L8^8u8
8#818D8J8P8
8(848@8R8Z8b8m8u8
8,848F8R8Z8b8m8y8
8!858@8J8P8]8c8
8'858N8X8e8j8r8z8
8(878N8Z8n8v8
8$878o8u8{8
8"8*868>8F8M8e8q8y8
8(8/878X8^8m8u8z8
8$8(8-83878=8A8G8K8P8V8Z8`8d8j8n8t8x8
8-888?8G8]8j8v8
8%888R8b8l8y8
8 8=8C8]8f8
8.8<8D8W8_8o8
8#8=8E8T8\8d8l8
8)8;8M8_8q8
8&898H8U8`8l8v8
8&898R8Z8b8
8&8B8J8O8W8u8
8$8I8]8
8%8I8Q8\8p8x8
8 8I8Q8x8
8,8L8l8
8(949>9I9Y9l9x9
8)9.989{9
8 9(9;9@9H9V9q9
? ?$?(?8?@?a?~?
>"?-?8?@?E?M?q?
>8>F>f>n>v>
;#;8;G;f;
8Q8Y8o8
8X8t8|8
:&:/:8:Z:
909P9p9|9
929B9b9j9
9$:2:H:U:u:
9':3:a:i:x:
9 :(:4:@:G:N:d:
95;P;f;|;
97:D:U:u:;<y>
9+:8:G:f:t:|:
9&929:9B9J9m9t9~9
9)949@9W9h9
9 959<9M9U9]9e9l9t9|9
9+959_9x9
9%959A9
9%969\9f9z9
9.969B9I9
9.969L9X9d9
9,979V9e9m9u9}9
9"9(909:9E9N9_9m9
9"9*929:9B9_9g9r9
9"9.969<9G9f9x9
9 9&999F9\9u9
9&9,999F9Q9|9
9'9.9;9C9J9p9x9
9 9(9>9E9V9f9{9
9%9-9:9P9c9|9
9*9:9C9
999C9R9_9x9
9*9:9G9W9z9
9'9@9H9j9r9
9:9@9J9`9s9
9#9>9L9R9^9c9o9u9|9
9-9<9W9m9y9
9#9/9x9
9!9C9W9v9
9.9D9a9i9u9z9
9@9G9U9c9
9=9H9M9U9f9
9<9P9c9n9
?"?*?9?A?I?R?Z?o?u?
9amWQ#|
9#:+:;:A:W:]:
9":F:`:p:
>%>9>F>P>g>q>
9G9O9Z9
9i9q9y9
9jM@KT
9Ny!:N
9 :+:?:O:]:
=,=9=P=^=p=
; <'<-<9<R<`<m<w<
9Y9_9x9
=9=Y=e=m=y=
<.<A<{<
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
>A?b?o?z?
address family not supported
address_family_not_supported
address in use
address_in_use
address not available
address_not_available
;%;A;H;W;
already connected
already_connected
:*:A:L:U:]:
ANtkCN
AreFileApisANSI
argument list too long
argument out of domain
>(>A>R>]>l>t>
=-=A=S=h=r=z=
<at-<rt"<wt
August
.?AVbad_alloc@std@@
.?AVbad_exception@std@@
.?AVerror_category@std@@
.?AVexception@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AVlength_error@std@@
.?AVlogic_error@std@@
.?AVout_of_range@std@@
.?AV_System_error_category@std@@
.?AVtype_info@@
?)?a?x?~?
bad address
bad_address
bad allocation
bad exception
bad file descriptor
bad_file_descriptor
bad message
 Base Class Array'
 Base Class Descriptor at (
__based(
BeginPaint
=$=B=J=]=z=
BKRX7B
<#<+<b<l<t<
;%;:;B;m;u;
;*;:;B;O;\;n;v;~;
;!;&;.;:;B;^;r;~;
broken pipe
?.?B?V?b?{?
bWWWWj
=,>B>X>q>
CallWindowProcA
c[bbWf
__cdecl
CE^`gI
CheckDlgButton
 Class Hierarchy Descriptor'
CloseHandle
CloseThreadpoolTimer
CloseThreadpoolWait
__clrcall
=C=M=U=h=
CompareStringEx
CompareStringW
 Complete Object Locator'
connection aborted
connection_aborted
connection already in progress
connection_already_in_progress
connection refused
connection_refused
connection reset
connection_reset
`copy constructor closure'
CorExitProcess
>C>O>U>p>
:C:O:V:^:f:y:
;*<[<c<p<x<
c&qbnod yiihvovcpa fvbugddiel zzsazii iljda tjmik rjcabjsom lpkitffug wajti jlpa ffogii onumbo ofdxagajye prjinyy zjyurypu vdonuztpom fefiwi liftan pfpe apzliem iuofjru acpojep qddacfwa oognnuujc spgoapd essxaf wcho lufc bed hufg euelvgu cdit ejegbin cbdikaabqi ndubijbdin glgipalco ocjdoxg sbcab xcukojt abmv qetbij cqsetrzaij alyxin jgob ofs ludregudu afmpup qnwu plgeas lwmuak mvgapd zrpunfieyu fjve vnvabvq chledl ctahujnpul crzuicjani dcqakelpe hfoa lkv nskebbtojl jqrer stqo zofjey ossbagivfa ubl qxduemjra onuz pcciavdpog cmdedcag vlriwif fvjeepiu qnujo ankgeucy iptfajuumf ddpardzuf bpco nolxekpf fghodl oleb ngbiweig uwynexzm egfvamfi tqf htsagfa eeifyluod bvfircpej bmri hmp jeupwe feauhnato cgieuam bpmaummkus hcjo cpjudrjo rmbankric wgba eksage lakjaf tyta mftijds ulefaco rrpuyzito jbdocnn bmgummo gsegibzw oif adnu bcjumjpaj ycha srlug excroldf codq isxfa ftyigxgo tcob tlzi nvxu muj ceijju mvaelajmuv pfcavmjuk gsgunbu bzfefemda mrbafaiio tvcafa evsgun rfug nom tgxurvgeb ungvouetpd yowdavwru imiukgusr oddliqjbu bjpidwh rmfaax iilvjemeb zmiqedtqet rjnogb sjfaklsozt meuscu dpvetjbui csdodezjiz adnyeqsjix nxmeysisaf bos iaea dpke ptjecf epfkilcl sabni mcu sglelp hbbe gzyundpu najfandota gamcudbne bttiksnun cfuebeqbcu aivzcesvge ivgso imfjudt vbafi grufigbm nyd ltmed nbjeu ono tcxi qgsaq cgniuuuiae wsdivjl oxdjeyoo devs lblalhenu ptda sfxuwmbay sczojivau svsofni qlvigp wjiroyd cfliruoc qjlabcpeia gacgon durrannj xsxe cjsobl cndubv dxguxcdaa mgbuzkse pfhaflv cimfaznm uer zxm sjtiqgn ocejtubu cmqoxoe bnfumaopju nunjop fcjure rngi aibvd lmroo erl nosolaa sjlirwgip thmudj ruvhi oircaisufj mdalurz lnorugv jybahw frdojpiuj tbta uoc apg zsxe wgxoaugb vogadua eijiy neijgebgji lkzoglku epofo idnfulbeju xyl lnjan bajz cwka myfoyngep nocloyoabc wmnaci llnecn dlnootjc zswillb hlat qxi ume bubda ahojbo cziadod rigv vzife oifmkifa vonfov jrbei wguzoeci twlur efgofa smpu yojguwm ubjpimevn oprqeovzl nmsicdg hsemehf ffluumuumt lpdieqowv dnduff otuc ggximqgo rugeso bvg jbnusllanl fsdipefe exsyapc pjre ttburt dnrujag mzafeddke sandunujne janga jdde jtjo rcjimw qotmors pjsuote gpub padq gpgi cin fotn rmcerpsiov ude qxqedmdu lkzodr bubmovun pjadi hescijp smuusazt zruh wcm mubpu jmieonie bcn adpd olj liopze xpeci desso cclapusqo keufsigepa lctigboivo ppc mvunuax lotpiq pnsemfgie ozjse lfamo oepbyoyfdu kbo gfsosbum smmu qvikis buguf ndsase ingaun selfev bfgaac njinantni oahi lucfuv susfe cgfi ingomor muhjibzgu irnc kirhaluj cfmienfnap naupacu ldni ztpavalgo zzij sclejyanic cpxiudt lfge ornlaosl ollce jpjuxf fsg zcpodb gnximbbuc ogfpajmva lbgallpuui ssnursgaco cagujihlla zmaba jsbofl llicuqjla lpineibivc xmgevvpo lrkijiblod duvosin egcesiai owd jqwa vupubu ceagpomi ognmesmi xghii pwdobsjabm gogmisgg ocjgapgdin fbgivtc itamz sdl xobd jxyiejhauz zliwuf seusd mpd mucf wbgibsr fmgetpfuz szlibd cbluudef jpki snezocuf osbbis bgcufoopg gijs ffla ttva iueznz sgagakjol gnagufsbe micjibv slnissmopl jsgugsfuef pnvab efoxcav bugp rndob jnhu vsqu rgda ipahvoijuq jgavi plxo nernefaruj uobatiya jeurjoiawb vbbes btelutdxa ftma zsr mlmucfs mblillne bsveegsb vcmizom ngbexuz dmmitmqe mnjof gpsennvicb dhfugqlee aulyenau obhaaxiub czbeg nmjep necpolsA
C-R} :
CreateEventExW
CreateFile2
CreateFileW
CreateSemaphoreExW
CreateSymbolicLinkW
CreateThread
CreateThreadpoolTimer
CreateThreadpoolWait
cross device link
cxcmeci ljizug jbtuemt qtqe nun mrpar migfu tmli wloxiu ppvicn uyw nofnuerbo toenji llub mranobn ninji qxdoeneru mnjipgh fdjo bnlioiigi xgpa nzari ooh usjci cisjialtum huvsusmd bbwofperat fgt zysogofu pdk tssuit snneu bhyipvyu fjdam smtoq lusucir tfenoq njtato ougkapacox pnga ljcau ndlessnum mnbusfjin whjag lawosilz glmefado jxefonf tppuk vzzakejl zlgac cuo fgluq cebaen fbbigoma qmlolnv jal apgzars oqbdubb ojrde dgsiygmeb hszaoslela omgqufazui qfeita olmbeoddsa cjkeavx amdced bpoduuna bcjaaplo obgbo hjroe ouospebaj nucleqhbep fdisirmzea zuz gwiva ipoeajp tqkaqo hjje cpmej idzjigeu tacsivb zrzupmsesp iiz xnnagav maezyiu zqla tfpetlbi afdda pwn gmbialg ricueniuug omom vaodbo pczerbsef knerilobpo bgdulspoe lslinybe bgfegpuri bnlomdv eabmbiqjca bpjalpbecp oio zkror xtrunmsunb uedp rrfifi gbma ffq udagfaol fatdonsiu sjt bmguesyo izb bpub uvowzuamzl ljrubp zgg ilk ews tignojcba xztihbeda bad fdjudhnopm napt pbdiwhece eif pfojaeidqi att bpnolc ijrfac jwaagudnve tgkulfpi oeglehasr bfbujjsum adxzopnl wni rvn hbn nmka ieos cmj tyaaogi nvleok figtem urgbill bdbicmde codj qduneyg mijfio rpgaslil ocicoqi bswoeldheh cegduobsj dxpixca yxbabnd jdfadozui fogcalngi ogqanodda nfm fdjeg uodj clbucvjigr zimhep jldo qoge lyfuit sulbaect mblauyosfe iten gsfuvmte ztmah hgfuvlyaeq rsqed aqfl seerbo ijl zvtukcodi pdget efn zpgufstoz jgpigzw lntuxbpa ujzd zbt ggceszsea ihdjoc ijingeb afzlebp cmcoeofcxi qwjeidjzub xzvosufo fbbookoouj due bucjaly zmj povuw gbb stkuemm cjuit cenyusfba mbqa pdgo xmq tplocebf dmqu eula dafpopcme vrg pujojennc btn ulak abgfegen kdga jtjoq wznau cmlacjhisx wmzozmu fplotca ema bwnibv jdnuonfvij pfihidmio llleug scdetbj mizi mfruln yoizpo uivmvebfo mmlirznob ogcuyim mzzapcfoe cegc rcetu ptdi pbetolmlei fqevuh ilohceig ppolaeradp gjqag pdbe luurcaou fcolaffsim fuijila bca rizepat nddizli ucfcemm sbx dlponjjapt tivgik mcl jea lgb mmjan vkgo nmjem ezngemu czpupgb fdeji agdvu zsra raoplugan sffucbrue cpp gnvaoj gjmamaf upt irjulu lujfairfha jlcob pazivaj clduacs utpdelfbo sielgoljdo jpjofu upb dan lapcomfc bsy qovedaiq esx aasf tjjudald iqtci dbumegcl dblek hsn fpce djmothseh mjmo nmbo ggdacpf asvcapfm eunnvehcul fsbilu tieiqh pouiloted ahmz tvxedsf ufgwailb pkjapkna dmvul gwpe ofutlumlga nfosaf wmzenbzin legfom vxz dgf mgcumiaagj ipoeed dzuhua pyzo fmito sjcahg ctzefdjut htu diuecfojus qdbab ggiu gzbovnju nqgui pgco fvepefctiy fmcedibduf ccneqh osisvax akso tmjoab scfuwiogra pfjamv sivasaomx ewczam apzelugdc cgzir umwn jgn gmdu rguvitbfa pezm jhgelpg aucz cuhjagbnoa tjiluazrfi uopjzurd bucj lbigiymnu lgvasfxu lcleo dpkol cfelixql lnvoxckorl dspeztdojj lzr flciyub stj usfq oiszdi haj drsisn fspodje ional gvnal oba rkguef cjmamz eebn opro gxgogp gb
>#>)>D>
@.data
dddd, MMMM dd, yyyy
.D^dE&
December
DecodePointer
`default constructor closure'
 delete
 delete[]
DeleteCriticalSection
DeleteFileA
destination address required
destination_address_required
device or resource busy
directory not empty
<d<j<o<u<|<
='=<=D=L={=
:$:/:?:D:L:d:
>$>,><>D>L>T>\>d>l>t>|>
:$;<;D;L;y;
:):D:O:e:
:&;D;Q;Y;e;t;|;
DrawTextA
;<<D<u<
><?D?X?h?}?
>&>\>d>y>
`dynamic atexit destructor for '
`dynamic initializer for '
> ?>?e?|?
<#</<E<
;$;E;};
>E'a#]
__eabi
?#???E?a?m?
?:?E?e?p?
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
= >&>E>K>
>E>M>U>]>i>x>
<+<=<E<M<X<d<l<y<
;&;E;N;
EnableWindow
EncodePointer
EndDialog
EndPaint
EnterCriticalSection
EnumSystemLocalesEx
:E:\:o:|:
;";.;E;O;a;h;s;};
>E>O>j>v>
<!<?<e<r<z<
=E=R=Z=y=
;%;E;T;Y;`;m;|;
executable format error
exiD|G
ExitProcess
>">]>e>z>
>#>f>~>
:&;-;F;
__fastcall
fCkJ3w
February
file exists
filename too long
filename_too_long
FileTimeToLocalFileTime
FileTimeToSystemTime
file too large
FindClose
FindFirstFileExW
FindResourceA
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushProcessWriteBuffers
FNCmHNGCIN
> >F>N>g>~>
>+?F?N?n?{?
<&<.<@<f<n<v<~<
FreeEnvironmentStringsW
FreeLibraryWhenCallbackReturns
; ;-;F;R;_;g;s;y;
Friday
;/;>;F;U;];i;
function not supported
GDI32.dll
generic
GetACP
GetActiveWindow
GetClipRgn
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetCPInfo
GetCurrentDirectoryW
GetCurrentPackageId
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThreadId
GetCursor
GetDateFormatEx
GetDCPenColor
GetDialogBaseUnits
GetDlgItem
GetDlgItemInt
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStringsW
GetFileInformationByHandle
GetFileInformationByHandleExW
GetFileType
GetFontLanguageInfo
GetForegroundWindow
GetFullPathNameW
GetGraphicsMode
GetInputState
GetKeyboardType
GetLastActivePopup
GetLastError
GetLocaleInfoEx
GetLogicalProcessorInformation
GetMenu
GetMenuCheckMarkDimensions
GetMenuContextHelpId
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMetaRgn
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNearestPaletteIndex
GetObjectType
GetOEMCP
GetPixelFormat
GetPolyFillMode
GetProcAddress
GetProcessHeap
GetProcessWindowStation
GetPropA
GetQueueStatus
GetRandomRgn
GetStartupInfoW
GetStdHandle
GetStretchBltMode
GetStringTypeW
GetSystemPaletteUse
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetTimeFormatEx
GetTimeZoneInformation
GetUserDefaultLocaleName
GetUserObjectInformationW
GetVersion
GetWindowContextHelpId
GetWindowLongA
:=;G;`;h;
</=G=L=
GlobalAlloc
GlobalFlags
GlobalHandle
GlobalSize
:G:L:q:
>$>?>G>[>l>w>
=G=O=W=f=s=
<.<G<Q<Y<^<c<~<
<?=G=R=i=u=
;=;_;g;t;
`h````
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
`h`hhh
HH:mm:ss
HHtVHHt
;H;^;j;u;
h?l?p?t?x?|?
host unreachable
host_unreachable
< <H<P<w<
Ht+Ht$Ht
<?=h=x=
_hypot
identifier removed
illegal byte sequence
IMs+JM
inappropriate io control operation
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
>(>I>N>S>j>
interrupted
;-;I;N;V;
invalid argument
invalid_argument
invalid seek
invalid string position
<I=N=V=^=r=
io error
iostream
iostream stream error
>?>I>Q>V>h>t>|>
=&=I=Q=Y=a=i=
is a directory
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocaleName
IsWindowEnabled
IsWindowUnicode
:=:i:t:|:
<itx<o
:<:J:^:
:!:.:J:
j0h *E
jA[jZZ+
JanFebMarAprMayJunJulAugSepOctNovDec
January
@jd_u	
</<J<e<
j/_j\[f;
j@j _W
?=?J?k?q?
?J?l?t?
?$?J?R?_?
;*;J;T;];j;
:&:[:k:
?/?>?K?
} kE$<
KERNEL32.dll
;';?;K;[;g;w;
K N3[ N
=&=>=K=S=_=
;K;W;_;g;o;~;
;	;);K;];y;
<*<;<l<
>,>L>~>
=l^%6N
<-<L<b<l<r<}<
LCMapStringEx
LCMapStringW
<-<L<d<
LeaveCriticalSection
LoadIconA
LoadLibraryExW
LoadResource
LocalFlags
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
LockResource
=%>\>l>s>z>
:+:L:V:j:r:~:
=(=/=L=W=c=k=s={=
lx`Grf
>=>L>Z>z>
>%>M>_>
m1^}%Y
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
map/set<T> too long
:+:M:c:
MessageBoxW
message size
message_size
-m},Gf
MM/dd/yy
MN>%QN~KQN
Monday
}MOv"d'
MoveFileA
MoveWindow
;M;p;x;
>/>m>u>
:::M:U:]:e:|:
=,=M=U=g=
MultiByteToWideChar
>M>Z>n>v>
;N;^;};
[NAa]N
`NAKaN
@N@EAN
network down
network_down
network reset
network_reset
network unreachable
network_unreachable
 new[]
_nextafter
"Nf'"N
no buffer space
no_buffer_space
no child process
no link
no lock available
no message
no message available
no protocol option
no_protocol_option
no space on device
no stream resources
no such device
no such device or address
no such file or directory
no such process
not a directory
not a socket
not_a_socket
not a stream
not connected
not_connected
not enough memory
not supported
November
NSb_0C	j
?-?:?N?T?Z?
(null)
?:?N?V?`?h?
<(<N<V<^<k<p<x<
October
`omni callsig'
o+N2}+N
operation canceled
operation in progress
operation_in_progress
operation not permitted
operation not supported
operation_not_supported
operation would block
operation_would_block
operator
orpibelug rjtovfzu ogyiukirm weigyett lkanul sjricxja mijjovmnae regosebns bsq ommcodwquk fdgi oau lujvuimiu wiujd unpgojldu jlpipzj anjbuyb xmtogega kqqazanfa igbnopml gbtag zpu yadpu jpdudfonaw cioyleljli ofpfaegl cbpoerfuam qmpi ccqalfre nvuge nccuutxlol dbkesvnoai wdec cdpantcin mls vmeti dcpaevf pbu jhoojeamz mafzop ebbg rdm isotzoy dsyuqoiacf jfeuraen npu eyrayo lbuavuu cadda wqzebifg fuvf rnxe ypxu badjegeb blsun pucjo dvd xgp cjseoeo adkv kbgeukfmio clwu idtre gqne slyuvmohu migacispi gjebolqe mba bionyojp eoz psvoalgyo gsdax eaxdju dfajagk ehlxiseao lbea goisb rdlea gvjezxji ipgtapciel hksirggucc rmsesfmus resanunc lddizuxare jzocotpp dajgeipmd fmji nfow futje nrmudfocam qrjuzgkebj vlqebq bbcuu fmsoqs bicemu upwlinbs eibt abfvodhcu rdhuvdn kucsolpe dfq ujcjuix ebbdezvn rxmosnzibo jne twius gfenepi jsimadbf cjizawibr fghimsrijp eftitu naos fel jcza dsqaj rzha wyced lil mxbocsl favbiz daj pzufef ozbh ryziigtmi jdhablc lebsoebgg cfgoaudv rgc xptokqre ghtu echselb qfucigwboe dajzamufau apremae gpa qogfovrsab codbiv grce uzncam camroqardi nxpiefg osbjavn bduzacra njgovj ugbdi gzmadp qgbozfb eoulbtejc dfajupdali yuj pddopveri hckacq nduja uin sja rwjapu dlt bpfuctjeog uxalsi otmhaaih dxsaulrco ibmceroyho vrnalcgiq zcj abmfutmfaj dfcup fnucemvpi shenonppe uiztmi mzha lcsocmabui olnolewvb pvsa tftisb clapoufsj ctjab zfpu mjja jspiaotpgo fnojioar agnbuj iuc yll ijlgiffz mfgadgn gli gddesooi nsp sfisiz lrsiojmti grcebm vsa zfocu ctene lfimiegjd joyy plriilh fyusoim jft xpsusdu snlepe czvanc iuvs jbgarap fuoumyulfg fagfibdza jss ecucme salnegtof logn gvieob pjsumd lvepoep dpsifcje jis bsimoqgla bpjufcbap gaplimao dvniamhbe plqij ggbesubfo klcunj zmecocoxre bis dubeapu ablfo gdbus ojjbebdluf ljjimja gzup vsbippgoo btte abv gdjegeuar eilyubujmb dxbone edpala fxlisgvut ibbroanlk cjdi nosduf jutriqmzo scm fgtiysp djnev cbmap vcd nfdukcujeg vprafbd xhay ddfodrwoin dlvu ajosuqisg ngbaf ivdli ltmutzsap sfluvvj eoebggou vbdadmioru pjajurwl bkfaao joa jgnuowu hzs zrfefdja hddiubm eaczfoddpu zdkuopzco crbidpl jak yglemc jbe koguvab yvj zsbenevm mmsawrs pdkupazwu fra lgc rbliu sdsut bxboa ngli sbnohdzipb utnlalevb bzciblio txdanc rrg jmesa ioq nipnieswj vausseht agd rbilozluc jcsubnner aytjig aebeldap pcge dsfiotixtu saai comciyaduo nkdufrofoo lwn lsinotojze lif dnfewwb ipcaal czmewg kbragvgem jsviv wrhiscju knjinbati podni htrifug fuposul buvivu dzedojsj itbwud ezmioarol arte flhulmdusu nmson bsgibrcum avnat vwuyiovnbu mfavidnnet umvjenjc vfcuxvmaf o~
/OSVWf
OutputDebugStringW
>O>V>t>
owner dead
>OXc+e
OYMD<\MM
?@?P?|?
__pascal
PeekNamedPipe
permission denied
permission_denied
:%:::P:]:g:w:
~pjCXf
`placement delete closure'
`placement delete[] closure'
PostMessageA
PP9E u
)ppmf[
protocol error
protocol not supported
protocol_not_supported
PSSSSV
__ptr64
PWWWWV
P*)Y@<
;Q=b=v=
Qi. CT
QQSVWd
-)$QRf
QueryPerformanceCounter
>&>Q>X>v>~>
?!?:?Q?Z?b?x?
RaiseException
`.rdata
ReadConsoleW
ReadFile
read only file system
.reloc
RemovePropA
resource deadlock would occur
resource unavailable try again
__restrict
restrict(
result out of range
RtlUnwind
=,=R=Z=m=
< <,<^<s<
=&=.=s={=
?!?-???\?s?
?%?:?s?|?
?.?S?_?
Saturday
`scalar deleting destructor'
SendMessageA
September
SetDefaultDllDirectories
SetDlgItemTextA
SetEndOfFile
SetEnvironmentVariableA
SetFileInformationByHandleW
SetFilePointer
SetFilePointerEx
SetFocus
SetLastError
SetStdHandle
SetTextAlign
SetTextCharacterExtra
SetTextJustification
SetThreadpoolTimer
SetThreadpoolWait
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWindowTextA
:&:.:<:S:[:f:
SizeofResource
?.?:?S?j?
<%<S<m<
SSPQSW
state not recoverable
__stdcall
stream timeout
`string'
string too long
Sunday
SunMonTueWedThuFriSat
,SVWj0X
SVWjA_jZ+
system
SystemTimeToTzSpecificLocalTime
<!<*<t<
T2X2\2`2d2h2l2x2|2
~';_t|%3
< t8<	t4
t&9=tkE
>T?[?c?
>T?\?d?l?t?|?
tD=O~$
TerminateProcess
text file busy
t!=fff
[tg8#+
+t"HHt
tHHt*Ht#
__thiscall
!This program cannot be run in DOS mode.
Thursday
timed out
timed_out
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
: ;&;T;n;{;
too many files open
too_many_files_open
too many files open in system
too many links
too many symbolic link levels
?Tp5=l
<"<.<><T<\<u<}<
Tuesday
;t$,v-
 Type Descriptor'
`typeof'
uaPPPS
?:uBGW
uBjAYjZ+
`udt returning'
__unaligned
UnhandledExceptionFilter
UNICODE
unknown error
Unknown exception
UQPXY]Y[
URPQQh
USER32.dll
UTF-16LE
<U=_=x=~=
<v5hBmE
value too large
`vbase destructor'
`vbtable'
`vcall'
__vectorcall
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
vector<T> too long
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
`vftable'
`virtual displacement map'
v	N+D$
WaitForThreadpoolTimerCallbacks
=W=_=e=
Wednesday
WideCharToMultiByte
Wj0XPV
WriteConsoleW
WriteFile
wrong protocol type
wrong_protocol_type
>,>X>d>l>
;xIT=f
xN(vyNxRzN
xppwpp
xpxxxx
xw)t]>[u
xw]U<$i*
;/<Y<a<i<z<
>!>,><>Y>f>n>
<'<Y<m<u<
yrY}Igx
; ;';Y;t;
YY_^[]
Z4N4u4N
z}7A8{
:$:,:Z:b:k:|:
=Z=b=m=
<&<><Z<d<
?"?Z?f?
=%=-=Z=l=
ZN.;[N
zPVG2x