Analysis Date2014-07-06 07:45:46
MD51ddbc3a840febfa05a81cbd56b5f5ac2
SHA1caec413ab54135527f30bea8447dac4023f8f931

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: fa014c2f24ce353858222aa9fde0911d sha1: 4a272c5419219c7c6ff1f083a88c72edb29ad75c size: 524288
Section.sedata md5: e23857d5e04b521ae42a46f77b0e3852 sha1: 51ddab1c1d8819e330eca51f410d061bbfda56c7 size: 1343488
Section.idata md5: 17c33354cefb289a162cb06b8cc6df0f sha1: e3fb1453aff85ebc9e5e057892cc4e87db7476ff size: 4096
Section.rsrc md5: 1b0874e469f3f8334777f0cf7cb1e64c sha1: 39f20c98a54a4d83df0442ea07a81fa9babbc0d0 size: 12288
Section.sedata md5: ef8f7b4d1ee9b464c732727cb16fa02d sha1: 7150f8f50a89d107c686bd2475aef0e6496b69d9 size: 4096
Timestamp2011-12-24 01:26:40
PackerSafeguard 1.03 -> Simonzh
PEhash1d969ba0341e861e792c048e03e0a62d4b65a102
IMPhash9a859aa2c13b798dbf6c45c7fa2fec5e
AV360 SafeTrojan.Generic.10407963
AVAd-AwareTrojan.Generic.10407963
AVAlwil (avast)no_virus
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Troj_Obfusc.P.gen!Eldorado
AVAvira (antivir)no_virus
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftno_virus
AVEset (nod32)Win32/Packed.NoobyProtect.J suspicious
AVFortinetPossibleThreat
AVFrisk (f-prot)W32/Troj_Obfusc.P.gen!Eldorado (generic, not disinfectable)
AVF-SecureTrojan.Generic.10407963
AVGrisoft (avg)Win32/Heur
AVIkarusTrojan.Win32.Diltacs
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Trojan.Generic.10407963
AVNormanwinpe/Bumrat.B
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!

Network Details:

DNSwww.web7b.cn
Type: A
118.99.58.15
DNSw.web7b.cn
Type: A
HTTP GEThttp://www.web7b.cn/banben.asp?banben=2.2.9.8
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Flows TCP192.168.1.1:1031 ➝ 118.99.58.15:80

Raw Pcap
0x00000000 (00000)   47455420 2f62616e 62656e2e 6173703f   GET /banben.asp?
0x00000010 (00016)   62616e62 656e3d32 2e322e39 2e382048   banben=2.2.9.8 H
0x00000020 (00032)   5454502f 312e310d 0a557365 722d4167   TTP/1.1..User-Ag
0x00000030 (00048)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x00000040 (00064)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x00000050 (00080)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x00000060 (00096)   4e542035 2e30290d 0a416363 6570743a   NT 5.0)..Accept:
0x00000070 (00112)   202a2f2a 0d0a486f 73743a20 7777772e    */*..Host: www.
0x00000080 (00128)   77656237 622e636e 0d0a4361 6368652d   web7b.cn..Cache-
0x00000090 (00144)   436f6e74 726f6c3a 206e6f2d 63616368   Control: no-cach
0x000000a0 (00160)   650d0a0d 0a                           e....


Strings
DEFAULT_ICON
\\.\PhysicalDrive%d
\\.\%S
SESDKDummy.dll
^_/,`,
:\"{^*
""""****
$/).\?
$$$$\\\\
####====
00006666
?00>cE
/00yTZ]
03J0}g(
-03Wjkl
$"0a`"
+0a#(@+
0aC=`]
~0ByLo
>0cF5*
!0cNfiY$
|+0Ev$
"^;0[G
\;#0h*
0--HPV
0J)Ah9
0"+j`i &/
0~JL[t
0,%k*C
~0"kCN
>0kKt.v!
)0	l;B_
0lWB/9>
0Mlb1w
0np?_)
0po.e(
?0pqF)}SWk
0rlKP;
0S2	d;B
0!Std 
_0tBD=
0tsCi0h$
[0U=&:
0U"$8I
0+W%ChJ%7
0(-yEj>
1)0(z	gY
11#?*0
	1}2+]
:15RShf
15VWn[+
17cA*<
17{D=~Ip
1!82HVc
1/8gTXb
18We2Y
1&Ae)#
1aE{W*!
1b|KJy*
1b	TO1b
1d."#<
1DBT@	
1E :>(
^1evjS@
1G|H$B
1==HA_
1J5niJ j
1K_~`/Q
1>Me6B
1N94\.
!&1	o5>k?
1Otf!:8
>`	=;1p
1[\ p6
`1?P$I]n
1Q*(>,
<|-1r'^(
1$r4=9
1~!sK,
<1SQN<
1	Uh)y+
~1weLs%	z
$1XQ7N;RI
%1`yC:
1z.90 =
1-({ZA
1z	t}]
^**{2+.
2(13jd
2222::::
;22dV::tN
+2~33s
28iGwS
2;8K18Q*
2aKNbE
*%?2Ar
2@c/[7
2C$Ngg
2dV2:tN:
2G0Q!L
(2=g1G
2i5?IjMd
"/[2 J\
}'?2J}
2=>Jo/
=2{n!WX
,2pjb`
2Q~0Wm
;2s[b#
`2;t9DA
~2x1t^]
??2@YAPAXI@Z
2Zyefn
\3>{^*
3+0|HmA
3+0|HmAi
3,0m)P
:31~A!
3*1VX=Q	
}34:Bu
?3>4,W>ka
3b"?C).
3=BY!gJ
3CaKpE*
!~#3{\	e
3E*/l?
3eM7n?
3?-e@yn
3E Y"t
{3g3I,
3G:rHC
3G.v{r
3>*HA>k1
]3HU,Eb
]3I0Z;
3=Im3O
3K6"16
3kD'2g
"*\3Kx
3L.e">
3<LJ:H
3MEO~0
3n6a:w
3[n-u;
;3^O'hl;' 
3PkSzG
3qY6\l
3@Ra#FJ
3SJ+M;
3t+s	q}
??3@YAXPAX@Z
$3&zQnA:
42T4VL/
43W\SR
441Vb#
"461N@
=465Z3
468H`ac	
4\6tVn-
>4$8,@
,4$8_@
_4}8fU
!)48`s
499250a
4A^\U7
4A{xj.
4\b-,2C
,4bWhFv
4#G0P-
4GetTextColor
4.g.ok
4HjM^9
4i5b{0 
4I*kad
>4i/`p
4~Jv2U=
]4?m4V(_
4??Mr2
4>o%$Ak
<4ofP~HQ
>4rJv*&
4rKzBF
4RvLIg
4|t_Uf
.4,u7Yf
4)uIb}^
<4V{7$J
4!!wth6
 ;&{4X
 4zf}|
~:+5/_{
@^*(5;
50fW|0
5-2~JoCF
$536&F
53GA0s
53Q#A`.i
5+3>.x
55j_WW
?|}55N
-58BHL<0s8-
/592SZ`
5<A}5;?|4:=|27;|Uag
5Aq\o}
5c$cU=
5}CM>O
5dcI!7
5(Dk*=
[%5e-k
(5#"f/
5h$'9E
5H;`agAy
:,5,II
5>iY7Ak
/5\#K>
5L	YOaE
5;'@*m4
):5m\F
5n]KVP
5>NR[Ck
5o\y	y}%
5~[PbI
5?Q8^u$T
5$qC6'
'5>>;RAk
5t5B$.
5tU`LP%
-5uy&~H
5\]wat
5xjR-_LS
5<zyV`$
&=60bj*OS1
6/?1>8
[65=JR
65o.6E
*65U`M
&&&&6666????
666eHHH
68~H":QP=
[69He52q)
6bad allocation
6cf#*u
6)FGD]
6@f ('i
6FW.tq
6I28q%
6I@8Ge
}/6ImageList_DragEnter
6J(|^K
6m*8S1
%	6!mD1
?6n9:W
}!6Na6g
6O@EX.
6P!5>=
;6qT8}
6Qv |.
6s}J"`mpS
6t2aYO
'6(w5[
6xb:$>
"6xpH#
6Yq~;MCN%`&
6yt7Tw 
$6%z2m
70<aUv
724=Vn
72KiSEk
75%W!Z
7777mmmm
7)7FZ9
7!~%?9
:79?Jrq&:
7 aGkP^O#
`.7cf$%'
7;CP_,
}'7EJJ
7eUt~[
7gB=ZV
7GetFileAttributesA
7GetProfileStringA
7GlobalHandle
 7H"!0
7H `p(
7hzKAg
7I[{j?
7ImageList_DragLeave
"7JaU}-Z
7j%~Rn
&.$7$KS
;7	*LR
7(lv}7Xj}j
7`mB>=
7?Mscx
7Nb[0C
7o:0`0
7PF7eO"
>7QUpdateWindow
7rz]5p
7Sleep
7sn"^o
7`t1ue
7TOmJ1,L
7$/_TR
}(]7u}1w
= *7Um~
7U]'>nj
7"vV* 
7wwr:o
?7xIg<
*7y_M?
:7YV@%
7z=L%vx
80[TCX
84qCvQv@
%\84ZI
86/*b!
*<8BJo
8<Eo,&
8(FKQz
8Fm6M1
8F.r8B
@`<8|=k
8KH59Q	
8K-mbT
>8%L5B1
'8L+OSS
8M>2aL
8`M2By
#_8MTb
8nE!u`
]8Nm9L-
8=p$a7Z
8^QFZs
8/R	[A
8{^<Rn
8t!bO[
8V@h&M%
-8VW:7=
8w5:^|
8X6*?mB?
8Zg1&Xy
:++9^@
#9 ]_\
,{+91qy
9+4sir)/8
95(tu*
9653Nn
='9-6d
9:7v#Z
98~]# 
9999JJJJLLLLXXXX
99rKJJ
9FHq:h
9	Ft>X<
9GetWindowTextA
9Hr	KG
9H=V(#
9IsBadCodePtr
9L		3dP6
9lj$m;
9m(xi	q
9Nh XP|\:
$9)?Nk
\9@nnW
-|9N:!Q
9op2Ly
9OpenPrinterA
9,!!P8
9s5[p&
9%^>[V&
>9Vk'C
|9vO\d|W^RK
9z.P]8
"""a^^_
a+0"\u
A*+3 ?^
a+`3\uI
a^52,*
A	5>~2_Ak
a5e@x@
a5j_5W
a6*8]?
%?a6d4
a8C)3Cl
<A9>dz
aaaa5555WWWW
AAAAOOOOgggg
aaj_55
~}a{B#
a=cD#p
,aClv?v[
){a!cU9
_adjust_fdiv
AdjustWindowRectEx
a+D!\ui
advapi32.dll
ADVAPI32.dll
aE_c- 
A:Ensy
a,e;+V
-af6#`
#AfH:2Z&
}aF/w$P
AGetFileSize
///AGGG
% AgJE
<Ah]j0z
A{I:iW
AIK&2a
\aIQb[
ajRWbr(6>
,AJ'W"
)aK<^*
*@+{AK
A!kW	H
a+l-\u
{)am3|gr<S:K
amidiOutUnprepareHeader
^~AMv9
#AnXn*H
AO(]+8
aO_XN)
$ AP=<*
aP3+.0
A=Pes]
a=pIiIx
AppendMenuA
>aQsCG
ArG;S-
a;`	rMJ
aS9.O(>_$
A\saD'
A(,Som
ATL.DLL
/aUgCA6Kn
Au_|#u
A,<V|{ww
+_A?]w
a+W0\u
awiv=q
AwjIsWindow
AwWK-D
AwX<J[
Ax;[p9
aY\7y'
!]A)yQ
	aZv#HH
b`/1KG
:(B*2)
B_4;UB
?b7h?S
{}b88X
;B8,b"
[B8w#]
B9@"/5
bad allocation
Bb6u`[
BBBBhhhhAAAA
bblDOP\*l_$X,
BBl_mk
Bb]RSO
Bc!! 0
BcK4:aQL
[Bc.L"
b+}c$Nf
bCreateMenu
;-;`Bd
BeginPaint
BeginPath
b	eH#o
^	beLq
Bf7uEi
bFgNk<
b>`FI_J c
BFqAD+
]B%FrO
B&$ftbIJ
:b$ftd?@
bg4:HF
bg6so|
BGetEnvironmentVariableA
bGetOEMCP
b(>Gf[
{b}G|N
BHr R3r
+Bhw;i
_Bhw,r
@bH "x
"Bi7}]
biJnt\
b(<@&Iq
BitBlt
	bJ|bE
#^b#=K
B>KRLCHYz
BleaRP
+Bm>)1
.b;m.p$i
 * Bmu/
$bnJp1~
/B^	[O
.b\r1f:
+BR=i~
bS11*?
*]bu^d
+BU@u{K
bvuv,Z	h
%+BVyS
B(W$g{
/-\bX8
B*%XV~A
By/1p5tn
B#~y>PT
By?=XK
bY&y|j
B"yzCh
bZ~S]V
'>%c	#
=%C$^!
_C[%}(
C1<'-x
C2$my~
#c 3?'
c3|}ds
c'3@Tgb_
]c4JtW
c4l{$z
C77nYmm
c='A'#
Ca)/4L
#c}>A67
CallNextHookEx
CallWindowProcA
cAo4$I
*^cA/s
CB}82.
cBd1EJ,
Cc0^`4
CCCCDDDD
CCCCMMMM3333
ccccUUUU!!!!
cccc||||wwww{{{{
CDpU61
CEN37}+
}C{$fh
{CFlushInstructionCache
};CfQI
C};G9f
cgEv~o/li
CG&G]gZv#
`cg)ou
c^H\al
CharNextA
CharUpperA
CheckMenuItem
CheckRemoteDebuggerPresent
ChildWindowFromPointEx
ChooseColorA
CIR7;$
c-jODF
c[K&n-
;ClientToScreen
CloseClipboard
CloseHandle
ClosePrinter
clr.dll
CLSIDFromProgID
CLSIDFromString
`;clSPjB
;C:LV9
/c%:M!!
CMeB`i
+C{'mG
	c~@MsJ
<C-MYEq
CnG	g{
cN":Oq
CO@4"h(
CoDisconnectObject
CoFreeUnusedLibraries
COMCTL32.dll
comdlg32.dll
CompareStringA
CompareStringW
CopyAcceleratorTableA
CopyFileA
CopyRect
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CpSY9a
CpW;aD
}CqJDyp
[cQkch
cQ~Y:C#
;;{c;Qz^pE>
CreateAcceleratorTableA
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateDCA
CreateDialogIndirectParamA
CreateDIBitmap
CreateEllipticRgn
CreateEllipticRgnIndirect
]CreateFileA
CreateFileMappingW
CreateFileW
CreateFontA
CreateFontIndirectA
CreateIconFromResource
CreateIconFromResourceEx
CreateILockBytesOnHGlobal
CreatePalette
CreatePen
CreatePolygonRgn
CreatePopupMenu
CreateProcessA
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSemaphoreA
CreateSolidBrush
CreateThread
CreateWindowExA
CrFDMk
	CsP(pm
cs;S7UV
c[.tFW&=
CU+ut){
C( !UX
/c?#+V
+(cVW3
 &cW-M
c\'x~D]
C^(X<g
?	_CxNB1
cyP&a8.
C.#z_$
CZNF.a-
CZQAP)
 '@cZy
d$ </`
d	0?Q1
d0uvk(
d1$WB9
D458Bx
D$4`fI
,d4	kt}
#D 7c5!
D7CreateCompatibleDC
D8|e{8x
d$$9\$
D; 9NN{
d$ 9pT
d$ 9Z4
d){af(
d$,<AfR
DA**U|
DbgBreakPoint
DbgUiRemoteBreakin
DbgUserBreakPoint
^DCoGetClassObject
dDc"n_
~~~~====dddd]]]]
d\D=jh
()}dE[
DefWindowProcA
DeleteCriticalSection
DeleteDC
DeleteFileA
DeleteFileW
DeleteMenu
DeleteObject
de$.o&o
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DeviceIoControl
?dF80X$
d$(fIf
d$ @fPf
""Df**T~
"Df"*T~*
Df""T~**;
D$!fUf
*-d~G`}
D{&-`G
\;d<GG33g
d# g|R
DgtdEA
+Dh{P"Z
DHSn?T
:di6y]
diasymreader.dll
DispatchMessageA
D~]I@U1
dI@`#WN
dJG)e:
\DJVLV
d?KCk7
d|kdJdi
dKHG_^
dlKcn?
__dllonexit
dls/ABC
DocumentPropertiesA
d]Omr*
$d:@P3Z
DP9io(94>
dp	KN'O
DPtoLP
!-)DQJ
dQLCbM[O
D;QzCM
DragAcceptFiles
DragFinish
DragQueryFileA
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawStateA
DrawTextA
d"~ReS
.drHf{
;DR/J9
d{s=	.
{dSetScrollRange
d$ tpu
d	U!Fz
DuplicateHandle
dV22tN::
Dv__9'
dVNvB6
 ;{Dvq
#,?Dw+
D/w^1&u=
D|wash
d$ WfV
d$`WfWfSfS
D?x?1h
%d?X4h
dx};{;7
`d!X'?98
dx.:b,
dx t	=
DxX\|-\&
DX~zik
&D; ?y
+D`@<yRtC6
@D(y;WV
'DZ$a:_|&
`[&(e[
&[!)/e
E1[UY"
E(1vhF
|E"2 8
>[(e)3
 e3/<j
e3+W=*v
e3@zo:5tUq
 e4?DV}
%E4E62
~e4qZV
E_4X :
E6[*2/
*(	E,8
eagx|[
eAKzqL
|eAl:K
?E'Baa
#Eb`Ez
;,eBqR
e+c#1x
}e=d1!
+ED()b
E(D@@%d
E!dieb6\Zf
&e$Do1
e?e;6F
]]]]eeee
eeeezzzz
E%E"qAYn
'<EF-}n8
eFzOlV
eG8bYi
eG91Y%
EGfY8bg
e,g>N=8
EgX%s$
Eh9D@R$Z
;eh`H%
E\i~N2	
Ej`NJ0:o
e;kOzB
eKYX-0V0
eK^zz$4
e	ll% 
Ellipse
EM"#OR
EmptyClipboard
	e?MQ]%
eMRY7F 
En7dj;
EnableMenuItem
EnableWindow
EndDialog
EndDoc
EndPage
EndPaint
EndPath
/Endt-
eN(fKJx
e[N>J$
EnterCriticalSection
EnumChildWindows
EnumThreadWindows
/!eo$B
_E`pL~&
E{"%&Q
'_eQD"
eQ$PqA
EqualRect
'=ErnX
Erp}	'p^B
erv*g}b
#E	Sa	=6
Escape
&ESX]e
E*t.e;
et[%N.
ETT$Wm
EU0^">
E$uC8[TH
E{{Ucf
euJy/6
eUswfs\
eUWWy)+,
e~Uzcc,
e}VdMo M
E:*^vs6 
^Ew;bK
_except_handler3
ExcludeClipRect
ExitProcess
ExtSelectClipRgn
ExtTextOutA
E<	yRTY
Ez9TMHA
EZBzE:
+@eZJ[G
e$(Zm0
+E	)^zt{
f<1C	#
f31PW2
^f[3q_
F5C'Z^
f5/y#oFL v
F>6f~f
F7M1ohk
F-8dL\
F8Et}?
}&f@9?
f_A3+S
fA{D:]
=faNn[ab
fC|2}9
FCU}#g"
-:F~Cv@
F&D4	^wa1
f""D~**T
`FEKcWD
ffff((((
ffffHHHH
FFFFWWWW
F	FpxP
fGetVersion
FGk7zgs
;f|]hc
fh;"L?
,%FhN:
fHR4hx
F,hU8S
fhY$HFX
F<!i#]
f%{I`A
FileTimeToLocalFileTime
(FileTimeToSystemTime
FillRgn
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FindWindowA
FindWindowExA
FIU	NP_
Fj5+5d.
fjDe[4
fjt3_p
}FK<kK|
&*f[kv
FlushFileBuffers
f>l$;w^
Fm#,hQb
Fm<VdS
 $FNTT
fo[5CH*
Foi{hu
~FOL$2
&F|'op
FormatMessageA
	@fow9`8
fP.5fRf
fP`fRf
.Fp.|g
f{PH9#
FPMfJNg}
[^f_)PO
f^pU8@+
FPy)Q7
fQVe{#
FrameRect
FreeEnvironmentStringsA
FreeLibrary
)FreeLibrary
f?Rxkvu
>'{,f.s*
fSt^|M
_f	T^3
fu3Mz=v
f!~}Vu
fw;[0k
f\!X^#2
>f(yey
Fyky3o
f-z_cF
"g"":]
G2:PeekMessageA
g39/08
G3W\uq^A
G59VgS
 G|7md
G9{RO,
GA8Vn~
gaj\~L5	 
GAS	Vf
+GbAiL
@gBjC&
`gb*kB.ej
G{Bur6yr
g[bWsh
}gc#jB
gcV)H(
$|gDHztnU
GDI32.dll
Gd'ms/
GetACP
GetActiveWindow
GetAdaptersInfo
GetBkColor
GetBkMode
GetCapture
GetClassInfoA
GetClassLongA
GetClassNameA
GetClientRect
GetClipBox
GetClipRgn
GetCommandLineA
GetCPInfo
GetCurrentObject
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetCursor
GetCursorPos
"GetDC
GetDesktopWindow
GetDeviceCaps
GetDIBits
GetDlgCtrlID
GetDlgItem
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeThread
GetFileSize
GetFileTime
/GetFileTitleA
GetFileType
GetForegroundWindow
GetFullPathNameA
GetKeyState
GetLastActivePopup
GetLastError
GetLocalTime
GetLogicalDriveStringsW
GetMapMode
GetMappedFileNameW
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMenuStringA
GetMessageA
GetMessagePos
GetMessageTime
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetNextDlgGroupItem
GetNextDlgTabItem
GetObjectA
GetOEMCP
GetOpenFileNameA
GetParent
GetPixel
GetPolyFillMode
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetProcessVersion
GetPropA
GetROP2
GetSaveFileNameA
GetScrollPos
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStockObject
GetStretchBltMode
GetStringTypeA
GetStringTypeW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemDefaultLangID
GetSystemDirectoryW
GetSystemMenu
GetSystemMetrics
GetSystemPaletteEntries
GetSystemTime
GetTabbedTextExtentA
GetTempFileNameW
GetTempPathW
GetTextExtentPoint32A
GetTextMetricsA
GetThreadContext
GetThreadLocale
GetTickCount
`GetTimeZoneInformation
GetTopWindow
#GetUserDefaultLCID
GetVersionExA
GetViewportExtEx
GetViewportOrgEx
GetVolumeInformationA
GetWindow
GetWindowDC
GetWindowExtEx
GetWindowLongA
GetWindowOrgEx
GetWindowPlacement
GetWindowRect
GetWindowTextLengthA
GetWindowThreadProcessId
GFa`[]
[Gg2?n\9R`
gggg++++
ggV}++
gI;3['
Gi7(D!9%
G|IQWq/
)#+GJ)	
GJDal1+8
G#K7?68
Gl$bW*
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
gLS(FC
GmG3_\
G>=Mhq
}gM}QV
G^^o1B
GP@__3
{^GQez
gqH&)	
)GQS<!
$=gr9|N'
GradientFill
GrayStringA
G&r!JX:
G+r`#R
?_{gR&y
gS~(%*
gT^Azs
gThxde
G-toH&
g=U;AP
\g)u:CM
G%Ue.C
GU`iKg
g<`uO`\m
!Gv#0e8
gv4L/3
Gv8:KoR
gV}<B'A
&Gv;yI
GWININET.dll
G^?w:Q
g'w_(;y
 gX5j!
G&X!k`C
>Gx#p'
GyZ*<#
;h_`$'
h1G#3	\U
h3uobjG
>&/h4;
H4"P(>
h	(5DQ
#h 5W3
h6n'-&
h7IRf!
}h#??8i
`=h:9T.
HA	BJ|a
HAI`)Js?
\haoPY
HARDWARE\DESCRIPTION\System
HARDWARE\DESCRIPTION\System\BIOS
Ha%tkj
hb`O	Y
H-DT]	c
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
/^;h'<&f
`h>FS{
hFvB V*
HGiR=r
h@H tag_
hid.dll
hI>oFl+
#(h$<$ iRvB4
hIvp2f
Hj6`>HP_
hjMYIG
@HK[Q	
hKy!&j;
$$Hl\\
hl\b[CDo
Hl$S)O
]>hL;y0
Hm)E-U%PZ
!H}Mwc+
hNeVd9
H|Nivj
hnl]3j
hO;3['
=!hoW)
hOz<b(~P]f
+HpXhE
HQij}S
(hqNM%
H_"Qpn
HR6sj,
HS*cEU}
HSCrV*
|hSfRp.
:Hs'Xa
Ht_hX40.
h)\TO}
h)t_q%T
HttpOpenRequestA
HttpQueryInfoA
-HttpSendRequestA
HuF?JRz
hV2MUn
!hVpgC$F&
Hv(%s3a
h{]"}w
,h~xp}
Hz`mh|X
Hzw_.`
i0Em%1
I1E[xd
!i1xdA
i/3X8e
^]I 5$
I7nWM6
(I86Tp=
\i8K}@[H
i9;8y!f
i_$[a&5
IAa52;
 }IAM%xu
ia=&S#
i	a[tF
I>b0~/X
$i*b80
I\b^{nwN
i`b>v,
icm$p.
IcQv~ez
IcVJ',
.idata
	iE|9<5
I]E9#t
iEZ,'.
\I @FN
-ig5>Kx
i&g"UP
iHmlQD
IH	@*@p
i=HS_#
IIIImmmm
iJ|]+c0
Ij]lY|3s
I@jrKV
/I|JYPU
Ik5tVh
IKM7:::
\iL1<'
)`IlBi
ImageList_Add
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawIndirect
ImageList_Duplicate
ImageList_EndDrag
%)ImageList_GetIcon
ImageList_GetImageCount
ImageList_Read
ImageList_SetBkColor
InflateRect
InitializeCriticalSection
_initterm
->;InPB:b."
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
InternetCanonicalizeUrlA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetSetOptionA
IntersectRect
InvalidateRect
i&oZ-x
*/ipAM
iphlpapi.dll
IPHLPAPI.DLL
IPT|#F(
IpX-g"
[Iq	o8
^IrEBTV
IrvNwL=
iRy	 r
IsBadReadPtr
IsBadWritePtr
%IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowVisible
IsWow64Process
IsZoomed
(it0y9
it"v7s
	iV|Tk4M
IVw|`h
I{WxYd
IYj8@n6
iY%uV:
+IZq-"
iZrJr>
IZW' )
j0D?.>
J2{l)Q
j~@3Y$
j$3=ZVy
J5DFFW
j5k-'~B$n
J9"F<Q
Ja78}cw
Ja',lG
 j?b3D(
_jbF~T
JC7G%j7
JDa' ^
J#DR,.
J|dS19
jel_"B
j{eNR8
JEnumDisplaySettingsA
jf-l+s
Jh2O'x
JHVBr+
J<i,<0
_Jj2=[{
jJ@B}#
[[[[jjjj
,j\jWW
+jk$"%
j%kGR^
j,kO7fJ=
jl:3k"
jlK"?1
jL;`kg
=j&&LZ66lA??~
JMSIMG32.dll
jnQ,8o
JNTNDe
%%Jo..\r
jO=T6K
jpa4(z
J~P'L]
?j-P;R
jQ=5])
j@r_lN
J<Rr?#
J-S`==
jSetCursorPos
JSetWindowLongA
JsMj1*
JS>U$,
](~jt4
JTP}oy
/jt'YS
J>t^ztk
JUaP`y
JUd}Vn
?juwfE
,	jvs<*
jv#YL/
`'.j[w
J?:$W)
J?w=r5%/$
JXk293
jXL3[:
%K@.1VtqoEq\
K2N6 W\
k(&+6*
?@/#K|!'_9
k9VGk4R
_K{[AV
~kAX-C
k[,	b!
KbTmOA
k"C\B7
kcJ8VGuo
kCR}or*
[kCUa3^
K$D+l6
K@E\AF
kernel32.dll
KERNEL32.dll
KernelBase.dll
K;FCqx
K/fD!]
kfN<BP
k)FPBn
-](K"F:x[
/KG<5e&1
kG#+,e`p
kGetScrollInfo
)kgo!o
@%KGX,
K>h2Jek
kh4Ur{
kHPCB8'|
KillTimer
kjCSf$
:[kjUawM
kKb)(x{
,k(K\#h;
kkkk::::
kkkkoooo
kk!|w"J
Kl\[ixS
[&K>M%{
KMb3=l
kM(]TU
KmY^7^
kOleUninitialize
;'Kp/@929g
k(PQ7R
)\kpzz
kQo+F":
KQ,)[U=
Kr`6*l`$
K$r[l}k
\Ks_	Dbw
?K&SnN
KTdH7k
KV`t%J=
KVY<fkW4
K>Y_(ck
k%zJ(j
$kzXr 
$\ l\?
)l_0G@-
_l0:mD
L0:%xq
l3	}3?
]L{4{\
l	4gHV)xoJ
$l	4[t
*l5[tD
l*}(7Ot
l9KU@7
la>pZf
l+_b*1d
>Lb"qM
L~Ce#.
L.c){\M
LCMapStringA
LCMapStringW
LeaveCriticalSection
L_F/645
lg0da)
LGetClipboardData
LGlobalFindAtomA
lGn_;]
L>{|guk
Lh3">d
lHH*Vl
LI.k{W+
LineTo
&&Lj66lZ??~A
&Lj&6lZ6?~A?
Lj&&lZ66~A??
ljP)?D
#lj\*tk
L\@LCT
llGWuM
llllppppHHHHPPPP
llllVVVV
L> !luk
LM`arw{=
)^=LM+E
='Ln/>
l$N>6H
L>n*R7CV
L>N:Xuk
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LoadStringA
LocalAlloc
LocalFree
]LocalReAlloc
LockFile
LockResource
$lOQa!
|LO<?r
LO"ZIK
[Lpg!a
	lPtC4Q
LPtoDP
L>Q]{uk
lQU_tNGetModuleFileNameA
	~l$,r<
lrilWD
l rQ\:X
lScaleViewportExtEx
lsK7U|
lStH(\
>lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenW
l$T#l$
l<U	\K
L,wC+`
LW	cmw
\#l%xmT#)z
lY\h+U
lZ0=iCD
LZBL`c
Lzo2#,e
L#'z/u
%>	!;M
m0c~j)
m0gR~b
:M&0mud
M1=+O}
m5GOoB
M5RuWn?]
(M8Qt640
M9Fj{M
m9?{N~
M[A0.K
M>a[`B4,T 
-{Mabkj$
m_ A<f
malloc
MapDialogRect
MapViewOfFile
MapViewOfFileEx
MapWindowPoints
mbB`V9
m%Bqti
MC9J6"r
MCIz\}d
+MdyOy
memcpy
=(MeN7F9>H
MessageBeep
MessageBoxA
MessageBoxW
[<m|f#9@+
Mfr^>J3
M }Fw^
=MGA^ND
M+( $h
Mh$q,QD2
Mi<\2'
midiOutReset
midiStreamClose
}midiStreamOpen
midiStreamOut
midiStreamProperty
midiStreamStop
}mIQ;=
MJ3^[-
mJBB	ME
mjTfIy
MK3^(U
/MKFTi
mKqlFH8/
m;KU8>
.>ML`\
Ml9.9^c
	'MlI=I
M>\L+vk
MMfU33
;;;;MMMM
&M,=ng
mO7+ri
ModifyMenuA
`MoNXS
MoveToEx
MoveWindow
Mpl+|6
mq(7bV
mqNeV'l>
^m$}qST
M~;R,\}
/M]r-9-
mscoree.dll
mscoreei.dll
mscorsvr.dll
mscorwks.dll
ms=&@H
MSIMG32.dll
MSVBVM60.DLL
MSVCRT.dll
:mT+<"
>mT'3>'
m`u7P"
Mu{k!p>
MulDiv
MultiByteToWideChar
mVflKB
m{VJ-9H'@$
m#Vv_u
M?W&awS
m=WoQe
mx/#k$]Cx
mx?]	XQJ
)mxXxz
!]mY6/F
m<yP)`
;M{yw&
MZ10584
_M@zZt="*
-<@>N 
{"N	,.
N,_{;=
\_N1R$n{
N]2	j^
'N2W:a
n5'mhW
n6Zr-a
&N95)gJA
n9c?V_C
N9?		L
}N_9ti
NA>)139
natAY-4!
@nB @s{
n C1E>_
)nCMxq@Yy
-nC}U2
=NCue0
NCx0?+
~nd6{X
nEP^2]g{	
nev.QGi0Z
Nf2L'1,
NF2;uRi=
.nfKd0
NG8D6j
ngmu,;
NH]bY;,
N\iOQ-
[nj>3~
%)&N~j@f
njkaCK2
N]jsgbfuz
N+Kj!<
N-*#L[
:nmb4|s	LTw
nmTpiq
/[nnI]
nnnnGGGG
nnnnZZZZ
n;O66v
|"<NOb
N\@|/P
(+&npA7
nPostThreadMessageA
N#rsbm*
[ns&6:
NS%>8A
ntdll.dll
^NtE;]7
NtQueryInformationThread
NtSetInformationThread
nTV_!	
;+N/U6
?Nudy1
N_Uo_Df
n}<|up
NuQBx:0E
nVg#[j
=nWanz
n+Wblk
_nW$w9
nw}y^1
%n`!;X
Nx[1\^v5!=
[}nzSF
~NZT)IT
nZ$Ypv
}-~?;o
o1<3"6
o3+_htY-
	`O	3pi
#o;`4F
O4oEo4R1
[@o6\:%
O#)/>6
/~O6vB
o|'<^7
O7^2"cs
:O7aVR
O7pySQ|<]Om
o+8F&0
!O ;9L
^,o9Y9
o:a~*,
^}Oa36
Oac-Gk:
o;B&d-
=oCmPs
oC	?tE
od#=Ax
odS^em
OE})h7n4
oeh/yoG`
oF2?pQH
OffsetRect
OffsetViewportOrgEx
]O\%go37
o?=H:=1
oH=d>0*
!o!HqzI
oI}n9;\
oiY{)zE
o%%Jr..\$
OJsAwV
`O^.K{
O*:?K@
O{kM+v
\ol->E( #
ole32.dll
OLEAUT32.dll
oledlg.dll
OleFlushClipboard
OleInitialize
OleIsCurrentClipboard
o#@L"Id
OlstrlenA
OM~K3]
_onexit
+~<OnY
*oNZZ%
{&Oo6`
oo~~eeR
OpenClipboard
_OpenClipboard
OpenProcess
OpenThread
oppdfI
+oq{]c
|Oqj \
!O|q\.s
ORwQ5L
ot+}c-
oUCreateToolhelp32Snapshot
o'uG[^
o,~uw+
:!|oV|
O'@V">_	
{OV6DiKI
O$v\aC
o~VM42^U`
oW1//p
[OW"kF
/OWMjk
oW?ws(c
Ox1*FY~
%o%xg(
oXor!y
o\x{?y
oY619D
O}`Y(k
OyMf<e
Oy\X#O
|+_Oz~
	-.]p'
P0{ctw
p1K/UA<
*p3nf'
{<P47ct
p@@5#C
P\'5p8
&.P|6M
p!#)8AH
`,P9WW
PA23^`
p.a{hX-
PatBlt
PathToRegion
P:.^~B
,PB0	?
`p]\bi
pBq"o&
|+"<PC
%pc7t9
p?_-c8
PC)eX-3e
P%\ c+J
PCreatePenIndirect
PCVLS?/
P>e>MI
Pft+9/75
>pG~1Y_c
,PgQ2#F
PI[nS&
p`J=nE
}pjP}#<
p*_:^k
;PKc	T
pKE~g1
PKJVA_
pK?K~4
PK}.W5
pKWOwC
'p~l~{
\pL?8N
p+lB)7
p`L'f)
p\lHtW
pM>BAeuk
pm}Lpby^I
pmOX-W
PmRM4MC
(pn/		
p<NE/w
P	NKg#
PostMessageA
PostQuitMessage
$%:PP>-9
pp|B>>q
pPJ1;"=A
pppp>>>>
PPPP<<<<
PPxD<<%
|:p*+q
PQaoiH
Pr9VH@
Process32First
Process32Next
proggam
`pS1}0
PS-3)X
P*s^:6k{Bo.
PSAPI.DLL
/=Psc:
PtInRect
p#tTGI
PtVisible
pubK/@
pU'dk{
p[UY*B
>`pVCR|
.[PV^d
@PVe/N
,pxAy0
P-y&E\
p=YYYW
Pz6g.G
}_pzPK
{	q]!'
:]<]q0h
;Q]4?C
q5[C<;
q'5-U!
.Q5zMa
qa0Vp^
qa3fN%
QaauM 
qb4?LG
="Qb]9
QBkcv|k
|.qbw/
QcoXc*P
%Qc|	SKj
Q}]D/5
Qd~reC%
Q<E8TbN
QF%6-W
;q+F B
=qG^cJ&
Q)?g~p
"Q)%(h
q>>hhV-
qI_23%
Q|I$?[5
qIX=(}
|	QIxE/
 Qki=,l
Ql,A%T
q.ll1h
qmidiStreamRestart
q^P?25HI
QPeA~S
____````QQQQ
 	}/QR~8
]Q Rectangle
QRt~_VF\nR
QS6t$K
)qT:A#|7;
qtajeR~
q!Trlml
QueryDosDeviceW
+\QV	e
\`qW_,Qa
QW]Z>G
q=y3@BN
Qz1=<W99B
QZ5n`f
}{))R>
.r?1in
R>~2h	B;
r2(%`x(
'?R3E>
R~ 5>6
R5"'mtR
r6>gnYY
|r6ou9J
r6tH(g
r(6.V"
!R7DUh
r7 pNLS
^r)8M\
R8=V){aK
:r 9hZ
R9m.uf
>R9%r C
r`.a-?
&r?A}/
RaiseException
^~rA,rl
RASAPI32.dll
RasEnumConnectionsA
RasEnumEntriesA
RasGetConnectStatusA
RasGetEntryDialParamsA
:RasHangUpA
r_AuJ"
"R\#B	%P
r}bU3>
R>C2/^
&rc+').U
RCzu:f
}rD	#	
r,$,d2
RDestroyWindow
r[#d^h
ReadFile
RealizePalette
RectVisible
RedrawWindow
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
RegOpenKeyExA
RegQueryValueA
RegQueryValueExA
RegSetValueExA
ReleaseCapture
ReleaseDC
(ReleaseSemaphore
RemovePropA
RestoreDC
ResumeThread
RF{2[T
RFillRect
rG9TUM~
	'r@H:
rhKO_@
][Rie=T
rI-@<V
RJfW3{7
rK|C:1U~
^r|kM9
R@lq+i
*R.Mi:
Rm%=k?D
rNJ.@>
)RntfW
RoundRect
'	}RPG
R_py"b
rq <=/
/r-~,Q
{RR5sJ2g
%%%%rrrr
RRRR;;;;
RRRR				jjjj
RRvM;;
R^S`%:
R.SdX4,
R\s=e'
R{s=IQ
RtlAllocateHeap
RtlFreeHeap
rTlsGetValue
RtlUnwind
{R<[TQ
RuiA":C
Ru?U9@
r{vG&7
RVs &r
)R?^W,
*R`w;I|
rwX\t1C>bS
rz)+\2
r\ZBAjPDr
-RZcQa
R@Z)tR7B
's..^:
%~\_;s
(+;]?S
-~s1R\
S1u*2W
S<+1*VW
?S)2J{
s/2VY/
s4YR|8
  .S5'
s8ou:I
s9cRG<
s9pxi=
`sa+7zu }
Safengine Shielden v2.1.3.0
SaveDC
`Sa'^w$
\S-AW\
S,BSsX
S}C4|K
ScaleWindowExtEx
S&{,cLk}
ScreenToClient
ScrollWindow
ScrollWindowEx
*"'s?d8
:SE\99
SECheckCountryID
SECheckExecTime
SECheckExpDate
SECheckHardwareID
SECheckLicenseFileW
SECheckProtection
SECheckTotalExecTime
.sedata
SEGetAppStatus
SEGetExecTimeLeft
SEGetExecTimeUsed
SEGetHardwareIDW
SEGetLicenseHash
SEGetLicenseTrialInfo
SEGetLicenseUserInfoW
SEGetNumDaysLeft
SEGetNumDaysUsed
SEGetNumExecLeft
SEGetNumExecUsed
SEGetProtectionDate
SEGetTotalExecTimeLeft
SEGetTotalExecTimeUsed
SelectClipRgn
SelectObject
SelectPalette
SendDlgItemMessageA
SendMessageA
SENotifyLicenseBanned
SEResetTrial
SESDKDummy.dll
SESetAppStatus
SESetExecTime
SESetNumExecUsed
SESetTotalExecTime
SetActiveWindow
SetBkColor
SetBkMode
SetCapture
SetClipboardData
SetCurrentDirectoryA
SetCursor
!SetEndOfFile
SetEnvironmentVariableA
@SetErrorMode
SetEvent
SetFilePointer
SetFocus
SetForegroundWindow
SetHandleCount
SetLastError
SetMapMode
SetMenu
SetMenuItemBitmaps
SetParent
SetPixel
SetPixelV
SetPolyFillMode
SetPropA
SetRect
SetRectEmpty
SetROP2
SetScrollInfo
SetScrollPos
SetStdHandle
SetStretchBltMode
SetTextColor
SetThreadAffinityMask
SetThreadContext
SetTimer
SetUnhandledExceptionFilter
SetViewportExtEx
SetViewportOrgEx
SetWindowContextHelpId
SetWindowOrgEx
SetWindowPos
SetWindowRgn
SetWindowsHookExA
s:F3QU
}\s;FA
sGetFocus
s{GWQ*lp
sGy@[i
sH@4})
SHELL32.dll
ShellExecuteA
Shell_NotifyIconA
ShowScrollBar
ShowWindow
)S(HQ3
{Si<=5
+s=jGl^
'SJ=qW
SJS)*t
{^S#Jy
&sKj1#
{Snd^>"s
s>NMz0k
&sNnw7q[
{(S*-?o
s*ocZr
SO^E=B
SOFTWARE\Classes\Interface\
So.JB5
S#,$OLE
S@P$G<q 
spvhTg
sQ>F^O
s{s.cxI
ssss````
S>s/YKJ
StartDocA
StartPage
/St{]c
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
>S@THi
S;tkdf*
strchr
StretchBlt
strncat
strncpy
sua<F]4Jp
s;udQm
SU]Fn)
SuspendThread
s{V6~V
svD35>
[SV>^I[;!
SvNq]%
s:W'EvK2
	Swy*=
S{XHG75
$SxxgIg
s&X zA
SystemBiosVersion
SystemManufacturer
SystemParametersInfoA
SystemTimeToFileTime
s)Z@7n
SZ]fQf
t://]--/
T'26W?
T28;5M
t2V[x/
t42vCT
T4\h#:
t4J>)t'
(&t59x
t5\=cw
T[$:.6
"|?t	69
T++9^@
T~[9@m?
TabbedTextOutA
tA?H%r
Tb.{D)
TbVy@0b
!T+}c,l
tc>u^y
!"]tcv2
TCvDI>A,*s
!}tdK0
TdMVkU@
tD*TFc
tD`UR&
?t%!DZ
TerminateProcess
TerminateThread
TextOutA
tf,3/m
tFHV{]
T$$fPS
T{FU9>0UWl%
t$$fUfU
T%^G4m
<t(gEf
TGetScrollRange
[]'tGi
]t(gzS#
^\T|H#
T$h@,gv
!This program cannot be run in DOS mode.
^<TIa~
%Tj{]6
t=j,A'
tjn}9>
tJY_vk
tKWOwC
t\lHBW
t~lh-R:
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
&t|)LZ
]t?m4~
]t@m4B
.t%"n~)
"TO\1P
TP\!4/:j
tP@ELq
#Tpkg6
TP$vZ7
TqI;r'
_TrackMouseEvent
TrackPopupMenu
TranslateAcceleratorA
TranslateCharsetInfo
TranslateMessage
TR%| Ri
t_/<S>
T+TJo%
tttt""""
TTTT{{{{
|Tu]de
T*]Um<
=tup^r<
|tVCh#
[T\VNa*
tv?rW@
T~VtBQP
tvUGSx
tvv|%,]
t]W :$
\^T<W7
t(:we)-
+TW	P@dw/g
]TwV-(0
tx<D>#
TXl&5#L
TX~;Rm
,/"tY*
t z-lK
U'{(,_
U1kg~S*
U	]1[n
u{$5tb
.U69j;
"|\:U&8
`u9+a?
U 9{a!
u>9N.<*zQ
u$9w_h
&+;U.A
	UAF~\
<U;%Ar
_UBiHoz
U[b@X|
uc>2x^
uc)r^v
ucUwb"V
UD(1+^[
,}%)ue
Uei7xN(
+	uePT
uE@	.V
[U:FOi@
UFs|-G
U-}g&,
#u%g,~di
.'Uh|k
uh==KpR
u:j!^(
u\[J"	
uj@h-l
uj&(yH
u%KaZ}U'
	UkH7I5)
-UkJS'<
Ulf*"d
ulvmi*
uMc67)
UnhandledExceptionFilter
u_n`hD
UnhookWindowsHookEx
;UnlockFile
UnmapViewOfFile
UnregisterClassA
UnregisterHotKey
\UN<'V=^
u+}]"O
UO47(#
Uo9<H"
uO+&`c
uof^]X
!U{Orf4e
u$pF8f
UPYCyc
UPzv:S
uQpH('$
URegisterHotKey
(UR=MxXr
&u[S2FxaW
*usAy1
user32.dll
USER32.dll
USetWindowExtEx
}uuImageList_GetImageInfo
UUPx((
U<Uul6M
uuuu				
UUUU((((
uV4c]<9$qpb
uYAqP	
U;@Y,~dN
<Uy	]j
&u]YmI
u`~`YZ
Uz\C/'O
 {-(v\
\_v<+`
v1lje'
V22dN::t
<)V[39
v3;%+S
V5[A%6
v5"abo&
v]	7O5s
v_7^xv
',v]8~
V.9]t\
~vA:*C.
+V){aK
ValidateRect
_&Vaqy
VA#y''
-%*vBg;
VBYkY$
@%v)C$
Vc4[b>
VCombineRgn
V&&cZz
!Vdh!g]
!!VdoE
Ve)=4@
vFreeEnvironmentStringsW
v/{Glz
vg]	rx$e
vhjF8N
*]V-IP
v|i$Qb
VirtualAlloc
#VirtualAlloc
VirtualFree
VirtualProtect
v&JC[Q
	vk2QBqd
>Vkb0 {
vkMFj,_
~v#KP7e
,v]K:v
v@K_y8
)<V;Lw_n
`V)m&gF
v+mg_m
=vMGWB-
VmidiOutPrepareHeader
`v;mQOE
%VNU>wT{
:v[<%O+
vob2!m
vp{0Q6
{VQ`pqy
	V?qU[ x1
Vr4cUEg
vR^6(V	h
 &v[r9
vrQWE[
_?$v;S
vVEa4l0Xag
vvvv[[[[
VVVV>>>>KKKK
v{	W5*=
VWdV)(q
Vw%W>f.~
v;x])(gU
+vX@ufU
V~y7/#	
v, Y"R
vyV{P<
(>V"@].@z
v\'z)Zf
w./<`;#
W09YUd
'|w0&c
<+W-1=
@ w|,2=,G
^W2~vh
W3.41!
W>3g:w}
W4_J_o
/W5ItL
W6/tD-
W7,gXa
W7$mh	
w8mr){af
?w]9S-
WaDi]%
WaitForInputIdle
WaitForMultipleObjects
WaitForSingleObject
W<AoMT
waveOutClose
waveOutGetNumDevs
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
W=BMrUf
-	%	wC
W-c8\m
w&C+bU
wCoRegisterMessageFilter
_wcsicmp
_wcsnicmp
wcsrchr
W;\+cy
wD6OiM
*we@Fi
wePX5;U
w'"$-F
wfl4WO5+,
(W(!F>`w7Y8|
;"W)(g
Wg%>JrF
*wGTyu
Wh(8c#P
W h?xJ	_=I
W\iCLU
WideCharToMultiByte
Wifvye
WindowFromDC
WindowFromPoint
WinExec
WinHelpA
WININET.dll
WINMM.dll
WINSPOOL.DRV
WI-V^["
w^J2j0
WjB!j-
~?[W.jP
wJUc?=<=
WJ-vP@
W~KHAn
w[M!Z:
=WNME<
	wo<+G
wo<JAR
`wpJyX2
wQmr){af
w)qrf[
w>RbQ.
WriteFile
WritePrivateProfileStringA
wRpm{A
\WS2_32.dll
WS2_32.dll
w+SaDb`
WSetWindowTextA
wsFV7`
wsprintfA
wsprintfW
|[]w!t
WTFJVr
WTlsSetValue
W!uxM\1 
W&+v%GT
W+\Vm.
WVtf8,
w	<w18
W;YYwsX
w^%Z6c
wZkwH"
W+Zz}:
}_ #_x
X.-^/)
X-0HH8
~+,x1PPp
x2AS@t
_X3\4&
x3y!5>;
(X5_3t
	x6nPfC@
X/6>qc
X7=lYkjE
X\\9lM
{X-bjf
]xBm44
xB?;~p
{?x~BS
XCreateEventA
Xc=TD!
'xD8w@
XdKQ_ZU	5e
<x~d@U
x]fQ^g
xg8%Z,
Xgf7X@+
X,gy&4
'[X!#h
XiK4>}_;X
XIP2z@
XIsWindowEnabled
x%Jo%.\r.
:xJWOR
Xlf	hu
XL$o"6g
(<xM _~
}X'mGw
xNF]/~
`x!N(G\Q
xO_BdH7#
XoCbyz
x;}P4>
xP_At['
;XP`fS
<X-`=q
<X-q|E
xqnPi!/
x.]QNr
X/=R6O
xR^96SY
$!xRC&
X$R:jY'
xRLs2w\
xS 1j'
xSy>Ki
Xt,,4.
^xTCD-
X	tyVgU
xu#6)t
x^}!ul
x<UMmG	
Xu&W>%/e
X.vLY\
x(`-X"%
X:;`X)
X<xD&7g
xxJo%%\r..8$
X_|xM3R3l$
xxxx%%%%....
]xY?9M
\x+Z#_7&
/xZQ&/
)`Y_^`
y/1_Bo
"%Y34L
y3m,nq
":y3P,
y"4sNIb
y6yg32eU
'y7kAU
y7S#]8
y7=>(WE\
[ y8<k
)Y!8s}
Y`,=%9
Y(90SX
Y*~\9u
YA$2;z
YBbB _w#
yBTZf=
?y_^]c8
.~+yCd
\*YDyOU
|yEHg|
|`#Yg<
y'GetMenuCheckMarkDimensions
YI/+C%
yJEmsW
YJo\re{
)YJ}(*<w
yL4z M
)]~yM~
Ymt?-V
"Y(My_
y;N<*M/
yo3lr6G
@Yo!VD
]y @p7
&YP_$B
Y`P]Jln8&
{yQC3.V 
Y$qP|\
(%YQqT
-yR4T>
-}YUYH
y* ,WA
+^y(Xc"
YX+@\H
}#YX-s
yx%#y>47
yYaF)+
yyyy    
YYYY''''
YYYYGGGG
,y"\!z>
yz F@F
{Yzg0i
z0IayJ
z1ESSb
Z2i4VN
z3_2&/![j[r
;Z6luL
Z8(;+]
Z8/1(6
<]z[|~9
Z9];cr_
z/9k*I
z	~"aN
ZdK	z)
z`e,\9
z(|fDY
~zfMXL
~~zG==
Z)G#_B
~=zG=d
==zGdd
|>Z;H$B]
~ZH(bkN4
+[%ZJg
(z`!KA
ZKjDd)+yg&p
~}Z$KM
z?Ky{B
ZlBJHW
'zLnf>
zlw4Oi
Z	Lww3
"'Z)#M
z"}m6/H
ZN`7,cd
Z:NT}ik0g
zO*G"1H6
Zp6Y\L
ZQweZU
ZqyKpQ
~zR8R 
Zr{cFQ
?Z-t	K\q
Z	{ts(
+~Z@upD
:Z<'W\
ZwT0Y1
#zX!@}|J
Zy],MXB
zy(,Sp
ZZP^?c