HummerEngine.dll

Description: 腾讯QQ

Authors: Copyright (C) 1999-2023 Tencent. All Rights Reserved

Version: 9.7.17.29215

Architecture: 32-bit

Operating System: Windows NT

SHA256: 346e7c14f1c82591a017c678d69dbecc

File Size: 155.4 KB

Uploaded At: Dec. 2, 2025, 2:46 p.m.

Views: 11

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, OpenProcess

Exported Functions

  • AddDisableCloseHandle (Ordinal: 1, Address: 0x8352)
  • RemoveDisableCloseHandle (Ordinal: 2, Address: 0x8389)
  • RunQQHummerEngine (Ordinal: 3, Address: 0xcaf5)
  • SetDmpUin (Ordinal: 4, Address: 0x33ab)
  • SetSeparateFreeMonitorPoint (Ordinal: 5, Address: 0x728f)
  • UninitializeCom (Ordinal: 6, Address: 0xca9c)

Imported DLLs & Functions

ADVAPI32.dll
  • GetTraceEnableFlags (Address: 0x54e46028)
  • GetTraceEnableLevel (Address: 0x54e4602c)
  • GetTraceLoggerHandle (Address: 0x54e4600c)
  • GetUserNameW (Address: 0x54e46018)
  • RegCloseKey (Address: 0x54e46000)
  • RegCreateKeyExW (Address: 0x54e46014)
  • RegisterTraceGuidsW (Address: 0x54e46024)
  • RegOpenKeyExW (Address: 0x54e46004)
  • RegQueryValueExW (Address: 0x54e46008)
  • RegSetValueExW (Address: 0x54e46010)
  • TraceEvent (Address: 0x54e4601c)
  • UnregisterTraceGuids (Address: 0x54e46020)
AFBase.DLL
  • ?DecodeSCBootParam@ShortcutUtil@@YAJVCTXStringW@@@Z (Address: 0x54e46044)
  • ?GetEnablePreload@Misc@Util@@YAHXZ (Address: 0x54e4604c)
  • ?GetInstallDir@Dir@Util@@YA?AVCTXStringW@@XZ (Address: 0x54e46048)
  • ?GetSSOLoginInfo@SSOLogin@Util@@YAHPAVCTXStringW@@@Z (Address: 0x54e46034)
  • ?IsNeedRestore@TXUpdateCfg@@YAHXZ (Address: 0x54e46064)
  • ?IsNeedRestorePatch@TXUpdateCfg@@YAHXZ (Address: 0x54e46060)
  • ?MessageBoxW@Misc@Util@@YAHPAUIGFFrame@@VCTXStringW@@1H@Z (Address: 0x54e46050)
  • ?SetEnablePreload@Misc@Util@@YAXH@Z (Address: 0x54e4605c)
  • ?SetFirstStartQQ@Misc@Util@@YAXH@Z (Address: 0x54e46040)
  • ?SetPerfOPReportDataForWord@PerfDataReportUtil@@YAXKPA_WKH@Z (Address: 0x54e46054)
  • ?SetPerfReportData@PerfDataReport2DC@@YAXK_J@Z (Address: 0x54e4603c)
  • ?SetPerfReportDataForBool@PerfDataReportUtil@@YAXPA_WH@Z (Address: 0x54e46038)
  • ?SetPerfReportDataForWord@PerfDataReportUtil@@YAXPA_WKH@Z (Address: 0x54e46058)
api-ms-win-crt-convert-l1-1-0.dll
  • _wtoi (Address: 0x54e46644)
api-ms-win-crt-heap-l1-1-0.dll
  • _callnewh (Address: 0x54e46654)
  • free (Address: 0x54e4664c)
  • malloc (Address: 0x54e46650)
api-ms-win-crt-math-l1-1-0.dll
  • _except1 (Address: 0x54e4665c)
  • fabs (Address: 0x54e46660)
api-ms-win-crt-runtime-l1-1-0.dll
  • __p___argc (Address: 0x54e4666c)
  • __p___wargv (Address: 0x54e46668)
  • _cexit (Address: 0x54e46680)
  • _configure_narrow_argv (Address: 0x54e4667c)
  • _crt_atexit (Address: 0x54e4669c)
  • _execute_onexit_table (Address: 0x54e466a0)
  • _exit (Address: 0x54e46688)
  • _initialize_narrow_environment (Address: 0x54e4668c)
  • _initialize_onexit_table (Address: 0x54e46694)
  • _initterm (Address: 0x54e46678)
  • _initterm_e (Address: 0x54e46674)
  • _invalid_parameter_noinfo_noreturn (Address: 0x54e46690)
  • _register_onexit_function (Address: 0x54e46698)
  • _seh_filter_dll (Address: 0x54e46670)
  • exit (Address: 0x54e46684)
api-ms-win-crt-stdio-l1-1-0.dll
  • __acrt_iob_func (Address: 0x54e466ac)
  • __stdio_common_vfprintf (Address: 0x54e466b0)
  • __stdio_common_vfwprintf (Address: 0x54e466b8)
  • __stdio_common_vsnprintf_s (Address: 0x54e466bc)
  • __stdio_common_vsnwprintf_s (Address: 0x54e466a8)
  • __stdio_common_vswprintf_s (Address: 0x54e466c0)
  • _wfopen (Address: 0x54e466b4)
  • fflush (Address: 0x54e466c4)
api-ms-win-crt-string-l1-1-0.dll
  • _stricmp (Address: 0x54e466d0)
  • _wcsicmp (Address: 0x54e466f4)
  • isalnum (Address: 0x54e466e0)
  • strcmp (Address: 0x54e466e8)
  • strlen (Address: 0x54e466e4)
  • strncpy_s (Address: 0x54e466d8)
  • tolower (Address: 0x54e46700)
  • wcscat_s (Address: 0x54e466d4)
  • wcscmp (Address: 0x54e466fc)
  • wcscpy_s (Address: 0x54e466f0)
  • wcslen (Address: 0x54e466dc)
  • wcsncmp (Address: 0x54e466f8)
  • wcsncpy_s (Address: 0x54e466cc)
  • wcstok (Address: 0x54e466ec)
api-ms-win-crt-time-l1-1-0.dll
  • _time64 (Address: 0x54e46708)
api-ms-win-crt-utility-l1-1-0.dll
  • rand (Address: 0x54e46710)
  • srand (Address: 0x54e46714)
AppUtil.dll
  • ?GetCPUCores@Misc@Util@@YAKXZ (Address: 0x54e4606c)
  • ?GetCPUFrequency@Misc@Util@@YAKXZ (Address: 0x54e46070)
  • ?InitFlashVersionChecker@Misc@Util@@YAHXZ (Address: 0x54e46078)
  • ?IsSupoortTrim@Misc@Util@@YAH_W@Z (Address: 0x54e46074)
AsyncTask.dll
  • ??0Lock@AsyncTask@@QAE@XZ (Address: 0x54e460d4)
  • ??0MessageLoopForUI@AsyncTask@@QAE@XZ (Address: 0x54e46080)
  • ??0Thread@AsyncTask@@QAE@PBD@Z (Address: 0x54e4609c)
  • ??1Lock@AsyncTask@@QAE@XZ (Address: 0x54e460b0)
  • ??1MessageLoopForUI@AsyncTask@@UAE@XZ (Address: 0x54e46084)
  • ??1Thread@AsyncTask@@UAE@XZ (Address: 0x54e460a0)
  • ??4PendingTask@MessageLoop@AsyncTask@@QAEAAU012@$$QAU012@@Z (Address: 0x54e46090)
  • ??MPendingTask@MessageLoop@AsyncTask@@QBE_NABU012@@Z (Address: 0x54e46094)
  • ?Acquire@Lock@AsyncTask@@QAEXXZ (Address: 0x54e460ac)
  • ?AddObserver@MessageLoopForUI@AsyncTask@@QAEXPAVObserver@MessagePumpWin@2@@Z (Address: 0x54e460bc)
  • ?CleanUp@Thread@AsyncTask@@MAEXXZ (Address: 0x54e460cc)
  • ?CleanUpAfterMessageLoopDestruction@Thread@AsyncTask@@MAEXXZ (Address: 0x54e460e0)
  • ?DoDelayedWork@MessageLoop@AsyncTask@@MAE_NPAVTime@2@@Z (Address: 0x54e460c8)
  • ?DoIdleWork@MessageLoop@AsyncTask@@MAE_NXZ (Address: 0x54e4608c)
  • ?DoWork@MessageLoop@AsyncTask@@MAE_NXZ (Address: 0x54e460c4)
  • ?Init@Thread@AsyncTask@@MAEXXZ (Address: 0x54e460dc)
  • ?PostTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@@Z (Address: 0x54e46098)
  • ?Release@Lock@AsyncTask@@QAEXXZ (Address: 0x54e460a8)
  • ?ReloadWorkQueue@MessageLoop@AsyncTask@@IAEXXZ (Address: 0x54e46088)
  • ?Run@MessageLoopForUI@AsyncTask@@QAEXXZ (Address: 0x54e460d0)
  • ?Run@Thread@AsyncTask@@MAEXPAVMessageLoop@2@@Z (Address: 0x54e460a4)
  • ?SetWorkerFactory@MessageLoop@AsyncTask@@QAEXPAVWorkerFactory@12@@Z (Address: 0x54e460c0)
  • ?StartWithOptions@Thread@AsyncTask@@QAE_NABUOptions@12@@Z (Address: 0x54e460b4)
  • ?Stop@Thread@AsyncTask@@QAEXXZ (Address: 0x54e460b8)
  • ?ThreadMain@Thread@AsyncTask@@EAEXXZ (Address: 0x54e460d8)
COMCTL32.dll
  • InitCommonControlsEx (Address: 0x54e460e8)
Common.dll
  • (Address: 0x54e46130)
  • (Address: 0x54e46224)
  • ??0CFmtString@@QAE@XZ (Address: 0x54e4625c)
  • ??0CSafeHook@Misc@Util@@QAE@AAV?$vector@PAXV?$allocator@PAX@std@@@std@@@Z (Address: 0x54e4620c)
  • ??0CTXAutoSpinLock@Util@@QAE@AAVCTXSpinLock@1@@Z (Address: 0x54e461f4)
  • ??0CTXBSTR@@QAE@ABVCTXStringW@@@Z (Address: 0x54e46294)
  • ??0CTXBSTR@@QAE@PB_W@Z (Address: 0x54e462d4)
  • ??0CTXBSTR@@QAE@XZ (Address: 0x54e462a8)
  • ??0CTXSpinLock@Util@@QAE@XZ (Address: 0x54e461f0)
  • ??0CTXStringA@@QAE@ABV0@@Z (Address: 0x54e46298)
  • ??0CTXStringA@@QAE@PBDH@Z (Address: 0x54e46128)
  • ??0CTXStringA@@QAE@XZ (Address: 0x54e4629c)
  • ??0CTXStringW@@QAE@ABV0@@Z (Address: 0x54e46274)
  • ??0CTXStringW@@QAE@ABVCTXBSTR@@@Z (Address: 0x54e461c4)
  • ??0CTXStringW@@QAE@PA_W@Z (Address: 0x54e4626c)
  • ??0CTXStringW@@QAE@PB_W@Z (Address: 0x54e4624c)
  • ??0CTXStringW@@QAE@UtagUTF8@@PBDH@Z (Address: 0x54e46260)
  • ??0CTXStringW@@QAE@XZ (Address: 0x54e462bc)
  • ??1CFmtString@@QAE@XZ (Address: 0x54e46258)
  • ??1CSafeHook@Misc@Util@@QAE@XZ (Address: 0x54e46210)
  • ??1CTXAutoSpinLock@Util@@QAE@XZ (Address: 0x54e461f8)
  • ??1CTXBSTR@@QAE@XZ (Address: 0x54e462d0)
  • ??1CTXStringA@@QAE@XZ (Address: 0x54e462a0)
  • ??1CTXStringW@@QAE@XZ (Address: 0x54e46248)
  • ??4CTXStringW@@QAEAAV0@ABV0@@Z (Address: 0x54e462b4)
  • ??4CTXStringW@@QAEAAV0@PA_W@Z (Address: 0x54e462ac)
  • ??4CTXStringW@@QAEAAV0@PB_W@Z (Address: 0x54e46284)
  • ??8@YA_NABVCTXStringW@@PB_W@Z (Address: 0x54e46288)
  • ??ACTXStringA@@QBEDH@Z (Address: 0x54e46180)
  • ??BCTXBSTR@@QBEPA_WXZ (Address: 0x54e462cc)
  • ??BCTXStringA@@QBEPBDXZ (Address: 0x54e46134)
  • ??BCTXStringW@@QBEPB_WXZ (Address: 0x54e462dc)
  • ??H@YA?AVCTXStringW@@ABV0@_W@Z (Address: 0x54e461d8)
  • ??H@YA?AVCTXStringW@@ABV0@0@Z (Address: 0x54e46270)
  • ??H@YA?AVCTXStringW@@ABV0@PB_W@Z (Address: 0x54e46290)
  • ??H@YA?AVCTXStringW@@PB_WABV0@@Z (Address: 0x54e46264)
  • ??ICTXBSTR@@QAEPAPA_WXZ (Address: 0x54e462a4)
  • ??YCTXStringW@@QAEAAV0@PB_W@Z (Address: 0x54e46108)
  • ?AddExtraMem@TXBugReport@@YAHKI@Z (Address: 0x54e46154)
  • ?AddFmtString@TXStringBundle@@YAXABVCFmtString@@@Z (Address: 0x54e46168)
  • ?AddIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z (Address: 0x54e461b0)
  • ?AppendChar@CTXStringA@@QAEXD@Z (Address: 0x54e4618c)
  • ?AppendFormat@CTXStringW@@QAAXPB_WZZ (Address: 0x54e46208)
  • ?CheckVistaAndStartSelfMediumLevel@Sys@Util@@YAHXZ (Address: 0x54e46244)
  • ?ClearDeadQueue@Misc@Util@@YAXXZ (Address: 0x54e4623c)
  • ?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z (Address: 0x54e46124)
  • ?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z (Address: 0x54e46120)
  • ?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z (Address: 0x54e4615c)
  • ?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z (Address: 0x54e46190)
  • ?DoFormat@CFmtString@@QAEPB_WPB_W@Z (Address: 0x54e46250)
  • ?Empty@CTXStringA@@QAEXXZ (Address: 0x54e46188)
  • ?Encode16@Encode@Util@@YA?AVCTXStringW@@PBXI@Z (Address: 0x54e460f0)
  • ?Find@CTXStringW@@QBEH_WH@Z (Address: 0x54e4610c)
  • ?Find@CTXStringW@@QBEHPB_WH@Z (Address: 0x54e46268)
  • ?FlushLog@TXLog@@YAXXZ (Address: 0x54e461e8)
  • ?Format@CTXStringW@@QAAXPB_WZZ (Address: 0x54e46280)
  • ?FreeUnusedLibraries@Com@Util@@YGXXZ (Address: 0x54e46220)
  • ?GetBSTR@CTXStringW@@QBEPA_WXZ (Address: 0x54e4628c)
  • ?GetBuffer@CTXStringA@@QAEPADXZ (Address: 0x54e46278)
  • ?GetBuffer@CTXStringW@@QAEPA_WH@Z (Address: 0x54e46200)
  • ?GetBuffer@CTXStringW@@QAEPA_WXZ (Address: 0x54e4627c)
  • ?GetBugReportFlag@TXBugReport@@YAKXZ (Address: 0x54e4613c)
  • ?GetLCID@NLS@@YAKXZ (Address: 0x54e46148)
  • ?GetLength@CTXStringA@@QBEHXZ (Address: 0x54e460f4)
  • ?GetLength@CTXStringW@@QBEHXZ (Address: 0x54e46110)
  • ?GetLogicThreadLoop@Misc@Util@@YAPAVMessageLoop@AsyncTask@@XZ (Address: 0x54e460fc)
  • ?GetMainAndLogicThreadId@Misc@Util@@YAXAAK0@Z (Address: 0x54e461ec)
  • ?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z (Address: 0x54e46234)
  • ?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z (Address: 0x54e462d8)
  • ?GetSession@TXLog@@YAKXZ (Address: 0x54e46144)
  • ?GetString@CTXStringW@@QBEPB_WXZ (Address: 0x54e462c4)
  • ?InitArkHttp@HttpClientUtil@@SAHXZ (Address: 0x54e46178)
  • ?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z (Address: 0x54e46140)
  • ?InitNetwork@Network@Util@@YAHXZ (Address: 0x54e46174)
  • ?InitPlatform@CoreCenter@Util@@YAHPA_W@Z (Address: 0x54e46160)
  • ?InitPlatformCoreConfig@Boot@Util@@YAHXZ (Address: 0x54e462e0)
  • ?InitPlatformFileSystem@Boot@Util@@YAHXZ (Address: 0x54e4616c)
  • ?InitPlatformGFConfig@Boot@Util@@YAHXZ (Address: 0x54e46170)
  • ?InitPlatformI18NConfig@Boot@Util@@YAHXZ (Address: 0x54e46164)
  • ?IsEmpty@CTXStringA@@QBE_NXZ (Address: 0x54e46184)
  • ?IsEmpty@CTXStringW@@QBE_NXZ (Address: 0x54e462b8)
  • ?IsFileExist@FS@@YAHPB_W@Z (Address: 0x54e4612c)
  • ?IsInitAsyncMsgLoop@Misc@Util@@YAHXZ (Address: 0x54e460f8)
  • ?IsVista@Sys@Util@@YAHXZ (Address: 0x54e461b4)
  • ?Left@CTXStringW@@QBE?AV1@H@Z (Address: 0x54e46118)
  • ?LoadCustomCache@FS@Util@@YAHPB_W0AAK@Z (Address: 0x54e461dc)
  • ?LoadRDOCache@FS@Util@@YAHPB_WAAK@Z (Address: 0x54e461d4)
  • ?LogTaskCheckDead@Misc@Util@@YAHXZ (Address: 0x54e4619c)
  • ?LogTaskEnd@Misc@Util@@YAXK@Z (Address: 0x54e46104)
  • ?LogTaskStart@Misc@Util@@YAKPB_W@Z (Address: 0x54e46100)
  • ?Mid@CTXStringW@@QBE?AV1@H@Z (Address: 0x54e4611c)
  • ?NotifyIdle@TXTimer@@YAXXZ (Address: 0x54e461e0)
  • ?NotifyIdle@Window@Util@@YAJXZ (Address: 0x54e4621c)
  • ?OnExitCoreCenter@Misc@Util@@YAXXZ (Address: 0x54e461cc)
  • ?OnExitWinMain@Misc@Util@@YAXXZ (Address: 0x54e461d0)
  • ?OnUninitCom@Misc@Util@@YAXXZ (Address: 0x54e46238)
  • ?pfPreBugReport@TXBugReport@@3P6AXXZA (Address: 0x54e46150)
  • ?PropertyDWord@CFmtString@@QAEHPB_WK0@Z (Address: 0x54e461c0)
  • ?PropertyStr@CFmtString@@QAEHPB_W0@Z (Address: 0x54e46254)
  • ?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z (Address: 0x54e46228)
  • ?ReleaseBuffer@CTXStringW@@QAEXH@Z (Address: 0x54e46204)
  • ?RemoveFileSystem@FS@@YAHPB_W@Z (Address: 0x54e461bc)
  • ?Replace@CTXStringW@@QAEHPB_W0@Z (Address: 0x54e46194)
  • ?Resolve@HostResolve@Util@@YAJPA_WPAUITXHostResolverSink@@PAK@Z (Address: 0x54e461ac)
  • ?ReverseFind@CTXStringW@@QBEH_W@Z (Address: 0x54e46230)
  • ?SafeLoadLibrary@Sys@Util@@YAPAUHINSTANCE__@@PB_W@Z (Address: 0x54e462b0)
  • ?SafeLoadLibraryEx@Sys@Util@@YAPAUHINSTANCE__@@PB_WPAXK@Z (Address: 0x54e4622c)
  • ?SetBugReportFlag@TXBugReport@@YAHK@Z (Address: 0x54e46138)
  • ?SetIdleCallback@TXTimer@@YAHPAUITXIdleCallback@@I@Z (Address: 0x54e46158)
  • ?SetLogFileMd5Dir@TXBugReport@@YAHPB_W00@Z (Address: 0x54e4614c)
  • ?SetMainAndLogicMsgLoop@Misc@Util@@YAXPAVMessageLoopForUI@AsyncTask@@PAVMessageLoop@4@@Z (Address: 0x54e461a0)
  • ?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z (Address: 0x54e461a4)
  • ?SetPtLogin2HttpsUrlConfig@HttpClientUtil@@SAXHPAUITXArray@@@Z (Address: 0x54e461a8)
  • ?SetWriteFileOpt@TXLog@@YAXH@Z (Address: 0x54e46240)
  • ?StartAddCache@FS@Util@@YAXXZ (Address: 0x54e46198)
  • ?Stop@TXBugMonitor@@YAHXZ (Address: 0x54e461c8)
  • ?TrimLeft@CTXStringW@@QAEAAV1@XZ (Address: 0x54e46114)
  • ?TXLoadString@@YAPB_WPB_W0@Z (Address: 0x54e462c8)
  • ?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z (Address: 0x54e462c0)
  • ?UpdateExitInfo@ExitInfo@Util@@YA_NW4ExitPhaseType@12@@Z (Address: 0x54e461b8)
  • ?ValidateBugReport@TXBugReport@@YAXXZ (Address: 0x54e4617c)
  • DetourFunctionWrapper (Address: 0x54e46214)
  • DetourRemoveWrapper (Address: 0x54e46218)
  • GetCallStack (Address: 0x54e461e4)
  • SaveCallStack (Address: 0x54e461fc)
GDI32.dll
  • GetDeviceCaps (Address: 0x54e462e8)
GF.dll
  • ?ClosePopupWindows@GF@Util@@YAXXZ (Address: 0x54e462f4)
  • ?FreeFlashLibrary@Flash@Util@@YAHHABVCTXStringW@@@Z (Address: 0x54e46300)
  • ?GetLoadedFlashPath@Flash@Util@@YAHAAVCTXStringW@@@Z (Address: 0x54e462f0)
  • ?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z (Address: 0x54e462fc)
  • ?SetDPIAdaptFlag@DPI@GF@Util@@YAXH@Z (Address: 0x54e462f8)
IMM32.dll
  • ImmAssociateContext (Address: 0x54e4630c)
  • ImmAssociateContextEx (Address: 0x54e46308)
IPHLPAPI.DLL
  • GetAdaptersAddresses (Address: 0x54e4631c)
  • GetAdaptersInfo (Address: 0x54e46314)
  • GetIpForwardTable (Address: 0x54e46318)
KERNEL32.dll
  • CloseHandle (Address: 0x54e46338)
  • CompareStringW (Address: 0x54e46428)
  • CreateEventW (Address: 0x54e46364)
  • CreateFileMappingW (Address: 0x54e46448)
  • CreateFileW (Address: 0x54e4636c)
  • CreateMutexW (Address: 0x54e463b0)
  • CreateProcessW (Address: 0x54e463ec)
  • CreateThread (Address: 0x54e46378)
  • CreateToolhelp32Snapshot (Address: 0x54e46420)
  • DebugBreak (Address: 0x54e463dc)
  • DeleteCriticalSection (Address: 0x54e4643c)
  • DeleteFileW (Address: 0x54e46410)
  • DeviceIoControl (Address: 0x54e46454)
  • DisableThreadLibraryCalls (Address: 0x54e46478)
  • DuplicateHandle (Address: 0x54e463cc)
  • ExitProcess (Address: 0x54e463f0)
  • FileTimeToLocalFileTime (Address: 0x54e463a8)
  • FileTimeToSystemTime (Address: 0x54e463ac)
  • FindClose (Address: 0x54e4641c)
  • FindFirstFileW (Address: 0x54e46418)
  • FreeLibrary (Address: 0x54e46358)
  • GetCommandLineW (Address: 0x54e46384)
  • GetCurrentProcess (Address: 0x54e46368)
  • GetCurrentProcessId (Address: 0x54e46354)
  • GetCurrentThread (Address: 0x54e46458)
  • GetCurrentThreadId (Address: 0x54e46334)
  • GetDriveTypeW (Address: 0x54e46408)
  • GetEnvironmentVariableW (Address: 0x54e463e8)
  • GetLastError (Address: 0x54e46344)
  • GetModuleFileNameW (Address: 0x54e4635c)
  • GetModuleHandleExW (Address: 0x54e463d4)
  • GetModuleHandleW (Address: 0x54e46348)
  • GetProcAddress (Address: 0x54e4634c)
  • GetProcessHeap (Address: 0x54e46394)
  • GetProcessId (Address: 0x54e463c8)
  • GetProcessTimes (Address: 0x54e46398)
  • GetSystemDirectoryW (Address: 0x54e463e4)
  • GetSystemTimeAsFileTime (Address: 0x54e46330)
  • GetThreadTimes (Address: 0x54e46470)
  • GetTickCount (Address: 0x54e463a4)
  • GetVersionExW (Address: 0x54e46380)
  • GetWindowsDirectoryW (Address: 0x54e463c0)
  • GlobalAlloc (Address: 0x54e463f4)
  • GlobalMemoryStatusEx (Address: 0x54e463bc)
  • HeapAlloc (Address: 0x54e46390)
  • HeapReAlloc (Address: 0x54e463fc)
  • InitializeCriticalSectionAndSpinCount (Address: 0x54e46360)
  • InitializeSListHead (Address: 0x54e46474)
  • InterlockedDecrement (Address: 0x54e46324)
  • InterlockedExchange (Address: 0x54e463a0)
  • InterlockedExchangeAdd (Address: 0x54e46400)
  • InterlockedIncrement (Address: 0x54e46328)
  • IsDebuggerPresent (Address: 0x54e4645c)
  • IsProcessorFeaturePresent (Address: 0x54e4646c)
  • LocalAlloc (Address: 0x54e463f8)
  • lstrcmpiW (Address: 0x54e46430)
  • lstrlenW (Address: 0x54e463d8)
  • MapViewOfFile (Address: 0x54e4644c)
  • MoveFileExW (Address: 0x54e46414)
  • OpenFileMappingW (Address: 0x54e46440)
  • OpenMutexW (Address: 0x54e46404)
  • OpenProcess (Address: 0x54e46350)
  • OutputDebugStringW (Address: 0x54e46460)
  • Process32FirstW (Address: 0x54e46424)
  • Process32NextW (Address: 0x54e4642c)
  • QueryPerformanceCounter (Address: 0x54e4632c)
  • QueryPerformanceFrequency (Address: 0x54e463b8)
  • ReleaseMutex (Address: 0x54e463b4)
  • ResumeThread (Address: 0x54e46340)
  • SetEnvironmentVariableW (Address: 0x54e46434)
  • SetErrorMode (Address: 0x54e4639c)
  • SetEvent (Address: 0x54e46370)
  • SetFileAttributesW (Address: 0x54e4640c)
  • SetLastError (Address: 0x54e463c4)
  • SetThreadPriority (Address: 0x54e4633c)
  • SetUnhandledExceptionFilter (Address: 0x54e46468)
  • Sleep (Address: 0x54e4638c)
  • SuspendThread (Address: 0x54e463d0)
  • TerminateProcess (Address: 0x54e46388)
  • TerminateThread (Address: 0x54e4637c)
  • TlsAlloc (Address: 0x54e463e0)
  • UnhandledExceptionFilter (Address: 0x54e46464)
  • UnmapViewOfFile (Address: 0x54e46444)
  • WaitForSingleObject (Address: 0x54e46374)
  • WideCharToMultiByte (Address: 0x54e46450)
  • WriteProcessMemory (Address: 0x54e46438)
KernelUtil.dll
  • ?CloseMsgStorage@Msg@Util@@YAXXZ (Address: 0x54e464b8)
  • ?GetBuildVer@Version@@YAKXZ (Address: 0x54e464ac)
  • ?GetGlobalDataDir@Sys@Util@@YA?AVCTXStringW@@XZ (Address: 0x54e464a0)
  • ?GetGlobalSysDir@Sys@Util@@YA?AVCTXStringW@@XZ (Address: 0x54e464d4)
  • ?GetMajorVer@Version@@YAEXZ (Address: 0x54e46498)
  • ?GetMinorVer@Version@@YAEXZ (Address: 0x54e46494)
  • ?GetProgramRootDir@Sys@Util@@YA?AVCTXStringW@@XZ (Address: 0x54e4648c)
  • ?GetPubNo@Version@@YAKXZ (Address: 0x54e4649c)
  • ?GetSetupInfo@Misc@Util@@YAHAAH0H@Z (Address: 0x54e46488)
  • ?GetUserDataSaveSetting@Sys@Util@@YA?AVCTXStringW@@AAKAAV3@@Z (Address: 0x54e464c8)
  • ?GetVersionExW@Version@@YAXAAUtagVersionInfo@1@@Z (Address: 0x54e46490)
  • ?GetVersionID@OSVersion@@YAHPAK0@Z (Address: 0x54e464c4)
  • ?Init@Version@@YAHXZ (Address: 0x54e464d0)
  • ?instance@CTXLoginStatistic@loginstatistics@@SAAAV12@XZ (Address: 0x54e46480)
  • ?IsVistaOrGreater@OSVersion@@YAHXZ (Address: 0x54e464c0)
  • ?IsWin7OrGreater@OSVersion@@YAHXZ (Address: 0x54e464a4)
  • ?OnExitProcess@NewRegistry@@YAHXZ (Address: 0x54e464bc)
  • ?setFirstStart@CTXLoginStatistic@loginstatistics@@QAEX_N@Z (Address: 0x54e46484)
  • ?setMachineInfo@CTXLoginStatistic@loginstatistics@@QAEXAAULoginMachineInfo@2@@Z (Address: 0x54e464a8)
  • ?SetUserData@UserData@Util@@YAPAXPBDPAX@Z (Address: 0x54e464cc)
  • ?StopMsgThread@Msg@Util@@YAXXZ (Address: 0x54e464b4)
  • ?StopThread@MsgIndex@Util@@YAXXZ (Address: 0x54e464b0)
MSVCP140.dll
  • ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ (Address: 0x54e464e4)
  • ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ (Address: 0x54e46528)
  • ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ (Address: 0x54e46508)
  • ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ (Address: 0x54e464e8)
  • ?_Xlength_error@std@@YAXPBD@Z (Address: 0x54e4652c)
  • ?_Xout_of_range@std@@YAXPBD@Z (Address: 0x54e46530)
  • ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ (Address: 0x54e4651c)
  • ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z (Address: 0x54e46514)
  • ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ (Address: 0x54e46540)
  • ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ (Address: 0x54e464dc)
  • ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ (Address: 0x54e4650c)
  • ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ (Address: 0x54e464e0)
  • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z (Address: 0x54e46510)
  • ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ (Address: 0x54e46524)
  • ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z (Address: 0x54e46518)
  • ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z (Address: 0x54e46504)
  • ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z (Address: 0x54e464fc)
  • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z (Address: 0x54e46520)
  • ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ (Address: 0x54e464ec)
  • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z (Address: 0x54e4653c)
  • ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z (Address: 0x54e46538)
  • ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ (Address: 0x54e46500)
  • ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ (Address: 0x54e464f0)
  • ?uncaught_exception@std@@YA_NXZ (Address: 0x54e46534)
  • ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z (Address: 0x54e464f4)
  • ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z (Address: 0x54e464f8)
NETAPI32.dll
  • Netbios (Address: 0x54e46548)
ole32.dll
  • CoCreateGuid (Address: 0x54e46720)
  • CoCreateInstance (Address: 0x54e46728)
  • CoInitialize (Address: 0x54e46730)
  • CoTaskMemFree (Address: 0x54e46738)
  • CoUninitialize (Address: 0x54e4672c)
  • OleInitialize (Address: 0x54e4671c)
  • OleUninitialize (Address: 0x54e46734)
  • StringFromCLSID (Address: 0x54e46724)
PSAPI.DLL
  • EnumProcessModules (Address: 0x54e46554)
  • GetModuleFileNameExW (Address: 0x54e46550)
SHELL32.dll
  • ShellExecuteW (Address: 0x54e4655c)
SHLWAPI.dll
  • PathCombineW (Address: 0x54e46568)
  • PathFindFileNameW (Address: 0x54e4656c)
  • StrToIntA (Address: 0x54e46564)
USER32.dll
  • CreateWindowExW (Address: 0x54e465b4)
  • DefWindowProcW (Address: 0x54e4659c)
  • DestroyWindow (Address: 0x54e46594)
  • DispatchMessageW (Address: 0x54e465a4)
  • GetClassNameW (Address: 0x54e46580)
  • GetDC (Address: 0x54e4658c)
  • GetDesktopWindow (Address: 0x54e46588)
  • GetMessageW (Address: 0x54e46598)
  • IsWindow (Address: 0x54e46578)
  • MessageBoxW (Address: 0x54e4657c)
  • PeekMessageW (Address: 0x54e465ac)
  • PostMessageW (Address: 0x54e465a0)
  • PostQuitMessage (Address: 0x54e46584)
  • PostThreadMessageW (Address: 0x54e465b0)
  • RegisterClassExW (Address: 0x54e46574)
  • SendMessageW (Address: 0x54e46590)
  • TranslateMessage (Address: 0x54e465a8)
VCRUNTIME140.dll
  • __CxxFrameHandler3 (Address: 0x54e465f0)
  • __std_exception_copy (Address: 0x54e465e0)
  • __std_exception_destroy (Address: 0x54e465e4)
  • __std_type_info_destroy_list (Address: 0x54e465ec)
  • _CxxThrowException (Address: 0x54e465bc)
  • _except_handler4_common (Address: 0x54e465dc)
  • _purecall (Address: 0x54e465d4)
  • memchr (Address: 0x54e465cc)
  • memcmp (Address: 0x54e465d0)
  • memcpy (Address: 0x54e465e8)
  • memmove (Address: 0x54e465c8)
  • memset (Address: 0x54e465d8)
  • wcsrchr (Address: 0x54e465c4)
  • wcsstr (Address: 0x54e465c0)
VERSION.dll
  • GetFileVersionInfoSizeW (Address: 0x54e46600)
  • GetFileVersionInfoW (Address: 0x54e465f8)
  • VerQueryValueW (Address: 0x54e465fc)
WS2_32.dll
  • closesocket (Address: 0x54e4663c)
  • getaddrinfo (Address: 0x54e46630)
  • htonl (Address: 0x54e46638)
  • htons (Address: 0x54e4661c)
  • inet_addr (Address: 0x54e4662c)
  • inet_ntoa (Address: 0x54e46610)
  • ntohs (Address: 0x54e4660c)
  • recvfrom (Address: 0x54e46614)
  • sendto (Address: 0x54e46620)
  • setsockopt (Address: 0x54e46624)
  • socket (Address: 0x54e46608)
  • WSACleanup (Address: 0x54e46634)
  • WSAGetLastError (Address: 0x54e46628)
  • WSAStartup (Address: 0x54e46618)