ProcessSession.dll

Description: 腾讯QQ

Version: 9.6.6.848

Architecture: 32-bit

Operating System: Windows NT

SHA256: bf2af753c4eaa519de4b155d5798b713

File Size: 64.4 KB

Uploaded At: Dec. 2, 2025, 2:46 p.m.

Views: 14

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

??0CTXOPChannel@@QAE@XZ (Ordinal: 1, Address: 0x4086)
??0CTXOPSession@@QAE@ABV0@@Z (Ordinal: 2, Address: 0x173e)
??0CTXOPSession@@QAE@XZ (Ordinal: 3, Address: 0x71e1)
??1CTXOPChannel@@UAE@XZ (Ordinal: 4, Address: 0x4242)
??1CTXOPSession@@UAE@XZ (Ordinal: 5, Address: 0x729b)
??_7CTXOPChannel@@6B@ (Ordinal: 6, Address: 0x957c)
??_7CTXOPSession@@6B@ (Ordinal: 7, Address: 0x9244)
?AddSink@CTXOPChannel@@QAEXPAUITXOPChanelSysSink@@@Z (Ordinal: 8, Address: 0x4492)
?AddSink@CTXOPSession@@QAEXPAUITXOPSessionSysSink@@@Z (Ordinal: 9, Address: 0x7354)
?Attach@CTXOPSession@@QAEHPAVCTXOPChannel@@KK@Z (Ordinal: 10, Address: 0x73a0)
?CloseConnect@CTXOPChannel@@QAEHK@Z (Ordinal: 11, Address: 0x4517)
?CloseSession@CTXOPSession@@QAEXXZ (Ordinal: 12, Address: 0x73c6)
?Connect@CTXOPChannel@@QAEKPB_W@Z (Ordinal: 13, Address: 0x4624)
?CreateSession@CTXOPSession@@QAEHPB_WW4CONTRAINER_TYPE@@0HPBEI@Z (Ordinal: 14, Address: 0x7429)
?DestroyContext@CTXOPChannel@@AAEXAAUCONTEXT@1@@Z (Ordinal: 15, Address: 0x4a57)
?GetChannel@CTXOPSession@@AAEPAVCTXOPChannel@@XZ (Ordinal: 16, Address: 0x753a)
?GetConnectCount@CTXOPChannel@@QAEIXZ (Ordinal: 17, Address: 0x4aa2)
?InitNewContext@CTXOPChannel@@AAEHPB_WAAUCONTEXT@1@@Z (Ordinal: 18, Address: 0x4b48)
?InternalSend@CTXOPChannel@@AAEHAAUCONTEXT@1@PBEII@Z (Ordinal: 19, Address: 0x4d9d)
?InternalSend@CTXOPChannel@@AAEHKPBXIHK@Z (Ordinal: 20, Address: 0x4ef6)
?Listen@CTXOPChannel@@QAEHXZ (Ordinal: 21, Address: 0x5032)
?OnAsyncCall@CTXOPChannel@@AAEJI@Z (Ordinal: 22, Address: 0x50e7)
?OnConnectClose@CTXOPSession@@AAEJKW4CLOSE_REASON@@@Z (Ordinal: 23, Address: 0x7591)
?OnPush@CTXOPSession@@AAEJKPBEI@Z (Ordinal: 24, Address: 0x75ee)
?OnQuery@CTXOPSession@@AAEJKKPBEI@Z (Ordinal: 25, Address: 0x769b)
?OnReply@CTXOPSession@@AAEJPBEIPAUITXDataRead@@@Z (Ordinal: 26, Address: 0x778c)
?OnTimeOut@CTXOPSession@@AAEJPAUITXDataRead@@@Z (Ordinal: 27, Address: 0x784c)
?OnTimer@CTXOPChannel@@AAEJI@Z (Ordinal: 28, Address: 0x52f4)
?OpenContext@CTXOPChannel@@AAEHPB_WAAUCONTEXT@1@@Z (Ordinal: 29, Address: 0x5309)
?PushData@CTXOPChannel@@QAEHKPBEI@Z (Ordinal: 30, Address: 0x54ea)
?PushData@CTXOPSession@@QAEHPBEI@Z (Ordinal: 31, Address: 0x78d5)
?RemoveSink@CTXOPChannel@@QAEHPAUITXOPChanelSysSink@@@Z (Ordinal: 32, Address: 0x5618)
?RemoveSink@CTXOPSession@@QAEHPAUITXOPSessionSysSink@@@Z (Ordinal: 33, Address: 0x79cf)
?Run@CTXOPChannel@@EAEIXZ (Ordinal: 34, Address: 0x56b2)
?SendQuery@CTXOPChannel@@QAEHKPBEIPAUITXOPChanelReplySink@@PAUITXDataRead@@K@Z (Ordinal: 35, Address: 0x6179)
?SendQuery@CTXOPSession@@QAEHPBEIPAUITXOPSessionReplySink@@PAUITXDataRead@@K@Z (Ordinal: 36, Address: 0x7a2d)
?SendQueryWaitReply@CTXOPChannel@@QAEHKPBEIAAVCTXBuffer@@I@Z (Ordinal: 37, Address: 0x62d9)
?SendQueryWaitReply@CTXOPSession@@QAEHPBEIAAVCTXBuffer@@I@Z (Ordinal: 38, Address: 0x7afa)
?SendReply@CTXOPChannel@@QAEHKKPBEI@Z (Ordinal: 39, Address: 0x64b8)
?SendReply@CTXOPSession@@QAEHKPBEI@Z (Ordinal: 40, Address: 0x7bb8)
?Start@CTXOPChannel@@QAEHPB_W@Z (Ordinal: 41, Address: 0x654f)
?Stop@CTXOPChannel@@QAEXXZ (Ordinal: 42, Address: 0x65ea)
DllCanUnloadNow (Ordinal: 43, Address: 0x70ee)
DllGetClassObject (Ordinal: 44, Address: 0x7102)
DllRegisterServer (Ordinal: 45, Address: 0x2248)
DllUnregisterServer (Ordinal: 46, Address: 0x2248)

Imported DLLs & Functions

api-ms-win-crt-heap-l1-1-0.dll

_callnewh (Address: 0x58969164)
free (Address: 0x58969160)
malloc (Address: 0x58969168)

api-ms-win-crt-runtime-l1-1-0.dll

_cexit (Address: 0x58969184)
_configure_narrow_argv (Address: 0x58969170)
_crt_atexit (Address: 0x58969180)
_execute_onexit_table (Address: 0x5896917c)
_initialize_narrow_environment (Address: 0x58969174)
_initialize_onexit_table (Address: 0x58969198)
_initterm (Address: 0x58969188)
_initterm_e (Address: 0x5896918c)
_invalid_parameter_noinfo_noreturn (Address: 0x58969190)
_register_onexit_function (Address: 0x58969178)
_seh_filter_dll (Address: 0x58969194)

api-ms-win-crt-string-l1-1-0.dll

wcsncpy (Address: 0x589691a0)

Common.dll

??0CTXStringW@@QAE@ABV0@@Z (Address: 0x5896900c)
??0CTXStringW@@QAE@PA_W@Z (Address: 0x58969010)
??0CTXStringW@@QAE@PB_W@Z (Address: 0x58969008)
??0CTXStringW@@QAE@XZ (Address: 0x58969004)
??0CTXThreadModel@@IAE@XZ (Address: 0x5896905c)
??1CTXStringW@@QAE@XZ (Address: 0x58969000)
??1CTXThreadModel@@MAE@XZ (Address: 0x58969060)
??4CTXStringW@@QAEAAV0@ABV0@@Z (Address: 0x58969014)
??BCTXStringW@@QBEPB_WXZ (Address: 0x58969030)
??H@YA?AVCTXStringW@@ABV0@0@Z (Address: 0x5896901c)
??H@YA?AVCTXStringW@@ABV0@PB_W@Z (Address: 0x58969018)
??M@YA_NABVCTXStringW@@0@Z (Address: 0x58969020)
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z (Address: 0x5896903c)
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z (Address: 0x58969064)
?EraseAsyncCallback@TXTimer@@YAHPAUITXAsyncCallback@@I@Z (Address: 0x5896904c)
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z (Address: 0x58969044)
?FlushLog@TXLog@@YAXXZ (Address: 0x58969038)
?Format@CTXStringW@@QAAXPB_WZZ (Address: 0x58969024)
?Left@CTXStringW@@QBE?AV1@H@Z (Address: 0x5896902c)
?ReverseFind@CTXStringW@@QBEH_W@Z (Address: 0x58969028)
?SetAsyncCallback@TXTimer@@YAHPAUITXAsyncCallback@@I@Z (Address: 0x58969048)
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z (Address: 0x58969040)
?StartThread@CTXThreadModel@@QAEHXZ (Address: 0x58969050)
?StopThread@CTXThreadModel@@QAEHK@Z (Address: 0x58969054)
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z (Address: 0x58969034)
?WaitThread@CTXThreadModel@@QAEHK@Z (Address: 0x58969058)

KERNEL32.dll

CloseHandle (Address: 0x5896907c)
CreateEventW (Address: 0x589690e4)
CreateFileMappingW (Address: 0x589690ec)
CreateMutexW (Address: 0x589690dc)
CreateProcessW (Address: 0x58969090)
DecodePointer (Address: 0x589690f4)
DeleteCriticalSection (Address: 0x589690bc)
EncodePointer (Address: 0x589690f0)
EnterCriticalSection (Address: 0x589690b4)
GetCurrentProcess (Address: 0x5896909c)
GetCurrentProcessId (Address: 0x589690a0)
GetCurrentThreadId (Address: 0x58969078)
GetLastError (Address: 0x589690a8)
GetModuleFileNameW (Address: 0x5896908c)
GetSystemTimeAsFileTime (Address: 0x58969080)
GetTickCount (Address: 0x58969084)
InitializeCriticalSection (Address: 0x589690b0)
InitializeCriticalSectionAndSpinCount (Address: 0x589690fc)
InitializeSListHead (Address: 0x58969110)
InterlockedDecrement (Address: 0x58969070)
InterlockedExchange (Address: 0x58969074)
InterlockedIncrement (Address: 0x5896906c)
IsDebuggerPresent (Address: 0x589690ac)
IsProcessorFeaturePresent (Address: 0x58969108)
LeaveCriticalSection (Address: 0x589690b8)
MapViewOfFile (Address: 0x589690d4)
OpenEventW (Address: 0x589690e8)
OpenFileMappingW (Address: 0x58969088)
OpenMutexW (Address: 0x589690e0)
OpenProcess (Address: 0x58969098)
OutputDebugStringW (Address: 0x5896910c)
QueryPerformanceCounter (Address: 0x58969094)
RaiseException (Address: 0x589690f8)
ReleaseMutex (Address: 0x589690c8)
ResetEvent (Address: 0x589690c4)
SetEvent (Address: 0x589690c0)
SetUnhandledExceptionFilter (Address: 0x58969100)
TerminateProcess (Address: 0x589690a4)
UnhandledExceptionFilter (Address: 0x58969104)
UnmapViewOfFile (Address: 0x589690d8)
WaitForMultipleObjects (Address: 0x589690d0)
WaitForSingleObject (Address: 0x589690cc)

MSVCP140.dll

?_Xlength_error@std@@YAXPBD@Z (Address: 0x58969118)

ole32.dll

CoCreateGuid (Address: 0x589691a8)
CoCreateInstance (Address: 0x589691ac)

USER32.dll

DispatchMessageW (Address: 0x5896912c)
MsgWaitForMultipleObjectsEx (Address: 0x58969128)
PeekMessageW (Address: 0x58969124)
TranslateMessage (Address: 0x58969120)

VCRUNTIME140.dll

__CxxFrameHandler3 (Address: 0x5896914c)
__std_exception_copy (Address: 0x5896913c)
__std_exception_destroy (Address: 0x58969140)
__std_type_info_destroy_list (Address: 0x58969148)
_CxxThrowException (Address: 0x58969158)
_except_handler4_common (Address: 0x58969144)
_purecall (Address: 0x58969150)
memcpy (Address: 0x58969134)
memmove (Address: 0x58969138)
memset (Address: 0x58969154)