{ "current": { "launcher_new_AutoUpdateVCTK.exe": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\AutoUpdateVCTK.exe", "size": 4057600, "mtime_local": "2026-09-19 21:16:32", "sha256": "F5DC940931CFB80887853B833A038BE9F3E0A49CF9AD4FEBA550951D7B0B4B80", "md5": "08B0A33A7EECEAE907BE9D8F187BA364", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1789821035, "subsystem": 2, "ep_rva": "0x182f90", "image_base": "0x400000", "sections": [ ".text vsz=0x1C0280 raw=0x1C0400 ent=6.49", ".rdata vsz=0x6058E raw=0x60600 ent=5.05", ".data vsz=0xAB60 raw=0x6200 ent=4.76", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0x193038 raw=0x193200 ent=8.00", ".reloc vsz=0x24414 raw=0x24600 ent=6.57" ], "max_section_entropy": 8.0, "imports": { "WINHTTP.dll": [ "WinHttpOpen", "WinHttpReadData", "WinHttpQueryHeaders", "WinHttpReceiveResponse", "WinHttpSendRequest", "WinHttpOpenRequest", "WinHttpCloseHandle", "WinHttpCrackUrl", "WinHttpSetOption", "WinHttpConnect" ], "ADVAPI32.dll": [ "RegEnumKeyExW", "RegEnumValueW", "RegQueryValueW", "RegEnumKeyW", "RegSetValueExW", "RegDeleteValueW", "RegDeleteKeyW", "RegCreateKeyExW", "RegQueryValueExW", "AllocateAndInitializeSid", "CheckTokenMembership", "FreeSid", "CryptAcquireContextW", "CryptCreateHash", "CryptReleaseContext", "CryptHashData", "CryptGetHashParam", "CryptDestroyHash", "RegOpenKeyExW", "RegCloseKey" ], "SHELL32.dll": [ "ShellExecuteW", "Shell_NotifyIconW", "SHGetFolderPathW", "CommandLineToArgvW", "SHBrowseForFolderW", "DragFinish", "DragQueryFileW", "SHAppBarMessage", "SHGetDesktopFolder", "SHGetSpecialFolderLocation", "SHGetPathFromIDListW", "SHGetFileInfoW", "ShellExecuteExW" ], "ole32.dll": [ "OleDuplicateData", "ReleaseStgMedium", "CoTaskMemFree", "CoTaskMemAlloc", "CoCreateGuid", "CoDisconnectObject", "DoDragDrop", "OleGetClipboard", "CoLockObjectExternal", "RegisterDragDrop", "RevokeDragDrop", "OleLockRunning", "OleCreateMenuDescriptor", "OleDestroyMenuDescriptor", "OleTranslateAccelerator", "IsAccelerator", "CoInitializeEx", "CreateStreamOnHGlobal", "CoUninitialize", "CoInitialize", "CoCreateInstance" ], "OLEAUT32.dll": [ "VarBstrFromDate", "VariantCopy", "VariantTimeToSystemTime", "SysAllocString", "VariantInit", "SysFreeString", "SysStringLen", "SysAllocStringLen", "LoadTypeLib", "VariantChangeType", "VariantClear", "SystemTimeToVariantTime" ], "VERSION.dll": [ "VerQueryValueW", "GetFileVersionInfoW", "GetFileVersionInfoSizeW" ], "gdiplus.dll": [ "GdipGetImageWidth", "GdipGetImageHeight", "GdipCreateBitmapFromFile", "GdipLoadImageFromStream", "GdipLoadImageFromFile", "GdipBitmapGetPixel", "GdipCreateFromHDC", "GdipDeleteGraphics", "GdipSetInterpolationMode", "GdipSetPixelOffsetMode", "GdipDrawImageRectI", "GdiplusShutdown", "GdipDrawImageRectRectI", "GdipCreateBitmapFromStream", "GdipCloneImage", "GdipAlloc", "GdipDisposeImage", "GdiplusStartup", "GdipFree", "GdipCreateBitmapFromHBITMAP", "GdipDrawImageI", "GdipBitmapUnlockBits", "GdipBitmapLockBits", "GdipGetImageGraphicsContext", "GdipGetImagePixelFormat", "GdipGetImagePalette", "GdipGetImagePaletteSize", "GdipCreateBitmapFromScan0" ], "Normaliz.dll": [ "NormalizeString" ], "KERNEL32.dll": [ "GlobalHandle", "LocalAlloc", "LocalReAlloc", "GetLocaleInfoW", "GetSystemDefaultUILanguage", "GetUserDefaultUILanguage", "GlobalFlags", "GlobalGetAtomNameW", "FileTimeToSystemTime", "lstrcpyW", "FlushFileBuffers", "GetFileSize", "GetVolumeInformationW", "LockFile", "SetEndOfFile", "SetFilePointer", "UnlockFile", "DuplicateHandle", "GetCurrentProcess", "lstrcmpiW", "VerSetConditionMask", "VerifyVersionInfoW", "VirtualProtect", "SetErrorMode", "FileTimeToLocalFileTime", "GetFileTime", "InitializeCriticalSection", "SystemTimeToTzSpecificLocalTime", "GetWindowsDirectoryW", "SearchPathW", "GetProfileIntW", "GetTempPathW", "FindResourceExW", "GetTempFileNameW", "GetUserDefaultLCID", "WaitForSingleObjectEx", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "TerminateProcess", "IsProcessorFeaturePresent", "QueryPerformanceCounter", "GetSystemTimeAsFileTime", "InitializeSListHead", "TlsFree", "GetStartupInfoW", "InitializeCriticalSectionAndSpinCount", "LeaveCriticalSection", "EnterCriticalSection", "CompareStringW", "GlobalFindAtomW", "LoadLibraryA", "GetSystemDirectoryW", "EncodePointer", "GlobalAddAtomW", "WritePrivateProfileStringW", "GetPrivateProfileStringW", "GetPrivateProfileIntW", "ResumeThread", "SetThreadPriority", "GlobalSize", "lstrcmpW", "lstrcmpA", "GlobalDeleteAtom", "LoadLibraryExW", "GetModuleHandleA", "GetVersionExW", "GetCurrentThread", "SetLastError", "OutputDebugStringA", "GetStringTypeW", "GetLocalTime", "Process32FirstW", "OutputDebugStringW", "InitializeSRWLock", "ReleaseSRWLockExclusive", "AcquireSRWLockExclusive", "TryEnterCriticalSection", "GetExitCodeThread", "Process32NextW", "GetTickCount64", "FormatMessageW", "ProcessIdToSessionId", "CreateToolhelp32Snapshot", "ExpandEnvironmentStringsW", "GetFullPathNameW", "SetEvent", "CreateEventW", "Sleep", "GetTickCount", "CreateProcessW", "GetCurrentDirectoryW", "MulDiv", "LCMapStringEx", "GlobalReAlloc", "TlsSetValue", "TlsGetValue", "IsDebuggerPresent", "QueryPerformanceFrequency", "CopyFileW", "GlobalUnlock", "GlobalFree", "GlobalLock", "FlsAlloc", "FlsGetValue", "FlsSetValue", "FlsFree", "GlobalAlloc", "GetFileAttributesExW", "FindClose", "FindNextFileW", "FindFirstFileW", "WideCharToMultiByte", "TlsAlloc", "MultiByteToWideChar", "MoveFileW", "MoveFileExW", "SetFileAttributesW", "DeleteFileW", "WriteFile", "GetCurrentThreadId", "CreateDirectoryW", "FindResourceW", "LoadResource", "LockResource", "SizeofResource", "FreeLibrary", "LoadLibraryW", "GetProcAddress", "GetModuleHandleW", "GetExitCodeProcess", "WaitForSingleObject", "GetEnvironmentVariableW", "ReadFile", "SetFilePointerEx", "GetFileSizeEx", "CreateFileW", "GetFileAttributesW", "LocalFree", "GetCommandLineW", "ReleaseMutex", "CreateMutexW", "QueryFullProcessImageNameW", "OpenProcess", "GetCurrentProcessId", "GetModuleFileNameW", "CloseHandle", "GetProcessHeap", "DeleteCriticalSection", "DecodePointer", "HeapAlloc", "RaiseException", "HeapReAlloc", "GetLastError", "HeapSize", "InitializeCriticalSectionEx", "HeapFree", "GetCPInfo", "RtlUnwind", "CreateThread", "ExitThread", "FreeLibraryAndExitThread", "GetModuleHandleExW", "GetCommandLineA", "HeapQueryInformation", "GetSystemInfo", "VirtualAlloc", "VirtualQuery", "SetStdHandle", "GetFileType", "GetStdHandle", "ExitProcess", "LCMapStringW", "IsValidLocale", "EnumSystemLocalesW", "GetTimeZoneInformation", "GetConsoleOutputCP", "GetConsoleMode", "FindFirstFileExW", "IsValidCodePage", "GetACP", "GetOEMCP", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "SetEnvironmentVariableW", "WriteConsoleW" ], "USER32.dll": [ "WaitMessage", "PostThreadMessageW", "FrameRect", "CopyIcon", "SetCursorPos", "ReuseDDElParam", "UnpackDDElParam", "InsertMenuItemW", "TranslateAcceleratorW", "BringWindowToTop", "CopyAcceleratorTableW", "DestroyAcceleratorTable", "CreateAcceleratorTableW", "LoadAcceleratorsW", "MapVirtualKeyW", "GetKeyboardState", "GetKeyboardLayout", "ToUnicodeEx", "ModifyMenuW", "LockWindowUpdate", "CharUpperBuffW", "SetParent", "SetClassLongW", "DrawFocusRect", "DrawFrameControl", "DrawEdge", "RegisterClipboardFormatW", "DrawIconEx", "EmptyClipboard", "SetClipboardData", "CloseClipboard", "OpenClipboard", "LoadImageW", "MapDialogRect", "EnumDisplayMonitors", "DestroyIcon", "MonitorFromPoint", "EnableScrollBar", "UpdateLayeredWindow", "SetMenuDefaultItem", "GetMenuDefaultItem", "NotifyWinEvent", "WindowFromPoint", "MessageBeep", "GetSystemMenu", "ReleaseCapture", "SetCapture", "GetAsyncKeyState", "CharUpperW", "IsZoomed", "TrackMouseEvent", "LoadCursorW", "GetSysColorBrush", "SetRectEmpty", "SendDlgItemMessageA", "RealChildWindowFromPoint", "DeleteMenu", "CopyImage", "SystemParametersInfoW", "GetMenuItemInfoW", "DestroyMenu", "LoadMenuW", "IntersectRect", "WinHelpW", "GetScrollInfo", "SetScrollInfo", "GetNextDlgGroupItem", "GetClassLongW", "EqualRect", "MapWindowPoints", "AdjustWindowRectEx", "RemovePropW", "GetPropW", "SetPropW", "ShowScrollBar", "GetScrollRange", "SetScrollRange", "GetScrollPos", "ScrollWindow", "TrackPopupMenu", "SetMenu", "GetMenu", "GetCapture", "EndDeferWindowPos", "DeferWindowPos", "BeginDeferWindowPos", "SetWindowPlacement", "GetWindowPlacement", "IsChild", "IsMenu", "CreateWindowExW", "GetClassInfoExW", "GetClassInfoW", "RegisterClassW", "CallWindowProcW", "DefWindowProcW", "GetMessageTime", "GetMessagePos", "RegisterWindowMessageW", "IsDialogMessageW", "SetWindowLongW", "SetWindowTextW", "SetFocus", "DrawMenuBar", "SendDlgItemMessageW", "IsDlgButtonChecked", "CheckRadioButton", "CheckDlgButton", "SetDlgItemTextW", "SetWindowPos", "MoveWindow", "GetClassNameW", "UpdateWindow", "DrawStateW", "SetCursor", "ShowOwnedPopups", "ValidateRect", "GetKeyState", "PeekMessageW", "DispatchMessageW", "TranslateMessage", "GetMessageW", "LoadBitmapW", "SetMenuItemInfoW", "GetMenuCheckMarkDimensions", "SetMenuItemBitmaps", "EnableMenuItem", "CheckMenuItem", "CallNextHookEx", "UnhookWindowsHookEx", "SetWindowsHookExW", "GetIconInfo", "HideCaret", "InvertRect", "GetKeyNameTextW", "IsClipboardFormatAvailable", "GetDoubleClickTime", "DestroyCursor", "GetTopWindow", "PtInRect", "GetFocus", "FillRect", "GetSysColor", "ScreenToClient", "ClientToScreen", "EndPaint", "BeginPaint", "ReleaseDC", "GetWindowDC", "GetDC", "TabbedTextOutW", "GrayStringW", "DrawTextExW", "DrawTextW", "RemoveMenu", "InsertMenuW", "GetMenuItemCount", "GetMenuItemID", "GetSubMenu", "GetMenuState", "GetMenuStringW", "GetLastActivePopup", "GetDesktopWindow", "SetActiveWindow", "IsWindowEnabled", "GetActiveWindow", "GetNextDlgTabItem", "EndDialog", "CreateDialogIndirectParamW", "DestroyWindow", "PostQuitMessage", "GetWindowLongW", "GetWindowTextLengthW", "ShowWindowAsync", "GetWindow", "SendMessageTimeoutW", "WaitForInputIdle", "GetForegroundWindow", "GetWindowTextW", "DefFrameProcW", "DefMDIChildProcW", "TranslateMDISysAccel", "IsCharLowerW", "MapVirtualKeyExW", "GetWindowRgn", "SubtractRect", "CreateMenu", "EnableWindow", "GetDlgItem", "GetCursorPos", "AppendMenuW", "CreatePopupMenu", "KillTimer", "InflateRect", "DrawIcon", "IsWindow", "PostMessageW", "RedrawWindow", "UnionRect", "SetWindowRgn", "InvalidateRect", "GetSystemMetrics", "SetRect", "CopyRect", "GetMonitorInfoW", "MonitorFromWindow", "GetWindowRect", "SetTimer", "SetLayeredWindowAttributes", "LoadIconW", "GetClientRect", "GetParent", "SendMessageW", "OffsetRect", "IsRectEmpty", "CharLowerBuffA", "MessageBoxW", "SetForegroundWindow", "IsIconic", "ShowWindow", "EnumWindows", "GetWindowThreadProcessId", "IsWindowVisible", "UnregisterClassW", "GetUpdateRect", "GetDlgCtrlID", "GetComboBoxInfo", "SetScrollPos" ], "GDI32.dll": [ "Rectangle", "GetObjectW", "MoveToEx", "TextOutW", "ExtTextOutW", "RoundRect", "GetStockObject", "CopyMetaFileW", "CreateDCW", "GetDeviceCaps", "SetViewportExtEx", "SetViewportOrgEx", "SetWindowExtEx", "SetWindowOrgEx", "OffsetViewportOrgEx", "OffsetWindowOrgEx", "ScaleViewportExtEx", "ScaleWindowExtEx", "CreateFontIndirectW", "CreateRectRgnIndirect", "PatBlt", "SetRectRgn", "DPtoLP", "GetTextExtentPoint32W", "GetTextMetricsW", "CreateRoundRectRgn", "CreateCompatibleBitmap", "CreateDIBSection", "CreateDIBitmap", "EnumFontFamiliesW", "GetTextCharsetInfo", "RealizePalette", "SetPixel", "BitBlt", "CreateFontW", "StretchBlt", "SetDIBColorTable", "DeleteObject", "GetRgnBox", "OffsetRgn", "CreateEllipticRgn", "Ellipse", "GetBkColor", "CreatePolygonRgn", "Polygon", "Polyline", "EnumFontFamiliesExW", "CreatePalette", "GetNearestPaletteIndex", "GetPaletteEntries", "GetSystemPaletteEntries", "LPtoDP", "ExtFloodFill", "SetPaletteEntries", "FillRgn", "FrameRgn", "GetBoundsRect", "PtInRegion", "GetViewportOrgEx", "GetWindowOrgEx", "SetPixelV", "GetTextFaceW", "SetROP2", "SetPolyFillMode", "GetLayout", "CombineRgn", "GetTextColor", "SetLayout", "SetMapMode", "CreateSolidBrush", "CreateRectRgn", "CreateBitmap", "SetTextColor", "SetBkMode", "SetBkColor", "SelectPalette", "SelectObject", "ExtSelectClipRgn", "SelectClipRgn", "SaveDC", "RestoreDC", "RectVisible", "PtVisible", "LineTo", "IntersectClipRect", "GetWindowExtEx", "GetViewportExtEx", "GetPixel", "GetObjectType", "GetClipBox", "ExcludeClipRect", "Escape", "DeleteDC", "CreatePatternBrush", "CreatePen", "CreateHatchBrush", "CreateCompatibleDC", "SetTextAlign" ], "MSIMG32.dll": [ "AlphaBlend", "TransparentBlt", "GradientFill" ], "WINSPOOL.DRV": [ "ClosePrinter", "DocumentPropertiesW", "OpenPrinterW" ], "COMCTL32.dll": [ "InitCommonControlsEx" ], "SHLWAPI.dll": [ "PathStripToRootW", "PathIsUNCW", "PathRemoveFileSpecW", "PathFindFileNameW", "PathFindExtensionW", "StrFormatKBSizeW" ], "UxTheme.dll": [ "GetThemePartSize", "GetThemeSysColor", "GetWindowTheme", "IsThemeBackgroundPartiallyTransparent", "GetCurrentThemeName", "GetThemeColor", "DrawThemeBackground", "CloseThemeData", "OpenThemeData", "DrawThemeParentBackground", "IsAppThemed", "SetWindowTheme", "DrawThemeText" ], "OLEACC.dll": [ "CreateStdAccessibleObject", "LresultFromObject", "AccessibleObjectFromWindow" ], "WINMM.dll": [ "PlaySoundW" ], "IMM32.dll": [ "ImmReleaseContext", "ImmGetOpenStatus", "ImmGetContext" ] }, "import_dlls": [ "ADVAPI32.dll", "COMCTL32.dll", "GDI32.dll", "IMM32.dll", "KERNEL32.dll", "MSIMG32.dll", "Normaliz.dll", "OLEACC.dll", "OLEAUT32.dll", "SHELL32.dll", "SHLWAPI.dll", "USER32.dll", "UxTheme.dll", "VERSION.dll", "WINHTTP.dll", "WINMM.dll", "WINSPOOL.DRV", "gdiplus.dll", "ole32.dll" ], "has_authenticode": false, "overlay_size": 0, "string_count": 15260, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "http": 18, "winhttp": 11, "https://": 4, "http://": 3, "loadlibrary": 3, "shellexecute": 2, "startup": 2, "vctk.me": 2, "setwindowshookex": 1, "getasynckeystate": 1, "createprocess": 1, "getprocaddress": 1, "vietguards": 1, "kimyen": 1 } }, "strings_file": "launcher_new_AutoUpdateVCTK.exe.strings.txt" }, "vlhookpr_new_VLHookPr.dll": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\_VLAuto\\VLHookPr.dll", "size": 282624, "mtime_local": "2026-09-25 22:59:05", "sha256": "DB716FF77241E5F5F16C20A6C0485048EA5F3DC01D51073078D9B5AC3B0F706C", "md5": "A29D429C9CE1BF535E15EC8DD08121F6", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1790310182, "subsystem": 2, "ep_rva": "0x1759e", "image_base": "0x10000000", "sections": [ ".text vsz=0x34D76 raw=0x34E00 ent=6.63", ".rdata vsz=0xBDBA raw=0xBE00 ent=5.58", ".data vsz=0x2F088 raw=0xE00 ent=2.91", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0x1E0 raw=0x200 ent=4.72", ".reloc vsz=0x2D74 raw=0x2E00 ent=6.74" ], "max_section_entropy": 6.74, "imports": { "KERNEL32.dll": [ "CloseHandle", "OpenProcess", "ReadProcessMemory", "DisableThreadLibraryCalls", "FreeLibrary", "GetModuleFileNameA", "LoadLibraryA", "ReadFile", "GlobalAlloc", "GetProcAddress", "GetPrivateProfileIntA", "GetPrivateProfileStringA", "HeapAlloc", "HeapFree", "GetProcessHeap", "GetCurrentProcessId", "GlobalUnlock", "GlobalLock", "IsProcessorFeaturePresent", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "EnterCriticalSection", "LeaveCriticalSection", "InitializeCriticalSectionAndSpinCount", "DeleteCriticalSection", "SetEvent", "ResetEvent", "WaitForSingleObjectEx", "CreateEventW", "GetModuleHandleW", "IsDebuggerPresent", "GetStartupInfoW", "QueryPerformanceCounter", "GetCurrentThreadId", "GetSystemTimeAsFileTime", "InitializeSListHead", "RtlUnwind", "InterlockedFlushSList", "RaiseException", "GetLastError", "SetLastError", "EncodePointer", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "LoadLibraryExW", "CreateFileW", "GetFileInformationByHandle", "GetFileType", "PeekNamedPipe", "SystemTimeToTzSpecificLocalTime", "FileTimeToSystemTime", "ExitProcess", "GetModuleHandleExW", "GetModuleFileNameW", "GetStdHandle", "FlsAlloc", "FlsGetValue", "FlsSetValue", "FlsFree", "InitializeCriticalSectionEx", "VirtualProtect", "CompareStringW", "LCMapStringW", "GetConsoleMode", "ReadConsoleW", "MultiByteToWideChar", "DeleteFileW", "MoveFileExW", "GetTimeZoneInformation", "GetCurrentDirectoryW", "SetStdHandle", "DecodePointer", "FindClose", "FindFirstFileExW", "FindNextFileW", "IsValidCodePage", "GetACP", "GetOEMCP", "GetCPInfo", "GetCommandLineA", "GetCommandLineW", "WideCharToMultiByte", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "SetEnvironmentVariableW", "GetStringTypeW", "GetFileSizeEx", "SetFilePointerEx", "FlushFileBuffers", "WriteFile", "GetConsoleOutputCP", "HeapSize", "HeapReAlloc", "SetEndOfFile", "WriteConsoleW" ] }, "import_dlls": [ "KERNEL32.dll" ], "export_count": 2, "has_authenticode": false, "overlay_size": 0, "string_count": 1631, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "setwindowshookex": 2, "loadlibrary": 2, "readprocessmemory": 1, "getasynckeystate": 1, "getprocaddress": 1, "startup": 1 } }, "strings_file": "vlhookpr_new_VLHookPr.dll.strings.txt" }, "vlhookpr_backup_VLHookPr.dll.backup": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\_VLAuto\\VLHookPr.dll.backup", "size": 282624, "mtime_local": "2026-09-10 00:23:10", "sha256": "289C8C6FDDDE6F41438F66F5A3E175748EF94497F8473AF9A0229FDEC9566D15", "md5": "1F7D059401E48979CCA0B0D50FF00829", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1783142487, "subsystem": 2, "ep_rva": "0x1742e", "image_base": "0x10000000", "sections": [ ".text vsz=0x34C06 raw=0x34E00 ent=6.62", ".rdata vsz=0xBD92 raw=0xBE00 ent=5.57", ".data vsz=0x2F088 raw=0xE00 ent=2.91", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0x1E0 raw=0x200 ent=4.72", ".reloc vsz=0x2D58 raw=0x2E00 ent=6.72" ], "max_section_entropy": 6.72, "imports": { "KERNEL32.dll": [ "CloseHandle", "OpenProcess", "ReadProcessMemory", "DisableThreadLibraryCalls", "FreeLibrary", "GetModuleFileNameA", "LoadLibraryA", "ReadFile", "GlobalAlloc", "GetProcAddress", "GetModuleHandleA", "GetPrivateProfileIntA", "GetPrivateProfileStringA", "GlobalUnlock", "GlobalLock", "IsProcessorFeaturePresent", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "EnterCriticalSection", "LeaveCriticalSection", "InitializeCriticalSectionAndSpinCount", "DeleteCriticalSection", "SetEvent", "ResetEvent", "WaitForSingleObjectEx", "CreateEventW", "GetModuleHandleW", "IsDebuggerPresent", "GetStartupInfoW", "QueryPerformanceCounter", "GetCurrentProcessId", "GetCurrentThreadId", "GetSystemTimeAsFileTime", "InitializeSListHead", "RtlUnwind", "InterlockedFlushSList", "RaiseException", "GetLastError", "SetLastError", "EncodePointer", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "LoadLibraryExW", "CreateFileW", "GetFileInformationByHandle", "GetFileType", "PeekNamedPipe", "SystemTimeToTzSpecificLocalTime", "FileTimeToSystemTime", "ExitProcess", "GetModuleHandleExW", "GetModuleFileNameW", "HeapFree", "HeapAlloc", "GetStdHandle", "FlsAlloc", "FlsGetValue", "FlsSetValue", "FlsFree", "InitializeCriticalSectionEx", "VirtualProtect", "CompareStringW", "LCMapStringW", "GetConsoleMode", "ReadConsoleW", "MultiByteToWideChar", "DeleteFileW", "MoveFileExW", "GetTimeZoneInformation", "GetCurrentDirectoryW", "SetStdHandle", "DecodePointer", "FindClose", "FindFirstFileExW", "FindNextFileW", "IsValidCodePage", "GetACP", "GetOEMCP", "GetCPInfo", "GetCommandLineA", "GetCommandLineW", "WideCharToMultiByte", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "SetEnvironmentVariableW", "GetProcessHeap", "GetStringTypeW", "GetFileSizeEx", "SetFilePointerEx", "FlushFileBuffers", "WriteFile", "GetConsoleOutputCP", "HeapSize", "HeapReAlloc", "SetEndOfFile", "WriteConsoleW" ] }, "import_dlls": [ "KERNEL32.dll" ], "export_count": 2, "has_authenticode": false, "overlay_size": 0, "string_count": 1656, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "setwindowshookex": 2, "loadlibrary": 2, "readprocessmemory": 1, "getasynckeystate": 1, "getprocaddress": 1, "startup": 1 } }, "strings_file": "vlhookpr_backup_VLHookPr.dll.backup.strings.txt" }, "vlautopr_new_VLAutoPr.exe": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\_VLAuto\\VLAutoPr.exe", "size": 2262528, "mtime_local": "2026-09-25 22:59:07", "sha256": "20F9EF68670EDFC2D55A150385872AC805E83612A1C7B8C03604D415CC7F62F7", "md5": "DF17E44FC5C254AE0A0985C3A2154C8E", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1790310206, "subsystem": 2, "ep_rva": "0x15b1ce", "image_base": "0x400000", "sections": [ ".text vsz=0x18DBFC raw=0x18DC00 ent=6.43", ".rdata vsz=0x5C352 raw=0x5C400 ent=5.04", ".data vsz=0xD1F8 raw=0x6200 ent=4.67", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0x12CD8 raw=0x12E00 ent=5.77", ".reloc vsz=0x24FE8 raw=0x25000 ent=6.56" ], "max_section_entropy": 6.56, "imports": { "VLHookPr.dll": [ "?StopInject@@YAIPAUHWND__@@@Z", "?StartInject@@YAIPAUHWND__@@0@Z" ], "WINMM.dll": [ "PlaySoundW" ], "KERNEL32.dll": [ "FlsGetValue", "FlsAlloc", "GetTimeZoneInformation", "ExitProcess", "GetStdHandle", "GetFileType", "SetStdHandle", "QueryPerformanceFrequency", "HeapQueryInformation", "GetCommandLineW", "FlsFree", "FreeLibraryAndExitThread", "ExitThread", "CreateThread", "VirtualQuery", "VirtualAlloc", "GetSystemInfo", "RtlUnwind", "OutputDebugStringW", "FlsSetValue", "InitializeCriticalSectionEx", "GetCommandLineA", "LCMapStringW", "GetConsoleOutputCP", "GetConsoleMode", "ReadConsoleW", "SetFilePointerEx", "FindFirstFileExW", "FindNextFileW", "IsValidCodePage", "GetACP", "GetOEMCP", "GetCPInfo", "GetEnvironmentStringsW", "GetStartupInfoW", "IsDebuggerPresent", "InitializeSListHead", "GetSystemTimeAsFileTime", "QueryPerformanceCounter", "IsProcessorFeaturePresent", "TerminateProcess", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetTempFileNameW", "Sleep", "SearchPathW", "GetProfileIntW", "GetTempPathW", "VerifyVersionInfoW", "VerSetConditionMask", "GetWindowsDirectoryW", "GetTickCount", "FindResourceExW", "lstrcpyW", "GetCurrentDirectoryW", "GlobalFlags", "GetUserDefaultUILanguage", "GetSystemDefaultUILanguage", "GetLocaleInfoW", "GlobalGetAtomNameW", "SetErrorMode", "SystemTimeToTzSpecificLocalTime", "GetFileTime", "GetFileSizeEx", "GetFileAttributesExW", "GetFileAttributesW", "FileTimeToLocalFileTime", "LocalReAlloc", "LocalAlloc", "GlobalHandle", "GlobalReAlloc", "TlsFree", "TlsSetValue", "TlsGetValue", "TlsAlloc", "LeaveCriticalSection", "EnterCriticalSection", "InitializeCriticalSection", "VirtualProtect", "FileTimeToSystemTime", "lstrcmpA", "GetVersionExW", "GetCurrentThread", "ResumeThread", "SetThreadPriority", "CreateEventW", "WaitForSingleObject", "GetCurrentProcessId", "CompareStringW", "GlobalFindAtomW", "GlobalAddAtomW", "lstrcmpW", "GlobalDeleteAtom", "FreeLibrary", "GetSystemDirectoryW", "GetCurrentThreadId", "EncodePointer", "GetThreadLocale", "lstrcmpiW", "LoadLibraryW", "LoadLibraryA", "LoadLibraryExW", "GetModuleHandleA", "DuplicateHandle", "OutputDebugStringA", "WriteFile", "UnlockFile", "SetFilePointer", "SetEndOfFile", "ReadFile", "LockFile", "GetVolumeInformationW", "GetFullPathNameW", "GetFileSize", "FlushFileBuffers", "FindFirstFileW", "FindClose", "DeleteFileW", "CopyFileW", "FormatMessageW", "MulDiv", "LocalFree", "GlobalFree", "GlobalSize", "SetLastError", "ReadProcessMemory", "OpenProcess", "GetProcAddress", "GetModuleHandleW", "CreateFileW", "WideCharToMultiByte", "GetPrivateProfileStringW", "GlobalLock", "GlobalUnlock", "GlobalAlloc", "WritePrivateProfileStringW", "GetPrivateProfileIntW", "GetCurrentProcess", "GetModuleFileNameW", "CreateDirectoryW", "FindResourceW", "WriteConsoleW", "SizeofResource", "LockResource", "LoadResource", "MultiByteToWideChar", "CloseHandle", "DeleteCriticalSection", "InitializeCriticalSectionAndSpinCount", "GetProcessHeap", "HeapSize", "HeapFree", "HeapReAlloc", "HeapAlloc", "GetLastError", "RaiseException", "DecodePointer", "FreeEnvironmentStringsW", "SetEnvironmentVariableW", "GetStringTypeW", "GetModuleHandleExW" ], "USER32.dll": [ "IntersectRect", "RealChildWindowFromPoint", "CopyImage", "GetSysColorBrush", "CharNextW", "GetAsyncKeyState", "WindowFromPoint", "GetDesktopWindow", "GetNextDlgTabItem", "EndDialog", "CreateDialogIndirectParamW", "OffsetRect", "SetRectEmpty", "SendDlgItemMessageA", "SystemParametersInfoW", "InflateRect", "GetMenuItemInfoW", "DestroyMenu", "ClientToScreen", "GetWindowDC", "TabbedTextOutW", "GrayStringW", "DrawTextExW", "DrawTextW", "MapDialogRect", "SetWindowContextHelpId", "ShowOwnedPopups", "PostQuitMessage", "GetActiveWindow", "TranslateMessage", "GetMessageW", "IsDialogMessageW", "SetWindowTextW", "CheckDlgButton", "GetDlgItemTextW", "SetDlgItemTextW", "GetDlgItemInt", "SetDlgItemInt", "MoveWindow", "SetMenuItemInfoW", "GetMenuCheckMarkDimensions", "SetMenuItemBitmaps", "EnableMenuItem", "CheckMenuItem", "WaitMessage", "IsWindowEnabled", "ReleaseDC", "GetDC", "MapVirtualKeyW", "GetKeyNameTextW", "GetMonitorInfoW", "MonitorFromWindow", "WinHelpW", "GetScrollInfo", "SetScrollInfo", "CallNextHookEx", "UnhookWindowsHookEx", "SetWindowsHookExW", "GetWindow", "GetLastActivePopup", "GetTopWindow", "GetClassNameW", "DeleteMenu", "SetWindowLongW", "GetWindowLongW", "PtInRect", "EqualRect", "CopyRect", "MapWindowPoints", "ScreenToClient", "MessageBoxW", "AdjustWindowRectEx", "GetWindowTextLengthW", "GetWindowTextW", "RemovePropW", "GetPropW", "SetPropW", "ShowScrollBar", "GetScrollRange", "SetScrollRange", "InvertRect", "SetScrollPos", "ScrollWindow", "RedrawWindow", "ValidateRect", "EndPaint", "BeginPaint", "GetForegroundWindow", "SetActiveWindow", "UpdateWindow", "EnableScrollBar", "SetMenu", "GetMenu", "GetCapture", "GetKeyState", "GetFocus", "SetFocus", "GetDlgCtrlID", "GetDlgItem", "EndDeferWindowPos", "NotifyWinEvent", "GetMenuDefaultItem", "SetLayeredWindowAttributes", "EnumDisplayMonitors", "UnregisterClassW", "SendMessageW", "PostMessageW", "IsWindow", "DeferWindowPos", "BeginDeferWindowPos", "SetWindowPlacement", "GetWindowPlacement", "SetWindowPos", "DestroyWindow", "IsChild", "IsMenu", "CreateWindowExW", "GetClassInfoExW", "CallWindowProcW", "DefWindowProcW", "GetMessageTime", "GetMessagePos", "PeekMessageW", "DispatchMessageW", "CharUpperW", "RemoveMenu", "DestroyIcon", "SetCapture", "ReleaseCapture", "CopyAcceleratorTableW", "InvalidateRgn", "SetRect", "IsRectEmpty", "GetNextDlgGroupItem", "MessageBeep", "TrackMouseEvent", "LoadImageW", "LoadAcceleratorsW", "TranslateAcceleratorW", "CreatePopupMenu", "AppendMenuW", "InsertMenuW", "GetMenuItemCount", "InsertMenuItemW", "UnpackDDElParam", "ReuseDDElParam", "RegisterClipboardFormatW", "DrawFocusRect", "DrawIconEx", "GetClassLongW", "DrawStateW", "SetClassLongW", "SetWindowRgn", "SetParent", "DrawEdge", "DrawFrameControl", "DestroyCursor", "GetWindowRgn", "CreateMenu", "FindWindowExW", "RegisterClassW", "GetClassInfoW", "IsWindowVisible", "IsIconic", "BringWindowToTop", "SetForegroundWindow", "FindWindowW", "RegisterWindowMessageW", "ExitWindowsEx", "ShowWindow", "SetTimer", "KillTimer", "EnableWindow", "GetSystemMetrics", "LoadMenuW", "GetSubMenu", "SetMenuDefaultItem", "DrawIcon", "GetClientRect", "GetWindowRect", "LoadIconW", "OpenClipboard", "CloseClipboard", "SetClipboardData", "EmptyClipboard", "GetCursorPos", "InvalidateRect", "GetParent", "GetWindowThreadProcessId", "GetMenuItemID", "TrackPopupMenu", "SetCursor", "GetSysColor", "FillRect", "LoadBitmapW", "LoadCursorW", "GetMenuStringW", "GetMenuState", "SubtractRect", "TranslateMDISysAccel", "GetIconInfo", "HideCaret", "DefMDIChildProcW", "DefFrameProcW", "DrawMenuBar", "GetUpdateRect", "IsClipboardFormatAvailable", "CharUpperBuffW", "ModifyMenuW", "GetDoubleClickTime", "LockWindowUpdate", "DestroyAcceleratorTable", "CreateAcceleratorTableW", "GetKeyboardState", "ToUnicodeEx", "MapVirtualKeyExW", "IsCharLowerW", "GetKeyboardLayout", "GetComboBoxInfo", "MonitorFromPoint", "UpdateLayeredWindow", "PostThreadMessageW", "UnionRect", "FrameRect", "CopyIcon", "SetCursorPos", "GetSystemMenu", "GetScrollPos", "IsZoomed" ], "GDI32.dll": [ "ExcludeClipRect", "GetClipBox", "GetObjectType", "GetPixel", "GetViewportExtEx", "GetWindowExtEx", "IntersectClipRect", "LineTo", "PtVisible", "RectVisible", "RestoreDC", "SaveDC", "SelectClipRgn", "ExtSelectClipRgn", "SelectObject", "SelectPalette", "SetBkMode", "SetMapMode", "SetLayout", "GetLayout", "SetPolyFillMode", "SetROP2", "SetTextAlign", "MoveToEx", "TextOutW", "ExtTextOutW", "SetViewportExtEx", "SetViewportOrgEx", "SetWindowExtEx", "SetWindowOrgEx", "OffsetViewportOrgEx", "OffsetWindowOrgEx", "ScaleViewportExtEx", "ScaleWindowExtEx", "CreateFontIndirectW", "GetTextExtentPoint32W", "DeleteObject", "GetTextColor", "CombineRgn", "GetMapMode", "SetRectRgn", "DPtoLP", "GetRgnBox", "GetTextMetricsW", "EnumFontFamiliesExW", "CreateCompatibleBitmap", "CreatePalette", "GetNearestPaletteIndex", "GetPaletteEntries", "GetSystemPaletteEntries", "RealizePalette", "CreateDIBitmap", "EnumFontFamiliesW", "GetTextCharsetInfo", "SetPixel", "StretchBlt", "CreateDIBSection", "SetDIBColorTable", "CreateEllipticRgn", "Ellipse", "CreatePolygonRgn", "Polygon", "Polyline", "CreateRoundRectRgn", "LPtoDP", "OffsetRgn", "RoundRect", "FillRgn", "FrameRgn", "GetBoundsRect", "PtInRegion", "ExtFloodFill", "SetPaletteEntries", "SetPixelV", "GetWindowOrgEx", "GetViewportOrgEx", "GetTextFaceW", "DeleteDC", "CreateRectRgn", "CreatePatternBrush", "CreatePen", "CreateHatchBrush", "CreateCompatibleDC", "BitBlt", "CreateBitmap", "PatBlt", "CreateRectRgnIndirect", "SetTextColor", "SetBkColor", "GetDeviceCaps", "CreateDCW", "CopyMetaFileW", "GetObjectW", "Rectangle", "GetStockObject", "GetBkColor", "Escape", "CreateSolidBrush" ], "MSIMG32.dll": [ "AlphaBlend", "TransparentBlt" ], "WINSPOOL.DRV": [ "ClosePrinter", "OpenPrinterW", "DocumentPropertiesW" ], "ADVAPI32.dll": [ "RegDeleteValueW", "AdjustTokenPrivileges", "LookupPrivilegeValueW", "RegEnumKeyExW", "RegEnumValueW", "RegQueryValueW", "RegEnumKeyW", "RegSetValueExW", "OpenProcessToken", "RegDeleteKeyW", "RegCreateKeyExW", "RegQueryValueExW", "RegOpenKeyExW", "RegCloseKey" ], "SHELL32.dll": [ "Shell_NotifyIconW", "SHGetFileInfoW", "DragQueryFileW", "DragFinish", "SHGetPathFromIDListW", "SHGetSpecialFolderLocation", "SHAppBarMessage", "SHBrowseForFolderW", "SHGetDesktopFolder", "ShellExecuteW" ], "COMCTL32.dll": [ "ImageList_AddMasked", "InitCommonControlsEx" ], "SHLWAPI.dll": [ "PathFindExtensionW", "PathIsUNCW", "PathRemoveFileSpecW", "StrFormatKBSizeW", "PathFindFileNameW", "PathStripToRootW" ], "UxTheme.dll": [ "IsAppThemed", "GetThemePartSize", "IsThemeBackgroundPartiallyTransparent", "GetCurrentThemeName", "GetWindowTheme", "DrawThemeBackground", "CloseThemeData", "OpenThemeData", "DrawThemeParentBackground", "DrawThemeText", "GetThemeColor", "GetThemeSysColor" ], "ole32.dll": [ "OleCreateMenuDescriptor", "OleDestroyMenuDescriptor", "OleTranslateAccelerator", "IsAccelerator", "OleLockRunning", "RevokeDragDrop", "RegisterDragDrop", "CoLockObjectExternal", "OleGetClipboard", "DoDragDrop", "CoRegisterMessageFilter", "OleIsCurrentClipboard", "OleFlushClipboard", "CoRevokeClassObject", "CreateStreamOnHGlobal", "OleUninitialize", "OleInitialize", "CoFreeUnusedLibraries", "CreateILockBytesOnHGlobal", "StgOpenStorageOnILockBytes", "StgCreateDocfileOnILockBytes", "CoGetClassObject", "CoDisconnectObject", "CoInitializeEx", "CLSIDFromProgID", "CLSIDFromString", "CoInitialize", "CoCreateInstance", "CoCreateGuid", "CoUninitialize", "ReleaseStgMedium", "OleDuplicateData", "CoTaskMemFree", "CoTaskMemAlloc" ], "OLEAUT32.dll": [ "SafeArrayDestroy", "VariantCopy", "SysStringLen", "VarBstrFromDate", "LoadTypeLib", "OleCreateFontIndirect", "SysAllocStringLen", "VariantInit", "VariantClear", "VariantTimeToSystemTime", "VariantChangeType", "SysFreeString", "SysAllocString", "SystemTimeToVariantTime" ], "oledlg.dll": [ "OleUIBusyW" ], "WS2_32.dll": [ "WSASetLastError", "WSACleanup", "WSAStartup" ], "PSAPI.DLL": [ "GetModuleBaseNameW" ], "gdiplus.dll": [ "GdipFree", "GdiplusStartup", "GdipCloneImage", "GdipDisposeImage", "GdipGetImageWidth", "GdipGetImageHeight", "GdipGetImagePixelFormat", "GdipGetImagePalette", "GdipGetImagePaletteSize", "GdipCreateBitmapFromStream", "GdipCreateBitmapFromScan0", "GdipBitmapLockBits", "GdipBitmapUnlockBits", "GdipDeleteGraphics", "GdipDrawImageI", "GdipCreateBitmapFromHBITMAP", "GdipCreateFromHDC", "GdipSetInterpolationMode", "GdipDrawImageRectI", "GdipGetImageGraphicsContext", "GdipAlloc", "GdiplusShutdown" ], "OLEACC.dll": [ "AccessibleObjectFromWindow", "LresultFromObject", "CreateStdAccessibleObject" ], "IMM32.dll": [ "ImmReleaseContext", "ImmGetOpenStatus", "ImmGetContext" ] }, "import_dlls": [ "ADVAPI32.dll", "COMCTL32.dll", "GDI32.dll", "IMM32.dll", "KERNEL32.dll", "MSIMG32.dll", "OLEACC.dll", "OLEAUT32.dll", "PSAPI.DLL", "SHELL32.dll", "SHLWAPI.dll", "USER32.dll", "UxTheme.dll", "VLHookPr.dll", "WINMM.dll", "WINSPOOL.DRV", "WS2_32.dll", "gdiplus.dll", "ole32.dll", "oledlg.dll" ], "has_authenticode": false, "overlay_size": 0, "string_count": 7523, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "loadlibrary": 3, "startup": 2, "http://": 1, "readprocessmemory": 1, "setwindowshookex": 1, "getasynckeystate": 1, "shellexecute": 1, "getprocaddress": 1, "http": 1 } }, "strings_file": "vlautopr_new_VLAutoPr.exe.strings.txt" }, "kymyen_new_KY_VCTK_CTCX_NEW.exe": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\_AutoKimYen\\KY_VCTK_CTCX_NEW.exe", "size": 15775232, "mtime_local": "2026-09-20 18:32:55", "sha256": "2C6205FBD41C305E2159A45B67ADF1D5501E5785E0BB97E2A0C724B6F6CBFFBC", "md5": "EA9374035CEC11189691D2B02B2058D7", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1683735105, "subsystem": 2, "ep_rva": "0xefd51c", "image_base": "0x400000", "sections": [ "(empty) vsz=0xD000 raw=0x7A00 ent=7.99 RWX!", "(empty) vsz=0x6000 raw=0x2400 ent=7.89 RWX!", "(empty) vsz=0x2000 raw=0x200 ent=6.27 RWX!", "(empty) vsz=0x2000 raw=0x200 ent=3.97 RWX!", "(empty) vsz=0x1000 raw=0xE00 ent=7.92 RWX!", "(empty) vsz=0x513000 raw=0x402000 ent=8.00 RWX!", ".rsrc vsz=0x2000 raw=0x2000 ent=3.64", "(empty) vsz=0x7B7000 raw=0x8E0E00 ent=8.00 RWX!", ".data vsz=0x21C000 raw=0x21B400 ent=7.96 RWX!" ], "max_section_entropy": 8.0, "imports": { "kernel32.dll": [ "GetModuleHandleA", "GetProcAddress", "ExitProcess", "LoadLibraryA" ], "user32.dll": [ "MessageBoxA" ], "advapi32.dll": [ "RegCloseKey" ], "oleaut32.dll": [ "SysFreeString" ], "gdi32.dll": [ "CreateFontA" ], "shell32.dll": [ "ShellExecuteA" ], "version.dll": [ "GetFileVersionInfoA" ] }, "import_dlls": [ "advapi32.dll", "gdi32.dll", "kernel32.dll", "oleaut32.dll", "shell32.dll", "user32.dll", "version.dll" ], "export_count": 0, "has_authenticode": false, "overlay_size": 0, "string_count": 75837, "interesting": { "urls": [ "http://pki-ocsp.symauth.com0" ], "url_count": 1, "ips": [], "ip_count": 0, "keyword_hits": { "http://": 3, "http": 3, "shellexecute": 1, "loadlibrary": 1, "getprocaddress": 1, "vlbs": 1 } }, "strings_file": "kymyen_new_KY_VCTK_CTCX_NEW.exe.strings.txt" }, "kymyen_new_vauth.auto": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\_AutoKimYen\\vauth.auto", "size": 6633984, "mtime_local": "2026-09-19 08:40:18", "sha256": "ACD28D061CA9B210A2801D06C546AD0BC995A49510375A7F17D6C86449B2849B", "md5": "CD3151230F31824FDD74741FB298041E", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1789781998, "subsystem": 2, "ep_rva": "0x65455e", "image_base": "0x400000", "sections": [ ".text vsz=0x652564 raw=0x652600 ent=6.75", ".rsrc vsz=0xF50 raw=0x1000 ent=3.34", ".reloc vsz=0xC raw=0x200 ent=0.10" ], "max_section_entropy": 6.75, "imports": { "mscoree.dll": [ "_CorExeMain" ] }, "import_dlls": [ "mscoree.dll" ], "has_authenticode": false, "overlay_size": 0, "string_count": 25085, "interesting": { "urls": [], "url_count": 0, "ips": [ "10.0.0.0", "2.0.2.4", "4.0.0.0" ], "ip_count": 3, "keyword_hits": { "http": 2, "writeprocessmemory": 1, "readprocessmemory": 1, "createremotethread": 1, "setwindowshookex": 1, "sendinput": 1, "shellexecute": 1, "createprocess": 1, "getprocaddress": 1 } }, "strings_file": "kymyen_new_vauth.auto.strings.txt" }, "asi_mPK_congdongvolam.com.asi": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\_AutoVLBS\\VLBS19Dai\\mPK_congdongvolam.com.asi", "size": 9374720, "mtime_local": "2026-09-10 00:23:10", "sha256": "EC9A1605D4FFCA2950410A33DC3C5697D3668AAD6376ABB9AA1BF182435B526E", "md5": "71454C678ADBAC5417FA60815A4CC88A", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1717189491, "subsystem": 2, "ep_rva": "0x1b2a7a8", "image_base": "0x10000000", "sections": [ "(empty) vsz=0xC54000 raw=0x55AA00 ent=8.00 RWX!", "(empty) vsz=0x586000 raw=0x13FC00 ent=8.00 RWX!", "(empty) vsz=0x47000 raw=0x5800 ent=7.99 RWX!", "(empty) vsz=0x5B000 raw=0x35400 ent=8.00 RWX!", "(empty) vsz=0x695000 raw=0xA00 ent=7.47 RWX!", ".data vsz=0x21B000 raw=0x21AC00 ent=7.96 RWX!" ], "max_section_entropy": 8.0, "imports": { "kernel32.dll": [ "GetModuleHandleA", "GetProcAddress", "ExitProcess", "LoadLibraryA" ], "user32.dll": [ "MessageBoxA" ], "advapi32.dll": [ "RegCloseKey" ], "oleaut32.dll": [ "SysFreeString" ], "gdi32.dll": [ "CreateFontA" ], "shell32.dll": [ "ShellExecuteA" ], "version.dll": [ "GetFileVersionInfoA" ], "SHLWAPI.dll": [ "StrRetToStrW" ], "DNSAPI.dll": [ "DnsFree" ], "IPHLPAPI.DLL": [ "GetBestInterfaceEx" ], "WS2_32.dll": [ "freeaddrinfo" ], "CRYPT32.dll": [ "CertCloseStore" ], "PSAPI.DLL": [ "EnumProcessModules" ], "ole32.dll": [ "CoTaskMemFree" ], "bcrypt.dll": [ "BCryptGenRandom" ], "WINMM.dll": [ "timeGetTime" ] }, "import_dlls": [ "CRYPT32.dll", "DNSAPI.dll", "IPHLPAPI.DLL", "PSAPI.DLL", "SHLWAPI.dll", "WINMM.dll", "WS2_32.dll", "advapi32.dll", "bcrypt.dll", "gdi32.dll", "kernel32.dll", "ole32.dll", "oleaut32.dll", "shell32.dll", "user32.dll", "version.dll" ], "export_count": 844, "has_authenticode": false, "overlay_size": 0, "string_count": 45037, "interesting": { "urls": [ "http://pki-ocsp.symauth.com0" ], "url_count": 1, "ips": [], "ip_count": 0, "keyword_hits": { "http://": 3, "http": 3, "shellexecute": 1, "loadlibrary": 1, "getprocaddress": 1 } }, "strings_file": "asi_mPK_congdongvolam.com.asi.strings.txt" }, "vlbs13_core.dll": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\_AutoVLBS\\VLBS13\\core.dll", "size": 112640, "mtime_local": "2026-09-18 20:07:52", "sha256": "B33802F9B261711EB5F63EB3C75FED81D737CCD46FCD4EB4B5934FB50C2156DE", "md5": "94A95FE6E16A3C4F140CD50C9E5E77E3", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1373802646, "subsystem": 2, "ep_rva": "0x9e329", "image_base": "0x10000000", "sections": [ ".text vsz=0x9D000 raw=0x1A000 ent=8.00 RWX!", ".rsrc vsz=0x2000 raw=0x1200 ent=7.13 RWX!", ".reloc vsz=0x200 raw=0x200 ent=0.18" ], "max_section_entropy": 8.0, "imports": { "kernel32.dll": [ "LoadLibraryA", "GetProcAddress", "VirtualAlloc", "VirtualFree" ], "USER32.dll": [ "GetWindowRect" ] }, "import_dlls": [ "USER32.dll", "kernel32.dll" ], "export_count": 3, "has_authenticode": false, "overlay_size": 0, "string_count": 509, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "loadlibrary": 1, "getprocaddress": 1 } }, "strings_file": "vlbs13_core.dll.strings.txt" }, "winmm_VLBS19Dai.dll": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\_AutoVLBS\\VLBS19Dai\\winmm.dll", "size": 1759744, "mtime_local": "2026-09-10 00:23:04", "sha256": "92858E63788EF967961D7A41EE1A3051E845657A181430A00FD68D9DB6942B7C", "md5": "1931075B59D02ADAF01C829C086D5426", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1743002085, "subsystem": 2, "ep_rva": "0x463d9", "image_base": "0x10000000", "sections": [ ".text vsz=0x7A26C raw=0x7A400 ent=6.55", ".rdata vsz=0x2D352 raw=0x2D400 ent=5.29", ".data vsz=0x941AC raw=0x2000 ent=3.96", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0xFCAD0 raw=0xFCC00 ent=6.67", ".reloc vsz=0x6FA8 raw=0x7000 ent=6.68" ], "max_section_entropy": 6.68, "imports": { "KERNEL32.dll": [ "HeapFree", "GetProcessHeap", "GetNativeSystemInfo", "VirtualAlloc", "VirtualProtect", "VirtualFree", "FreeLibrary", "GetProcAddress", "LoadLibraryA", "IsBadReadPtr", "LoadLibraryW", "VirtualQuery", "CloseHandle", "GetLastError", "HeapCreate", "HeapReAlloc", "Sleep", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThreadId", "OpenThread", "SuspendThread", "ResumeThread", "GetThreadContext", "SetThreadContext", "FlushInstructionCache", "GetModuleHandleW", "CreateToolhelp32Snapshot", "Thread32First", "Thread32Next", "GetCommandLineA", "GetCommandLineW", "SetCurrentDirectoryW", "GetCurrentDirectoryW", "CreateFileA", "CreateFileW", "FindClose", "FindFirstFileA", "FindFirstFileW", "FindFirstFileExA", "FindFirstFileExW", "FindNextFileA", "FindNextFileW", "GetFileAttributesA", "GetFileAttributesW", "GetFileAttributesExA", "GetFileAttributesExW", "WriteFile", "CreateFile2", "OutputDebugStringA", "SetUnhandledExceptionFilter", "AcquireSRWLockExclusive", "CreateMutexW", "OpenMutexW", "HeapAlloc", "CreateEventW", "ExitProcess", "GetCurrentThread", "GetStartupInfoW", "GetSystemInfo", "GetSystemTimeAsFileTime", "GetModuleFileNameA", "GetModuleFileNameW", "GetModuleHandleA", "GetModuleHandleExA", "GetModuleHandleExW", "LoadLibraryExA", "LoadLibraryExW", "LoadResource", "LockResource", "SizeofResource", "FindResourceW", "GetShortPathNameA", "GetStartupInfoA", "GetPrivateProfileIntW", "GetPrivateProfileStringW", "MultiByteToWideChar", "CreateDirectoryA", "CreateDirectoryW", "CancelIo", "InitializeCriticalSection", "EnterCriticalSection", "LeaveCriticalSection", "SetEvent", "ResetEvent", "CreateThread", "GetSystemTime", "SystemTimeToFileTime", "SetEndOfFile", "WriteConsoleW", "HeapSize", "SetStdHandle", "SetEnvironmentVariableW", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetOEMCP", "GetACP", "IsValidCodePage", "GetTimeZoneInformation", "ReadConsoleW", "GetConsoleMode", "GetConsoleOutputCP", "FlushFileBuffers", "EnumSystemLocalesW", "GetUserDefaultLCID", "IsValidLocale", "GetLocaleInfoW", "LCMapStringW", "CompareStringW", "GetTimeFormatW", "GetDateFormatW", "CreateEventA", "SetLastError", "FlsFree", "FlsSetValue", "FlsGetValue", "FlsAlloc", "SetFilePointerEx", "GetFileSizeEx", "GetFileType", "GetStdHandle", "ReadFile", "TlsFree", "TlsSetValue", "TlsGetValue", "TlsAlloc", "InitializeCriticalSectionAndSpinCount", "InterlockedFlushSList", "RaiseException", "RtlUnwind", "LCMapStringEx", "GetCPInfo", "CompareStringEx", "DecodePointer", "EncodePointer", "DeleteCriticalSection", "InitializeCriticalSectionEx", "GetStringTypeW", "WideCharToMultiByte", "GetFileInformationByHandleEx", "AreFileApisANSI", "GetFullPathNameW", "GetLocaleInfoEx", "FormatMessageA", "LocalFree", "InitializeSListHead", "QueryPerformanceCounter", "IsDebuggerPresent", "IsProcessorFeaturePresent", "TerminateProcess", "UnhandledExceptionFilter", "SleepConditionVariableSRW", "ReleaseSRWLockExclusive", "WakeAllConditionVariable" ], "USER32.dll": [ "GetDlgItemTextW", "SetWindowTextW", "GetWindowRect", "GetDesktopWindow", "EnumWindows", "GetWindowThreadProcessId", "SetDlgItemTextW", "EndDialog", "DialogBoxParamW", "SetWindowsHookExW", "FindWindowW", "ShowCursor", "SetForegroundWindow", "KillTimer", "SetTimer", "SendMessageW", "ReleaseDC", "GetDC", "MessageBoxW", "CallNextHookEx", "wsprintfW", "SetWindowPos" ], "GDI32.dll": [ "GetDeviceCaps" ], "SHELL32.dll": [ "SHGetKnownFolderPath", "ShellExecuteW" ], "ole32.dll": [ "CoTaskMemFree", "CoCreateInstance" ], "d3d9.dll": [ "Direct3DCreate9" ], "dbghelp.dll": [ "SymFromAddr", "MiniDumpWriteDump", "SymCleanup", "SymSetOptions", "StackWalk64", "SymInitialize" ], "WS2_32.dll": [ "inet_ntoa", "inet_addr", "htons", "htonl", "getsockopt", "ntohl", "getpeername", "ioctlsocket", "connect", "closesocket", "bind", "accept", "ntohs", "recv", "recvfrom", "select", "send", "sendto", "setsockopt", "shutdown", "socket", "WSAStartup", "WSACleanup", "WSASetLastError", "WSAGetLastError", "WSACloseEvent", "WSACreateEvent", "listen", "WSAEventSelect", "WSAGetOverlappedResult", "WSARecv", "WSARecvFrom", "WSAResetEvent", "WSASend", "WSASendTo", "WSASetEvent", "WSAWaitForMultipleEvents", "getsockname", "__WSAFDIsSet" ] }, "import_dlls": [ "GDI32.dll", "KERNEL32.dll", "SHELL32.dll", "USER32.dll", "WS2_32.dll", "d3d9.dll", "dbghelp.dll", "ole32.dll" ], "export_count": 1308, "has_authenticode": false, "overlay_size": 0, "string_count": 11661, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "http": 212, "winhttp": 156, "loadlibrary": 15, "startup": 12, "internetopen": 8, "setwindowshookex": 5, "createprocess": 5, "getprocaddress": 4, "cookies": 2, "getasynckeystate": 2, "minidump": 1, "writeprocessmemory": 1, "readprocessmemory": 1, "createremotethread": 1, "virtualprotectex": 1, "shellexecute": 1 } }, "strings_file": "winmm_VLBS19Dai.dll.strings.txt" }, "blob_vietguards.driver": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\vietguards.driver", "size": 32342408, "mtime_local": "2026-09-24 20:23:32", "sha256": "0AC4697919C9639614E9F82E20981535466B7D0A0C5E85578009EFD8D085AE87", "md5": "C4F7915C33E0B73F79D01AF71FADE93D", "mz_header": false, "blob": { "per_mb_entropy": [ 7.957, 7.918, 8.0, 7.999, 7.999, 7.999, 7.999, 7.999, 8.0, 8.0, 8.0, 7.982, 7.951, 7.955, 7.955, 7.977, 7.983, 7.963, 7.969, 7.924, 7.925, 7.966, 7.963, 7.965, 7.996, 8.0, 8.0, 8.0, 8.0, 8.0, 7.999 ], "embedded_pe_offsets": [], "first_bytes_hex": "7f 6f 8b c0 fd 97 fd a4 97 3f cb 0b 74 7e 41 7d f4 d5 27 31 aa fa 9d 05 ee 56 50 d2 a2 e8 d6 16" }, "string_count": 144406, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "vlbs": 1 } }, "strings_file": "blob_vietguards.driver.strings.txt" }, "vietguard_VietGuardJX.sys": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\VietGuardJX.sys", "size": 212988, "mtime_local": "2026-08-17 00:23:48", "sha256": "8FCF5088FFD8E0FFA20C418727A5401105052D0E38EED545710D378B08AA8CE6", "md5": "D6C2437C49321AF6130560033E9401B2", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1230104570, "subsystem": 2, "ep_rva": "0xc29d", "image_base": "0x400000", "sections": [ ".text vsz=0x1C06A raw=0x1D000 ent=6.57", ".rdata vsz=0x6638 raw=0x7000 ent=4.75", ".data vsz=0x5D58 raw=0x2000 ent=3.62", ".rsrc vsz=0xC16C raw=0xD000 ent=4.52" ], "max_section_entropy": 6.57, "imports": { "*invalid*": [ "ord_12", "ord_8" ] }, "import_dlls": [ "*invalid*" ], "has_authenticode": false, "overlay_size": 3728, "string_count": 775, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "loadlibrary": 2, "startup": 2, "setwindowshookex": 1, "shellexecute": 1, "createprocess": 1, "getprocaddress": 1 } }, "strings_file": "vietguard_VietGuardJX.sys.strings.txt" }, "engine_engine.dll": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\engine.dll", "size": 402848, "mtime_local": "2020-02-28 23:02:56", "sha256": "3BB7F74631C0B51C1E53AF1630371839B04F93EE41B0CB8E0357295715F51A91", "md5": "7F0F77B191E766E590963EDFDC899790", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1339763544, "subsystem": 2, "ep_rva": "0x309c1", "image_base": "0x10000000", "sections": [ ".text vsz=0x3D8CA raw=0x3E000 ent=6.58 RWX!", ".rdata vsz=0x15BA7 raw=0x16000 ent=5.80", ".data vsz=0x114B0 raw=0x7000 ent=3.92", ".rsrc vsz=0x51C raw=0x1000 ent=4.13", ".reloc vsz=0x3822 raw=0x4000 ent=5.90" ], "max_section_entropy": 6.58, "imports": { "DDRAW.dll": [ "DirectDrawCreate" ], "DSOUND.dll": [ "ord_1" ], "WINMM.dll": [ "timeKillEvent", "timeGetTime", "timeSetEvent" ], "DINPUT8.dll": [ "DirectInput8Create" ], "KERNEL32.dll": [ "InterlockedDecrement", "GetTickCount", "SetLocalTime", "GetCurrentThreadId", "Sleep", "WaitForMultipleObjects", "InitializeCriticalSection", "DeleteCriticalSection", "EnterCriticalSection", "LeaveCriticalSection", "GetCurrentDirectoryA", "FindClose", "FindNextFileA", "SetCurrentDirectoryA", "FindFirstFileA", "TerminateThread", "SuspendThread", "ResumeThread", "InterlockedIncrement", "SetThreadPriority", "QueryPerformanceFrequency", "QueryPerformanceCounter", "GetCurrentProcessId", "GetLastError", "CreateDirectoryA", "DeleteFileA", "SetFileAttributesA", "CopyFileA", "CompareFileTime", "GetFileAttributesA", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "InterlockedCompareExchange", "InterlockedExchange", "WaitForSingleObject", "SetEvent", "CloseHandle", "CreateEventA", "LoadLibraryA", "GetProcAddress", "FreeLibrary", "GetModuleHandleA", "DisableThreadLibraryCalls", "GetThreadPriority", "IsDebuggerPresent", "GetSystemTimeAsFileTime" ], "USER32.dll": [ "RegisterClassA", "LoadCursorA", "LoadIconA", "SetFocus", "UpdateWindow", "CreateWindowExA", "SetCursor", "DestroyWindow", "PostMessageA", "WaitMessage", "GetMessageA", "DispatchMessageA", "PostQuitMessage", "GetCursorPos", "DefWindowProcA", "GetSystemMetrics", "GetKeyboardLayout", "MessageBoxA", "SendMessageA", "FindWindowA", "SetWindowLongA", "GetWindowLongA", "GetMenu", "AdjustWindowRectEx", "SetWindowPos", "ScreenToClient", "ClientToScreen", "GetClientRect", "PeekMessageA", "TranslateMessage" ], "GDI32.dll": [ "GetStockObject" ], "comdlg32.dll": [ "GetSaveFileNameA", "GetOpenFileNameA" ], "LuaLibDll.dll": [ "lua_isnumber", "lua_close", "lua_open", "lua_baselibopen", "lua_iolibopen", "lua_strlibopen", "lua_mathlibopen", "lua_dblibopen", "lua_setgcthreshold", "lua_getgcthreshold", "lua_newpack", "lua_newtag", "lua_joinpack", "lua_clearpack", "lua_isstring", "lua_call", "Lua_SetTable_StringFromId", "Lua_SetTable_DoubleFromId", "Lua_SetTable_IntFromId", "Lua_SetTable_CFunFromName", "Lua_SetTable_CFunFromId", "Lua_SetTable_StringFromName", "Lua_SetTable_IntFromName", "Lua_SetTable_DoubleFromName", "lua_gettopindex", "lua_settop", "lua_gettop", "lua_pushnumber", "lua_pushstring", "lua_tonumber", "lua_tostring", "lua_compilebuffer", "lua_usepack", "lua_dostring", "lua_addbreakpoint", "lua_delbreakpoint", "lua_remove", "lua_rawget", "lua_type", "lua_getglobal", "lua_setglobal", "lua_pushcclosure", "lua_outerrmsg", "lua_newtable", "lua_setoutput_function", "lua_execute", "lua_pushusertag", "lua_rawseti", "lua_pushvalue", "lua_pushnil" ], "MSVCR80.dll": [ "_open", "_close", "_write", "_chdir", "_getcwd", "_stricmp", "??3@YAXPAX@Z", "??_V@YAXPAX@Z", "__CxxFrameHandler3", "??2@YAPAXI@Z", "memset", "free", "malloc", "strrchr", "_localtime32", "_time32", "vsprintf", "exit", "sprintf", "fclose", "strncpy", "_stat32", "fopen", "_snprintf", "fflush", "fwrite", "vfprintf", "fprintf", "??0exception@std@@QAE@ABQBD@Z", "?what@exception@std@@UBEPBDXZ", "??1exception@std@@UAE@XZ", "??0exception@std@@QAE@XZ", "_invalid_parameter_noinfo", "_CxxThrowException", "??0exception@std@@QAE@ABV01@@Z", "memcpy", "printf", "_purecall", "__iob_func", "_strlwr", "_errno", "puts", "fputs", "_vsnprintf", "??_U@YAPAXI@Z", "strchr", "_findclose", "_findnext32", "_strupr", "_findfirst32", "memmove", "isdigit", "isspace", "_beginthreadex", "strtoul", "fread", "ftell", "_CIpow", "strstr", "_access", "_mkdir", "atoi", "atof", "sscanf", "memchr", "_mktime32", "memmove_s", "?terminate@@YAXXZ", "_unlock", "__dllonexit", "_encode_pointer", "_lock", "_onexit", "_decode_pointer", "_malloc_crt", "_encoded_null", "_initterm", "_initterm_e", "_amsg_exit", "_adjust_fdiv", "__CppXcptFilter", "?_type_info_dtor_internal_method@type_info@@QAEXXZ", "_except_handler4_common", "_crt_debugger_hook", "__clean_type_info_names_internal", "_ftol", "strerror", "fseek" ], "MSVCP80.dll": [ "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z", "?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z", "?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB", "?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z", "??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z" ], "IMM32.dll": [ "ImmReleaseContext", "ImmGetContext", "ImmSimulateHotKey", "ImmIsIME", "ImmSetConversionStatus", "ImmGetDefaultIMEWnd", "ImmSetOpenStatus", "ImmGetConversionStatus", "ImmSetCompositionWindow", "ImmGetOpenStatus" ] }, "import_dlls": [ "DDRAW.dll", "DINPUT8.dll", "DSOUND.dll", "GDI32.dll", "IMM32.dll", "KERNEL32.dll", "LuaLibDll.dll", "MSVCP80.dll", "MSVCR80.dll", "USER32.dll", "WINMM.dll", "comdlg32.dll" ], "export_count": 1358, "has_authenticode": true, "overlay_size": 5536, "string_count": 3004, "interesting": { "urls": [ "http://ocsp.verisign.com0", "http://ocsp.verisign.com01", "http://ocsp.verisign.com0?", "http://www.oberhumer.com", "https://www.verisign.com/cps0*", "https://www.verisign.com/rpa0" ], "url_count": 6, "ips": [], "ip_count": 0, "keyword_hits": { "http": 17, "http://": 11, "https://": 6, "loadlibrary": 1, "getprocaddress": 1, "startup": 1 } }, "strings_file": "engine_engine.dll.strings.txt" }, "film_Game_film.exe": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\Game_film.exe", "size": 2684872, "mtime_local": "2026-08-17 00:23:50", "sha256": "F17D35DF0FC473D379A79E6918E32619F9A47174F957BB77B680FD5BDBF315C9", "md5": "D208437EFC6962180D51195712901243", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1340706750, "subsystem": 2, "ep_rva": "0x213432", "image_base": "0x400000", "sections": [ ".text vsz=0x238E8C raw=0x239000 ent=6.11", ".rdata vsz=0x4146B raw=0x42000 ent=5.05", ".data vsz=0xFA2E10 raw=0x11000 ent=6.57", ".rsrc vsz=0xF54 raw=0x1000 ent=5.85" ], "max_section_entropy": 6.57, "imports": { "WS2_32.dll": [ "inet_ntoa" ], "KERNEL32.dll": [ "CloseHandle", "TerminateThread", "GetExitCodeThread", "FreeLibrary", "WaitForSingleObject", "GetProcAddress", "LoadLibraryA", "Sleep", "SystemTimeToTzSpecificLocalTime", "WritePrivateProfileStringA", "GetLastError", "CreateProcessA", "SetUnhandledExceptionFilter", "IsBadReadPtr", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThreadId", "CreateFileA", "FormatMessageA", "lstrlenA", "CreateSemaphoreA", "OpenSemaphoreA", "CreateEventA", "SetEvent", "LeaveCriticalSection", "EnterCriticalSection", "ResetEvent", "CreateThread", "InitializeCriticalSection", "InterlockedDecrement", "GetComputerNameA", "FileTimeToSystemTime", "LocalFileTimeToFileTime", "SystemTimeToFileTime", "OpenProcess", "TerminateProcess", "ReadProcessMemory", "GetCurrentDirectoryA", "GetVersionExA", "InterlockedExchange", "InterlockedCompareExchange", "GetStartupInfoA", "UnhandledExceptionFilter", "IsDebuggerPresent", "QueryPerformanceCounter", "GetSystemTimeAsFileTime", "SetLastError", "CreateMutexA", "OpenMutexA", "VirtualProtect", "LoadLibraryW", "GetProcessHeap", "HeapFree", "MulDiv", "GlobalAlloc", "GlobalLock", "GlobalUnlock", "GetTempPathA", "GetTempFileNameA", "VirtualFreeEx", "CreateRemoteThread", "WriteProcessMemory", "MultiByteToWideChar", "CreateFileMappingA", "VirtualAllocEx", "GetTickCount", "GetPrivateProfileIntA", "GetLocalTime", "GetVersion", "FindFirstFileA", "SetFileAttributesA", "DeleteFileA", "FindNextFileA", "FindClose", "RemoveDirectoryA", "AllocConsole", "FreeConsole", "GetModuleFileNameA", "GetDiskFreeSpaceExA", "DeleteCriticalSection", "MapViewOfFile", "UnmapViewOfFile", "GetProcessTimes", "GetThreadContext", "ResumeThread", "VirtualProtectEx", "FlushInstructionCache", "SetThreadContext" ], "USER32.dll": [ "GetDC", "CopyRect", "CharLowerA", "SetWindowLongA", "GetWindowLongA", "MoveWindow", "ReleaseDC", "InvalidateRect", "BringWindowToTop", "SetWindowTextA", "wsprintfA", "ReleaseCapture", "SetCapture", "SetCursorPos", "InSendMessage", "MessageBoxA", "GetMessagePos", "ScreenToClient", "GetKeyState", "SetClipboardData", "OpenClipboard", "GetClipboardData", "EmptyClipboard", "CloseClipboard", "SetCaretPos", "EnableWindow", "ShowWindow", "SetFocus", "DestroyWindow", "IsWindow", "GetClientRect", "ClientToScreen", "SetWindowPos", "CreateWindowExA", "ShowCursor", "LoadCursorFromFileA", "LoadCursorA", "SetCursor", "SendMessageA", "GetParent" ], "comdlg32.dll": [ "GetOpenFileNameA" ], "ADVAPI32.dll": [ "OpenProcessToken", "RegQueryValueExA", "LookupPrivilegeValueA", "AdjustTokenPrivileges", "RegOpenKeyExA", "RegSetValueExA", "RegCreateKeyExA", "RegCloseKey" ], "SHELL32.dll": [ "SHGetSpecialFolderPathA", "ShellExecuteA" ], "ole32.dll": [ "StgCreateDocfile", "OleUninitialize", "OleInitialize", "OleCreate", "OleSetContainedObject", "OleSave" ], "FilterText.dll": [ "CreateTextFilter" ], "LuaLibDll.dll": [ "lua_typename", "lua_setglobal", "lua_getn", "lua_stackspace", "lua_rawgeti", "lua_rawseti", "lua_error", "lua_newtable", "lua_settable", "lua_curpack", "lua_rawget", "lua_pushnil", "lua_isstring", "lua_pushstring", "lua_pushnumber", "lua_type", "lua_tonumber", "lua_gettop", "lua_tostring", "lua_pushcclosure" ], "MSVCP80.dll": [ "?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z", "?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z", "?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ", "?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ", "?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z", "?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ", "?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z", "?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z", "??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z", "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z", "??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z", "??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z", "?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB", "?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ", "?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z", "?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z", "?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ", "??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z", "?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ", "??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z", "??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z", "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z", "?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z", "?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z" ], "MSVCR80.dll": [ "_localtime32", "_purecall", "strcat", "strftime", "isgraph", "atoi", "printf", "freopen", "__iob_func", "free", "realloc", "malloc", "memmove", "_mbsicmp", "isspace", "abs", "_difftime32", "memcmp", "sscanf", "memmove_s", "_mktime32", "rand", "fclose", "fwrite", "fopen", "srand", "memcpy", "isdigit", "_mbsstr", "remove", "_ui64toa", "_i64toa", "fflush", "fprintf", "_gmtime32", "sprintf_s", "_chmod", "vsprintf", "_vsnprintf", "strrchr", "_ctime32", "exit", "_mkdir", "_CIsqrt", "puts", "floor", "strncmp", "_CIcos", "_CIsin", "strtoul", "_unlock", "__dllonexit", "_encode_pointer", "_lock", "_onexit", "_decode_pointer", "?terminate@@YAXXZ", "_amsg_exit", "__getmainargs", "_cexit", "_exit", "_XcptFilter", "_ismbblead", "_acmdln", "_initterm", "_initterm_e", "_configthreadlocale", "__setusermatherr", "_adjust_fdiv", "__p__commode", "__p__fmode", "__set_app_type", "_except_handler4_common", "_crt_debugger_hook", "?_type_info_dtor_internal_method@type_info@@QAEXXZ", "_invoke_watson", "_controlfp_s", "strcmp", "memset", "strlen", "??_V@YAXPAX@Z", "_snprintf", "_time32", "?what@exception@std@@UBEPBDXZ", "??0exception@std@@QAE@ABQBD@Z", "??0exception@std@@QAE@ABV01@@Z", "??0exception@std@@QAE@XZ", "??1exception@std@@UAE@XZ", "_CxxThrowException", "??2@YAPAXI@Z", "_invalid_parameter_noinfo", "??3@YAXPAX@Z", "__CxxFrameHandler3", "strcpy", "strchr", "strstr", "sprintf", "strncpy", "_itoa", "_stricmp", "_getcwd", "_strlwr", "__CxxFrameHandler", "labs", "calloc" ], "engine.dll": [ "EDOneTimePad_Decipher", "?Run@KWin32App@@UAEXXZ", "?Init@KWin32App@@UAEHPAUHINSTANCE__@@PAD@Z", "??0KWin32App@@QAE@XZ", "?InitClass@KWin32App@@MAEHPAUHINSTANCE__@@@Z", "?InitWindow@KWin32App@@MAEHPAUHINSTANCE__@@@Z", "?ShowMouse@KWin32App@@UAEXH@Z", "?SetMultiGame@KWin32App@@UAEXH@Z", "?MsgProc@KWin32App@@UAEJPAUHWND__@@IIJ@Z", "?SetMouseHoverTime@KWin32App@@QAEXI@Z", "?Start@KTimer@@QAEXXZ", "?GetElapse@KTimer@@QAEKXZ", "InitTextRender", "?g_InitEngine@@YAHPBD0@Z", "?g_ExitEngine@@YAXXZ", "?g_DebugLog@@YAXPBDZZ", "EDOneTimePad_Encipher", "RegisterInlineCtrl", "RemoveInlineWndCtrl", "?g_StrCpy@@YAXPADPBD@Z", "?g_StrCmpLen@@YAHPBD0H@Z", "?g_StrLen@@YAHPBD@Z", "?GetString@KTabFile@@UAEHHHPBDPADK@Z", "?SetKeepDataForOutMaxWidth@KTabFile@@QAEXH@Z", "?Init@KSG_LogFile@@QAEHPBD@Z", "?puts@KSG_LogFile@@QAEXPBD@Z", "?write_date_time@KSG_LogFile@@QAEXXZ", "?GetScript@KLuaScriptSet@@QAEPAVKLuaScript@@PBD@Z", "?LoadScriptByRelPath@KLuaScriptSet@@QAE?AW4_CODE_RESULT@@PBDPAPAVKLuaScript@@H@Z", "?FormatCallByVaList@KLuaCall@@QAEHPBDPAH0PAD@Z", "??1KNode@@UAE@XZ", "?RegisterFunctions@KLuaScriptSet@@QAEHPAUTLua_Funcs@@H@Z", "?SetGlobalInt@KLuaScriptSet@@QAEXPBDH@Z", "?SetRootPath@KLuaScriptSet@@QAEXPBD@Z", "?GetScript@KLuaScriptSet@@QAEPAVKLuaScript@@K@Z", "?GetFloat@KTabFile@@UAEHHPBDMPAMH@Z", "?Insert@KLinkArray@@QAEXH@Z", "?Init@KLinkArray@@QAEXH@Z", "?GetInteger@KTabFile@@UAEHHHHPAH@Z", "?FindColumn@KTabFile@@UAEHPBD@Z", "??0KLuaScriptSet@@QAE@HH@Z", "??1KLuaScriptSet@@QAE@XZ", "?SetGlobalName@KLuaCall@@QAEXPBD@Z", "?g_FileName2Id@@YAKPBD@Z", "?GetNext@KLinkArray@@QBEHH@Z", "??1KLinkArray@@QAE@XZ", "??0KLinkArray@@QAE@XZ", "?Remove@KLinkArray@@QAEXH@Z", "??1KSoundCache@@QAE@XZ", "?Exit@KDirectSound@@QAEXXZ", "?SetVolume@KWavSound@@QAEXH@Z", "?SetPan@KWavSound@@QAEXH@Z", "?Stop@KWavSound@@QAEXXZ", "?IsPlaying@KWavSound@@QAEHXZ", "??0KDirectSound@@QAE@XZ", "??1KDirectSound@@QAE@XZ", "??1KMusic@@UAE@XZ", "??0KMemClass@@QAE@XZ", "??_7KMp3Music@@6B@", "??0KMusic@@QAE@XZ", "??0KSoundCache@@QAE@XZ", "?Init@KDirectSound@@QAEHXZ", "?Open@KMp3Music@@UAEHPAD@Z", "?Close@KMusic@@UAEXXZ", "?Play@KMusic@@UAEXH@Z", "?Stop@KMusic@@UAEXXZ", "?Rewind@KMp3Music@@UAEXXZ", "?SetVolume@KMusic@@UAEXJ@Z", "?HandleNotify@KMusic@@UAEHXZ", "?IsPlaying@KMusic@@UAEHXZ", "?Init@KMusic@@MAEHXZ", "?InitSoundFormat@KMp3Music@@MAEXXZ", "?InitSoundBuffer@KMusic@@MAEHXZ", "?FreeSoundBuffer@KMusic@@MAEXXZ", "?InitSoundNotify@KMusic@@MAEHXZ", "?FreeSoundNotify@KMusic@@MAEXXZ", "?InitEventHandle@KMusic@@MAEHXZ", "?FreeEventHandle@KMusic@@MAEXXZ", "?FillBufferWithSound@KMusic@@MAEHK@Z", "?FillBufferWithSilence@KMusic@@MAEHXZ", "?ReadWaveData@KMp3Music@@MAEKPAEK@Z", "?Mp3Init@KMp3Music@@MAEHXZ", "?Mp3FillBuffer@KMp3Music@@MAEHXZ", "?Mp3Decode@KMp3Music@@MAEKPAEK@Z", "?Mp3FileOpen@KMp3Music@@MAEHPAD@Z", "?Mp3FileRead@KMp3Music@@MAEKPAEK@Z", "?Mp3FileSeek@KMp3Music@@MAEKJ@Z", "?Seek@KMp3Music@@UAEXH@Z", "??1KMemClass@@QAE@XZ", "?Play@KWavSound@@QAEXHHH@Z", "?GetNext@KNode@@QBEPAV1@XZ", "?Remove@KNode@@QAEXXZ", "?GetHead@KList@@QBEPAVKNode@@XZ", "??0KNode@@QAE@XZ", "?GetPrev@KLinkArray@@QBEHH@Z", "?AddTail@KList@@QAEXPAVKNode@@@Z", "?GetString@KTabFile@@UAEHPBD00PADK@Z", "?g_StrCat@@YAXPADPBD@Z", "?SetGlobalName@KLuaScript@@QAEXPBD@Z", "??0KList@@QAE@XZ", "?GetWidth@KTabFile@@UAEHXZ", "TGetLimitLenEncodedString", "?g_StrLower@@YAXPAD@Z", "?Clear@KPolygon@@QAEXXZ", "??0KPolygon@@QAE@XZ", "?g_StrCmp@@YAHPBD0@Z", "?AddHead@KList@@QAEXPAVKNode@@@Z", "?RemoveHead@KList@@QAEPAVKNode@@XZ", "?GetRect@KIniFile@@QAEXPBD0PAUtagRECT@@@Z", "?Seek@KPakFile@@QAEKHI@Z", "?Stop@KTimer@@QAEXXZ", "?g_GetRandomSeed@@YAIXZ", "?GetValuesFromStack@KLuaScript@@QAAHPBDZZ", "?g_StrWrap@@YAXPADPBDH@Z", "?g_UnitePathAndName@@YAXPBD0PAD@Z", "?KSG_StringGetInt@@YAHPAPBDH@Z", "?KSG_StringSkipSymbol@@YA_NPAPBDH@Z", "gAdviseMemFileNotify", "?GetInteger@KTabFile@@UAEHPBD0HPAH@Z", "?GetActionScriptID@KLuaScript@@SAKPAUlua_State@@@Z", "?PushNumber@KLuaCall@@QAEXN@Z", "?IsLoaded@KLuaScript@@QBEHXZ", "?g_GetRootPath@@YAXPADI@Z", "??0KTabFile@@QAE@ABV0@@Z", "?WriteString@KTabFileCtrl@@QAEHHPBD0H@Z", "?WriteString@KTabFileCtrl@@QAEHHHPBDK@Z", "?Search@KTabFile@@QAEHPBD0H@Z", "?Search@KTabFile@@QAEHPBDHH@Z", "?Save@KTabFileCtrl@@QAEHXZ", "?Save@KTabFile@@UAEHPBD@Z", "?FindRow@KTabFile@@UAEHPBDH@Z", "?GetFloat@KTabFile@@UAEHPBD0MPAM@Z", "?GetFloat@KTabFile@@UAEHHHMPAM@Z", "??0KTabFileCtrl@@QAE@XZ", "?Load@KTabFileCtrl@@UAEHPBD@Z", "?Save@KTabFileCtrl@@UAEHPBD@Z", "?FindRow@KTabFileCtrl@@UAEHPBDH@Z", "?FindColumn@KTabFileCtrl@@UAEHPBD@Z", "?GetWidth@KTabFileCtrl@@UAEHXZ", "?GetHeight@KTabFileCtrl@@UAEHXZ", "?GetString@KTabFileCtrl@@UAEHPBD00PADK@Z", "?GetString@KTabFileCtrl@@UAEHHHPBDPADK@Z", "?GetString@KTabFileCtrl@@UAEHHPBD0PADKH@Z", "?GetInteger@KTabFileCtrl@@UAEHPBD0HPAH@Z", "?GetInteger@KTabFileCtrl@@UAEHHHHPAH@Z", "?GetInteger@KTabFileCtrl@@UAEHHPBDHPAHH@Z", "?GetFloat@KTabFileCtrl@@UAEHPBD0MPAM@Z", "?GetFloat@KTabFileCtrl@@UAEHHHMPAM@Z", "?GetFloat@KTabFileCtrl@@UAEHHPBDMPAMH@Z", "?Clear@KTabFileCtrl@@UAEXXZ", "??1KTabFileCtrl@@UAE@XZ", "?GetNodeCount@KList@@QBEJXZ", "gAddToMemFileManager", "gOnUpdateFinishForMemFileManager", "?release_image@@YAXPAUKSGImageContent@@@Z", "?g_FileExists@@YAHPBD@Z", "?Tell@KPakFile@@QAEKXZ", "?RemoveTail@KList@@QAEPAVKNode@@XZ", "?GetTail@KList@@QBEPAVKNode@@XZ", "?GetGlobalName@KLuaScript@@QAEXPBD@Z", "??0KMutex@@QAE@XZ", "?Lock@KMutex@@QAEXXZ", "?Unlock@KMutex@@QAEXXZ", "??1KMutex@@QAE@XZ", "?GetTopIndex@KLuaCall@@QBEHXZ", "?StackCall@KLuaCall@@QAEHPBDHHPAH@Z", "?ValueToNumber@KLuaCall@@QAEIH@Z", "?ValueToString@KLuaCall@@QAEPBDH@Z", "??1KLuaCall@@QAE@XZ", "?g_RandomSeed@@YAXI@Z", "?CallFunction@KLuaScript@@QAEHPBDH0PAD@Z", "?SafeCallBegin@KLuaScript@@QAEXPAH@Z", "?SafeCallEnd@KLuaScript@@QAEXH@Z", "?GetNextKey@KIniFile@@QAEHPBD0PAD@Z", "TGetEncodedTextOutputLenPos", "TGetEncodedTextEffectCtrls", "?g_Random@@YAII@Z", "?Clear@KTabFile@@UAEXXZ", "?Open@KFile@@QAEHPBD@Z", "?Read@KFile@@QAEKPAXK@Z", "?Load@KTabFile@@UAEHPBD@Z", "?GetHeight@KTabFile@@UAEHXZ", "?GetInteger@KTabFile@@UAEHHPBDHPAHH@Z", "?GetString@KTabFile@@UAEHHPBD0PADKH@Z", "??1KTabFile@@UAE@XZ", "??0KTabFile@@QAE@XZ", "TSplitEncodedString", "?IsSectionExist@KIniFile@@QAEHPBD@Z", "?KSG_StringToMD5String@@YAHQADQBD@Z", "?WriteStruct@KIniFile@@QAEXPBD0PAXK@Z", "?EraseKey@KIniFile@@QAEXPBD0@Z", "?GetStruct@KIniFile@@QAEXPBD0PAXK@Z", "TClearSpecialCtrlInEncodedText", "?g_GetDrawHWnd@@YAPAUHWND__@@XZ", "TEncodeTextAndPickCtrl", "?GetInteger2@KIniFile@@QAEHPBD0PAH1@Z", "TRemoveCtrlInEncodedText", "GetCtrlHandle", "??1KIme@@QAE@XZ", "??0KIme@@QAE@XZ", "TIsLocalWord", "TSplitString", "TSplitStringLine", "TIsHightChar", "?EnableLanguageChange@KIme@@QAEXXZ", "?OpenIME@KIme@@QAEXXZ", "?SetCaretPos@KIme@@QAEXHH@Z", "?IsIme@KIme@@QAEHXZ", "TGetLimitLenString", "??0KPakFile@@QAE@XZ", "??0KFile@@QAE@XZ", "?Create@KFile@@QAEHPBD@Z", "?Open@KPakFile@@QAEHPBD@Z", "?Size@KPakFile@@QAEKXZ", "?Read@KPakFile@@QAEKPAXI@Z", "?Close@KPakFile@@QAEXXZ", "??1KFile@@QAE@XZ", "??1KPakFile@@QAE@XZ", "TGetEncodedTextLineCount", "TFindSpecialCtrlInEncodedText", "??0KTimer@@QAE@XZ", "?Clear@KIniFile@@QAEXXZ", "?Close@KFile@@QAEXXZ", "?Write@KFile@@QAEKPAXK@Z", "?Seek@KFile@@QAEKJK@Z", "?g_pIme@@3PAVKIme@@A", "?DisableLanguageChange@KIme@@QAEXXZ", "?CloseIME@KIme@@QAEXXZ", "?TurnOn@KIme@@QAEXXZ", "?EraseSection@KIniFile@@QAEXPBD@Z", "?LoadBuffer@KLuaScript@@QAEHPAEKPBD@Z", "?ExecuteCode@KLuaScript@@QAEHXZ", "?Release@KLuaScript@@QAEXXZ", "?CreateScript@KLuaScriptSet@@QAEPAVKLuaScript@@XZ", "?RegisterFunctions@KLuaScript@@QAEHPAUTLua_Funcs@@H@Z", "?g_StrCpyLen@@YAXPADPBDH@Z", "?WriteInteger@KIniFile@@QAEXPBD0H@Z", "?Save@KIniFile@@QAEHPBD@Z", "?g_GetFullPath@@YAXPADIPBD@Z", "?g_GetMainHWnd@@YAPAUHWND__@@XZ", "?g_CreatePath@@YAXPBD@Z", "??1KSG_LogFile@@UAE@XZ", "??0KSG_LogFile@@QAE@PBD@Z", "?InitWithDate@KSG_LogFile@@QAEHPBD0H@Z", "?printf_t@KSG_LogFile@@QAAXPBDZZ", "?GetTmpScript@KLuaScriptSet@@QAEPAVKLuaScript@@XZ", "?AddIncluder@KLuaScript@@QAEXK@Z", "??0KLuaCall@@QAE@PAVKLuaScript@@H@Z", "??1KIniFile@@QAE@XZ", "?GetString@KIniFile@@QAEHPBD00PADK@Z", "?Load@KIniFile@@QAEHPBD@Z", "?WriteString@KIniFile@@QAEXPBD00@Z", "?g_HashString2Id@@YAKPBD@Z", "TEncodeText", "?GetInteger@KIniFile@@QAEHPBD0HPAH@Z", "??0KIniFile@@QAE@XZ", "TIsLocalChar" ], "IMM32.dll": [ "ImmAssociateContext" ], "WINMM.dll": [ "timeGetTime" ], "GDI32.dll": [ "GetDeviceCaps", "RealizePalette", "SelectPalette" ], "OLEAUT32.dll": [ "SysAllocString", "VariantClear", "SysFreeString" ] }, "import_dlls": [ "ADVAPI32.dll", "FilterText.dll", "GDI32.dll", "IMM32.dll", "KERNEL32.dll", "LuaLibDll.dll", "MSVCP80.dll", "MSVCR80.dll", "OLEAUT32.dll", "SHELL32.dll", "USER32.dll", "WINMM.dll", "WS2_32.dll", "comdlg32.dll", "engine.dll", "ole32.dll" ], "export_count": 5, "has_authenticode": true, "overlay_size": 6088, "string_count": 9112, "interesting": { "urls": [ "http://jx.kingsoft.com/tan.shtml", "http://ocsp.verisign.com0", "http://ocsp.verisign.com0;", "http://pass.kingsoft.com/jh/", "http://www.jxqy1.com/news.html", "https://pay.zing.vn/napcard/volam.html", "https://www.verisign.com/cps0*", "https://www.verisign.com/rpa0" ], "url_count": 8, "ips": [], "ip_count": 0, "keyword_hits": { "http": 21, "http://": 13, "https://": 7, "createprocess": 4, "readprocessmemory": 3, "loadlibrary": 3, "minidump": 2, "writeprocessmemory": 2, "virtualprotectex": 2, "getprocaddress": 2, "createremotethread": 1, "keybd_event": 1, "mouse_event": 1, "sendinput": 1, "shellexecute": 1, "startup": 1 } }, "strings_file": "film_Game_film.exe.strings.txt" }, "rainbow_Rainbow.dll": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\Rainbow.dll", "size": 28064, "mtime_local": "2026-08-17 00:23:48", "sha256": "A5386F95B72319AEBFD5EFCE6112D138614FC345326947EAE7A2394E76EB5B62", "md5": "92120390FC5E6F503B27DD2B1A3A78BC", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1339763772, "subsystem": 2, "ep_rva": "0x3de1", "image_base": "0x10000000", "sections": [ ".text vsz=0x3606 raw=0x3800 ent=5.73", ".rdata vsz=0xED2 raw=0x1000 ent=4.44", ".data vsz=0x428 raw=0x200 ent=2.28", ".rsrc vsz=0x520 raw=0x600 ent=4.69", ".reloc vsz=0x38A raw=0x400 ent=6.02" ], "max_section_entropy": 6.02, "imports": { "WS2_32.dll": [ "send", "recv", "WSAGetLastError", "WSACleanup", "WSAStartup", "bind", "ioctlsocket", "closesocket", "socket", "htons", "connect", "inet_ntoa" ], "KERNEL32.dll": [ "GetSystemTimeAsFileTime", "GetCurrentProcessId", "GetCurrentThreadId", "GetTickCount", "QueryPerformanceCounter", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "InterlockedCompareExchange", "InterlockedExchange", "Sleep", "InitializeCriticalSection", "EnterCriticalSection", "LeaveCriticalSection", "DeleteCriticalSection", "CreateThread", "CloseHandle", "TerminateThread", "WaitForSingleObject" ], "MSVCR80.dll": [ "_except_handler4_common", "free", "realloc", "memcpy", "memmove", "??3@YAXPAX@Z", "_purecall", "??2@YAPAXI@Z", "__CxxFrameHandler3", "strncpy", "memset", "??_U@YAPAXI@Z", "??_V@YAXPAX@Z", "_vsnprintf", "_encode_pointer", "_malloc_crt", "_encoded_null", "_decode_pointer", "_initterm", "_initterm_e", "_amsg_exit", "_adjust_fdiv", "__CppXcptFilter", "?terminate@@YAXXZ", "?_type_info_dtor_internal_method@type_info@@QAEXXZ", "_crt_debugger_hook", "__clean_type_info_names_internal", "_unlock", "__dllonexit", "_lock", "_onexit" ] }, "import_dlls": [ "KERNEL32.dll", "MSVCR80.dll", "WS2_32.dll" ], "export_count": 1, "has_authenticode": true, "overlay_size": 5536, "string_count": 213, "interesting": { "urls": [ "http://ocsp.verisign.com0", "http://ocsp.verisign.com01", "http://ocsp.verisign.com0?", "https://www.verisign.com/cps0*", "https://www.verisign.com/rpa0" ], "url_count": 5, "ips": [], "ip_count": 0, "keyword_hits": { "http": 16, "http://": 10, "https://": 6 } }, "strings_file": "rainbow_Rainbow.dll.strings.txt" }, "vggame_current_vggame.exe": { "path": "C:\\JXVCTK\\JxVoCongTruyenKy\\vggame.exe", "size": 3167128, "mtime_local": "2026-08-17 00:24:17", "sha256": "F66DAA617E67BCF346ED25669051A33D62C0D2522FFC5A127FB3D1D6CE53D78B", "md5": "83B68D6C58E3492BDBA454F162256F62", "mz_header": true, "is_pe": true, "machine": "0x14c", "timestamp": 1340706750, "subsystem": 2, "ep_rva": "0x1a9bf70", "image_base": "0x400000", "sections": [ "(empty) vsz=0x239000 raw=0xD1000 ent=8.00 RWX!", "(empty) vsz=0x42000 raw=0x12000 ent=7.91 RWX!", "(empty) vsz=0xFA3000 raw=0xB000 ent=7.81 RWX!", "(empty) vsz=0x1000 raw=0x1000 ent=0.23 RWX!", ".rsrc vsz=0x1000 raw=0x1000 ent=5.45 RWX!", "(empty) vsz=0x6A0000 raw=0x34000 ent=8.00 RWX!", ".data vsz=0x1DD000 raw=0x1DD000 ent=7.96 RWX!" ], "max_section_entropy": 8.0, "imports": { "kernel32.dll": [ "GetModuleHandleA", "GetProcAddress", "ExitProcess", "LoadLibraryA" ], "user32.dll": [ "MessageBoxA" ], "advapi32.dll": [ "RegCloseKey" ], "oleaut32.dll": [ "SysFreeString" ], "gdi32.dll": [ "CreateFontA" ], "shell32.dll": [ "ShellExecuteA" ], "version.dll": [ "GetFileVersionInfoA" ], "WS2_32.dll": [ "inet_ntoa" ], "comdlg32.dll": [ "GetOpenFileNameA" ], "ole32.dll": [ "StgCreateDocfile" ], "FilterText.dll": [ "CreateTextFilter" ], "LuaLibDll.dll": [ "lua_typename" ], "MSVCP80.dll": [ "?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z" ], "MSVCR80.dll": [ "_localtime32" ], "engine.dll": [ "EDOneTimePad_Decipher" ], "IMM32.dll": [ "ImmAssociateContext" ], "WINMM.dll": [ "timeGetTime" ] }, "import_dlls": [ "FilterText.dll", "IMM32.dll", "LuaLibDll.dll", "MSVCP80.dll", "MSVCR80.dll", "WINMM.dll", "WS2_32.dll", "advapi32.dll", "comdlg32.dll", "engine.dll", "gdi32.dll", "kernel32.dll", "ole32.dll", "oleaut32.dll", "shell32.dll", "user32.dll", "version.dll" ], "export_count": 5, "has_authenticode": true, "overlay_size": 13208, "string_count": 11845, "interesting": { "urls": [ "http://ocsp.digicert.com0A", "http://ocsp.digicert.com0C", "http://ocsp.digicert.com0]", "http://ocsp.verisign.com0", "http://ocsp.verisign.com0;", "http://pki-ocsp.symauth.com0", "https://www.verisign.com/cps0*", "https://www.verisign.com/rpa0" ], "url_count": 8, "ips": [], "ip_count": 0, "keyword_hits": { "http": 28, "http://": 22, "https://": 6, "vietguards": 3, "shellexecute": 1, "loadlibrary": 1, "getprocaddress": 1 } }, "strings_file": "vggame_current_vggame.exe.strings.txt" } }, "zip_old": { "old_launcher_AutoUpdateVCTK.exe": { "zip_entry": "JxVoCongTruyenKy/AutoUpdateVCTK.exe", "size": 3947520, "sha256": "63049DBA6D8E35387A17770B790788E630A3031E132709FE65B9069C5635D5C5", "md5": "B0447117EB9DB5B563F932BEBFEE69A0", "is_pe": true, "machine": "0x14c", "timestamp": 1788970597, "subsystem": 2, "ep_rva": "0x16f26c", "image_base": "0x400000", "sections": [ ".text vsz=0x1AAB10 raw=0x1AAC00 ent=6.47", ".rdata vsz=0x5BDC8 raw=0x5BE00 ent=5.10", ".data vsz=0xAA58 raw=0x6000 ent=4.77", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0x193038 raw=0x193200 ent=8.00", ".reloc vsz=0x23994 raw=0x23A00 ent=6.57" ], "max_section_entropy": 8.0, "imports": { "WINHTTP.dll": [ "WinHttpOpen", "WinHttpReadData", "WinHttpQueryHeaders", "WinHttpReceiveResponse", "WinHttpSendRequest", "WinHttpOpenRequest", "WinHttpCloseHandle", "WinHttpCrackUrl", "WinHttpSetOption", "WinHttpConnect" ], "ADVAPI32.dll": [ "RegEnumKeyExW", "RegEnumValueW", "RegQueryValueW", "RegEnumKeyW", "RegSetValueExW", "RegDeleteValueW", "RegDeleteKeyW", "RegCreateKeyExW", "RegQueryValueExW", "AllocateAndInitializeSid", "CheckTokenMembership", "FreeSid", "CryptAcquireContextW", "CryptCreateHash", "CryptReleaseContext", "CryptHashData", "CryptGetHashParam", "CryptDestroyHash", "RegOpenKeyExW", "RegCloseKey" ], "SHELL32.dll": [ "SHGetFileInfoW", "SHGetPathFromIDListW", "SHGetSpecialFolderLocation", "SHGetDesktopFolder", "SHAppBarMessage", "DragQueryFileW", "DragFinish", "SHBrowseForFolderW", "Shell_NotifyIconW", "ShellExecuteW", "SHGetFolderPathW", "CommandLineToArgvW", "ShellExecuteExW" ], "ole32.dll": [ "OleDuplicateData", "IsAccelerator", "CoTaskMemFree", "CoTaskMemAlloc", "CoCreateGuid", "OleTranslateAccelerator", "OleDestroyMenuDescriptor", "OleCreateMenuDescriptor", "OleLockRunning", "RevokeDragDrop", "RegisterDragDrop", "CoLockObjectExternal", "OleGetClipboard", "DoDragDrop", "CreateStreamOnHGlobal", "CoUninitialize", "CoInitialize", "CoCreateInstance", "CoDisconnectObject", "CoInitializeEx", "ReleaseStgMedium" ], "VERSION.dll": [ "VerQueryValueW", "GetFileVersionInfoW", "GetFileVersionInfoSizeW" ], "gdiplus.dll": [ "GdipGetImageWidth", "GdipGetImageHeight", "GdipCreateBitmapFromFile", "GdipLoadImageFromStream", "GdipLoadImageFromFile", "GdipCreateBitmapFromStream", "GdipBitmapGetPixel", "GdipCreateFromHDC", "GdipDeleteGraphics", "GdipSetInterpolationMode", "GdipSetPixelOffsetMode", "GdipDrawImageRectI", "GdiplusShutdown", "GdipDrawImageRectRectI", "GdipCloneImage", "GdipAlloc", "GdipDisposeImage", "GdiplusStartup", "GdipFree", "GdipCreateBitmapFromHBITMAP", "GdipDrawImageI", "GdipGetImageGraphicsContext", "GdipGetImagePixelFormat", "GdipGetImagePalette", "GdipGetImagePaletteSize", "GdipCreateBitmapFromScan0", "GdipBitmapLockBits", "GdipBitmapUnlockBits" ], "KERNEL32.dll": [ "GetVolumeInformationW", "LockFile", "SetEndOfFile", "SetFilePointer", "UnlockFile", "DuplicateHandle", "GetCurrentProcess", "lstrcmpiW", "VerSetConditionMask", "VerifyVersionInfoW", "VirtualProtect", "SetErrorMode", "FileTimeToLocalFileTime", "GetFileTime", "SystemTimeToTzSpecificLocalTime", "GetWindowsDirectoryW", "SearchPathW", "GetProfileIntW", "GetTempPathW", "FindResourceExW", "GetTempFileNameW", "GetUserDefaultLCID", "GetFullPathNameW", "WaitForSingleObjectEx", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "TerminateProcess", "IsProcessorFeaturePresent", "QueryPerformanceCounter", "GetSystemTimeAsFileTime", "InitializeSListHead", "IsDebuggerPresent", "GetStartupInfoW", "ReleaseSRWLockExclusive", "AcquireSRWLockExclusive", "TryEnterCriticalSection", "LCMapStringEx", "FileTimeToSystemTime", "GlobalGetAtomNameW", "GlobalFlags", "GetUserDefaultUILanguage", "GetSystemDefaultUILanguage", "GetLocaleInfoW", "LocalReAlloc", "LocalAlloc", "GlobalHandle", "GlobalReAlloc", "TlsFree", "TlsSetValue", "QueryPerformanceFrequency", "GetFileSize", "FlushFileBuffers", "FlsAlloc", "FlsGetValue", "FlsSetValue", "FlsFree", "TlsGetValue", "TlsAlloc", "lstrcpyW", "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount", "LeaveCriticalSection", "EnterCriticalSection", "CompareStringW", "GlobalFindAtomW", "LoadLibraryA", "GetSystemDirectoryW", "EncodePointer", "GlobalAddAtomW", "WritePrivateProfileStringW", "GetPrivateProfileStringW", "GetPrivateProfileIntW", "ResumeThread", "SetThreadPriority", "CreateEventW", "FormatMessageW", "GlobalSize", "lstrcmpW", "lstrcmpA", "GlobalDeleteAtom", "LoadLibraryExW", "GetModuleHandleA", "GetVersionExW", "GetCurrentThread", "SetLastError", "OutputDebugStringA", "Sleep", "GetTickCount", "CreateProcessW", "GetCurrentDirectoryW", "MulDiv", "CopyFileW", "GlobalUnlock", "GlobalFree", "GlobalLock", "GlobalAlloc", "GetFileAttributesExW", "FindClose", "FindNextFileW", "FindFirstFileW", "WideCharToMultiByte", "MultiByteToWideChar", "MoveFileW", "MoveFileExW", "SetFileAttributesW", "DeleteFileW", "WriteFile", "GetCurrentThreadId", "CreateDirectoryW", "FindResourceW", "LoadResource", "LockResource", "SizeofResource", "FreeLibrary", "LoadLibraryW", "GetProcAddress", "GetModuleHandleW", "GetExitCodeProcess", "WaitForSingleObject", "GetEnvironmentVariableW", "ReadFile", "SetFilePointerEx", "GetFileSizeEx", "CreateFileW", "GetFileAttributesW", "LocalFree", "GetCommandLineW", "ReleaseMutex", "CreateMutexW", "CloseHandle", "QueryFullProcessImageNameW", "OpenProcess", "GetCurrentProcessId", "GetModuleFileNameW", "GetProcessHeap", "DeleteCriticalSection", "DecodePointer", "HeapAlloc", "RaiseException", "HeapReAlloc", "GetLastError", "HeapSize", "InitializeCriticalSectionEx", "HeapFree", "GetCPInfo", "RtlUnwind", "OutputDebugStringW", "CreateThread", "ExitThread", "FreeLibraryAndExitThread", "GetModuleHandleExW", "GetCommandLineA", "HeapQueryInformation", "GetSystemInfo", "VirtualAlloc", "VirtualQuery", "SetStdHandle", "GetFileType", "GetStdHandle", "ExitProcess", "LCMapStringW", "IsValidLocale", "EnumSystemLocalesW", "GetTimeZoneInformation", "GetConsoleOutputCP", "InitializeSRWLock", "GetExitCodeThread", "GetStringTypeW", "GetConsoleMode", "FindFirstFileExW", "IsValidCodePage", "GetACP", "GetOEMCP", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "SetEnvironmentVariableW", "WriteConsoleW" ], "USER32.dll": [ "IsZoomed", "TrackMouseEvent", "LoadCursorW", "GetSysColorBrush", "SetRectEmpty", "SendDlgItemMessageA", "RealChildWindowFromPoint", "DeleteMenu", "CopyImage", "SystemParametersInfoW", "GetMenuItemInfoW", "DestroyMenu", "LoadMenuW", "IntersectRect", "WinHelpW", "SetScrollInfo", "GetTopWindow", "GetClassLongW", "EqualRect", "MapWindowPoints", "AdjustWindowRectEx", "RemovePropW", "GetPropW", "SetPropW", "ShowScrollBar", "GetScrollRange", "SetScrollRange", "GetScrollPos", "SetScrollPos", "ScrollWindow", "GetForegroundWindow", "TrackPopupMenu", "SetMenu", "GetMenu", "GetCapture", "EndDeferWindowPos", "DeferWindowPos", "BeginDeferWindowPos", "SetWindowPlacement", "GetWindowPlacement", "IsChild", "IsMenu", "CreateWindowExW", "GetClassInfoExW", "GetClassInfoW", "RegisterClassW", "CallWindowProcW", "DefWindowProcW", "GetMessageTime", "GetMessagePos", "RegisterWindowMessageW", "IsDialogMessageW", "GetWindow", "SetWindowLongW", "GetWindowTextLengthW", "GetWindowTextW", "SetWindowTextW", "SetFocus", "GetDlgCtrlID", "SendDlgItemMessageW", "CharUpperW", "CheckRadioButton", "CheckDlgButton", "SetDlgItemTextW", "SetWindowPos", "MoveWindow", "GetClassNameW", "UpdateWindow", "DrawStateW", "SetCursor", "ShowOwnedPopups", "ValidateRect", "GetKeyState", "PeekMessageW", "SetMenuDefaultItem", "TranslateMessage", "GetMessageW", "LoadBitmapW", "SetMenuItemInfoW", "GetMenuCheckMarkDimensions", "SetMenuItemBitmaps", "EnableMenuItem", "CheckMenuItem", "CallNextHookEx", "UnhookWindowsHookEx", "SetWindowsHookExW", "PtInRect", "GetFocus", "FillRect", "GetSysColor", "ScreenToClient", "ClientToScreen", "EndPaint", "BeginPaint", "ReleaseDC", "GetWindowDC", "GetDC", "TabbedTextOutW", "GrayStringW", "DrawTextExW", "DrawTextW", "RemoveMenu", "InsertMenuW", "GetMenuItemCount", "GetMenuItemID", "GetSubMenu", "GetMenuState", "GetMenuStringW", "GetLastActivePopup", "GetDesktopWindow", "UpdateLayeredWindow", "EnableScrollBar", "MonitorFromPoint", "DestroyIcon", "GetWindowLongW", "SetActiveWindow", "IsWindowEnabled", "GetActiveWindow", "GetNextDlgTabItem", "EndDialog", "CreateDialogIndirectParamW", "GetAsyncKeyState", "SetCapture", "ReleaseCapture", "GetSystemMenu", "MessageBeep", "WindowFromPoint", "NotifyWinEvent", "IsDlgButtonChecked", "DestroyWindow", "PostQuitMessage", "EnableWindow", "GetDlgItem", "GetCursorPos", "AppendMenuW", "CreatePopupMenu", "KillTimer", "InflateRect", "IsWindow", "DrawIcon", "PostMessageW", "RedrawWindow", "UnionRect", "EnumDisplayMonitors", "MapDialogRect", "LoadImageW", "OpenClipboard", "CloseClipboard", "SetClipboardData", "EmptyClipboard", "DrawIconEx", "RegisterClipboardFormatW", "DrawEdge", "DrawFrameControl", "DrawFocusRect", "GetWindowRgn", "SubtractRect", "CreateMenu", "GetUpdateRect", "GetComboBoxInfo", "MapVirtualKeyExW", "IsCharLowerW", "TranslateMDISysAccel", "DefMDIChildProcW", "DefFrameProcW", "DrawMenuBar", "DestroyCursor", "GetDoubleClickTime", "IsClipboardFormatAvailable", "GetKeyNameTextW", "InvertRect", "HideCaret", "GetIconInfo", "GetNextDlgGroupItem", "WaitMessage", "PostThreadMessageW", "FrameRect", "CopyIcon", "SetCursorPos", "ReuseDDElParam", "UnpackDDElParam", "SetWindowRgn", "InvalidateRect", "GetSystemMetrics", "SetRect", "CopyRect", "GetMonitorInfoW", "MonitorFromWindow", "GetWindowRect", "SetTimer", "SetLayeredWindowAttributes", "LoadIconW", "GetClientRect", "GetParent", "SendMessageW", "OffsetRect", "IsRectEmpty", "CharLowerBuffA", "MessageBoxW", "SetForegroundWindow", "IsIconic", "ShowWindow", "EnumWindows", "InsertMenuItemW", "TranslateAcceleratorW", "BringWindowToTop", "CopyAcceleratorTableW", "DestroyAcceleratorTable", "CreateAcceleratorTableW", "LoadAcceleratorsW", "MapVirtualKeyW", "GetKeyboardState", "GetKeyboardLayout", "ToUnicodeEx", "GetWindowThreadProcessId", "IsWindowVisible", "UnregisterClassW", "ModifyMenuW", "GetMenuDefaultItem", "LockWindowUpdate", "CharUpperBuffW", "SetParent", "DispatchMessageW", "SetClassLongW", "GetScrollInfo" ], "GDI32.dll": [ "CreatePatternBrush", "DeleteDC", "Escape", "ExcludeClipRect", "GetClipBox", "GetObjectType", "GetPixel", "GetViewportExtEx", "GetWindowExtEx", "IntersectClipRect", "LineTo", "PtVisible", "RectVisible", "RestoreDC", "SaveDC", "SelectClipRgn", "ExtSelectClipRgn", "SelectObject", "SelectPalette", "SetBkColor", "SetBkMode", "SetMapMode", "SetLayout", "GetLayout", "SetPolyFillMode", "SetROP2", "SetTextColor", "SetTextAlign", "GetObjectW", "MoveToEx", "TextOutW", "ExtTextOutW", "SetViewportExtEx", "SetViewportOrgEx", "CreateCompatibleDC", "SetWindowOrgEx", "OffsetViewportOrgEx", "OffsetWindowOrgEx", "ScaleViewportExtEx", "CreatePen", "CreateFontIndirectW", "CreateRectRgnIndirect", "PatBlt", "SetRectRgn", "DPtoLP", "GetTextExtentPoint32W", "GetTextMetricsW", "CreateRoundRectRgn", "CreateCompatibleBitmap", "CreateDIBSection", "CreateDIBitmap", "EnumFontFamiliesW", "GetTextCharsetInfo", "RealizePalette", "SetPixel", "StretchBlt", "SetDIBColorTable", "GetTextColor", "GetRgnBox", "OffsetRgn", "CreateEllipticRgn", "Ellipse", "GetBkColor", "CreatePolygonRgn", "Polygon", "Polyline", "EnumFontFamiliesExW", "CreatePalette", "GetNearestPaletteIndex", "GetPaletteEntries", "GetSystemPaletteEntries", "LPtoDP", "ExtFloodFill", "SetPaletteEntries", "FillRgn", "FrameRgn", "GetBoundsRect", "PtInRegion", "GetViewportOrgEx", "GetWindowOrgEx", "SetPixelV", "GetTextFaceW", "CreateHatchBrush", "ScaleWindowExtEx", "CreateBitmap", "BitBlt", "GetDeviceCaps", "CreateDCW", "CopyMetaFileW", "GetStockObject", "RoundRect", "Rectangle", "DeleteObject", "CombineRgn", "CreateRectRgn", "SetWindowExtEx", "CreateSolidBrush", "CreateFontW" ], "MSIMG32.dll": [ "TransparentBlt", "AlphaBlend", "GradientFill" ], "WINSPOOL.DRV": [ "ClosePrinter", "DocumentPropertiesW", "OpenPrinterW" ], "COMCTL32.dll": [ "InitCommonControlsEx" ], "SHLWAPI.dll": [ "PathStripToRootW", "PathIsUNCW", "PathRemoveFileSpecW", "PathFindFileNameW", "PathFindExtensionW", "StrFormatKBSizeW" ], "UxTheme.dll": [ "GetThemePartSize", "GetThemeSysColor", "GetWindowTheme", "IsThemeBackgroundPartiallyTransparent", "GetCurrentThemeName", "GetThemeColor", "DrawThemeBackground", "CloseThemeData", "OpenThemeData", "DrawThemeParentBackground", "IsAppThemed", "SetWindowTheme", "DrawThemeText" ], "OLEAUT32.dll": [ "SysAllocStringLen", "VariantClear", "VariantChangeType", "LoadTypeLib", "SysFreeString", "SysAllocString", "VariantInit", "VarBstrFromDate", "VariantCopy", "VariantTimeToSystemTime", "SystemTimeToVariantTime", "SysStringLen" ], "OLEACC.dll": [ "AccessibleObjectFromWindow", "CreateStdAccessibleObject", "LresultFromObject" ], "WINMM.dll": [ "PlaySoundW" ], "IMM32.dll": [ "ImmReleaseContext", "ImmGetOpenStatus", "ImmGetContext" ] }, "import_dlls": [ "ADVAPI32.dll", "COMCTL32.dll", "GDI32.dll", "IMM32.dll", "KERNEL32.dll", "MSIMG32.dll", "OLEACC.dll", "OLEAUT32.dll", "SHELL32.dll", "SHLWAPI.dll", "USER32.dll", "UxTheme.dll", "VERSION.dll", "WINHTTP.dll", "WINMM.dll", "WINSPOOL.DRV", "gdiplus.dll", "ole32.dll" ], "has_authenticode": false, "overlay_size": 0, "string_count": 14963, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "http": 18, "winhttp": 11, "https://": 4, "http://": 3, "loadlibrary": 3, "shellexecute": 2, "startup": 2, "vctk.me": 2, "setwindowshookex": 1, "getasynckeystate": 1, "createprocess": 1, "getprocaddress": 1, "vietguards": 1 } }, "strings_file": "old_launcher_AutoUpdateVCTK.exe.strings.txt" }, "old_vlautopr_VLAutoPr.exe": { "zip_entry": "JxVoCongTruyenKy/_VLAuto/VLAutoPr.exe", "size": 2262528, "sha256": "DBC66C16C5DDC72EB4398A80E2A34DE9E3078D0F86D12836B9D3A208F0B3D50D", "md5": "0A4BC7C59AD34471469F85C20CC6A9D5", "is_pe": true, "machine": "0x14c", "timestamp": 1783142507, "subsystem": 2, "ep_rva": "0x15b1ce", "image_base": "0x400000", "sections": [ ".text vsz=0x18DBFC raw=0x18DC00 ent=6.43", ".rdata vsz=0x5C352 raw=0x5C400 ent=5.04", ".data vsz=0xD1F8 raw=0x6200 ent=4.67", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0x12CD8 raw=0x12E00 ent=5.77", ".reloc vsz=0x24FE8 raw=0x25000 ent=6.56" ], "max_section_entropy": 6.56, "imports": { "VLHookPr.dll": [ "?StopInject@@YAIPAUHWND__@@@Z", "?StartInject@@YAIPAUHWND__@@0@Z" ], "WINMM.dll": [ "PlaySoundW" ], "KERNEL32.dll": [ "FlsGetValue", "FlsAlloc", "GetTimeZoneInformation", "ExitProcess", "GetStdHandle", "GetFileType", "SetStdHandle", "QueryPerformanceFrequency", "HeapQueryInformation", "GetCommandLineW", "FlsFree", "FreeLibraryAndExitThread", "ExitThread", "CreateThread", "VirtualQuery", "VirtualAlloc", "GetSystemInfo", "RtlUnwind", "OutputDebugStringW", "FlsSetValue", "InitializeCriticalSectionEx", "GetCommandLineA", "LCMapStringW", "GetConsoleOutputCP", "GetConsoleMode", "ReadConsoleW", "SetFilePointerEx", "FindFirstFileExW", "FindNextFileW", "IsValidCodePage", "GetACP", "GetOEMCP", "GetCPInfo", "GetEnvironmentStringsW", "GetStartupInfoW", "IsDebuggerPresent", "InitializeSListHead", "GetSystemTimeAsFileTime", "QueryPerformanceCounter", "IsProcessorFeaturePresent", "TerminateProcess", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetTempFileNameW", "Sleep", "SearchPathW", "GetProfileIntW", "GetTempPathW", "VerifyVersionInfoW", "VerSetConditionMask", "GetWindowsDirectoryW", "GetTickCount", "FindResourceExW", "lstrcpyW", "GetCurrentDirectoryW", "GlobalFlags", "GetUserDefaultUILanguage", "GetSystemDefaultUILanguage", "GetLocaleInfoW", "GlobalGetAtomNameW", "SetErrorMode", "SystemTimeToTzSpecificLocalTime", "GetFileTime", "GetFileSizeEx", "GetFileAttributesExW", "GetFileAttributesW", "FileTimeToLocalFileTime", "LocalReAlloc", "LocalAlloc", "GlobalHandle", "GlobalReAlloc", "TlsFree", "TlsSetValue", "TlsGetValue", "TlsAlloc", "LeaveCriticalSection", "EnterCriticalSection", "InitializeCriticalSection", "VirtualProtect", "FileTimeToSystemTime", "lstrcmpA", "GetVersionExW", "GetCurrentThread", "ResumeThread", "SetThreadPriority", "CreateEventW", "WaitForSingleObject", "GetCurrentProcessId", "CompareStringW", "GlobalFindAtomW", "GlobalAddAtomW", "lstrcmpW", "GlobalDeleteAtom", "FreeLibrary", "GetSystemDirectoryW", "GetCurrentThreadId", "EncodePointer", "GetThreadLocale", "lstrcmpiW", "LoadLibraryW", "LoadLibraryA", "LoadLibraryExW", "GetModuleHandleA", "DuplicateHandle", "OutputDebugStringA", "WriteFile", "UnlockFile", "SetFilePointer", "SetEndOfFile", "ReadFile", "LockFile", "GetVolumeInformationW", "GetFullPathNameW", "GetFileSize", "FlushFileBuffers", "FindFirstFileW", "FindClose", "DeleteFileW", "CopyFileW", "FormatMessageW", "MulDiv", "LocalFree", "GlobalFree", "GlobalSize", "SetLastError", "ReadProcessMemory", "OpenProcess", "GetProcAddress", "GetModuleHandleW", "CreateFileW", "WideCharToMultiByte", "GetPrivateProfileStringW", "GlobalLock", "GlobalUnlock", "GlobalAlloc", "WritePrivateProfileStringW", "GetPrivateProfileIntW", "GetCurrentProcess", "GetModuleFileNameW", "CreateDirectoryW", "FindResourceW", "WriteConsoleW", "SizeofResource", "LockResource", "LoadResource", "MultiByteToWideChar", "CloseHandle", "DeleteCriticalSection", "InitializeCriticalSectionAndSpinCount", "GetProcessHeap", "HeapSize", "HeapFree", "HeapReAlloc", "HeapAlloc", "GetLastError", "RaiseException", "DecodePointer", "FreeEnvironmentStringsW", "SetEnvironmentVariableW", "GetStringTypeW", "GetModuleHandleExW" ], "USER32.dll": [ "IntersectRect", "RealChildWindowFromPoint", "CopyImage", "GetSysColorBrush", "CharNextW", "GetAsyncKeyState", "WindowFromPoint", "GetDesktopWindow", "GetNextDlgTabItem", "EndDialog", "CreateDialogIndirectParamW", "OffsetRect", "SetRectEmpty", "SendDlgItemMessageA", "SystemParametersInfoW", "InflateRect", "GetMenuItemInfoW", "DestroyMenu", "ClientToScreen", "GetWindowDC", "TabbedTextOutW", "GrayStringW", "DrawTextExW", "DrawTextW", "MapDialogRect", "SetWindowContextHelpId", "ShowOwnedPopups", "PostQuitMessage", "GetActiveWindow", "TranslateMessage", "GetMessageW", "IsDialogMessageW", "SetWindowTextW", "CheckDlgButton", "GetDlgItemTextW", "SetDlgItemTextW", "GetDlgItemInt", "SetDlgItemInt", "MoveWindow", "SetMenuItemInfoW", "GetMenuCheckMarkDimensions", "SetMenuItemBitmaps", "EnableMenuItem", "CheckMenuItem", "WaitMessage", "IsWindowEnabled", "ReleaseDC", "GetDC", "MapVirtualKeyW", "GetKeyNameTextW", "GetMonitorInfoW", "MonitorFromWindow", "WinHelpW", "GetScrollInfo", "SetScrollInfo", "CallNextHookEx", "UnhookWindowsHookEx", "SetWindowsHookExW", "GetWindow", "GetLastActivePopup", "GetTopWindow", "GetClassNameW", "DeleteMenu", "SetWindowLongW", "GetWindowLongW", "PtInRect", "EqualRect", "CopyRect", "MapWindowPoints", "ScreenToClient", "MessageBoxW", "AdjustWindowRectEx", "GetWindowTextLengthW", "GetWindowTextW", "RemovePropW", "GetPropW", "SetPropW", "ShowScrollBar", "GetScrollRange", "SetScrollRange", "InvertRect", "SetScrollPos", "ScrollWindow", "RedrawWindow", "ValidateRect", "EndPaint", "BeginPaint", "GetForegroundWindow", "SetActiveWindow", "UpdateWindow", "EnableScrollBar", "SetMenu", "GetMenu", "GetCapture", "GetKeyState", "GetFocus", "SetFocus", "GetDlgCtrlID", "GetDlgItem", "EndDeferWindowPos", "NotifyWinEvent", "GetMenuDefaultItem", "SetLayeredWindowAttributes", "EnumDisplayMonitors", "UnregisterClassW", "SendMessageW", "PostMessageW", "IsWindow", "DeferWindowPos", "BeginDeferWindowPos", "SetWindowPlacement", "GetWindowPlacement", "SetWindowPos", "DestroyWindow", "IsChild", "IsMenu", "CreateWindowExW", "GetClassInfoExW", "CallWindowProcW", "DefWindowProcW", "GetMessageTime", "GetMessagePos", "PeekMessageW", "DispatchMessageW", "CharUpperW", "RemoveMenu", "DestroyIcon", "SetCapture", "ReleaseCapture", "CopyAcceleratorTableW", "InvalidateRgn", "SetRect", "IsRectEmpty", "GetNextDlgGroupItem", "MessageBeep", "TrackMouseEvent", "LoadImageW", "LoadAcceleratorsW", "TranslateAcceleratorW", "CreatePopupMenu", "AppendMenuW", "InsertMenuW", "GetMenuItemCount", "InsertMenuItemW", "UnpackDDElParam", "ReuseDDElParam", "RegisterClipboardFormatW", "DrawFocusRect", "DrawIconEx", "GetClassLongW", "DrawStateW", "SetClassLongW", "SetWindowRgn", "SetParent", "DrawEdge", "DrawFrameControl", "DestroyCursor", "GetWindowRgn", "CreateMenu", "FindWindowExW", "RegisterClassW", "GetClassInfoW", "IsWindowVisible", "IsIconic", "BringWindowToTop", "SetForegroundWindow", "FindWindowW", "RegisterWindowMessageW", "ExitWindowsEx", "ShowWindow", "SetTimer", "KillTimer", "EnableWindow", "GetSystemMetrics", "LoadMenuW", "GetSubMenu", "SetMenuDefaultItem", "DrawIcon", "GetClientRect", "GetWindowRect", "LoadIconW", "OpenClipboard", "CloseClipboard", "SetClipboardData", "EmptyClipboard", "GetCursorPos", "InvalidateRect", "GetParent", "GetWindowThreadProcessId", "GetMenuItemID", "TrackPopupMenu", "SetCursor", "GetSysColor", "FillRect", "LoadBitmapW", "LoadCursorW", "GetMenuStringW", "GetMenuState", "SubtractRect", "TranslateMDISysAccel", "GetIconInfo", "HideCaret", "DefMDIChildProcW", "DefFrameProcW", "DrawMenuBar", "GetUpdateRect", "IsClipboardFormatAvailable", "CharUpperBuffW", "ModifyMenuW", "GetDoubleClickTime", "LockWindowUpdate", "DestroyAcceleratorTable", "CreateAcceleratorTableW", "GetKeyboardState", "ToUnicodeEx", "MapVirtualKeyExW", "IsCharLowerW", "GetKeyboardLayout", "GetComboBoxInfo", "MonitorFromPoint", "UpdateLayeredWindow", "PostThreadMessageW", "UnionRect", "FrameRect", "CopyIcon", "SetCursorPos", "GetSystemMenu", "GetScrollPos", "IsZoomed" ], "GDI32.dll": [ "ExcludeClipRect", "GetClipBox", "GetObjectType", "GetPixel", "GetViewportExtEx", "GetWindowExtEx", "IntersectClipRect", "LineTo", "PtVisible", "RectVisible", "RestoreDC", "SaveDC", "SelectClipRgn", "ExtSelectClipRgn", "SelectObject", "SelectPalette", "SetBkMode", "SetMapMode", "SetLayout", "GetLayout", "SetPolyFillMode", "SetROP2", "SetTextAlign", "MoveToEx", "TextOutW", "ExtTextOutW", "SetViewportExtEx", "SetViewportOrgEx", "SetWindowExtEx", "SetWindowOrgEx", "OffsetViewportOrgEx", "OffsetWindowOrgEx", "ScaleViewportExtEx", "ScaleWindowExtEx", "CreateFontIndirectW", "GetTextExtentPoint32W", "DeleteObject", "GetTextColor", "CombineRgn", "GetMapMode", "SetRectRgn", "DPtoLP", "GetRgnBox", "GetTextMetricsW", "EnumFontFamiliesExW", "CreateCompatibleBitmap", "CreatePalette", "GetNearestPaletteIndex", "GetPaletteEntries", "GetSystemPaletteEntries", "RealizePalette", "CreateDIBitmap", "EnumFontFamiliesW", "GetTextCharsetInfo", "SetPixel", "StretchBlt", "CreateDIBSection", "SetDIBColorTable", "CreateEllipticRgn", "Ellipse", "CreatePolygonRgn", "Polygon", "Polyline", "CreateRoundRectRgn", "LPtoDP", "OffsetRgn", "RoundRect", "FillRgn", "FrameRgn", "GetBoundsRect", "PtInRegion", "ExtFloodFill", "SetPaletteEntries", "SetPixelV", "GetWindowOrgEx", "GetViewportOrgEx", "GetTextFaceW", "DeleteDC", "CreateRectRgn", "CreatePatternBrush", "CreatePen", "CreateHatchBrush", "CreateCompatibleDC", "BitBlt", "CreateBitmap", "PatBlt", "CreateRectRgnIndirect", "SetTextColor", "SetBkColor", "GetDeviceCaps", "CreateDCW", "CopyMetaFileW", "GetObjectW", "Rectangle", "GetStockObject", "GetBkColor", "Escape", "CreateSolidBrush" ], "MSIMG32.dll": [ "AlphaBlend", "TransparentBlt" ], "WINSPOOL.DRV": [ "ClosePrinter", "OpenPrinterW", "DocumentPropertiesW" ], "ADVAPI32.dll": [ "RegDeleteValueW", "AdjustTokenPrivileges", "LookupPrivilegeValueW", "RegEnumKeyExW", "RegEnumValueW", "RegQueryValueW", "RegEnumKeyW", "RegSetValueExW", "OpenProcessToken", "RegDeleteKeyW", "RegCreateKeyExW", "RegQueryValueExW", "RegOpenKeyExW", "RegCloseKey" ], "SHELL32.dll": [ "Shell_NotifyIconW", "SHGetFileInfoW", "DragQueryFileW", "DragFinish", "SHGetPathFromIDListW", "SHGetSpecialFolderLocation", "SHAppBarMessage", "SHBrowseForFolderW", "SHGetDesktopFolder", "ShellExecuteW" ], "COMCTL32.dll": [ "ImageList_AddMasked", "InitCommonControlsEx" ], "SHLWAPI.dll": [ "PathFindExtensionW", "PathIsUNCW", "PathRemoveFileSpecW", "StrFormatKBSizeW", "PathFindFileNameW", "PathStripToRootW" ], "UxTheme.dll": [ "IsAppThemed", "GetThemePartSize", "IsThemeBackgroundPartiallyTransparent", "GetCurrentThemeName", "GetWindowTheme", "DrawThemeBackground", "CloseThemeData", "OpenThemeData", "DrawThemeParentBackground", "DrawThemeText", "GetThemeColor", "GetThemeSysColor" ], "ole32.dll": [ "OleCreateMenuDescriptor", "OleDestroyMenuDescriptor", "OleTranslateAccelerator", "IsAccelerator", "OleLockRunning", "RevokeDragDrop", "RegisterDragDrop", "CoLockObjectExternal", "OleGetClipboard", "DoDragDrop", "CoRegisterMessageFilter", "OleIsCurrentClipboard", "OleFlushClipboard", "CoRevokeClassObject", "CreateStreamOnHGlobal", "OleUninitialize", "OleInitialize", "CoFreeUnusedLibraries", "CreateILockBytesOnHGlobal", "StgOpenStorageOnILockBytes", "StgCreateDocfileOnILockBytes", "CoGetClassObject", "CoDisconnectObject", "CoInitializeEx", "CLSIDFromProgID", "CLSIDFromString", "CoInitialize", "CoCreateInstance", "CoCreateGuid", "CoUninitialize", "ReleaseStgMedium", "OleDuplicateData", "CoTaskMemFree", "CoTaskMemAlloc" ], "OLEAUT32.dll": [ "SafeArrayDestroy", "VariantCopy", "SysStringLen", "VarBstrFromDate", "LoadTypeLib", "OleCreateFontIndirect", "SysAllocStringLen", "VariantInit", "VariantClear", "VariantTimeToSystemTime", "VariantChangeType", "SysFreeString", "SysAllocString", "SystemTimeToVariantTime" ], "oledlg.dll": [ "OleUIBusyW" ], "WS2_32.dll": [ "WSASetLastError", "WSACleanup", "WSAStartup" ], "PSAPI.DLL": [ "GetModuleBaseNameW" ], "gdiplus.dll": [ "GdipFree", "GdiplusStartup", "GdipCloneImage", "GdipDisposeImage", "GdipGetImageWidth", "GdipGetImageHeight", "GdipGetImagePixelFormat", "GdipGetImagePalette", "GdipGetImagePaletteSize", "GdipCreateBitmapFromStream", "GdipCreateBitmapFromScan0", "GdipBitmapLockBits", "GdipBitmapUnlockBits", "GdipDeleteGraphics", "GdipDrawImageI", "GdipCreateBitmapFromHBITMAP", "GdipCreateFromHDC", "GdipSetInterpolationMode", "GdipDrawImageRectI", "GdipGetImageGraphicsContext", "GdipAlloc", "GdiplusShutdown" ], "OLEACC.dll": [ "AccessibleObjectFromWindow", "LresultFromObject", "CreateStdAccessibleObject" ], "IMM32.dll": [ "ImmReleaseContext", "ImmGetOpenStatus", "ImmGetContext" ] }, "import_dlls": [ "ADVAPI32.dll", "COMCTL32.dll", "GDI32.dll", "IMM32.dll", "KERNEL32.dll", "MSIMG32.dll", "OLEACC.dll", "OLEAUT32.dll", "PSAPI.DLL", "SHELL32.dll", "SHLWAPI.dll", "USER32.dll", "UxTheme.dll", "VLHookPr.dll", "WINMM.dll", "WINSPOOL.DRV", "WS2_32.dll", "gdiplus.dll", "ole32.dll", "oledlg.dll" ], "has_authenticode": false, "overlay_size": 0, "string_count": 7523, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "loadlibrary": 3, "startup": 2, "http://": 1, "readprocessmemory": 1, "setwindowshookex": 1, "getasynckeystate": 1, "shellexecute": 1, "getprocaddress": 1, "http": 1 } }, "strings_file": "old_vlautopr_VLAutoPr.exe.strings.txt" }, "old_vlhookpr_VLHookPr.dll": { "zip_entry": "JxVoCongTruyenKy/_VLAuto/VLHookPr.dll", "size": 282624, "sha256": "289C8C6FDDDE6F41438F66F5A3E175748EF94497F8473AF9A0229FDEC9566D15", "md5": "1F7D059401E48979CCA0B0D50FF00829", "is_pe": true, "machine": "0x14c", "timestamp": 1783142487, "subsystem": 2, "ep_rva": "0x1742e", "image_base": "0x10000000", "sections": [ ".text vsz=0x34C06 raw=0x34E00 ent=6.62", ".rdata vsz=0xBD92 raw=0xBE00 ent=5.57", ".data vsz=0x2F088 raw=0xE00 ent=2.91", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0x1E0 raw=0x200 ent=4.72", ".reloc vsz=0x2D58 raw=0x2E00 ent=6.72" ], "max_section_entropy": 6.72, "imports": { "KERNEL32.dll": [ "CloseHandle", "OpenProcess", "ReadProcessMemory", "DisableThreadLibraryCalls", "FreeLibrary", "GetModuleFileNameA", "LoadLibraryA", "ReadFile", "GlobalAlloc", "GetProcAddress", "GetModuleHandleA", "GetPrivateProfileIntA", "GetPrivateProfileStringA", "GlobalUnlock", "GlobalLock", "IsProcessorFeaturePresent", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "EnterCriticalSection", "LeaveCriticalSection", "InitializeCriticalSectionAndSpinCount", "DeleteCriticalSection", "SetEvent", "ResetEvent", "WaitForSingleObjectEx", "CreateEventW", "GetModuleHandleW", "IsDebuggerPresent", "GetStartupInfoW", "QueryPerformanceCounter", "GetCurrentProcessId", "GetCurrentThreadId", "GetSystemTimeAsFileTime", "InitializeSListHead", "RtlUnwind", "InterlockedFlushSList", "RaiseException", "GetLastError", "SetLastError", "EncodePointer", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "LoadLibraryExW", "CreateFileW", "GetFileInformationByHandle", "GetFileType", "PeekNamedPipe", "SystemTimeToTzSpecificLocalTime", "FileTimeToSystemTime", "ExitProcess", "GetModuleHandleExW", "GetModuleFileNameW", "HeapFree", "HeapAlloc", "GetStdHandle", "FlsAlloc", "FlsGetValue", "FlsSetValue", "FlsFree", "InitializeCriticalSectionEx", "VirtualProtect", "CompareStringW", "LCMapStringW", "GetConsoleMode", "ReadConsoleW", "MultiByteToWideChar", "DeleteFileW", "MoveFileExW", "GetTimeZoneInformation", "GetCurrentDirectoryW", "SetStdHandle", "DecodePointer", "FindClose", "FindFirstFileExW", "FindNextFileW", "IsValidCodePage", "GetACP", "GetOEMCP", "GetCPInfo", "GetCommandLineA", "GetCommandLineW", "WideCharToMultiByte", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "SetEnvironmentVariableW", "GetProcessHeap", "GetStringTypeW", "GetFileSizeEx", "SetFilePointerEx", "FlushFileBuffers", "WriteFile", "GetConsoleOutputCP", "HeapSize", "HeapReAlloc", "SetEndOfFile", "WriteConsoleW" ] }, "import_dlls": [ "KERNEL32.dll" ], "export_count": 2, "has_authenticode": false, "overlay_size": 0, "string_count": 1656, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "setwindowshookex": 2, "loadlibrary": 2, "readprocessmemory": 1, "getasynckeystate": 1, "getprocaddress": 1, "startup": 1 } }, "strings_file": "old_vlhookpr_VLHookPr.dll.strings.txt" }, "old_kymyen_KY_VCTK_CTCX_NEW.exe": { "zip_entry": "JxVoCongTruyenKy/_AutoKimYen/KY_VCTK_CTCX_NEW.exe", "size": 15582720, "sha256": "CB8AB6D044805A8CFF4628F252AD6F09E72358225463CCA8DF9A5B666E8E3AD6", "md5": "10A19F7858EB424E83939EBD202B836E", "is_pe": true, "machine": "0x14c", "timestamp": 1683735105, "subsystem": 2, "ep_rva": "0xee5780", "image_base": "0x400000", "sections": [ "(empty) vsz=0xD000 raw=0x7A00 ent=7.99 RWX!", "(empty) vsz=0x6000 raw=0x2400 ent=7.89 RWX!", "(empty) vsz=0x2000 raw=0x200 ent=6.21 RWX!", "(empty) vsz=0x2000 raw=0x200 ent=4.07 RWX!", "(empty) vsz=0x1000 raw=0xE00 ent=7.93 RWX!", "(empty) vsz=0x513000 raw=0x402200 ent=8.00 RWX!", ".rsrc vsz=0x2000 raw=0x2000 ent=3.64", "(empty) vsz=0x7A4000 raw=0x8B6A00 ent=8.00 RWX!", ".data vsz=0x217000 raw=0x216600 ent=7.96 RWX!" ], "max_section_entropy": 8.0, "imports": { "kernel32.dll": [ "GetModuleHandleA", "GetProcAddress", "ExitProcess", "LoadLibraryA" ], "user32.dll": [ "MessageBoxA" ], "advapi32.dll": [ "RegCloseKey" ], "oleaut32.dll": [ "SysFreeString" ], "gdi32.dll": [ "CreateFontA" ], "shell32.dll": [ "ShellExecuteA" ], "version.dll": [ "GetFileVersionInfoA" ] }, "import_dlls": [ "advapi32.dll", "gdi32.dll", "kernel32.dll", "oleaut32.dll", "shell32.dll", "user32.dll", "version.dll" ], "export_count": 0, "has_authenticode": false, "overlay_size": 0, "string_count": 71159, "interesting": { "urls": [ "http://pki-ocsp.symauth.com0" ], "url_count": 1, "ips": [], "ip_count": 0, "keyword_hits": { "http://": 3, "http": 3, "shellexecute": 1, "loadlibrary": 1, "getprocaddress": 1 } }, "strings_file": "old_kymyen_KY_VCTK_CTCX_NEW.exe.strings.txt" }, "old_winmm_winmm.dll": { "zip_entry": "JxVoCongTruyenKy/_AutoVLBS/VLBS19Dai/winmm.dll", "size": 1759744, "sha256": "92858E63788EF967961D7A41EE1A3051E845657A181430A00FD68D9DB6942B7C", "md5": "1931075B59D02ADAF01C829C086D5426", "is_pe": true, "machine": "0x14c", "timestamp": 1743002085, "subsystem": 2, "ep_rva": "0x463d9", "image_base": "0x10000000", "sections": [ ".text vsz=0x7A26C raw=0x7A400 ent=6.55", ".rdata vsz=0x2D352 raw=0x2D400 ent=5.29", ".data vsz=0x941AC raw=0x2000 ent=3.96", ".fptable vsz=0x80 raw=0x200 ent=-0.00", ".rsrc vsz=0xFCAD0 raw=0xFCC00 ent=6.67", ".reloc vsz=0x6FA8 raw=0x7000 ent=6.68" ], "max_section_entropy": 6.68, "imports": { "KERNEL32.dll": [ "HeapFree", "GetProcessHeap", "GetNativeSystemInfo", "VirtualAlloc", "VirtualProtect", "VirtualFree", "FreeLibrary", "GetProcAddress", "LoadLibraryA", "IsBadReadPtr", "LoadLibraryW", "VirtualQuery", "CloseHandle", "GetLastError", "HeapCreate", "HeapReAlloc", "Sleep", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThreadId", "OpenThread", "SuspendThread", "ResumeThread", "GetThreadContext", "SetThreadContext", "FlushInstructionCache", "GetModuleHandleW", "CreateToolhelp32Snapshot", "Thread32First", "Thread32Next", "GetCommandLineA", "GetCommandLineW", "SetCurrentDirectoryW", "GetCurrentDirectoryW", "CreateFileA", "CreateFileW", "FindClose", "FindFirstFileA", "FindFirstFileW", "FindFirstFileExA", "FindFirstFileExW", "FindNextFileA", "FindNextFileW", "GetFileAttributesA", "GetFileAttributesW", "GetFileAttributesExA", "GetFileAttributesExW", "WriteFile", "CreateFile2", "OutputDebugStringA", "SetUnhandledExceptionFilter", "AcquireSRWLockExclusive", "CreateMutexW", "OpenMutexW", "HeapAlloc", "CreateEventW", "ExitProcess", "GetCurrentThread", "GetStartupInfoW", "GetSystemInfo", "GetSystemTimeAsFileTime", "GetModuleFileNameA", "GetModuleFileNameW", "GetModuleHandleA", "GetModuleHandleExA", "GetModuleHandleExW", "LoadLibraryExA", "LoadLibraryExW", "LoadResource", "LockResource", "SizeofResource", "FindResourceW", "GetShortPathNameA", "GetStartupInfoA", "GetPrivateProfileIntW", "GetPrivateProfileStringW", "MultiByteToWideChar", "CreateDirectoryA", "CreateDirectoryW", "CancelIo", "InitializeCriticalSection", "EnterCriticalSection", "LeaveCriticalSection", "SetEvent", "ResetEvent", "CreateThread", "GetSystemTime", "SystemTimeToFileTime", "SetEndOfFile", "WriteConsoleW", "HeapSize", "SetStdHandle", "SetEnvironmentVariableW", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetOEMCP", "GetACP", "IsValidCodePage", "GetTimeZoneInformation", "ReadConsoleW", "GetConsoleMode", "GetConsoleOutputCP", "FlushFileBuffers", "EnumSystemLocalesW", "GetUserDefaultLCID", "IsValidLocale", "GetLocaleInfoW", "LCMapStringW", "CompareStringW", "GetTimeFormatW", "GetDateFormatW", "CreateEventA", "SetLastError", "FlsFree", "FlsSetValue", "FlsGetValue", "FlsAlloc", "SetFilePointerEx", "GetFileSizeEx", "GetFileType", "GetStdHandle", "ReadFile", "TlsFree", "TlsSetValue", "TlsGetValue", "TlsAlloc", "InitializeCriticalSectionAndSpinCount", "InterlockedFlushSList", "RaiseException", "RtlUnwind", "LCMapStringEx", "GetCPInfo", "CompareStringEx", "DecodePointer", "EncodePointer", "DeleteCriticalSection", "InitializeCriticalSectionEx", "GetStringTypeW", "WideCharToMultiByte", "GetFileInformationByHandleEx", "AreFileApisANSI", "GetFullPathNameW", "GetLocaleInfoEx", "FormatMessageA", "LocalFree", "InitializeSListHead", "QueryPerformanceCounter", "IsDebuggerPresent", "IsProcessorFeaturePresent", "TerminateProcess", "UnhandledExceptionFilter", "SleepConditionVariableSRW", "ReleaseSRWLockExclusive", "WakeAllConditionVariable" ], "USER32.dll": [ "GetDlgItemTextW", "SetWindowTextW", "GetWindowRect", "GetDesktopWindow", "EnumWindows", "GetWindowThreadProcessId", "SetDlgItemTextW", "EndDialog", "DialogBoxParamW", "SetWindowsHookExW", "FindWindowW", "ShowCursor", "SetForegroundWindow", "KillTimer", "SetTimer", "SendMessageW", "ReleaseDC", "GetDC", "MessageBoxW", "CallNextHookEx", "wsprintfW", "SetWindowPos" ], "GDI32.dll": [ "GetDeviceCaps" ], "SHELL32.dll": [ "SHGetKnownFolderPath", "ShellExecuteW" ], "ole32.dll": [ "CoTaskMemFree", "CoCreateInstance" ], "d3d9.dll": [ "Direct3DCreate9" ], "dbghelp.dll": [ "SymFromAddr", "MiniDumpWriteDump", "SymCleanup", "SymSetOptions", "StackWalk64", "SymInitialize" ], "WS2_32.dll": [ "inet_ntoa", "inet_addr", "htons", "htonl", "getsockopt", "ntohl", "getpeername", "ioctlsocket", "connect", "closesocket", "bind", "accept", "ntohs", "recv", "recvfrom", "select", "send", "sendto", "setsockopt", "shutdown", "socket", "WSAStartup", "WSACleanup", "WSASetLastError", "WSAGetLastError", "WSACloseEvent", "WSACreateEvent", "listen", "WSAEventSelect", "WSAGetOverlappedResult", "WSARecv", "WSARecvFrom", "WSAResetEvent", "WSASend", "WSASendTo", "WSASetEvent", "WSAWaitForMultipleEvents", "getsockname", "__WSAFDIsSet" ] }, "import_dlls": [ "GDI32.dll", "KERNEL32.dll", "SHELL32.dll", "USER32.dll", "WS2_32.dll", "d3d9.dll", "dbghelp.dll", "ole32.dll" ], "export_count": 1308, "has_authenticode": false, "overlay_size": 0, "string_count": 11661, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": { "http": 212, "winhttp": 156, "loadlibrary": 15, "startup": 12, "internetopen": 8, "setwindowshookex": 5, "createprocess": 5, "getprocaddress": 4, "cookies": 2, "getasynckeystate": 2, "minidump": 1, "writeprocessmemory": 1, "readprocessmemory": 1, "createremotethread": 1, "virtualprotectex": 1, "shellexecute": 1 } }, "strings_file": "old_winmm_winmm.dll.strings.txt" }, "old_driver_vietguards.driver": { "zip_entry": "JxVoCongTruyenKy/vietguards.driver", "size": 30928467, "sha256": "6E91D835E0E3FB4F09CF29852F50C8A9A59D0B89EA826854CC3EAA0A5B48D916", "md5": "BD1FD8C8CB53A4AD7BEE21C0CF082E03", "string_count": 137315, "interesting": { "urls": [], "url_count": 0, "ips": [], "ip_count": 0, "keyword_hits": {} }, "strings_file": "old_driver_vietguards.driver.strings.txt" }, "old_vggame_vggame.exe": { "zip_entry": "JxVoCongTruyenKy/vggame.exe", "size": 3167128, "sha256": "F66DAA617E67BCF346ED25669051A33D62C0D2522FFC5A127FB3D1D6CE53D78B", "md5": "83B68D6C58E3492BDBA454F162256F62", "is_pe": true, "machine": "0x14c", "timestamp": 1340706750, "subsystem": 2, "ep_rva": "0x1a9bf70", "image_base": "0x400000", "sections": [ "(empty) vsz=0x239000 raw=0xD1000 ent=8.00 RWX!", "(empty) vsz=0x42000 raw=0x12000 ent=7.91 RWX!", "(empty) vsz=0xFA3000 raw=0xB000 ent=7.81 RWX!", "(empty) vsz=0x1000 raw=0x1000 ent=0.23 RWX!", ".rsrc vsz=0x1000 raw=0x1000 ent=5.45 RWX!", "(empty) vsz=0x6A0000 raw=0x34000 ent=8.00 RWX!", ".data vsz=0x1DD000 raw=0x1DD000 ent=7.96 RWX!" ], "max_section_entropy": 8.0, "imports": { "kernel32.dll": [ "GetModuleHandleA", "GetProcAddress", "ExitProcess", "LoadLibraryA" ], "user32.dll": [ "MessageBoxA" ], "advapi32.dll": [ "RegCloseKey" ], "oleaut32.dll": [ "SysFreeString" ], "gdi32.dll": [ "CreateFontA" ], "shell32.dll": [ "ShellExecuteA" ], "version.dll": [ "GetFileVersionInfoA" ], "WS2_32.dll": [ "inet_ntoa" ], "comdlg32.dll": [ "GetOpenFileNameA" ], "ole32.dll": [ "StgCreateDocfile" ], "FilterText.dll": [ "CreateTextFilter" ], "LuaLibDll.dll": [ "lua_typename" ], "MSVCP80.dll": [ "?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z" ], "MSVCR80.dll": [ "_localtime32" ], "engine.dll": [ "EDOneTimePad_Decipher" ], "IMM32.dll": [ "ImmAssociateContext" ], "WINMM.dll": [ "timeGetTime" ] }, "import_dlls": [ "FilterText.dll", "IMM32.dll", "LuaLibDll.dll", "MSVCP80.dll", "MSVCR80.dll", "WINMM.dll", "WS2_32.dll", "advapi32.dll", "comdlg32.dll", "engine.dll", "gdi32.dll", "kernel32.dll", "ole32.dll", "oleaut32.dll", "shell32.dll", "user32.dll", "version.dll" ], "export_count": 5, "has_authenticode": true, "overlay_size": 13208, "string_count": 11845, "interesting": { "urls": [ "http://ocsp.digicert.com0A", "http://ocsp.digicert.com0C", "http://ocsp.digicert.com0]", "http://ocsp.verisign.com0", "http://ocsp.verisign.com0;", "http://pki-ocsp.symauth.com0", "https://www.verisign.com/cps0*", "https://www.verisign.com/rpa0" ], "url_count": 8, "ips": [], "ip_count": 0, "keyword_hits": { "http": 28, "http://": 22, "https://": 6, "vietguards": 3, "shellexecute": 1, "loadlibrary": 1, "getprocaddress": 1 } }, "strings_file": "old_vggame_vggame.exe.strings.txt" }, "old_engine_engine.dll": { "zip_entry": "JxVoCongTruyenKy/engine.dll", "size": 402848, "sha256": "3BB7F74631C0B51C1E53AF1630371839B04F93EE41B0CB8E0357295715F51A91", "md5": "7F0F77B191E766E590963EDFDC899790", "is_pe": true, "machine": "0x14c", "timestamp": 1339763544, "subsystem": 2, "ep_rva": "0x309c1", "image_base": "0x10000000", "sections": [ ".text vsz=0x3D8CA raw=0x3E000 ent=6.58 RWX!", ".rdata vsz=0x15BA7 raw=0x16000 ent=5.80", ".data vsz=0x114B0 raw=0x7000 ent=3.92", ".rsrc vsz=0x51C raw=0x1000 ent=4.13", ".reloc vsz=0x3822 raw=0x4000 ent=5.90" ], "max_section_entropy": 6.58, "imports": { "DDRAW.dll": [ "DirectDrawCreate" ], "DSOUND.dll": [ "ord_1" ], "WINMM.dll": [ "timeKillEvent", "timeGetTime", "timeSetEvent" ], "DINPUT8.dll": [ "DirectInput8Create" ], "KERNEL32.dll": [ "InterlockedDecrement", "GetTickCount", "SetLocalTime", "GetCurrentThreadId", "Sleep", "WaitForMultipleObjects", "InitializeCriticalSection", "DeleteCriticalSection", "EnterCriticalSection", "LeaveCriticalSection", "GetCurrentDirectoryA", "FindClose", "FindNextFileA", "SetCurrentDirectoryA", "FindFirstFileA", "TerminateThread", "SuspendThread", "ResumeThread", "InterlockedIncrement", "SetThreadPriority", "QueryPerformanceFrequency", "QueryPerformanceCounter", "GetCurrentProcessId", "GetLastError", "CreateDirectoryA", "DeleteFileA", "SetFileAttributesA", "CopyFileA", "CompareFileTime", "GetFileAttributesA", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "InterlockedCompareExchange", "InterlockedExchange", "WaitForSingleObject", "SetEvent", "CloseHandle", "CreateEventA", "LoadLibraryA", "GetProcAddress", "FreeLibrary", "GetModuleHandleA", "DisableThreadLibraryCalls", "GetThreadPriority", "IsDebuggerPresent", "GetSystemTimeAsFileTime" ], "USER32.dll": [ "RegisterClassA", "LoadCursorA", "LoadIconA", "SetFocus", "UpdateWindow", "CreateWindowExA", "SetCursor", "DestroyWindow", "PostMessageA", "WaitMessage", "GetMessageA", "DispatchMessageA", "PostQuitMessage", "GetCursorPos", "DefWindowProcA", "GetSystemMetrics", "GetKeyboardLayout", "MessageBoxA", "SendMessageA", "FindWindowA", "SetWindowLongA", "GetWindowLongA", "GetMenu", "AdjustWindowRectEx", "SetWindowPos", "ScreenToClient", "ClientToScreen", "GetClientRect", "PeekMessageA", "TranslateMessage" ], "GDI32.dll": [ "GetStockObject" ], "comdlg32.dll": [ "GetSaveFileNameA", "GetOpenFileNameA" ], "LuaLibDll.dll": [ "lua_isnumber", "lua_close", "lua_open", "lua_baselibopen", "lua_iolibopen", "lua_strlibopen", "lua_mathlibopen", "lua_dblibopen", "lua_setgcthreshold", "lua_getgcthreshold", "lua_newpack", "lua_newtag", "lua_joinpack", "lua_clearpack", "lua_isstring", "lua_call", "Lua_SetTable_StringFromId", "Lua_SetTable_DoubleFromId", "Lua_SetTable_IntFromId", "Lua_SetTable_CFunFromName", "Lua_SetTable_CFunFromId", "Lua_SetTable_StringFromName", "Lua_SetTable_IntFromName", "Lua_SetTable_DoubleFromName", "lua_gettopindex", "lua_settop", "lua_gettop", "lua_pushnumber", "lua_pushstring", "lua_tonumber", "lua_tostring", "lua_compilebuffer", "lua_usepack", "lua_dostring", "lua_addbreakpoint", "lua_delbreakpoint", "lua_remove", "lua_rawget", "lua_type", "lua_getglobal", "lua_setglobal", "lua_pushcclosure", "lua_outerrmsg", "lua_newtable", "lua_setoutput_function", "lua_execute", "lua_pushusertag", "lua_rawseti", "lua_pushvalue", "lua_pushnil" ], "MSVCR80.dll": [ "_open", "_close", "_write", "_chdir", "_getcwd", "_stricmp", "??3@YAXPAX@Z", "??_V@YAXPAX@Z", "__CxxFrameHandler3", "??2@YAPAXI@Z", "memset", "free", "malloc", "strrchr", "_localtime32", "_time32", "vsprintf", "exit", "sprintf", "fclose", "strncpy", "_stat32", "fopen", "_snprintf", "fflush", "fwrite", "vfprintf", "fprintf", "??0exception@std@@QAE@ABQBD@Z", "?what@exception@std@@UBEPBDXZ", "??1exception@std@@UAE@XZ", "??0exception@std@@QAE@XZ", "_invalid_parameter_noinfo", "_CxxThrowException", "??0exception@std@@QAE@ABV01@@Z", "memcpy", "printf", "_purecall", "__iob_func", "_strlwr", "_errno", "puts", "fputs", "_vsnprintf", "??_U@YAPAXI@Z", "strchr", "_findclose", "_findnext32", "_strupr", "_findfirst32", "memmove", "isdigit", "isspace", "_beginthreadex", "strtoul", "fread", "ftell", "_CIpow", "strstr", "_access", "_mkdir", "atoi", "atof", "sscanf", "memchr", "_mktime32", "memmove_s", "?terminate@@YAXXZ", "_unlock", "__dllonexit", "_encode_pointer", "_lock", "_onexit", "_decode_pointer", "_malloc_crt", "_encoded_null", "_initterm", "_initterm_e", "_amsg_exit", "_adjust_fdiv", "__CppXcptFilter", "?_type_info_dtor_internal_method@type_info@@QAEXXZ", "_except_handler4_common", "_crt_debugger_hook", "__clean_type_info_names_internal", "_ftol", "strerror", "fseek" ], "MSVCP80.dll": [ "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z", "?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z", "?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB", "?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z", "??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z" ], "IMM32.dll": [ "ImmReleaseContext", "ImmGetContext", "ImmSimulateHotKey", "ImmIsIME", "ImmSetConversionStatus", "ImmGetDefaultIMEWnd", "ImmSetOpenStatus", "ImmGetConversionStatus", "ImmSetCompositionWindow", "ImmGetOpenStatus" ] }, "import_dlls": [ "DDRAW.dll", "DINPUT8.dll", "DSOUND.dll", "GDI32.dll", "IMM32.dll", "KERNEL32.dll", "LuaLibDll.dll", "MSVCP80.dll", "MSVCR80.dll", "USER32.dll", "WINMM.dll", "comdlg32.dll" ], "export_count": 1358, "has_authenticode": true, "overlay_size": 5536, "string_count": 3004, "interesting": { "urls": [ "http://ocsp.verisign.com0", "http://ocsp.verisign.com01", "http://ocsp.verisign.com0?", "http://www.oberhumer.com", "https://www.verisign.com/cps0*", "https://www.verisign.com/rpa0" ], "url_count": 6, "ips": [], "ip_count": 0, "keyword_hits": { "http": 17, "http://": 11, "https://": 6, "loadlibrary": 1, "getprocaddress": 1, "startup": 1 } }, "strings_file": "old_engine_engine.dll.strings.txt" } } }