滴水逆向-导入表

课堂知识点

文字知识点

导入表
实现：

1.使用OD打开一个发布版的exe程序，定位到某个DLL的API
2.在没有加载的EXE中找到这个位置，观察加载前后的区别


导入表结构：
typedef struct _IMAGE_IMPORT_DESCRIPTOR {
    union {
        DWORD   Characteristics;
        DWORD   OriginalFirstThunk;         		//RVA 指向IMAGE_THUNK_DATA结构数组
    };
    DWORD   TimeDateStamp;               		    //时间戳
    DWORD   ForwarderChain;
    DWORD   Name;						            //RVA,指向dll名字，该名字已0结尾
    DWORD   FirstThunk;                 		    //RVA,指向IMAGE_THUNK_DATA结构数组
} IMAGE_IMPORT_DESCRIPTOR;
typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;


typedef struct _IMAGE_THUNK_DATA32 {
    union {					                            call [0x412356]
        PBYTE  ForwarderString;
        PDWORD Function;
        DWORD Ordinal;						                 //序号
        PIMAGE_IMPORT_BY_NAME  AddressOfData;		//指向IMAGE_IMPORT_BY_NAME
    } u1;
} IMAGE_THUNK_DATA32;
typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;


typedef struct _IMAGE_IMPORT_BY_NAME {
    WORD    Hint;						//可能为空，编译器决定 如果不为空 是函数在导出表中的索引
    BYTE    Name[1];						//函数名称，以0结尾
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;


输出导入表的过程：

1.定位导入表：
	目录项目的第2个结构就是导入表
	typedef struct _IMAGE_DATA_DIRECTORY {
	    DWORD   VirtualAddress;					       //RVA 指向导入表结构
	    DWORD   Size;
	} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;


		将RVA转换成FOA

	typedef struct _IMAGE_IMPORT_DESCRIPTOR {
	    union {
	        DWORD   Characteristics;
	        DWORD   OriginalFirstThunk;
	    };
	    DWORD   TimeDateStamp;
	    DWORD   ForwarderChain;
	    DWORD   Name;
	    DWORD   FirstThunk;
	} IMAGE_IMPORT_DESCRIPTOR;
	typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;

	......

	typedef struct _IMAGE_IMPORT_DESCRIPTOR {
	    union {
	        DWORD   Characteristics;
	        DWORD   OriginalFirstThunk;
	    };
	    DWORD   TimeDateStamp;
	    DWORD   ForwarderChain;
	    DWORD   Name;
	    DWORD   FirstThunk;
	} IMAGE_IMPORT_DESCRIPTOR;
	typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;


	sizeOf(IMAGE_IMPORT_DESCRIPTOR) 个 0  代表导入表结束


2.输出DLL名字

	typedef struct _IMAGE_IMPORT_DESCRIPTOR {
	    union {
	        DWORD   Characteristics;
	        DWORD   OriginalFirstThunk;
	    };
	    DWORD   TimeDateStamp;
	    DWORD   ForwarderChain;
	    DWORD   Name;				                             RVA 指向一个以0结尾的字符串  是DLL的名字
	    DWORD   FirstThunk;
	} IMAGE_IMPORT_DESCRIPTOR;
	typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;


3.遍历OriginalFirstThunk

OriginalFirstThunk
                IMAGE_THUNK_DATA32			判断最高位是否为1 如果时 那么除去最高位的值
		IMAGE_THUNK_DATA32			就是函数的导出序号
		IMAGE_THUNK_DATA32
		IMAGE_THUNK_DATA32			如果不是，那么这个值是一个RVA 指向
		IMAGE_THUNK_DATA32			IMAGE_IMPORT_BY_NAME
		IMAGE_THUNK_DATA32
		..				                                GetProcAddr(m,函数的名字或者导出序号);
		..
		..			                                        IMAGE_IMPORT_BY_NAME
		..			                                        HIT	NAME
		..
		..
		00000000000000000			         typedef struct _IMAGE_IMPORT_BY_NAME {
							                                      WORD    Hint;
		IMAGE_THUNK_DATA32			              BYTE    Name[1];
		结构数组 以0结尾			                 } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
		宽度4字节
		HIT 2字节
		NAME 长度不定 以''结尾

4、遍历FirstThunk

FirstThunk
                IMAGE_THUNK_DATA32			判断最高位是否为1 如果时 那么除去最高位的值
		IMAGE_THUNK_DATA32			就是函数的导出序号
		IMAGE_THUNK_DATA32
		IMAGE_THUNK_DATA32			如果不是，那么这个值是一个RVA 指向
		IMAGE_THUNK_DATA32			IMAGE_IMPORT_BY_NAME
		IMAGE_THUNK_DATA32
				..
				..
				..			                        IMAGE_IMPORT_BY_NAME
				..			                        HIT	NAME
				..
				..
		00000000000000000
		IMAGE_THUNK_DATA32
		结构数组 以0结尾
		宽度4字节
	        HIT 2字节
                NAME 长度不定 以''结尾

打印导入表代码

//导入表打印
VOID LogImportTable(IN PVOID pFileBuffer)
{
    PIMAGE_DOS_HEADER pDosHeader = NULL;
    PIMAGE_NT_HEADERS pNTHeader = NULL;
    PIMAGE_FILE_HEADER pPEHeader = NULL;
    PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
    PIMAGE_SECTION_HEADER pSectionHeader = NULL;
    PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
    PIMAGE_DATA_DIRECTORY pDataDirectory_ImportTable = NULL;
    PIMAGE_IMPORT_DESCRIPTOR pImportTable = NULL;
    PIMAGE_IMPORT_BY_NAME pImportByName = NULL;
    PIMAGE_THUNK_DATA pOriginalFirstThunk = NULL;
    PIMAGE_THUNK_DATA pFirstThunk = NULL;

    if (pFileBuffer == NULL)
    {
        printf("FileBuffer获取失败!
");
        return;
    }

    //判断是否是有效的MZ标志
    if (*((PWORD)pFileBuffer) != IMAGE_DOS_SIGNATURE)
    {
        printf("无效的MZ标识
");
        return;
    }
    pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;

    //判断是否是有效的PE标志
    if (*((PDWORD)((DWORD)pFileBuffer+pDosHeader->e_lfanew)) != IMAGE_NT_SIGNATURE)
    {
        printf("无效的PE标记
");
        return;
    }

    //定位各种头
    pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer+pDosHeader->e_lfanew);
    pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader)+0x04);
    pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader+IMAGE_SIZEOF_FILE_HEADER);
    pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader+pPEHeader->SizeOfOptionalHeader);
    pDataDirectory = (PIMAGE_DATA_DIRECTORY)pOptionHeader->DataDirectory;

    //根据可选PE头里面的数据目录这个数组准确定位到导入表位置,导入表是在数据目录的第二个位置，下面两种方式都可以
    //pDataDirectory_ImportTable = &pDataDirectory[1];
    pDataDirectory_ImportTable = &pDataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];

    if (!pDataDirectory_ImportTable->VirtualAddress)
    {
        printf("pDataDirectory_ImportTable 这个程序不存在导入表
");
        return;
    }

    //验证打印导出表RVA和FOA地址
    printf("Import Table RVA: %#010x
",pDataDirectory_ImportTable->VirtualAddress);
    DWORD FOA_ImportTable = RvaToFileOffset(pFileBuffer,pDataDirectory_ImportTable->VirtualAddress);
    printf("Import Table FOA: %#010x
",FOA_ImportTable);
    //确认好FOA地址之后，开始指针偏移到文件的导入表位置
    pImportTable = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pDosHeader+FOA_ImportTable);

    /*
        下面就开始操作系统加载程序的整个流程，期间PE的加载过程：
        1.对应的exe程序将其拉伸贴到内存中；
        2.贴入各种所需要的dll文件，期间如果所申请的地址被占用，申请其他内存地址，再根据重定位表修改变量；
        3.完成之后开始操作导入表利用IAT表和导出表提取dll函数地址；
        4.这期间下面要做的事情就是第三步；

        typedef struct _IMAGE_IMPORT_DESCRIPTOR {
            union {
                DWORD   Characteristics;
                DWORD   OriginalFirstThunk;     //RVA 指向IMAGE_THUNK_DATA结构数组
              };
            DWORD   TimeDateStamp;              //时间戳
            DWORD   ForwarderChain;
            DWORD   Name;						//RVA,指向dll名字，该名字已0结尾
            DWORD   FirstThunk;                 //RVA,指向IMAGE_THUNK_DATA结构数组
        } IMAGE_IMPORT_DESCRIPTOR;
        typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;
        OriginalFirstThunk -- 指向的INT表，就是导入名称表，是结构体IMAGE_THUNK_DATA，里面是联合体
        她里面最大的宽度是4个字节，就看出4个字节宽度即可
        FirstThunk -- 指向的IAT表，就是导入地址表，
    */
    //首先是遍历所有的dll模块，这里是基于导入表结构体中的Name字段进行操作；
    //下面使用while循环，终止条件就是Name是否等于0，因为如果为0，就表示已经到结尾了，结束了；
    while (pImportTable->Name != 0)
    {
        //准备打印dll模块，将导入表里面的Name的RVA地址转换为FOA地址
        DWORD FOA_DllName = RvaToFileOffset(pFileBuffer,pImportTable->Name);
        //得到FOA地址，开始进行指针偏移
        PDWORD FOA_pDllName = (PDWORD)((DWORD)pDosHeader+FOA_DllName);
        //开始打印dll模块
        printf("%s
",FOA_pDllName);

        //准备打印OriginalFirstThunk，这里同样是导入表里面OriginalFirstThunk的RVA地址转换为FOA地址
        DWORD FOA_OriginalFirstThunk = RvaToFileOffset(pFileBuffer,pImportTable->OriginalFirstThunk);
        //得到FOA地址，继续进行指针偏移
        PDWORD FOA_pOriginalFirstThunk = (PDWORD)((DWORD)pDosHeader+FOA_OriginalFirstThunk);
        //开始打印OriginalFirstThunk
        printf("****************************FOA_OriginalFirstThunk:%#010x*********************************
",FOA_OriginalFirstThunk);
        //上面的操作完成之后只是进入了导入表第一层的FOA地址位置，下面开始进入导入表里面一层IMAGE_THUNK_DATA
/*
         typedef struct _IMAGE_THUNK_DATA32 {
             union {					call [0x412356]
                 PBYTE  ForwarderString;
             PDWORD Function;
             DWORD Ordinal;						                //序号
             PIMAGE_IMPORT_BY_NAME  AddressOfData;			    //指向IMAGE_IMPORT_BY_NAME
             } u1;
         } IMAGE_THUNK_DATA32;

         typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;


         typedef struct _IMAGE_IMPORT_BY_NAME {
             WORD    Hint;					                	//可能为空，编译器决定 如果不为空 是函数在导出表中的索引
             BYTE    Name[1];						            //函数名称，以0结尾
         } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
*/
        pOriginalFirstThunk = (PIMAGE_THUNK_DATA)FOA_pOriginalFirstThunk;

        //打印OriginalFirstThunk里面关于IMAGE_THUNK_DATA和IMAGE_IMPORT_BY_NAME
        while (*(PDWORD)pOriginalFirstThunk)
        {
            DWORD value = *(PDWORD)pOriginalFirstThunk;
            //这个IMAGE_ORDINAL_FLAG32 是预定义的0x80000000，这样就可以通过得到地址与32位的二进制最高位是1
            //进行与的关系得出结果是最高位为0或者1，最后通过右移31位得出最终结果是否为0或者1
            DWORD cntf = (value & IMAGE_ORDINAL_FLAG32) >> 31;
            //上面算法就是得出最高位如果是1，就以序号方式输入，否则最高位为0，以函数名称方式输入
            if (cntf)
            {
                //输入序号
                value -= IMAGE_ORDINAL_FLAG32;
                printf("Import Ordinal --> %#010x
",value);
            }
            else
            {
                //输入名称
                DWORD FOA_ImportByName = RvaToFileOffset(pFileBuffer,value);
                PDWORD FOA_pImportByName = (PDWORD)((DWORD)pDosHeader+FOA_ImportByName);
                pImportByName = (PIMAGE_IMPORT_BY_NAME)FOA_pImportByName;
                printf("Import Hint Name --> %#-028s Import Address --> %#010x
",pImportByName->Name,pImportByName->Hint);
            }
            pOriginalFirstThunk++;
        }

        //打印FirstThunk
        //这里操作跟上面操作OriginalFirstThunk的方式是一样的
        DWORD FOA_FirstThunk = RvaToFileOffset(pFileBuffer,pImportTable->FirstThunk);
        PDWORD FOA_pFirstThunk = (PDWORD)((DWORD)pDosHeader+FOA_FirstThunk);
        printf("****************************FOA_FirstThunk:%#010x*********************************
",FOA_FirstThunk);
        pFirstThunk = (PIMAGE_THUNK_DATA)FOA_pFirstThunk;
        while (*(PDWORD)pFirstThunk)
        {
            DWORD value = *(PDWORD)pFirstThunk;
            DWORD cntf = (value & IMAGE_ORDINAL_FLAG32) >> 31;
            //上面算法同样是得出最高位如果是1，就以序号方式输入，否则最高位为0，以函数名称方式输入
            if (cntf)
            {
                //输入序号
                value -= IMAGE_ORDINAL_FLAG32;
                printf("Import Ordinal --> %#010x
",value);
            }
            else
            {
                //输入名称
                DWORD FOA_ImportByName = RvaToFileOffset(pFileBuffer,value);
                PDWORD FOA_pImportByName = (PDWORD)((DWORD)pDosHeader+FOA_ImportByName);
                pImportByName = (PIMAGE_IMPORT_BY_NAME)FOA_pImportByName;
                printf("Import Hint Name --> %#-028s Import Address --> %#010x
",pImportByName->Name,pImportByName->Hint);
            }
            pFirstThunk++;
        }
        printf("
");
        pImportTable++;
    }
}

执行结果

打印ipmsg.exe导入表






打印notepad.exe导入表




上述打印导入表的结果，确实程序在未运行前其INT表和IAT表存储的内容一样
对比上面打印ipmsg.exe和notepad.exe这两个程序发现，notepad.exe没有导出序号，就是没有FirstThunk

打印出来的结果

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 12.00.8804 for 80x86
Copyright (C) Microsoft Corp 1984-1998. All rights reserved.

pelx.cpp
Microsoft (R) Incremental Linker Version 6.00.8447
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.

FileBuffer: 0x65000
exe->filebuffer  返回值为计算所得文件大小：0x65000
Import Table RVA: 0x000500d0
Import Table FOA: 0x000500d0
KERNEL32.dll
****************************FOA_OriginalFirstThunk:0x00050278*********************************
Import Hint Name --> GetDiskFreeSpaceA            Import Address --> 0x00000100
Import Hint Name --> GetVolumeInformationA        Import Address --> 0x00000177
Import Hint Name --> GetCommandLineA              Import Address --> 0x000000ca
Import Hint Name --> lstrcmpiA                    Import Address --> 0x000002ff
Import Hint Name --> GetSystemDefaultLCID         Import Address --> 0x00000157
Import Hint Name --> GetDriveTypeA                Import Address --> 0x00000104
Import Hint Name --> GetThreadLocale              Import Address --> 0x00000168
Import Hint Name --> GetCurrentProcess            Import Address --> 0x000000f7
Import Hint Name --> SetPriorityClass             Import Address --> 0x00000277
Import Hint Name --> GlobalLock                   Import Address --> 0x0000018c
Import Hint Name --> GlobalUnlock                 Import Address --> 0x00000193
Import Hint Name --> SetFileTime                  Import Address --> 0x0000026c
Import Hint Name --> SuspendThread                Import Address --> 0x00000298
Import Hint Name --> ResumeThread                 Import Address --> 0x0000022c
Import Hint Name --> LocalFree                    Import Address --> 0x000001cc
Import Hint Name --> Sleep                        Import Address --> 0x00000296
Import Hint Name --> GetComputerNameW             Import Address --> 0x000000cf
Import Hint Name --> GetModuleHandleA             Import Address --> 0x00000126
Import Hint Name --> GetProcAddress               Import Address --> 0x0000013e
Import Hint Name --> GetSystemTime                Import Address --> 0x0000015d
Import Hint Name --> SystemTimeToFileTime         Import Address --> 0x0000029b
Import Hint Name --> GetStartupInfoA              Import Address --> 0x00000150
Import Hint Name --> SetThreadLocale              Import Address --> 0x00000286
Import Hint Name --> SetUnhandledExceptionFilter  Import Address --> 0x0000028b
Import Hint Name --> GetLastError                 Import Address --> 0x0000011a
Import Hint Name --> IsDBCSLeadByte               Import Address --> 0x000001b9
Import Hint Name --> VirtualFree                  Import Address --> 0x000002bf
Import Hint Name --> VirtualAlloc                 Import Address --> 0x000002bb
Import Hint Name --> GetVersion                   Import Address --> 0x00000174
Import Hint Name --> GetWindowsDirectoryW         Import Address --> 0x0000017e
Import Hint Name --> GetFileInformationByHandle   Import Address --> 0x00000111
Import Hint Name --> FormatMessageW               Import Address --> 0x000000b0
Import Hint Name --> GetFileAttributesW           Import Address --> 0x00000110
Import Hint Name --> SetFileAttributesW           Import Address --> 0x00000269
Import Hint Name --> FindFirstFileW               Import Address --> 0x00000097
Import Hint Name --> FindNextFileW                Import Address --> 0x0000009e
Import Hint Name --> CreateFileW                  Import Address --> 0x00000037
Import Hint Name --> MoveFileW                    Import Address --> 0x000001e0
Import Hint Name --> RemoveDirectoryW             Import Address --> 0x00000228
Import Hint Name --> DeleteFileW                  Import Address --> 0x00000058
Import Hint Name --> CreateDirectoryW             Import Address --> 0x00000030
Import Hint Name --> SetCurrentDirectoryW         Import Address --> 0x0000025e
Import Hint Name --> GetModuleFileNameW           Import Address --> 0x00000125
Import Hint Name --> GetCurrentDirectoryW         Import Address --> 0x000000f6
Import Hint Name --> GetDiskFreeSpaceW            Import Address --> 0x00000103
Import Hint Name --> GetDriveTypeW                Import Address --> 0x00000105
Import Hint Name --> GetFullPathNameW             Import Address --> 0x00000117
Import Hint Name --> GetVolumeInformationW        Import Address --> 0x00000178
Import Hint Name --> GetCommandLineW              Import Address --> 0x000000cb
Import Hint Name --> LoadLibraryW                 Import Address --> 0x000001c5
Import Hint Name --> lstrcmpiW                    Import Address --> 0x00000300
Import Hint Name --> GetLocalTime                 Import Address --> 0x0000011b
Import Hint Name --> MultiByteToWideChar          Import Address --> 0x000001e4
Import Hint Name --> WideCharToMultiByte          Import Address --> 0x000002d2
Import Hint Name --> FindClose                    Import Address --> 0x00000090
Import Hint Name --> ExitThread                   Import Address --> 0x0000007e
Import Hint Name --> UnmapViewOfFile              Import Address --> 0x000002b0
Import Hint Name --> GetFileSize                  Import Address --> 0x00000112
Import Hint Name --> CreateFileMappingA           Import Address --> 0x00000035
Import Hint Name --> lstrlenW                     Import Address --> 0x00000309
Import Hint Name --> FormatMessageA               Import Address --> 0x000000af
Import Hint Name --> MapViewOfFile                Import Address --> 0x000001d6
Import Hint Name --> IsBadReadPtr                 Import Address --> 0x000001b5
Import Hint Name --> GetFileAttributesA           Import Address --> 0x0000010d
Import Hint Name --> SetFileAttributesA           Import Address --> 0x00000268
Import Hint Name --> FindFirstFileA               Import Address --> 0x00000094
Import Hint Name --> FindNextFileA                Import Address --> 0x0000009d
Import Hint Name --> CreateFileA                  Import Address --> 0x00000034
Import Hint Name --> MoveFileA                    Import Address --> 0x000001dd
Import Hint Name --> CreateDirectoryA             Import Address --> 0x0000002d
Import Hint Name --> RemoveDirectoryA             Import Address --> 0x00000227
Import Hint Name --> DeleteFileA                  Import Address --> 0x00000057
Import Hint Name --> GetCurrentDirectoryA         Import Address --> 0x000000f5
Import Hint Name --> SetCurrentDirectoryA         Import Address --> 0x0000025d
Import Hint Name --> GetModuleFileNameA           Import Address --> 0x00000124
Import Hint Name --> GetTickCount                 Import Address --> 0x0000016d
Import Hint Name --> CreateThread                 Import Address --> 0x0000004a
Import Hint Name --> SetFilePointer               Import Address --> 0x0000026a
Import Hint Name --> WriteFile                    Import Address --> 0x000002df
Import Hint Name --> CreateMutexA                 Import Address --> 0x0000003f
Import Hint Name --> WaitForSingleObject          Import Address --> 0x000002ce
Import Hint Name --> ReleaseMutex                 Import Address --> 0x00000225
Import Hint Name --> CloseHandle                  Import Address --> 0x0000001b
Import Hint Name --> ExitProcess                  Import Address --> 0x0000007d
Import Hint Name --> LoadLibraryA                 Import Address --> 0x000001c2
Import Hint Name --> GetFullPathNameA             Import Address --> 0x00000116
Import Hint Name --> lstrlenA                     Import Address --> 0x00000308
****************************FOA_FirstThunk:0x000460a4*********************************
Import Hint Name --> GetDiskFreeSpaceA            Import Address --> 0x00000100
Import Hint Name --> GetVolumeInformationA        Import Address --> 0x00000177
Import Hint Name --> GetCommandLineA              Import Address --> 0x000000ca
Import Hint Name --> lstrcmpiA                    Import Address --> 0x000002ff
Import Hint Name --> GetSystemDefaultLCID         Import Address --> 0x00000157
Import Hint Name --> GetDriveTypeA                Import Address --> 0x00000104
Import Hint Name --> GetThreadLocale              Import Address --> 0x00000168
Import Hint Name --> GetCurrentProcess            Import Address --> 0x000000f7
Import Hint Name --> SetPriorityClass             Import Address --> 0x00000277
Import Hint Name --> GlobalLock                   Import Address --> 0x0000018c
Import Hint Name --> GlobalUnlock                 Import Address --> 0x00000193
Import Hint Name --> SetFileTime                  Import Address --> 0x0000026c
Import Hint Name --> SuspendThread                Import Address --> 0x00000298
Import Hint Name --> ResumeThread                 Import Address --> 0x0000022c
Import Hint Name --> LocalFree                    Import Address --> 0x000001cc
Import Hint Name --> Sleep                        Import Address --> 0x00000296
Import Hint Name --> GetComputerNameW             Import Address --> 0x000000cf
Import Hint Name --> GetModuleHandleA             Import Address --> 0x00000126
Import Hint Name --> GetProcAddress               Import Address --> 0x0000013e
Import Hint Name --> GetSystemTime                Import Address --> 0x0000015d
Import Hint Name --> SystemTimeToFileTime         Import Address --> 0x0000029b
Import Hint Name --> GetStartupInfoA              Import Address --> 0x00000150
Import Hint Name --> SetThreadLocale              Import Address --> 0x00000286
Import Hint Name --> SetUnhandledExceptionFilter  Import Address --> 0x0000028b
Import Hint Name --> GetLastError                 Import Address --> 0x0000011a
Import Hint Name --> IsDBCSLeadByte               Import Address --> 0x000001b9
Import Hint Name --> VirtualFree                  Import Address --> 0x000002bf
Import Hint Name --> VirtualAlloc                 Import Address --> 0x000002bb
Import Hint Name --> GetVersion                   Import Address --> 0x00000174
Import Hint Name --> GetWindowsDirectoryW         Import Address --> 0x0000017e
Import Hint Name --> GetFileInformationByHandle   Import Address --> 0x00000111
Import Hint Name --> FormatMessageW               Import Address --> 0x000000b0
Import Hint Name --> GetFileAttributesW           Import Address --> 0x00000110
Import Hint Name --> SetFileAttributesW           Import Address --> 0x00000269
Import Hint Name --> FindFirstFileW               Import Address --> 0x00000097
Import Hint Name --> FindNextFileW                Import Address --> 0x0000009e
Import Hint Name --> CreateFileW                  Import Address --> 0x00000037
Import Hint Name --> MoveFileW                    Import Address --> 0x000001e0
Import Hint Name --> RemoveDirectoryW             Import Address --> 0x00000228
Import Hint Name --> DeleteFileW                  Import Address --> 0x00000058
Import Hint Name --> CreateDirectoryW             Import Address --> 0x00000030
Import Hint Name --> SetCurrentDirectoryW         Import Address --> 0x0000025e
Import Hint Name --> GetModuleFileNameW           Import Address --> 0x00000125
Import Hint Name --> GetCurrentDirectoryW         Import Address --> 0x000000f6
Import Hint Name --> GetDiskFreeSpaceW            Import Address --> 0x00000103
Import Hint Name --> GetDriveTypeW                Import Address --> 0x00000105
Import Hint Name --> GetFullPathNameW             Import Address --> 0x00000117
Import Hint Name --> GetVolumeInformationW        Import Address --> 0x00000178
Import Hint Name --> GetCommandLineW              Import Address --> 0x000000cb
Import Hint Name --> LoadLibraryW                 Import Address --> 0x000001c5
Import Hint Name --> lstrcmpiW                    Import Address --> 0x00000300
Import Hint Name --> GetLocalTime                 Import Address --> 0x0000011b
Import Hint Name --> MultiByteToWideChar          Import Address --> 0x000001e4
Import Hint Name --> WideCharToMultiByte          Import Address --> 0x000002d2
Import Hint Name --> FindClose                    Import Address --> 0x00000090
Import Hint Name --> ExitThread                   Import Address --> 0x0000007e
Import Hint Name --> UnmapViewOfFile              Import Address --> 0x000002b0
Import Hint Name --> GetFileSize                  Import Address --> 0x00000112
Import Hint Name --> CreateFileMappingA           Import Address --> 0x00000035
Import Hint Name --> lstrlenW                     Import Address --> 0x00000309
Import Hint Name --> FormatMessageA               Import Address --> 0x000000af
Import Hint Name --> MapViewOfFile                Import Address --> 0x000001d6
Import Hint Name --> IsBadReadPtr                 Import Address --> 0x000001b5
Import Hint Name --> GetFileAttributesA           Import Address --> 0x0000010d
Import Hint Name --> SetFileAttributesA           Import Address --> 0x00000268
Import Hint Name --> FindFirstFileA               Import Address --> 0x00000094
Import Hint Name --> FindNextFileA                Import Address --> 0x0000009d
Import Hint Name --> CreateFileA                  Import Address --> 0x00000034
Import Hint Name --> MoveFileA                    Import Address --> 0x000001dd
Import Hint Name --> CreateDirectoryA             Import Address --> 0x0000002d
Import Hint Name --> RemoveDirectoryA             Import Address --> 0x00000227
Import Hint Name --> DeleteFileA                  Import Address --> 0x00000057
Import Hint Name --> GetCurrentDirectoryA         Import Address --> 0x000000f5
Import Hint Name --> SetCurrentDirectoryA         Import Address --> 0x0000025d
Import Hint Name --> GetModuleFileNameA           Import Address --> 0x00000124
Import Hint Name --> GetTickCount                 Import Address --> 0x0000016d
Import Hint Name --> CreateThread                 Import Address --> 0x0000004a
Import Hint Name --> SetFilePointer               Import Address --> 0x0000026a
Import Hint Name --> WriteFile                    Import Address --> 0x000002df
Import Hint Name --> CreateMutexA                 Import Address --> 0x0000003f
Import Hint Name --> WaitForSingleObject          Import Address --> 0x000002ce
Import Hint Name --> ReleaseMutex                 Import Address --> 0x00000225
Import Hint Name --> CloseHandle                  Import Address --> 0x0000001b
Import Hint Name --> ExitProcess                  Import Address --> 0x0000007d
Import Hint Name --> LoadLibraryA                 Import Address --> 0x000001c2
Import Hint Name --> GetFullPathNameA             Import Address --> 0x00000116
Import Hint Name --> lstrlenA                     Import Address --> 0x00000308

USER32.dll
****************************FOA_OriginalFirstThunk:0x00050528*********************************
Import Hint Name --> LoadAcceleratorsA            Import Address --> 0x00000196
Import Hint Name --> SetTimer                     Import Address --> 0x00000252
Import Hint Name --> RegisterWindowMessageA       Import Address --> 0x00000200
Import Hint Name --> MessageBoxA                  Import Address --> 0x000001be
Import Hint Name --> KillTimer                    Import Address --> 0x00000195
Import Hint Name --> GetAsyncKeyState             Import Address --> 0x000000e3
Import Hint Name --> GetMenuItemCount             Import Address --> 0x00000122
Import Hint Name --> CreateMenu                   Import Address --> 0x00000057
Import Hint Name --> InvalidateRect               Import Address --> 0x0000017a
Import Hint Name --> MessageBeep                  Import Address --> 0x000001bd
Import Hint Name --> DestroyMenu                  Import Address --> 0x0000008d
Import Hint Name --> TrackPopupMenu               Import Address --> 0x0000027c
Import Hint Name --> GetMessagePos                Import Address --> 0x0000012c
Import Hint Name --> GetCursorPos                 Import Address --> 0x000000fc
Import Hint Name --> GetSubMenu                   Import Address --> 0x00000142
Import Hint Name --> LoadMenuA                    Import Address --> 0x000001a6
Import Hint Name --> LoadCursorA                  Import Address --> 0x0000019a
Import Hint Name --> LoadIconA                    Import Address --> 0x0000019e
Import Hint Name --> SetForegroundWindow          Import Address --> 0x00000230
Import Hint Name --> wsprintfA                    Import Address --> 0x000002ac
Import Hint Name --> PostQuitMessage              Import Address --> 0x000001e0
Import Hint Name --> FlashWindow                  Import Address --> 0x000000d9
Import Hint Name --> SetClassLongA                Import Address --> 0x00000220
Import Hint Name --> SetDlgItemTextW              Import Address --> 0x0000022d
Import Hint Name --> GetParent                    Import Address --> 0x00000135
Import Hint Name --> GetDlgItem                   Import Address --> 0x00000102
Import Hint Name --> SendDlgItemMessageA          Import Address --> 0x0000020f
Import Hint Name --> GetWindowRect                Import Address --> 0x0000015c
Import Hint Name --> GetWindow                    Import Address --> 0x00000152
Import Hint Name --> SetCapture                   Import Address --> 0x0000021d
Import Hint Name --> ScreenToClient               Import Address --> 0x0000020a
Import Hint Name --> ReleaseCapture               Import Address --> 0x00000202
Import Hint Name --> UpdateWindow                 Import Address --> 0x00000291
Import Hint Name --> SetFocus                     Import Address --> 0x0000022f
Import Hint Name --> CreatePopupMenu              Import Address --> 0x00000058
Import Hint Name --> GetClientRect                Import Address --> 0x000000f0
Import Hint Name --> BeginDeferWindowPos          Import Address --> 0x0000000b
Import Hint Name --> IsWindowEnabled              Import Address --> 0x00000190
Import Hint Name --> DeferWindowPos               Import Address --> 0x00000086
Import Hint Name --> EndDeferWindowPos            Import Address --> 0x000000b8
Import Hint Name --> IsWindowVisible              Import Address --> 0x00000192
Import Hint Name --> InvalidateRgn                Import Address --> 0x0000017b
Import Hint Name --> GetSysColor                  Import Address --> 0x00000143
Import Hint Name --> GetSystemMenu                Import Address --> 0x00000145
Import Hint Name --> LoadBitmapA                  Import Address --> 0x00000198
Import Hint Name --> SendMessageA                 Import Address --> 0x00000214
Import Hint Name --> OpenClipboard                Import Address --> 0x000001d3
Import Hint Name --> EnumClipboardFormats         Import Address --> 0x000000be
Import Hint Name --> CloseClipboard               Import Address --> 0x0000003c
Import Hint Name --> GetDesktopWindow             Import Address --> 0x000000ff
Import Hint Name --> GetDC                        Import Address --> 0x000000fd
Import Hint Name --> ReleaseDC                    Import Address --> 0x00000203
Import Hint Name --> RegisterHotKey               Import Address --> 0x000001fa
Import Hint Name --> UnregisterHotKey             Import Address --> 0x0000028e
Import Hint Name --> SendMessageW                 Import Address --> 0x00000219
Import Hint Name --> IsIconic                     Import Address --> 0x0000018c
Import Hint Name --> EnableWindow                 Import Address --> 0x000000b7
Import Hint Name --> ShowWindow                   Import Address --> 0x0000026a
Import Hint Name --> GetWindowPlacement           Import Address --> 0x0000015b
Import Hint Name --> SetWindowPlacement           Import Address --> 0x0000025a
Import Hint Name --> CharLowerA                   Import Address --> 0x00000021
Import Hint Name --> CharUpperA                   Import Address --> 0x0000002f
Import Hint Name --> ModifyMenuA                  Import Address --> 0x000001c4
Import Hint Name --> InsertMenuA                  Import Address --> 0x00000174
Import Hint Name --> CreateWindowExA              Import Address --> 0x00000059
Import Hint Name --> FindWindowA                  Import Address --> 0x000000d5
Import Hint Name --> RegisterClassA               Import Address --> 0x000001f2
Import Hint Name --> CallWindowProcA              Import Address --> 0x00000016
Import Hint Name --> SetWindowLongA               Import Address --> 0x00000258
Import Hint Name --> GetWindowLongA               Import Address --> 0x00000156
Import Hint Name --> DialogBoxParamA              Import Address --> 0x00000093
Import Hint Name --> CreateDialogParamA           Import Address --> 0x0000004f
Import Hint Name --> SetDlgItemTextA              Import Address --> 0x0000022c
Import Hint Name --> GetDlgItemTextA              Import Address --> 0x00000104
Import Hint Name --> GetWindowTextLengthA         Import Address --> 0x0000015f
Import Hint Name --> SetWindowTextA               Import Address --> 0x0000025e
Import Hint Name --> GetWindowTextA               Import Address --> 0x0000015e
Import Hint Name --> CharUpperW                   Import Address --> 0x00000032
Import Hint Name --> CharLowerW                   Import Address --> 0x00000024
Import Hint Name --> ModifyMenuW                  Import Address --> 0x000001c5
Import Hint Name --> InsertMenuW                  Import Address --> 0x00000177
Import Hint Name --> CreateWindowExW              Import Address --> 0x0000005a
Import Hint Name --> FindWindowW                  Import Address --> 0x000000d8
Import Hint Name --> RegisterClassW               Import Address --> 0x000001f5
Import Hint Name --> SetWindowLongW               Import Address --> 0x00000259
Import Hint Name --> GetWindowLongW               Import Address --> 0x00000157
Import Hint Name --> DialogBoxParamW              Import Address --> 0x00000094
Import Hint Name --> CreateDialogParamW           Import Address --> 0x00000050
Import Hint Name --> MessageBoxW                  Import Address --> 0x000001c3
Import Hint Name --> SendDlgItemMessageW          Import Address --> 0x00000210
Import Hint Name --> PostMessageW                 Import Address --> 0x000001df
Import Hint Name --> GetDlgItemTextW              Import Address --> 0x00000105
Import Hint Name --> GetWindowTextLengthW         Import Address --> 0x00000160
Import Hint Name --> SetWindowTextW               Import Address --> 0x0000025f
Import Hint Name --> GetWindowTextW               Import Address --> 0x00000161
Import Hint Name --> AppendMenuW                  Import Address --> 0x00000008
Import Hint Name --> GetMenuStringW               Import Address --> 0x00000129
Import Hint Name --> LoadStringW                  Import Address --> 0x000001ac
Import Hint Name --> LoadStringA                  Import Address --> 0x000001ab
Import Hint Name --> wsprintfW                    Import Address --> 0x000002ad
Import Hint Name --> DispatchMessageA             Import Address --> 0x00000095
Import Hint Name --> TranslateMessage             Import Address --> 0x00000282
Import Hint Name --> GetMessageA                  Import Address --> 0x0000012a
Import Hint Name --> DefWindowProcA               Import Address --> 0x00000084
Import Hint Name --> PeekMessageA                 Import Address --> 0x000001dc
Import Hint Name --> DestroyWindow                Import Address --> 0x0000008e
Import Hint Name --> IsWindow                     Import Address --> 0x0000018f
Import Hint Name --> TranslateAcceleratorA        Import Address --> 0x0000027f
Import Hint Name --> GetDlgItemInt                Import Address --> 0x00000103
Import Hint Name --> SetDlgItemInt                Import Address --> 0x0000022b
Import Hint Name --> CheckDlgButton               Import Address --> 0x00000033
Import Hint Name --> IsDlgButtonChecked           Import Address --> 0x0000018a
Import Hint Name --> BringWindowToTop             Import Address --> 0x0000000e
Import Hint Name --> SetWindowPos                 Import Address --> 0x0000025b
Import Hint Name --> SystemParametersInfoA        Import Address --> 0x00000271
Import Hint Name --> AttachThreadInput            Import Address --> 0x0000000a
Import Hint Name --> GetWindowThreadProcessId     Import Address --> 0x00000162
Import Hint Name --> GetForegroundWindow          Import Address --> 0x00000108
Import Hint Name --> SetActiveWindow              Import Address --> 0x0000021c
Import Hint Name --> SetWindowWord                Import Address --> 0x00000260
Import Hint Name --> GetWindowWord                Import Address --> 0x00000163
Import Hint Name --> MoveWindow                   Import Address --> 0x000001c9
Import Hint Name --> IsDialogMessageA             Import Address --> 0x00000188
Import Hint Name --> EndDialog                    Import Address --> 0x000000b9
Import Hint Name --> PostMessageA                 Import Address --> 0x000001de
Import Hint Name --> CallWindowProcW              Import Address --> 0x00000017
Import Hint Name --> SetCursor                    Import Address --> 0x00000226
Import Hint Name --> GetSystemMetrics             Import Address --> 0x00000146
****************************FOA_FirstThunk:0x00046354*********************************
Import Hint Name --> LoadAcceleratorsA            Import Address --> 0x00000196
Import Hint Name --> SetTimer                     Import Address --> 0x00000252
Import Hint Name --> RegisterWindowMessageA       Import Address --> 0x00000200
Import Hint Name --> MessageBoxA                  Import Address --> 0x000001be
Import Hint Name --> KillTimer                    Import Address --> 0x00000195
Import Hint Name --> GetAsyncKeyState             Import Address --> 0x000000e3
Import Hint Name --> GetMenuItemCount             Import Address --> 0x00000122
Import Hint Name --> CreateMenu                   Import Address --> 0x00000057
Import Hint Name --> InvalidateRect               Import Address --> 0x0000017a
Import Hint Name --> MessageBeep                  Import Address --> 0x000001bd
Import Hint Name --> DestroyMenu                  Import Address --> 0x0000008d
Import Hint Name --> TrackPopupMenu               Import Address --> 0x0000027c
Import Hint Name --> GetMessagePos                Import Address --> 0x0000012c
Import Hint Name --> GetCursorPos                 Import Address --> 0x000000fc
Import Hint Name --> GetSubMenu                   Import Address --> 0x00000142
Import Hint Name --> LoadMenuA                    Import Address --> 0x000001a6
Import Hint Name --> LoadCursorA                  Import Address --> 0x0000019a
Import Hint Name --> LoadIconA                    Import Address --> 0x0000019e
Import Hint Name --> SetForegroundWindow          Import Address --> 0x00000230
Import Hint Name --> wsprintfA                    Import Address --> 0x000002ac
Import Hint Name --> PostQuitMessage              Import Address --> 0x000001e0
Import Hint Name --> FlashWindow                  Import Address --> 0x000000d9
Import Hint Name --> SetClassLongA                Import Address --> 0x00000220
Import Hint Name --> SetDlgItemTextW              Import Address --> 0x0000022d
Import Hint Name --> GetParent                    Import Address --> 0x00000135
Import Hint Name --> GetDlgItem                   Import Address --> 0x00000102
Import Hint Name --> SendDlgItemMessageA          Import Address --> 0x0000020f
Import Hint Name --> GetWindowRect                Import Address --> 0x0000015c
Import Hint Name --> GetWindow                    Import Address --> 0x00000152
Import Hint Name --> SetCapture                   Import Address --> 0x0000021d
Import Hint Name --> ScreenToClient               Import Address --> 0x0000020a
Import Hint Name --> ReleaseCapture               Import Address --> 0x00000202
Import Hint Name --> UpdateWindow                 Import Address --> 0x00000291
Import Hint Name --> SetFocus                     Import Address --> 0x0000022f
Import Hint Name --> CreatePopupMenu              Import Address --> 0x00000058
Import Hint Name --> GetClientRect                Import Address --> 0x000000f0
Import Hint Name --> BeginDeferWindowPos          Import Address --> 0x0000000b
Import Hint Name --> IsWindowEnabled              Import Address --> 0x00000190
Import Hint Name --> DeferWindowPos               Import Address --> 0x00000086
Import Hint Name --> EndDeferWindowPos            Import Address --> 0x000000b8
Import Hint Name --> IsWindowVisible              Import Address --> 0x00000192
Import Hint Name --> InvalidateRgn                Import Address --> 0x0000017b
Import Hint Name --> GetSysColor                  Import Address --> 0x00000143
Import Hint Name --> GetSystemMenu                Import Address --> 0x00000145
Import Hint Name --> LoadBitmapA                  Import Address --> 0x00000198
Import Hint Name --> SendMessageA                 Import Address --> 0x00000214
Import Hint Name --> OpenClipboard                Import Address --> 0x000001d3
Import Hint Name --> EnumClipboardFormats         Import Address --> 0x000000be
Import Hint Name --> CloseClipboard               Import Address --> 0x0000003c
Import Hint Name --> GetDesktopWindow             Import Address --> 0x000000ff
Import Hint Name --> GetDC                        Import Address --> 0x000000fd
Import Hint Name --> ReleaseDC                    Import Address --> 0x00000203
Import Hint Name --> RegisterHotKey               Import Address --> 0x000001fa
Import Hint Name --> UnregisterHotKey             Import Address --> 0x0000028e
Import Hint Name --> SendMessageW                 Import Address --> 0x00000219
Import Hint Name --> IsIconic                     Import Address --> 0x0000018c
Import Hint Name --> EnableWindow                 Import Address --> 0x000000b7
Import Hint Name --> ShowWindow                   Import Address --> 0x0000026a
Import Hint Name --> GetWindowPlacement           Import Address --> 0x0000015b
Import Hint Name --> SetWindowPlacement           Import Address --> 0x0000025a
Import Hint Name --> CharLowerA                   Import Address --> 0x00000021
Import Hint Name --> CharUpperA                   Import Address --> 0x0000002f
Import Hint Name --> ModifyMenuA                  Import Address --> 0x000001c4
Import Hint Name --> InsertMenuA                  Import Address --> 0x00000174
Import Hint Name --> CreateWindowExA              Import Address --> 0x00000059
Import Hint Name --> FindWindowA                  Import Address --> 0x000000d5
Import Hint Name --> RegisterClassA               Import Address --> 0x000001f2
Import Hint Name --> CallWindowProcA              Import Address --> 0x00000016
Import Hint Name --> SetWindowLongA               Import Address --> 0x00000258
Import Hint Name --> GetWindowLongA               Import Address --> 0x00000156
Import Hint Name --> DialogBoxParamA              Import Address --> 0x00000093
Import Hint Name --> CreateDialogParamA           Import Address --> 0x0000004f
Import Hint Name --> SetDlgItemTextA              Import Address --> 0x0000022c
Import Hint Name --> GetDlgItemTextA              Import Address --> 0x00000104
Import Hint Name --> GetWindowTextLengthA         Import Address --> 0x0000015f
Import Hint Name --> SetWindowTextA               Import Address --> 0x0000025e
Import Hint Name --> GetWindowTextA               Import Address --> 0x0000015e
Import Hint Name --> CharUpperW                   Import Address --> 0x00000032
Import Hint Name --> CharLowerW                   Import Address --> 0x00000024
Import Hint Name --> ModifyMenuW                  Import Address --> 0x000001c5
Import Hint Name --> InsertMenuW                  Import Address --> 0x00000177
Import Hint Name --> CreateWindowExW              Import Address --> 0x0000005a
Import Hint Name --> FindWindowW                  Import Address --> 0x000000d8
Import Hint Name --> RegisterClassW               Import Address --> 0x000001f5
Import Hint Name --> SetWindowLongW               Import Address --> 0x00000259
Import Hint Name --> GetWindowLongW               Import Address --> 0x00000157
Import Hint Name --> DialogBoxParamW              Import Address --> 0x00000094
Import Hint Name --> CreateDialogParamW           Import Address --> 0x00000050
Import Hint Name --> MessageBoxW                  Import Address --> 0x000001c3
Import Hint Name --> SendDlgItemMessageW          Import Address --> 0x00000210
Import Hint Name --> PostMessageW                 Import Address --> 0x000001df
Import Hint Name --> GetDlgItemTextW              Import Address --> 0x00000105
Import Hint Name --> GetWindowTextLengthW         Import Address --> 0x00000160
Import Hint Name --> SetWindowTextW               Import Address --> 0x0000025f
Import Hint Name --> GetWindowTextW               Import Address --> 0x00000161
Import Hint Name --> AppendMenuW                  Import Address --> 0x00000008
Import Hint Name --> GetMenuStringW               Import Address --> 0x00000129
Import Hint Name --> LoadStringW                  Import Address --> 0x000001ac
Import Hint Name --> LoadStringA                  Import Address --> 0x000001ab
Import Hint Name --> wsprintfW                    Import Address --> 0x000002ad
Import Hint Name --> DispatchMessageA             Import Address --> 0x00000095
Import Hint Name --> TranslateMessage             Import Address --> 0x00000282
Import Hint Name --> GetMessageA                  Import Address --> 0x0000012a
Import Hint Name --> DefWindowProcA               Import Address --> 0x00000084
Import Hint Name --> PeekMessageA                 Import Address --> 0x000001dc
Import Hint Name --> DestroyWindow                Import Address --> 0x0000008e
Import Hint Name --> IsWindow                     Import Address --> 0x0000018f
Import Hint Name --> TranslateAcceleratorA        Import Address --> 0x0000027f
Import Hint Name --> GetDlgItemInt                Import Address --> 0x00000103
Import Hint Name --> SetDlgItemInt                Import Address --> 0x0000022b
Import Hint Name --> CheckDlgButton               Import Address --> 0x00000033
Import Hint Name --> IsDlgButtonChecked           Import Address --> 0x0000018a
Import Hint Name --> BringWindowToTop             Import Address --> 0x0000000e
Import Hint Name --> SetWindowPos                 Import Address --> 0x0000025b
Import Hint Name --> SystemParametersInfoA        Import Address --> 0x00000271
Import Hint Name --> AttachThreadInput            Import Address --> 0x0000000a
Import Hint Name --> GetWindowThreadProcessId     Import Address --> 0x00000162
Import Hint Name --> GetForegroundWindow          Import Address --> 0x00000108
Import Hint Name --> SetActiveWindow              Import Address --> 0x0000021c
Import Hint Name --> SetWindowWord                Import Address --> 0x00000260
Import Hint Name --> GetWindowWord                Import Address --> 0x00000163
Import Hint Name --> MoveWindow                   Import Address --> 0x000001c9
Import Hint Name --> IsDialogMessageA             Import Address --> 0x00000188
Import Hint Name --> EndDialog                    Import Address --> 0x000000b9
Import Hint Name --> PostMessageA                 Import Address --> 0x000001de
Import Hint Name --> CallWindowProcW              Import Address --> 0x00000017
Import Hint Name --> SetCursor                    Import Address --> 0x00000226
Import Hint Name --> GetSystemMetrics             Import Address --> 0x00000146

GDI32.dll
****************************FOA_OriginalFirstThunk:0x00050244*********************************
Import Hint Name --> GetTextExtentExPointW        Import Address --> 0x0000016c
Import Hint Name --> GetObjectA                   Import Address --> 0x0000014f
Import Hint Name --> DeleteObject                 Import Address --> 0x00000053
Import Hint Name --> CreateFontIndirectA          Import Address --> 0x00000037
Import Hint Name --> GetDeviceCaps                Import Address --> 0x00000125
Import Hint Name --> CreateDIBitmap               Import Address --> 0x00000030
Import Hint Name --> GetDIBits                    Import Address --> 0x00000124
****************************FOA_FirstThunk:0x00046070*********************************
Import Hint Name --> GetTextExtentExPointW        Import Address --> 0x0000016c
Import Hint Name --> GetObjectA                   Import Address --> 0x0000014f
Import Hint Name --> DeleteObject                 Import Address --> 0x00000053
Import Hint Name --> CreateFontIndirectA          Import Address --> 0x00000037
Import Hint Name --> GetDeviceCaps                Import Address --> 0x00000125
Import Hint Name --> CreateDIBitmap               Import Address --> 0x00000030
Import Hint Name --> GetDIBits                    Import Address --> 0x00000124

comdlg32.dll
****************************FOA_OriginalFirstThunk:0x00050798*********************************
Import Hint Name --> GetOpenFileNameW             Import Address --> 0x0000000a
Import Hint Name --> GetOpenFileNameA             Import Address --> 0x00000009
Import Hint Name --> GetSaveFileNameA             Import Address --> 0x0000000b
Import Hint Name --> ChooseFontA                  Import Address --> 0x00000002
Import Hint Name --> GetSaveFileNameW             Import Address --> 0x0000000c
****************************FOA_FirstThunk:0x000465c4*********************************
Import Hint Name --> GetOpenFileNameW             Import Address --> 0x0000000a
Import Hint Name --> GetOpenFileNameA             Import Address --> 0x00000009
Import Hint Name --> GetSaveFileNameA             Import Address --> 0x0000000b
Import Hint Name --> ChooseFontA                  Import Address --> 0x00000002
Import Hint Name --> GetSaveFileNameW             Import Address --> 0x0000000c

ADVAPI32.dll
****************************FOA_OriginalFirstThunk:0x000501d4*********************************
Import Hint Name --> RegEnumKeyExA                Import Address --> 0x00000167
Import Hint Name --> RegCreateKeyExA              Import Address --> 0x0000015f
Import Hint Name --> RegOpenKeyExA                Import Address --> 0x00000172
Import Hint Name --> RegQueryValueExA             Import Address --> 0x0000017b
Import Hint Name --> RegQueryValueA               Import Address --> 0x0000017a
Import Hint Name --> RegSetValueExA               Import Address --> 0x00000186
Import Hint Name --> RegDeleteKeyA                Import Address --> 0x00000162
Import Hint Name --> GetUserNameW                 Import Address --> 0x000000d8
Import Hint Name --> RegCloseKey                  Import Address --> 0x0000015b
Import Hint Name --> RegCreateKeyExW              Import Address --> 0x00000160
Import Hint Name --> RegOpenKeyExW                Import Address --> 0x00000173
Import Hint Name --> RegQueryValueExW             Import Address --> 0x0000017c
Import Hint Name --> RegQueryValueW               Import Address --> 0x0000017d
Import Hint Name --> RegSetValueExW               Import Address --> 0x00000187
Import Hint Name --> RegDeleteKeyW                Import Address --> 0x00000163
Import Hint Name --> RegDeleteValueW              Import Address --> 0x00000165
Import Hint Name --> RegEnumKeyExW                Import Address --> 0x00000168
Import Hint Name --> RegEnumValueA                Import Address --> 0x0000016a
Import Hint Name --> RegDeleteValueA              Import Address --> 0x00000164
Import Hint Name --> RegEnumValueW                Import Address --> 0x0000016b
****************************FOA_FirstThunk:0x00046000*********************************
Import Hint Name --> RegEnumKeyExA                Import Address --> 0x00000167
Import Hint Name --> RegCreateKeyExA              Import Address --> 0x0000015f
Import Hint Name --> RegOpenKeyExA                Import Address --> 0x00000172
Import Hint Name --> RegQueryValueExA             Import Address --> 0x0000017b
Import Hint Name --> RegQueryValueA               Import Address --> 0x0000017a
Import Hint Name --> RegSetValueExA               Import Address --> 0x00000186
Import Hint Name --> RegDeleteKeyA                Import Address --> 0x00000162
Import Hint Name --> GetUserNameW                 Import Address --> 0x000000d8
Import Hint Name --> RegCloseKey                  Import Address --> 0x0000015b
Import Hint Name --> RegCreateKeyExW              Import Address --> 0x00000160
Import Hint Name --> RegOpenKeyExW                Import Address --> 0x00000173
Import Hint Name --> RegQueryValueExW             Import Address --> 0x0000017c
Import Hint Name --> RegQueryValueW               Import Address --> 0x0000017d
Import Hint Name --> RegSetValueExW               Import Address --> 0x00000187
Import Hint Name --> RegDeleteKeyW                Import Address --> 0x00000163
Import Hint Name --> RegDeleteValueW              Import Address --> 0x00000165
Import Hint Name --> RegEnumKeyExW                Import Address --> 0x00000168
Import Hint Name --> RegEnumValueA                Import Address --> 0x0000016a
Import Hint Name --> RegDeleteValueA              Import Address --> 0x00000164
Import Hint Name --> RegEnumValueW                Import Address --> 0x0000016b

SHELL32.dll
****************************FOA_OriginalFirstThunk:0x000504f4*********************************
Import Hint Name --> ExtractIconW                 Import Address --> 0x00000023
Import Hint Name --> SHGetMalloc                  Import Address --> 0x0000004b
Import Hint Name --> DragFinish                   Import Address --> 0x00000012
Import Hint Name --> Shell_NotifyIconW            Import Address --> 0x0000007a
Import Hint Name --> DragQueryFileW               Import Address --> 0x00000016
Import Hint Name --> ShellExecuteW                Import Address --> 0x00000076
Import Hint Name --> ShellExecuteExW              Import Address --> 0x00000075
Import Hint Name --> DragQueryFileA               Import Address --> 0x00000014
Import Hint Name --> ShellExecuteA                Import Address --> 0x00000072
Import Hint Name --> ShellExecuteExA              Import Address --> 0x00000074
Import Hint Name --> SHGetPathFromIDListA         Import Address --> 0x00000050
Import Hint Name --> SHBrowseForFolderA           Import Address --> 0x00000039
****************************FOA_FirstThunk:0x00046320*********************************
Import Hint Name --> ExtractIconW                 Import Address --> 0x00000023
Import Hint Name --> SHGetMalloc                  Import Address --> 0x0000004b
Import Hint Name --> DragFinish                   Import Address --> 0x00000012
Import Hint Name --> Shell_NotifyIconW            Import Address --> 0x0000007a
Import Hint Name --> DragQueryFileW               Import Address --> 0x00000016
Import Hint Name --> ShellExecuteW                Import Address --> 0x00000076
Import Hint Name --> ShellExecuteExW              Import Address --> 0x00000075
Import Hint Name --> DragQueryFileA               Import Address --> 0x00000014
Import Hint Name --> ShellExecuteA                Import Address --> 0x00000072
Import Hint Name --> ShellExecuteExA              Import Address --> 0x00000074
Import Hint Name --> SHGetPathFromIDListA         Import Address --> 0x00000050
Import Hint Name --> SHBrowseForFolderA           Import Address --> 0x00000039

ole32.dll
****************************FOA_OriginalFirstThunk:0x000507b0*********************************
Import Hint Name --> CoUninitialize               Import Address --> 0x00000053
Import Hint Name --> CoInitialize                 Import Address --> 0x0000002d
Import Hint Name --> OleSetContainedObject        Import Address --> 0x000000dd
Import Hint Name --> OleDuplicateData             Import Address --> 0x000000c3
Import Hint Name --> CoCreateInstance             Import Address --> 0x0000000d
Import Hint Name --> StgCreateDocfileOnILockBytes Import Address --> 0x000000fe
Import Hint Name --> CreateILockBytesOnHGlobal    Import Address --> 0x00000060
Import Hint Name --> ReleaseStgMedium             Import Address --> 0x000000f0
Import Hint Name --> OleCreateStaticFromData      Import Address --> 0x000000bf
****************************FOA_FirstThunk:0x000465dc*********************************
Import Hint Name --> CoUninitialize               Import Address --> 0x00000053
Import Hint Name --> CoInitialize                 Import Address --> 0x0000002d
Import Hint Name --> OleSetContainedObject        Import Address --> 0x000000dd
Import Hint Name --> OleDuplicateData             Import Address --> 0x000000c3
Import Hint Name --> CoCreateInstance             Import Address --> 0x0000000d
Import Hint Name --> StgCreateDocfileOnILockBytes Import Address --> 0x000000fe
Import Hint Name --> CreateILockBytesOnHGlobal    Import Address --> 0x00000060
Import Hint Name --> ReleaseStgMedium             Import Address --> 0x000000f0
Import Hint Name --> OleCreateStaticFromData      Import Address --> 0x000000bf

COMCTL32.dll
****************************FOA_OriginalFirstThunk:0x00050228*********************************
Import Hint Name --> ImageList_AddMasked          Import Address --> 0x0000001e
Import Hint Name --> ImageList_Add                Import Address --> 0x0000001c
Import Hint Name --> ImageList_Create             Import Address --> 0x00000021
Import Hint Name --> ImageList_Destroy            Import Address --> 0x00000022
Import Hint Name --> ImageList_SetOverlayImage    Import Address --> 0x00000040
Import Ordinal --> 0x00000011
****************************FOA_FirstThunk:0x00046054*********************************
Import Hint Name --> ImageList_AddMasked          Import Address --> 0x0000001e
Import Hint Name --> ImageList_Add                Import Address --> 0x0000001c
Import Hint Name --> ImageList_Create             Import Address --> 0x00000021
Import Hint Name --> ImageList_Destroy            Import Address --> 0x00000022
Import Hint Name --> ImageList_SetOverlayImage    Import Address --> 0x00000040
Import Ordinal --> 0x00000011

IMM32.dll
****************************FOA_OriginalFirstThunk:0x00050264*********************************
Import Hint Name --> ImmGetOpenStatus             Import Address --> 0x00000030
Import Hint Name --> ImmReleaseContext            Import Address --> 0x0000004f
Import Hint Name --> ImmSetOpenStatus             Import Address --> 0x0000005e
Import Hint Name --> ImmGetContext                Import Address --> 0x0000001e
****************************FOA_FirstThunk:0x00046090*********************************
Import Hint Name --> ImmGetOpenStatus             Import Address --> 0x00000030
Import Hint Name --> ImmReleaseContext            Import Address --> 0x0000004f
Import Hint Name --> ImmSetOpenStatus             Import Address --> 0x0000005e
Import Hint Name --> ImmGetContext                Import Address --> 0x0000001e

WSOCK32.dll
****************************FOA_OriginalFirstThunk:0x00050738*********************************
Import Ordinal --> 0x00000011
Import Ordinal --> 0x00000014
Import Ordinal --> 0x00000001
Import Ordinal --> 0x00000004
Import Ordinal --> 0x0000000e
Import Ordinal --> 0x00000034
Import Ordinal --> 0x00000065
Import Ordinal --> 0x00000074
Import Ordinal --> 0x00000073
Import Ordinal --> 0x00000017
Import Ordinal --> 0x0000000b
Import Ordinal --> 0x00000009
Import Ordinal --> 0x00000003
Import Ordinal --> 0x00000010
Import Ordinal --> 0x00000012
Import Ordinal --> 0x00000013
Import Ordinal --> 0x0000000a
Import Ordinal --> 0x0000006f
Import Ordinal --> 0x00000039
Import Ordinal --> 0x0000000d
Import Ordinal --> 0x00000015
Import Ordinal --> 0x0000000c
Import Ordinal --> 0x00000002
****************************FOA_FirstThunk:0x00046564*********************************
Import Ordinal --> 0x00000011
Import Ordinal --> 0x00000014
Import Ordinal --> 0x00000001
Import Ordinal --> 0x00000004
Import Ordinal --> 0x0000000e
Import Ordinal --> 0x00000034
Import Ordinal --> 0x00000065
Import Ordinal --> 0x00000074
Import Ordinal --> 0x00000073
Import Ordinal --> 0x00000017
Import Ordinal --> 0x0000000b
Import Ordinal --> 0x00000009
Import Ordinal --> 0x00000003
Import Ordinal --> 0x00000010
Import Ordinal --> 0x00000012
Import Ordinal --> 0x00000013
Import Ordinal --> 0x0000000a
Import Ordinal --> 0x0000006f
Import Ordinal --> 0x00000039
Import Ordinal --> 0x0000000d
Import Ordinal --> 0x00000015
Import Ordinal --> 0x0000000c
Import Ordinal --> 0x00000002

MSVCRT.dll
****************************FOA_OriginalFirstThunk:0x000503d8*********************************
Import Hint Name --> _strcmpi                     Import Address --> 0x000001bd
Import Hint Name --> _wcsdup                      Import Address --> 0x000001e9
Import Hint Name --> _strdup                      Import Address --> 0x000001bf
Import Hint Name --> _stricmp                     Import Address --> 0x000001c1
Import Hint Name --> _controlfp                   Import Address --> 0x000000b7
Import Hint Name --> __set_app_type               Import Address --> 0x00000081
Import Hint Name --> __p__fmode                   Import Address --> 0x0000006f
Import Hint Name --> __p__commode                 Import Address --> 0x0000006a
Import Hint Name --> _adjust_fdiv                 Import Address --> 0x0000009d
Import Hint Name --> __setusermatherr             Import Address --> 0x00000083
Import Hint Name --> _initterm                    Import Address --> 0x0000010f
Import Hint Name --> __getmainargs                Import Address --> 0x00000058
Import Hint Name --> _acmdln                      Import Address --> 0x0000008f
Import Hint Name --> exit                         Import Address --> 0x00000249
Import Hint Name --> _XcptFilter                  Import Address --> 0x00000048
Import Hint Name --> _exit                        Import Address --> 0x000000d3
Import Hint Name --> ?terminate@@YAXXZ            Import Address --> 0x0000002e
Import Hint Name --> _except_handler3             Import Address --> 0x000000ca
Import Hint Name --> ??2@YAPAXI@Z                 Import Address --> 0x0000000f
Import Hint Name --> ??3@YAXPAX@Z                 Import Address --> 0x00000010
Import Hint Name --> __CxxFrameHandler            Import Address --> 0x00000049
Import Hint Name --> free                         Import Address --> 0x0000025e
Import Hint Name --> srand                        Import Address --> 0x000002b4
Import Hint Name --> strchr                       Import Address --> 0x000002b7
Import Hint Name --> atoi                         Import Address --> 0x0000023d
Import Hint Name --> strncmp                      Import Address --> 0x000002c0
Import Hint Name --> sprintf                      Import Address --> 0x000002b2
Import Hint Name --> malloc                       Import Address --> 0x00000291
Import Hint Name --> strtoul                      Import Address --> 0x000002c9
Import Hint Name --> strrchr                      Import Address --> 0x000002c3
Import Hint Name --> atol                         Import Address --> 0x0000023e
Import Hint Name --> strstr                       Import Address --> 0x000002c5
Import Hint Name --> memmove                      Import Address --> 0x00000298
Import Hint Name --> realloc                      Import Address --> 0x000002a7
Import Hint Name --> strpbrk                      Import Address --> 0x000002c2
Import Hint Name --> wcslen                       Import Address --> 0x000002e6
Import Hint Name --> rand                         Import Address --> 0x000002a6
Import Hint Name --> longjmp                      Import Address --> 0x00000290
Import Hint Name --> _setjmp3                     Import Address --> 0x000001a8
Import Hint Name --> __CxxLongjmpUnwind           Import Address --> 0x0000004a
Import Hint Name --> wcschr                       Import Address --> 0x000002e0
Import Hint Name --> wcscpy                       Import Address --> 0x000002e3
Import Hint Name --> strcmp                       Import Address --> 0x000002b8
Import Hint Name --> _ftol                        Import Address --> 0x000000f1
Import Hint Name --> toupper                      Import Address --> 0x000002d4
Import Hint Name --> strtol                       Import Address --> 0x000002c8
Import Hint Name --> _snprintf                    Import Address --> 0x000001ae
Import Hint Name --> floor                        Import Address --> 0x00000255
Import Hint Name --> modf                         Import Address --> 0x0000029b
Import Hint Name --> frexp                        Import Address --> 0x00000260
Import Hint Name --> _CIpow                       Import Address --> 0x0000003b
Import Hint Name --> gmtime                       Import Address --> 0x0000026e
Import Hint Name --> fprintf                      Import Address --> 0x00000258
Import Hint Name --> _iob                         Import Address --> 0x00000113
Import Hint Name --> fwrite                       Import Address --> 0x00000266
Import Hint Name --> fflush                       Import Address --> 0x0000024f
Import Hint Name --> atof                         Import Address --> 0x0000023c
Import Hint Name --> fread                        Import Address --> 0x0000025d
Import Hint Name --> strcpy                       Import Address --> 0x000002ba
Import Hint Name --> strlen                       Import Address --> 0x000002be
Import Hint Name --> _mbschr                      Import Address --> 0x00000158
Import Hint Name --> swprintf                     Import Address --> 0x000002cb
Import Hint Name --> wcstol                       Import Address --> 0x000002f0
Import Hint Name --> wcstoul                      Import Address --> 0x000002f2
Import Hint Name --> wcsrchr                      Import Address --> 0x000002eb
Import Hint Name --> _wcsnicmp                    Import Address --> 0x000001ee
Import Hint Name --> wcscmp                       Import Address --> 0x000002e1
Import Hint Name --> _purecall                    Import Address --> 0x00000192
Import Hint Name --> _vsnprintf                   Import Address --> 0x000001e1
Import Hint Name --> _strnicmp                    Import Address --> 0x000001c5
****************************FOA_FirstThunk:0x00046204*********************************
Import Hint Name --> _strcmpi                     Import Address --> 0x000001bd
Import Hint Name --> _wcsdup                      Import Address --> 0x000001e9
Import Hint Name --> _strdup                      Import Address --> 0x000001bf
Import Hint Name --> _stricmp                     Import Address --> 0x000001c1
Import Hint Name --> _controlfp                   Import Address --> 0x000000b7
Import Hint Name --> __set_app_type               Import Address --> 0x00000081
Import Hint Name --> __p__fmode                   Import Address --> 0x0000006f
Import Hint Name --> __p__commode                 Import Address --> 0x0000006a
Import Hint Name --> _adjust_fdiv                 Import Address --> 0x0000009d
Import Hint Name --> __setusermatherr             Import Address --> 0x00000083
Import Hint Name --> _initterm                    Import Address --> 0x0000010f
Import Hint Name --> __getmainargs                Import Address --> 0x00000058
Import Hint Name --> _acmdln                      Import Address --> 0x0000008f
Import Hint Name --> exit                         Import Address --> 0x00000249
Import Hint Name --> _XcptFilter                  Import Address --> 0x00000048
Import Hint Name --> _exit                        Import Address --> 0x000000d3
Import Hint Name --> ?terminate@@YAXXZ            Import Address --> 0x0000002e
Import Hint Name --> _except_handler3             Import Address --> 0x000000ca
Import Hint Name --> ??2@YAPAXI@Z                 Import Address --> 0x0000000f
Import Hint Name --> ??3@YAXPAX@Z                 Import Address --> 0x00000010
Import Hint Name --> __CxxFrameHandler            Import Address --> 0x00000049
Import Hint Name --> free                         Import Address --> 0x0000025e
Import Hint Name --> srand                        Import Address --> 0x000002b4
Import Hint Name --> strchr                       Import Address --> 0x000002b7
Import Hint Name --> atoi                         Import Address --> 0x0000023d
Import Hint Name --> strncmp                      Import Address --> 0x000002c0
Import Hint Name --> sprintf                      Import Address --> 0x000002b2
Import Hint Name --> malloc                       Import Address --> 0x00000291
Import Hint Name --> strtoul                      Import Address --> 0x000002c9
Import Hint Name --> strrchr                      Import Address --> 0x000002c3
Import Hint Name --> atol                         Import Address --> 0x0000023e
Import Hint Name --> strstr                       Import Address --> 0x000002c5
Import Hint Name --> memmove                      Import Address --> 0x00000298
Import Hint Name --> realloc                      Import Address --> 0x000002a7
Import Hint Name --> strpbrk                      Import Address --> 0x000002c2
Import Hint Name --> wcslen                       Import Address --> 0x000002e6
Import Hint Name --> rand                         Import Address --> 0x000002a6
Import Hint Name --> longjmp                      Import Address --> 0x00000290
Import Hint Name --> _setjmp3                     Import Address --> 0x000001a8
Import Hint Name --> __CxxLongjmpUnwind           Import Address --> 0x0000004a
Import Hint Name --> wcschr                       Import Address --> 0x000002e0
Import Hint Name --> wcscpy                       Import Address --> 0x000002e3
Import Hint Name --> strcmp                       Import Address --> 0x000002b8
Import Hint Name --> _ftol                        Import Address --> 0x000000f1
Import Hint Name --> toupper                      Import Address --> 0x000002d4
Import Hint Name --> strtol                       Import Address --> 0x000002c8
Import Hint Name --> _snprintf                    Import Address --> 0x000001ae
Import Hint Name --> floor                        Import Address --> 0x00000255
Import Hint Name --> modf                         Import Address --> 0x0000029b
Import Hint Name --> frexp                        Import Address --> 0x00000260
Import Hint Name --> _CIpow                       Import Address --> 0x0000003b
Import Hint Name --> gmtime                       Import Address --> 0x0000026e
Import Hint Name --> fprintf                      Import Address --> 0x00000258
Import Hint Name --> _iob                         Import Address --> 0x00000113
Import Hint Name --> fwrite                       Import Address --> 0x00000266
Import Hint Name --> fflush                       Import Address --> 0x0000024f
Import Hint Name --> atof                         Import Address --> 0x0000023c
Import Hint Name --> fread                        Import Address --> 0x0000025d
Import Hint Name --> strcpy                       Import Address --> 0x000002ba
Import Hint Name --> strlen                       Import Address --> 0x000002be
Import Hint Name --> _mbschr                      Import Address --> 0x00000158
Import Hint Name --> swprintf                     Import Address --> 0x000002cb
Import Hint Name --> wcstol                       Import Address --> 0x000002f0
Import Hint Name --> wcstoul                      Import Address --> 0x000002f2
Import Hint Name --> wcsrchr                      Import Address --> 0x000002eb
Import Hint Name --> _wcsnicmp                    Import Address --> 0x000001ee
Import Hint Name --> wcscmp                       Import Address --> 0x000002e1
Import Hint Name --> _purecall                    Import Address --> 0x00000192
Import Hint Name --> _vsnprintf                   Import Address --> 0x000001e1
Import Hint Name --> _strnicmp                    Import Address --> 0x000001c5

WINMM.dll
****************************FOA_OriginalFirstThunk:0x0005072c*********************************
Import Hint Name --> PlaySoundW                   Import Address --> 0x0000000d
Import Hint Name --> PlaySoundA                   Import Address --> 0x0000000c
****************************FOA_FirstThunk:0x00046558*********************************
Import Hint Name --> PlaySoundW                   Import Address --> 0x0000000d
Import Hint Name --> PlaySoundA                   Import Address --> 0x0000000c