Generated by JEB on 2019/08/01

PE: C:\Windows\SysWOW64\vdmdbg.dll Base=0x10000000 SHA-256=B1EF0FE2F165CEF5EACCD103CF53949E47016ECFA6F0E21C016D7F73FDDCDE0C
PDB: vdmdbg.pdb GUID={B7E23E14-881B-E769-E9D86458025B864D} Age=1

141 located named symbols:
0x100027A0: "__stdcall VDMGlobalFirst" _VDMGlobalFirst@24
0x100060B0: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1000601C: "__stdcall _imp__OpenProcess" __imp__OpenProcess@12
0x100015B0: "__stdcall VDMIsModuleLoaded" _VDMIsModuleLoaded@4
0x100024B8: "__stdcall WalkMapForValue" _WalkMapForValue@20
0x10006054: "__stdcall _imp__TerminateThread" __imp__TerminateThread@8
0x10002731: "__stdcall CopyFromGlobalEntry16" _CopyFromGlobalEntry16@8
0x10005000: "__cdecl __security_cookie" ___security_cookie
0x10003BA0: "__fastcall __security_check_cookie" @__security_check_cookie@4
0x10002B69: "__stdcall InternalGetPointer" _InternalGetPointer@16
0x10005464: "__cdecl wKernelSeg" _wKernelSeg
0x10003020: "__stdcall VDMGetThreadContext" _VDMGetThreadContext@8
0x10005460: "__cdecl lpRemoteAddress" _lpRemoteAddress
0x10003060: "__stdcall VDMSetThreadContext" _VDMSetThreadContext@8
0x10006014: "__stdcall _imp__QueryPerformanceCounter" __imp__QueryPerformanceCounter@4
0x100028DB: "__stdcall CopyToModuleEntry16" _CopyToModuleEntry16@8
0x10003B80: "__stdcall _DllMainCRTStartupForGS" __DllMainCRTStartupForGS@12
0x10006038: "__stdcall _imp__HeapFree" __imp__HeapFree@12
0x10006068: "__stdcall _imp__GetNextVDMCommand" __imp__GetNextVDMCommand@4
0x10001EF2: "__stdcall ExtractSymbol" _ExtractSymbol@40
0x10002F8B: "__stdcall ParseModuleName" _ParseModuleName@8
0x1000609C: "__cdecl _imp__strncpy_s" __imp__strncpy_s
0x100015EB: "__stdcall SegmentLoad" _SegmentLoad@12
0x100035B0: "__stdcall VDMProcessException" _VDMProcessException@4
0x10006028: "__stdcall _imp__WriteProcessMemory" __imp__WriteProcessMemory@20
0x1000118C: "ModuleNext" ??_C@_0L@KCNCNGCB@ModuleNext?$AA@
0x10006018: "__stdcall _imp__TerminateProcess" __imp__TerminateProcess@8
0x100060AC: "__cdecl __guard_check_icall_fptr" ___guard_check_icall_fptr
0x10003650: "__stdcall VDMGetDbgFlags" _VDMGetDbgFlags@4
0x100036C0: "__stdcall VDMSetDbgFlags" _VDMSetDbgFlags@8
0x10002A70: "__stdcall VDMModuleNext" _VDMModuleNext@20
0x10006008: "__stdcall _imp__GetSystemTimeAsFileTime" __imp__GetSystemTimeAsFileTime@4
0x10006060: "__stdcall _imp__GetThreadContext" __imp__GetThreadContext@8
0x10006000: "__stdcall _imp__ContinueDebugEvent" __imp__ContinueDebugEvent@12
0x10006024: "__stdcall _imp__ReadProcessMemory" __imp__ReadProcessMemory@20
0x10001360: "__stdcall ProcessBPNotification" _ProcessBPNotification@4
0x10006080: "__stdcall _imp__GetWindowThreadProcessId" __imp__GetWindowThreadProcessId@8
0x10006004: "__stdcall _imp__GetTickCount" __imp__GetTickCount@0
0x100016B0: "__stdcall ModuleLoad" _ModuleLoad@16
0x10001158: "GlobalFirst" ??_C@_0M@JMAONNK@GlobalFirst?$AA@
0x1000602C: "__stdcall _imp__DisableThreadLibraryCalls" __imp__DisableThreadLibraryCalls@4
0x10006094: "__cdecl _imp__memcpy" __imp__memcpy
0x10006074: "__stdcall _imp__SetUnhandledExceptionFilter" __imp__SetUnhandledExceptionFilter@4
0x10005468: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUnewnUewnwytUlyquivUrDIGUkivxlnkOlyq@vdmdbg" ___@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUnewnUewnwytUlyquivUrDIGUkivxlnkOlyq@vdmdbg
0x10006010: "__stdcall _imp__GetCurrentProcessId" __imp__GetCurrentProcessId@0
0x10001140: ".exe" ??_C@_04JLMDILM@?4exe?$AA@
0x10003630: "__stdcall VDMGetModuleSelector" _VDMGetModuleSelector@20
0x10001180: "ModuleFirst" ??_C@_0M@EEMJOHPH@ModuleFirst?$AA@
0x10003000: "__stdcall VDMGetPointer" _VDMGetPointer@20
0x100060A4: "__cdecl _imp__memset" __imp__memset
0x100060A0: "__stdcall _imp__NtOpenThread" __imp__NtOpenThread@16
0x10001826: "__stdcall ProcessSegmentNotification" _ProcessSegmentNotification@4
0x10001A10: "__stdcall VDMGetSegmentInfo" _VDMGetSegmentInfo@16
0x10006044: "__stdcall _imp___llseek" __imp___llseek@12
0x10006078: KERNEL32_NULL_THUNK_DATA
0x10003600: "__stdcall VDMGetSelectorModule" _VDMGetSelectorModule@32
0x1000177A: "__stdcall V86SegmentMove" _V86SegmentMove@16
0x100038A1: "__stdcall VDMEnumTaskWOWWorker" _VDMEnumTaskWOWWorker@16
0x10001174: "GlobalNext" ??_C@_0L@BJLJKDEB@GlobalNext?$AA@
0x10005330: "__cdecl SegListHead" _SegListHead
0x10001164: "TOOLHELP.DLL" ??_C@_0N@HOKAJGNC@TOOLHELP?4DLL?$AA@
0x10006064: "__stdcall _imp__SetThreadContext" __imp__SetThreadContext@8
0x100032E0: "__stdcall VDMSetContext" _VDMSetContext@12
0x100030A0: "__stdcall VDMGetContext" _VDMGetContext@12
0x10001A88: "__stdcall FindExport" _FindExport@24
0x1000606C: "__stdcall _imp__GlobalAddAtomA" __imp__GlobalAddAtomA@4
0x10003CB9: "__cdecl __security_init_cookie" ___security_init_cookie
0x10005454: "__cdecl lpNtvdmState" _lpNtvdmState
0x10001148: ".dll" ??_C@_04HLONOPDM@?4dll?$AA@
0x10006088: USER32_NULL_THUNK_DATA
0x10006048: "__stdcall _imp___lclose" __imp___lclose@4
0x100029B0: "__stdcall VDMModuleFirst" _VDMModuleFirst@20
0x10002EDF: "__stdcall ProcessInitNotification" _ProcessInitNotification@4
0x10006058: "__stdcall _imp__GetCurrentProcess" __imp__GetCurrentProcess@0
0x10005004: "__cdecl __security_cookie_complement" ___security_cookie_complement
0x1000603C: "__stdcall _imp__OpenFile" __imp__OpenFile@12
0x100022A1: "__stdcall ExtractValue" _ExtractValue@24
0x100023F5: "__stdcall WalkSegmentsForValue" _WalkSegmentsForValue@28
0x10003A60: "__stdcall VDMTerminateTaskWOW" _VDMTerminateTaskWOW@8
0x10006034: "__stdcall _imp__GetProcessHeap" __imp__GetProcessHeap@0
0x10003D49: "__cdecl memset" _memset
0x10003A20: "__stdcall VDMEnumTaskWOW" _VDMEnumTaskWOW@12
0x1000605C: "__stdcall _imp__WaitForSingleObject" __imp__WaitForSingleObject@8
0x10002670: "__stdcall VDMGetAddrExpression" _VDMGetAddrExpression@20
0x10003D40: "__fastcall _guard_check_icall_nop" @_guard_check_icall_nop@4
0x1000544C: "__cdecl lpVdmContext" _lpVdmContext
0x100035A0: "__stdcall VDMBreakThread" _VDMBreakThread@8
0x100019AC: "__stdcall CopySegmentInfo" _CopySegmentInfo@8
0x100060D8: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x1000209E: "__stdcall WalkSegmentsForSymbol" _WalkSegmentsForSymbol@32
0x100010AC: "__cdecl __guard_fids_table" ___guard_fids_table
0x10002BDD: "__stdcall ReadItem" _ReadItem@20
0x100021A0: "__stdcall VDMGetSymbol" _VDMGetSymbol@28
0x10002B26: "__stdcall InternalGetThreadSelectorEntry" _InternalGetThreadSelectorEntry@12
0x10006070: "__stdcall _imp__UnhandledExceptionFilter" __imp__UnhandledExceptionFilter@4
0x1000607C: "__stdcall _imp__FindWindowExA" __imp__FindWindowExA@16
0x10001669: "__stdcall SegmentFree" _SegmentFree@4
0x10003BB0: "__cdecl __report_gsfailure" ___report_gsfailure
0x1000172E: "__stdcall ModuleFree" _ModuleFree@4
0x10006084: "__stdcall _imp__PostMessageA" __imp__PostMessageA@16
0x10001008: "__cdecl _load_config_used" __load_config_used
0x100060A8: ntdll_NULL_THUNK_DATA
0x10006090: "__cdecl _imp__strcat_s" __imp__strcat_s
0x10003D43: "__cdecl memcpy" _memcpy
0x10003760: "__stdcall VDMDetectWOW" _VDMDetectWOW@0
0x10002C69: "__stdcall CallRemote16" _CallRemote16@36
0x10006020: "__stdcall _imp__CloseHandle" __imp__CloseHandle@4
0x10006098: "__cdecl _imp__strcpy_s" __imp__strcpy_s
0x100060C4: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x1000293C: "__stdcall CopyFromModuleEntry16" _CopyFromModuleEntry16@8
0x100015A0: "__stdcall VDMGetSegtablePointer" _VDMGetSegtablePointer@0
0x10002FE0: "__stdcall VDMGetThreadSelectorEntry" _VDMGetThreadSelectorEntry@16
0x10005450: "__cdecl lpVdmDbgFlags" _lpVdmDbgFlags
0x10006030: "__stdcall _imp__HeapAlloc" __imp__HeapAlloc@12
0x1000608C: "__cdecl _imp___stricmp" __imp___stricmp
0x10006050: "__stdcall _imp__WaitForDebugEvent" __imp__WaitForDebugEvent@8
0x10002840: "__stdcall VDMGlobalNext" _VDMGlobalNext@24
0x1000600C: "__stdcall _imp__GetCurrentThreadId" __imp__GetCurrentThreadId@0
0x10003A40: "__stdcall VDMEnumTaskWOWEx" _VDMEnumTaskWOWEx@12
0x10003760: "__stdcall VDMKillWOW" _VDMKillWOW@0
0x10005458: "__cdecl dwLdtBase" _dwLdtBase
0x10006040: "__stdcall _imp___lread" __imp___lread@12
0x1000545C: "__cdecl lpRemoteBlock" _lpRemoteBlock
0x10003B10: "__stdcall VDMStartTaskInWOW" _VDMStartTaskInWOW@12
0x1000604C: "__stdcall _imp__CreateRemoteThread" __imp__CreateRemoteThread@28
0x10002C23: "__stdcall WriteItem" _WriteItem@20
0x10001198: "WowExecClass" ??_C@_0N@BMCBOHAH@WowExecClass?$AA@
0x100026CA: "__stdcall CopyToGlobalEntry16" _CopyToGlobalEntry16@8
0x10003770: "__stdcall VDMEnumProcessWOW" _VDMEnumProcessWOW@8
0x10005448: "__cdecl lpVdmBreakPoints" _lpVdmBreakPoints
0x10001150: ".sym" ??_C@_04LFNFNAMA@?4sym?$AA@
0x100060EC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]