Appendix 5:  API Recovery Table
 


0x0000adc8 htonl
0x0000ae61 sendto
0x0000aeb5 RegOpenKeyExA
0x0000aed9 socket
0x0000b050 ntdll_RtlEnterCriticalSection
0x0000b091 htons
0x0000b12c ntdll_RtlEnterCriticalSection
0x0000b29a WSAGetLastError
0x0000b2f6 ntdll_RtlLeaveCriticalSection
0x0000b339 ntdll_RtlEnterCriticalSection
0x0000b355 ntdll_RtlLeaveCriticalSection
0x0000b3d1 ntdll_RtlEnterCriticalSection
0x0000b3f1 ntdll_RtlLeaveCriticalSection
0x0000b433 bind
0x0000b45c ntdll_RtlLeaveCriticalSection
0x0000b583 ntdll_RtlEnterCriticalSection
0x0000b59b ntdll_RtlLeaveCriticalSection
0x0000b5ac GetTickCount
0x0000b63f closesocket
0x0000b679 ntdll_RtlLeaveCriticalSection
0x0000b795 VirtualAlloc
0x0000b8a7 closesocket
0x0000b8eb closesocket
0x0000ba8d GetTempPathA
0x0000bca5 RegOpenKeyExA
0x0000bd8d RegQueryValueExA
0x0000bedd GetFileAttributesA
0x0000c14c ExitThread
0x0000c1bb RegCloseKey
0x0000c1e3 RegOpenKeyExA
0x0000c36e __WSAFDIsSet
0x0000c47f InitializeCriticalSection
0x0000c67a Sleep
0x0000c719 ntdll_RtlEnterCriticalSection
0x0000c74c ntdll_RtlLeaveCriticalSection
0x0000c912 GetTickCount
0x0000c94c send
0x0000c9b1 ntdll_RtlLeaveCriticalSection
0x0000c9ea ExitThread
0x0000cb2b ntdll_RtlLeaveCriticalSection
0x0000cc9a htonl
0x0000cdf1 ntdll_RtlLeaveCriticalSection
0x0000d052 GetTickCount
0x0000d0e1 WSAGetLastError
0x0000d145 ioctlsocket
0x0000d28f __WSAFDIsSet
0x0000d2c5 InitializeCriticalSection
0x0000d352 ntdll_RtlLeaveCriticalSection
0x0000d3bb ntdll_RtlLeaveCriticalSection
0x0000d4a4 GlobalAlloc
0x0000d4dd Sleep
0x0000d4fd ExitThread
0x0000d5a1 WaitForSingleObject
0x0000d6b4 ntdll_RtlLeaveCriticalSection
0x0000d72d ntdll_RtlEnterCriticalSection
0x0000d74c ntdll_RtlLeaveCriticalSection
0x0000d912 ntdll_RtlEnterCriticalSection
0x0000d933 ntdll_RtlLeaveCriticalSection
0x0000d9bb ntdll_RtlEnterCriticalSection
0x0000dc82 GetTickCount
0x0000dd26 ntdll_RtlEnterCriticalSection
0x0000de23 __WSAFDIsSet
0x0000dfb5 ntdll_RtlLeaveCriticalSection
0x0000e021 Sleep
0x0000e0c7 Sleep
0x0000e1ce Sleep
0x0000e285 RegCloseKey
0x0000e3ea ntdll_RtlLeaveCriticalSection
0x0000e5cd ntdll_RtlLeaveCriticalSection
0x0000e640 RegQueryValueExA
0x0000e6b2 closesocket
0x0000e6d5 GetTickCount
0x0000e6ec InternetGetConnectedState
0x0000e701 InterlockedExchange
0x0000e787 GlobalFree
0x0000e7bb closesocket
0x0000e8cc ntdll_RtlLeaveCriticalSection
0x0000e929 htons
0x0000eae4 ntdll_RtlEnterCriticalSection
0x0000eb0a CloseHandle
0x0000ec66 ntdll_RtlEnterCriticalSection
0x0000edc0 RegSetValueExA
0x0000ede3 ntdll_RtlEnterCriticalSection
0x0000eecb GetTickCount
0x0000ef6a RegSetValueExA
0x0000f01a ntdll_RtlLeaveCriticalSection
0x0000f072 ntdll_RtlEnterCriticalSection
0x0000f163 VerQueryValueA
0x0000f1b6 CreateThread
0x0000f20c CloseHandle
0x0000f296 ntdll_RtlEnterCriticalSection
0x0000f5aa ntdll_RtlEnterCriticalSection
0x0000f5c7 ntdll_RtlLeaveCriticalSection
0x0000f613 ntdll_RtlEnterCriticalSection
0x0000f631 ntdll_RtlLeaveCriticalSection
0x0000f69f GetTickCount
0x0000f789 GetTickCount
0x0000f897 RegDeleteValueA
0x0000f8be recv
0x0000fa1d accept
0x0000fa75 ioctlsocket
0x0000faa3 getsockname
0x0000face _memicmp
0x0000faf8 GetFileVersionInfoA
0x0000fb6b closesocket
0x0000fb94 ExitThread
0x0000fdeb GetTickCount
0x0000fdff socket
0x0000ffb1 ntdll_RtlEnterCriticalSection
0x0000fffa recv
0x00010119 RegOpenKeyExA
0x000101d8 closesocket
0x0001023d InitializeCriticalSection
0x000102a6 DeleteFileA
0x000103a0 bind
0x000103d3 RegCloseKey
0x0001042f GetVersion
0x000104fc InterlockedExchange
0x0001058a InitializeCriticalSection
0x000105b6 InitializeCriticalSection
0x0001060e time
0x0001061d GetTickCount
0x0001066d GetTickCount
0x0001069c ntdll_RtlLeaveCriticalSection
0x000107e1 GetFileVersionInfoSizeA
0x00010827 InitializeCriticalSection
0x0001085b CloseHandle
0x0001086e CloseHandle
0x000109fe ntdll_RtlEnterCriticalSection
0x00010a3b ntdll_RtlLeaveCriticalSection
0x00010af7 GetModuleHandleA
0x00010b3f WSAGetLastError
0x00010baa CreateThread
0x00010bca closesocket
0x00010be0 Sleep
0x00010c99 GetTickCount
0x00010e93 ioctlsocket
0x00010fa0 InterlockedExchange
0x00011007 ntdll_RtlEnterCriticalSection
0x00011070 closesocket
0x0001108b Sleep
0x000110e7 CloseHandle
0x00011120 CryptGenRandom
0x00011184 InterlockedExchange
0x00011202 ntdll_RtlLeaveCriticalSection
0x000112ee SetEvent
0x00011557 RegQueryValueExA
0x000115c5 time
0x000115d5 GetTickCount
0x0001163f RegCloseKey
0x00011684 ntdll_RtlLeaveCriticalSection
0x0001178b ntdll_RtlEnterCriticalSection
0x000117ba closesocket
0x0001193c RegCloseKey
0x00011ae6 ExitThread
0x00011b74 ntdll_RtlEnterCriticalSection
0x00011c25 ExitThread
0x00012107 RegCreateKeyExA
0x000121cd htons
0x0001228c ntdll_RtlEnterCriticalSection
0x00012298 GetTickCount
0x000122d9 ntdll_RtlGetLastWin32Error
0x000123a9 socket
0x000124b3 ntdll_RtlEnterCriticalSection
0x00012514 ntdll_RtlEnterCriticalSection
0x00012532 ntdll_RtlLeaveCriticalSection
0x000125f4 ntdll_RtlLeaveCriticalSection
0x000126f0 ExitThread
0x00012805 ntdll_RtlLeaveCriticalSection
0x000128b8 RegQueryValueExA
0x00012953 ntdll_RtlEnterCriticalSection
0x00012977 closesocket
0x000129a8 ntdll_RtlLeaveCriticalSection
0x00012a14 CreateDirectoryA
0x00012bd1 GetVersionExA
0x00012c27 InterlockedExchange
0x00012d0f RegCloseKey
0x00012d24 RegCloseKey
0x00012d4d htons
0x000130f8 CreateFileA
0x0001325b RegSetValueExA
0x000133f1 ntdll_RtlLeaveCriticalSection
0x0001346e ntdll_RtlEnterCriticalSection
0x0001348b RegOpenKeyExA
0x000134de GetSystemTime
0x000134ea GetTickCount
0x00013589 CreateEventA
0x00013725 ntdll_RtlEnterCriticalSection
0x0001375e RegCloseKey
0x00013ad8 ntdll_RtlEnterCriticalSection
0x00013b52 GetTickCount
0x00013c7a InitializeCriticalSection
0x00013c8c InitializeCriticalSection
0x00013cbf InitializeCriticalSection
0x00014112 InternetTimeToSystemTime
0x00014174 SetFilePointer
0x00014192 WriteFile
0x00014219 htons
0x0001423e recvfrom
0x000142b6 ExitThread
0x000144ce ntdll_RtlEnterCriticalSection
0x0001451e RegOpenKeyExA
0x00014560 ntdll_RtlLeaveCriticalSection
0x000145ba ntdll_RtlEnterCriticalSection
0x000145d8 ntdll_RtlLeaveCriticalSection
0x0001464c ntdll_RtlEnterCriticalSection
0x00014700 RegCloseKey
0x0001492a SetFileAttributesA
0x00014939 DeleteFileA
0x00014c47 closesocket
0x0001501c ntdll_RtlEnterCriticalSection
0x00015155 SetFilePointer
0x00015175 ReadFile
0x000151bc GlobalAlloc
0x0001556a htons
0x00015583 connect
0x00015677 GetVersion
0x000156ba GetVersionExA
0x0001581b ntdll_RtlLeaveCriticalSection
0x0001585b SystemTimeToFileTime
0x000158a4 InterlockedExchange
0x000158f8 closesocket
0x00015933 GlobalFree
0x000159c3 Sleep
0x000159f7 GetTickCount
0x00015a83 socket
0x00015ae6 ExitThread
0x00015bcc ObtainUserAgentString
0x00015cd1 closesocket
0x00015cee WaitForSingleObject
0x00015d1a GetTempFileNameA
0x00015d42 memmove
0x00015dc8 htons
0x00015e17 closesocket
0x00015e45 getpeername
0x00015f0c ntdll_RtlLeaveCriticalSection
0x00015f94 WSAIoctl
0x00016101 htons
0x0001616f socket
0x000161d1 closesocket
0x00016219 GetTickCount
0x0001622d GetTickCount
0x000162b8 WSASocketA
0x000162f4 ntdll_RtlLeaveCriticalSection
0x00016328 listen
0x00016397 InitializeCriticalSection
0x0001646c gethostbyname