| / Chip 2003 July
/ Chip_2003-07_cd1.bin / tema / bootman / download / pm / data1.cab / BlueScrn / BlueScrn.exe
| < prev | next > |
| MS-DOS/Windows or OS/2 Executable | 2001-01-30 | 6.0 KB |
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text| Confidence | Program | Detection | Match Type | Support |
|---|---|---|---|---|
| 100% | dexvert | MS-DOS/Windows or OS/2 Executable (executable/exe) | magic | Supported |
| 1% | dexvert | Ady's GLUE Packed (archive/adysGLUEPacked) | ext | Unsupported |
| 1% | dexvert | BlacK FiST Packed (archive/blackFiSTPacked) | ext | Unsupported |
| 1% | dexvert | CauseWay Compressor Packed (archive/causeWayCompressorPacked) | ext | Unsupported |
| 1% | dexvert | CExe Packed (archive/cExePacked) | ext | Unsupported |
| 1% | dexvert | cIPHATOR Protected (archive/ciphatorProtected) | ext | Unsupported |
| 1% | dexvert | CRYPACK Protected (archive/crypackProtected) | ext | Unsupported |
| 1% | dexvert | CRYPTEXE Protected (archive/cryptexeProtected) | ext | Unsupported |
| 1% | dexvert | Crypt Light Show Protected (archive/cryptLightShowProtected) | ext | Unsupported |
| 1% | dexvert | DaRKSToP Protected (archive/darkstopProtected) | ext | Unsupported |
| 1% | dexvert | DiskImager SFX Image (archive/diskImagerSFXImage) | ext | Unsupported |
| 1% | dexvert | Dismember EXE CRYPT Protected (archive/dismemberProtected) | ext | Unsupported |
| 1% | dexvert | DJP Packed (archive/djpPacked) | ext | Unsupported |
| 1% | dexvert | .NETZ Packed (archive/dotNETZPacked) | ext | Unsupported |
| 1% | dexvert | DSHIELD Protected (archive/dshieldProtected) | ext | Unsupported |
| 1% | dexvert | Exe32Pack Packed (archive/exe32PackPacked) | ext | Unsupported |
| 1% | dexvert | EXE Manager Protected (archive/exeManagerProtected) | ext | Unsupported |
| 1% | dexvert | EXETOOLS Protected (archive/exetoolsProtected) | ext | Unsupported |
| 1% | dexvert | EZip Packed (archive/ezipPacked) | ext | Unsupported |
| 1% | dexvert | FSG Packed (archive/fsgPacked) | ext | Unsupported |
| 1% | dexvert | HackStop Protected (archive/hackStopProtected) | ext | Unsupported |
| 1% | dexvert | JMCryptExe Protected (archive/jmCryptExeProtected) | ext | Unsupported |
| 1% | dexvert | kkrunchy Packed (archive/kkcrunchPacked) | ext | Unsupported |
| 1% | dexvert | mbp SHRINK Packed (archive/mbpSHRINKPacked) | ext | Unsupported |
| 1% | dexvert | MEGALITE Packed (archive/megalitePacked) | ext | Unsupported |
| 1% | dexvert | Mess Protected (archive/messProtected) | ext | Unsupported |
| 1% | dexvert | Mew Packed (archive/mewPacked) | ext | Unsupported |
| 1% | dexvert | MPRESS Packed (archive/mpressPacked) | ext | Unsupported |
| 1% | dexvert | NOS Packer Packed (archive/nosPackerPacked) | ext | Unsupported |
| 1% | dexvert | NTShell Protected (archive/ntShellProtected) | ext | Unsupported |
| 1% | dexvert | Pack Master Packed (archive/packMasterPacked) | ext | Unsupported |
| 1% | dexvert | PE Diminisher Packed (archive/peDiminisherPacked) | ext | Unsupported |
| 1% | dexvert | Petite Packed (archive/petitePacked) | ext | Unsupported |
| 1% | dexvert | PeX Packed (archive/pexPacked) | ext | Unsupported |
| 1% | dexvert | PKLITE32 Packed (archive/pklite32Packed) | ext | Unsupported |
| 1% | dexvert | PowerBatch Packed (archive/powerBatchPacked) | ext | Unsupported |
| 1% | dexvert | protector Protected (archive/protectorProtected) | ext | Unsupported |
| 1% | dexvert | py2exe Packed (archive/py2exePacked) | ext | Unsupported |
| 1% | dexvert | PyInstaller Packed (archive/pyInstallerPacked) | ext | Unsupported |
| 1% | dexvert | Scramb Packed (archive/scrambPacked) | ext | Unsupported |
| 1% | dexvert | SECURE Protected (archive/secureProtected) | ext | Unsupported |
| 1% | dexvert | Shrinker Packed (Windows) (archive/shrinkerWindowsPacked) | ext | Unsupported |
| 1% | dexvert | Spoon Studio Packed (archive/spoonStudioPacked) | ext | Unsupported |
| 1% | dexvert | tElock Packed (archive/telockPacked) | ext | Unsupported |
| 1% | dexvert | The Builder Packed (archive/theBuilderPacked) | ext | Unsupported |
| 1% | dexvert | The Patcher Packed (archive/thePatcherPacked) | ext | Unsupported |
| 1% | dexvert | 32Lite Packed (archive/thirtyTwoLitePacked) | ext | Unsupported |
| 1% | dexvert | TinyProt Protected (archive/tinyProtProtected) | ext | Unsupported |
| 1% | dexvert | (Win)Upack Packed (archive/winUpackPacked) | ext | Unsupported |
| 1% | dexvert | Yoda's Crypte Protected (archive/yodasCrypterProtected) | ext | Unsupported |
| 1% | dexvert | MS-DOS PMODE extender executable (executable/msdosPMODEExtenderExecutable) | ext | Unsupported |
| 1% | dexvert | Sony Playstation Executable (executable/sonyPlaystationExe) | ext | Unsupported |
| 1% | dexvert | Novell Netware Virtual Loadable Module (other/novellNetwareVirtualLoadableModule) | ext | Unsupported |
| 100% | file | PE32 executable for MS Windows 4.00 (native), Intel i386, 4 sections | default | |
| 99% | file | data | default | |
| 33% | TrID | Win64 Executable (generic) | default | |
| 20% | TrID | Win32 Dynamic Link Library (generic) | default | |
| 14% | TrID | Win32 Executable (generic) | default | |
| 6% | TrID | Win16/32 Executable Delphi generic | default (weak) | |
| 6% | TrID | Windows Icons Library (generic) | default (weak) | |
| 100% | siegfried | fmt/899 Windows Portable Executable (32 bit) | default | |
| 100% | gt2 | Ist eine ausf�hrbare Win32 Datei | default | |
| 100% | binwalkID | Microsoft executable, portable (PE) | default | |
| 100% | xdgMime | application/vnd.microsoft.portable-executable | default (weak) |
+--------+-------------------------+-------------------------+--------+--------+
|00000000| 4d 5a 90 00 03 00 00 00 | 04 00 00 00 ff ff 00 00 |MZ......|........|
|00000010| b8 00 00 00 00 00 00 00 | 40 00 00 00 00 00 00 00 |........|@.......|
|00000020| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000030| 00 00 00 00 00 00 00 00 | 00 00 00 00 80 00 00 00 |........|........|
|00000040| 0e 1f ba 0e 00 b4 09 cd | 21 b8 01 4c cd 21 54 68 |........|!..L.!Th|
|00000050| 69 73 20 70 72 6f 67 72 | 61 6d 20 63 61 6e 6e 6f |is progr|am canno|
|00000060| 74 20 62 65 20 72 75 6e | 20 69 6e 20 44 4f 53 20 |t be run| in DOS |
|00000070| 6d 6f 64 65 2e 0d 0d 0a | 24 00 00 00 00 00 00 00 |mode....|$.......|
|00000080| 50 45 00 00 4c 01 04 00 | 9b a4 76 3a 00 00 00 00 |PE..L...|..v:....|
|00000090| 00 00 00 00 e0 00 0e 01 | 0b 01 05 00 00 02 00 00 |........|........|
|000000a0| 00 06 00 00 00 00 00 00 | 00 10 00 00 00 10 00 00 |........|........|
|000000b0| 00 20 00 00 00 00 40 00 | 00 10 00 00 00 02 00 00 |. ....@.|........|
|000000c0| 04 00 00 00 00 00 00 00 | 04 00 00 00 00 00 00 00 |........|........|
|000000d0| 00 50 00 00 00 04 00 00 | cd f9 00 00 01 00 00 00 |.P......|........|
|000000e0| 00 00 10 00 00 10 00 00 | 00 00 10 00 00 10 00 00 |........|........|
|000000f0| 00 00 00 00 10 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000100| 00 30 00 00 28 00 00 00 | 00 00 00 00 00 00 00 00 |.0..(...|........|
|00000110| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000120| 00 40 00 00 24 00 00 00 | 00 00 00 00 00 00 00 00 |.@..$...|........|
|00000130| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000140| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000150| 00 00 00 00 00 00 00 00 | 58 30 00 00 30 00 00 00 |........|X0..0...|
|00000160| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000170| 00 00 00 00 00 00 00 00 | 2e 74 65 78 74 00 00 00 |........|.text...|
|00000180| 6a 01 00 00 00 10 00 00 | 00 02 00 00 00 10 00 00 |j.......|........|
|00000190| 00 00 00 00 00 00 00 00 | 00 00 00 00 20 00 00 60 |........|.... ..`|
|000001a0| 2e 64 61 74 61 00 00 00 | 3e 00 00 00 00 20 00 00 |.data...|>.... ..|
|000001b0| 00 02 00 00 00 12 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001c0| 00 00 00 00 40 00 00 c0 | 2e 69 64 61 74 61 00 00 |....@...|.idata..|
|000001d0| 58 01 00 00 00 30 00 00 | 00 02 00 00 00 14 00 00 |X....0..|........|
|000001e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 40 00 00 c0 |........|....@...|
|000001f0| 2e 72 65 6c 6f 63 00 00 | 42 00 00 00 00 40 00 00 |.reloc..|B....@..|
|00000200| 00 02 00 00 00 16 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000210| 00 00 00 00 40 00 00 42 | 00 00 00 00 00 00 00 00 |....@..B|........|
|00000220| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000230| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000240| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000250| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000260| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000270| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000280| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000290| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000002a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000002b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000002c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000002d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000002e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000002f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000300| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000310| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000320| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000330| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000340| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000350| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000360| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000370| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000380| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000390| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000003a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000003b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000003c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000003d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000003e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000003f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000400| 30 00 5f 4e 74 52 65 70 | 6c 61 63 65 4b 65 79 40 |0._NtRep|laceKey@|
|00000410| 31 32 00 5f 4e 74 52 65 | 70 6c 79 50 6f 72 74 40 |12._NtRe|plyPort@|
|00000420| 38 00 5f 4e 74 52 65 70 | 6c 79 57 61 69 74 52 65 |8._NtRep|lyWaitRe|
|00000430| 63 65 69 76 65 50 6f 72 | 74 40 31 36 00 5f 4e 74 |ceivePor|t@16._Nt|
|00000440| 52 65 70 6c 79 57 61 69 | 74 52 65 70 6c 79 50 6f |ReplyWai|tReplyPo|
|00000450| 72 74 40 38 00 5f 4e 74 | 52 65 70 6c 79 57 61 69 |rt@8._Nt|ReplyWai|
|00000460| 74 53 65 6e 64 43 68 61 | 6e 6e 65 6c 40 31 32 00 |tSendCha|nnel@12.|
|00000470| 5f 4e 74 52 65 71 75 65 | 73 74 50 6f 72 74 40 38 |_NtReque|stPort@8|
|00000480| 00 5f 4e 74 52 65 71 75 | 65 73 74 57 61 69 74 52 |._NtRequ|estWaitR|
|00000490| 65 70 6c 79 50 6f 72 74 | 40 31 32 00 5f 4e 74 52 |eplyPort|@12._NtR|
|000004a0| 65 73 65 74 45 76 65 6e | 74 40 38 00 5f 4e 74 52 |esetEven|t@8._NtR|
|000004b0| 65 73 74 6f 72 65 4b 65 | 79 40 31 32 00 5f 4e 74 |estoreKe|y@12._Nt|
|000004c0| 52 65 73 75 6d 65 54 68 | 72 65 61 64 40 38 00 5f |ResumeTh|read@8._|
|000004d0| 4e 74 53 61 76 65 4b 65 | 79 40 38 00 5f 4e 74 53 |NtSaveKe|y@8._NtS|
|000004e0| 65 6e 64 57 61 69 74 52 | 65 70 6c 79 43 68 61 6e |endWaitR|eplyChan|
|000004f0| 6e 65 6c 40 31 36 00 5f | 4e 74 53 65 74 43 6f 6e |nel@16._|NtSetCon|
|00000500| 74 65 78 74 43 68 61 6e | 6e 65 6c 40 34 00 5f 4e |textChan|nel@4._N|
|00000510| 74 53 65 74 43 6f 6e 74 | 65 78 74 54 68 72 65 61 |tSetCont|extThrea|
|00000520| 64 40 38 00 5f 4e 74 53 | 65 74 44 65 66 61 75 6c |d@8._NtS|etDefaul|
|00000530| 74 48 61 72 64 45 72 72 | 6f 72 50 6f 72 74 40 34 |tHardErr|orPort@4|
|00000540| 00 5f 4e 74 53 65 74 44 | 65 66 61 75 6c 74 4c 6f |._NtSetD|efaultLo|
|00000550| 63 61 6c 65 40 38 00 5f | 4e 74 53 65 74 45 61 46 |cale@8._|NtSetEaF|
|00000560| 69 6c 65 40 31 36 00 5f | 4e 74 53 65 74 45 76 65 |ile@16._|NtSetEve|
|00000570| 6e 74 40 38 00 5f 4e 74 | 53 65 74 48 69 67 68 45 |nt@8._Nt|SetHighE|
|00000580| 76 65 6e 74 50 61 69 72 | 40 34 00 5f 4e 74 53 65 |ventPair|@4._NtSe|
|00000590| 74 48 69 67 68 57 61 69 | 74 4c 6f 77 45 76 65 6e |tHighWai|tLowEven|
|000005a0| 74 50 61 69 72 40 34 00 | 5f 4e 74 53 65 74 48 69 |tPair@4.|_NtSetHi|
|000005b0| 67 68 57 61 69 74 4c 6f | 77 54 68 72 65 61 64 40 |ghWaitLo|wThread@|
|000005c0| 30 00 5f 4e 74 53 65 74 | 49 6e 66 6f 72 6d 61 74 |0._NtSet|Informat|
|000005d0| 69 6f 6e 46 69 6c 65 40 | 32 30 00 5f 4e 74 53 65 |ionFile@|20._NtSe|
|000005e0| 74 49 6e 66 6f 72 6d 61 | 74 69 6f 6e 4b 65 79 40 |tInforma|tionKey@|
|000005f0| 31 36 00 5f 4e 74 53 65 | 74 49 6e 66 6f 72 6d 61 |16._NtSe|tInforma|
|00000600| 74 69 6f 6e 4f 62 6a 65 | 63 74 40 31 36 00 5f 4e |tionObje|ct@16._N|
|00000610| 74 53 65 74 49 6e 66 6f | 72 6d 61 74 69 6f 6e 50 |tSetInfo|rmationP|
|00000620| 72 6f 63 65 73 73 40 31 | 36 00 5f 4e 74 53 65 74 |rocess@1|6._NtSet|
|00000630| 49 6e 66 6f 72 6d 61 74 | 69 6f 6e 54 68 72 65 61 |Informat|ionThrea|
|00000640| 64 40 31 36 00 5f 4e 74 | 53 65 74 49 6e 66 6f 72 |d@16._Nt|SetInfor|
|00000650| 6d 61 74 69 6f 6e 54 6f | 6b 65 6e 40 31 36 00 5f |mationTo|ken@16._|
|00000660| 4e 74 53 65 74 49 6e 74 | 65 72 76 61 6c 50 72 6f |NtSetInt|ervalPro|
|00000670| 66 69 6c 65 40 38 00 5f | 4e 74 53 65 74 49 6f 43 |file@8._|NtSetIoC|
|00000680| 6f 6d 70 6c 65 74 69 6f | 6e 40 32 30 00 5f 4e 74 |ompletio|n@20._Nt|
|00000690| 53 65 74 4c 64 74 45 6e | 74 72 69 65 73 40 32 34 |SetLdtEn|tries@24|
|000006a0| 00 5f 4e 74 53 65 74 4c | 6f 77 45 76 65 6e 74 50 |._NtSetL|owEventP|
|000006b0| 61 69 72 40 34 00 5f 4e | 74 53 65 74 4c 6f 77 57 |air@4._N|tSetLowW|
|000006c0| 61 69 74 48 69 67 68 45 | 76 65 6e 74 50 61 69 72 |aitHighE|ventPair|
|000006d0| 40 34 00 5f 4e 74 53 65 | 74 4c 6f 77 57 61 69 74 |@4._NtSe|tLowWait|
|000006e0| 48 69 67 68 54 68 72 65 | 61 64 40 30 00 5f 4e 74 |HighThre|ad@0._Nt|
|000006f0| 53 65 74 53 65 63 75 72 | 69 74 79 4f 62 6a 65 63 |SetSecur|ityObjec|
|00000700| 74 40 31 32 00 5f 4e 74 | 53 65 74 53 79 73 74 65 |t@12._Nt|SetSyste|
|00000710| 6d 45 6e 76 69 72 6f 6e | 6d 65 6e 74 56 61 6c 75 |mEnviron|mentValu|
|00000720| 65 40 38 00 5f 4e 74 53 | 65 74 53 79 73 74 65 6d |e@8._NtS|etSystem|
|00000730| 49 6e 66 6f 72 6d 61 74 | 69 6f 6e 40 31 32 00 5f |Informat|ion@12._|
|00000740| 4e 74 53 65 74 53 79 73 | 74 65 6d 50 6f 77 65 72 |NtSetSys|temPower|
|00000750| 53 74 61 74 65 40 31 32 | 00 5f 4e 74 53 65 74 53 |State@12|._NtSetS|
|00000760| 79 73 74 65 6d 54 69 6d | 65 40 38 00 5f 4e 74 53 |ystemTim|e@8._NtS|
|00000770| 65 74 54 69 6d 65 72 40 | 32 38 00 5f 4e 74 53 65 |etTimer@|28._NtSe|
|00000780| 74 54 69 6d 65 72 52 65 | 73 6f 6c 75 74 69 6f 6e |tTimerRe|solution|
|00000790| 40 31 32 00 5f 4e 74 53 | 65 74 56 61 6c 75 65 4b |@12._NtS|etValueK|
|000007a0| 65 79 40 32 34 00 5f 4e | 74 53 65 74 56 6f 6c 75 |ey@24._N|tSetVolu|
|000007b0| 6d 65 49 6e 66 6f 72 6d | 61 74 69 6f 6e 46 69 6c |meInform|ationFil|
|000007c0| 65 40 32 30 00 5f 4e 74 | 53 68 75 74 64 6f 77 6e |e@20._Nt|Shutdown|
|000007d0| 53 79 73 74 65 6d 40 34 | 00 5f 4e 74 53 69 67 6e |System@4|._NtSign|
|000007e0| 61 6c 41 6e 64 57 61 69 | 74 46 6f 72 53 69 6e 67 |alAndWai|tForSing|
|000007f0| 6c 65 4f 62 6a 65 63 74 | 40 31 36 00 5f 4e 74 53 |leObject|@16._NtS|
|00000800| 74 61 72 74 50 72 6f 66 | 69 6c 65 40 34 00 5f 4e |tartProf|ile@4._N|
|00000810| 74 53 74 6f 70 50 72 6f | 66 69 6c 65 40 34 00 5f |tStopPro|file@4._|
|00000820| 4e 74 53 75 73 70 65 6e | 64 54 68 72 65 61 64 40 |NtSuspen|dThread@|
|00000830| 38 00 5f 4e 74 53 79 73 | 74 65 6d 44 65 62 75 67 |8._NtSys|temDebug|
|00000840| 43 6f 6e 74 72 6f 6c 40 | 32 34 00 5f 4e 74 54 65 |Control@|24._NtTe|
|00000850| 72 6d 69 6e 61 74 65 50 | 72 6f 63 65 73 73 40 38 |rminateP|rocess@8|
|00000860| 00 5f 4e 74 54 65 72 6d | 69 6e 61 74 65 54 68 72 |._NtTerm|inateThr|
|00000870| 65 61 64 40 38 00 5f 4e | 74 54 65 73 74 41 6c 65 |ead@8._N|tTestAle|
|00000880| 72 74 40 30 00 5f 4e 74 | 55 6e 6c 6f 61 64 44 72 |rt@0._Nt|UnloadDr|
|00000890| 69 76 65 72 40 34 00 5f | 4e 74 55 6e 6c 6f 61 64 |iver@4._|NtUnload|
|000008a0| 4b 65 79 40 34 00 5f 4e | 74 55 6e 6c 6f 63 6b 46 |Key@4._N|tUnlockF|
|000008b0| 69 6c 65 40 32 30 00 5f | 4e 74 55 6e 6c 6f 63 6b |ile@20._|NtUnlock|
|000008c0| 56 69 72 74 75 61 6c 4d | 65 6d 6f 72 79 40 31 36 |VirtualM|emory@16|
|000008d0| 00 5f 4e 74 55 6e 6d 61 | 70 56 69 65 77 4f 66 53 |._NtUnma|pViewOfS|
|000008e0| 65 63 74 69 6f 6e 40 38 | 00 5f 4e 74 56 64 6d 43 |ection@8|._NtVdmC|
|000008f0| 6f 6e 74 72 6f 6c 40 38 | 00 5f 4e 74 57 33 32 43 |ontrol@8|._NtW32C|
|00000900| 61 6c 6c 40 32 30 00 5f | 4e 74 57 61 69 74 46 6f |all@20._|NtWaitFo|
|00000910| 72 4d 75 6c 74 69 70 6c | 65 4f 62 6a 65 63 74 73 |rMultipl|eObjects|
|00000920| 40 32 30 00 5f 4e 74 57 | 61 69 74 46 6f 72 53 69 |@20._NtW|aitForSi|
|00000930| 6e 67 6c 65 4f 62 6a 65 | 63 74 40 31 32 00 5f 4e |ngleObje|ct@12._N|
|00000940| 74 57 61 69 74 48 69 67 | 68 45 76 65 6e 74 50 61 |tWaitHig|hEventPa|
|00000950| 69 72 40 34 00 5f 4e 74 | 57 61 69 74 4c 6f 77 45 |ir@4._Nt|WaitLowE|
|00000960| 76 65 6e 74 50 61 69 72 | 40 34 00 5f 4e 74 57 72 |ventPair|@4._NtWr|
|00000970| 69 74 65 46 69 6c 65 40 | 33 36 00 5f 4e 74 57 72 |iteFile@|36._NtWr|
|00000980| 69 74 65 52 65 71 75 65 | 73 74 44 61 74 61 40 32 |iteReque|stData@2|
|00000990| 34 00 5f 4e 74 57 72 69 | 74 65 56 69 72 74 75 61 |4._NtWri|teVirtua|
|000009a0| 6c 4d 65 6d 6f 72 79 40 | 32 30 00 5f 4e 74 59 69 |lMemory@|20._NtYi|
|000009b0| 65 6c 64 45 78 65 63 75 | 74 69 6f 6e 40 30 00 5f |eldExecu|tion@0._|
|000009c0| 50 66 78 46 69 6e 64 50 | 72 65 66 69 78 40 38 00 |PfxFindP|refix@8.|
|000009d0| 5f 50 66 78 49 6e 69 74 | 69 61 6c 69 7a 65 40 34 |_PfxInit|ialize@4|
|000009e0| 00 5f 50 66 78 49 6e 73 | 65 72 74 50 72 65 66 69 |._PfxIns|ertPrefi|
|000009f0| 78 40 31 32 00 5f 50 66 | 78 52 65 6d 6f 76 65 50 |x@12._Pf|xRemoveP|
|00000a00| 72 65 66 69 78 40 38 00 | 5f 52 65 73 74 6f 72 65 |refix@8.|_Restore|
|00000a10| 45 6d 38 37 43 6f 6e 74 | 65 78 74 00 5f 52 74 6c |Em87Cont|ext._Rtl|
|00000a20| 41 62 6f 72 74 52 58 61 | 63 74 40 34 00 5f 52 74 |AbortRXa|ct@4._Rt|
|00000a30| 6c 41 62 73 6f 6c 75 74 | 65 54 6f 53 65 6c 66 52 |lAbsolut|eToSelfR|
|00000a40| 65 6c 61 74 69 76 65 53 | 44 40 31 32 00 5f 52 74 |elativeS|D@12._Rt|
|00000a50| 6c 41 63 71 75 69 72 65 | 50 65 62 4c 6f 63 6b 40 |lAcquire|PebLock@|
|00000a60| 30 00 5f 52 74 6c 41 63 | 71 75 69 72 65 52 65 73 |0._RtlAc|quireRes|
|00000a70| 6f 75 72 63 65 45 78 63 | 6c 75 73 69 76 65 40 38 |ourceExc|lusive@8|
|00000a80| 00 5f 52 74 6c 41 63 71 | 75 69 72 65 52 65 73 6f |._RtlAcq|uireReso|
|00000a90| 75 72 63 65 53 68 61 72 | 65 64 40 38 00 5f 52 74 |urceShar|ed@8._Rt|
|00000aa0| 6c 41 64 64 41 63 63 65 | 73 73 41 6c 6c 6f 77 65 |lAddAcce|ssAllowe|
|00000ab0| 64 41 63 65 40 31 36 00 | 5f 52 74 6c 41 64 64 41 |dAce@16.|_RtlAddA|
|00000ac0| 63 63 65 73 73 44 65 6e | 69 65 64 41 63 65 40 31 |ccessDen|iedAce@1|
|00000ad0| 36 00 5f 52 74 6c 41 64 | 64 41 63 65 40 32 30 00 |6._RtlAd|dAce@20.|
|00000ae0| 5f 52 74 6c 41 64 64 41 | 63 74 69 6f 6e 54 6f 52 |_RtlAddA|ctionToR|
|00000af0| 58 61 63 74 40 32 34 00 | 5f 52 74 6c 41 64 64 41 |Xact@24.|_RtlAddA|
|00000b00| 74 6f 6d 54 6f 41 74 6f | 6d 54 61 62 6c 65 40 31 |tomToAto|mTable@1|
|00000b10| 32 00 5f 52 74 6c 41 64 | 64 41 74 74 72 69 62 75 |2._RtlAd|dAttribu|
|00000b20| 74 65 41 63 74 69 6f 6e | 54 6f 52 58 61 63 74 40 |teAction|ToRXact@|
|00000b30| 33 32 00 5f 52 74 6c 41 | 64 64 41 75 64 69 74 41 |32._RtlA|ddAuditA|
|00000b40| 63 63 65 73 73 41 63 65 | 40 32 34 00 5f 52 74 6c |ccessAce|@24._Rtl|
|00000b50| 41 64 64 43 6f 6d 70 6f | 75 6e 64 41 63 65 40 32 |AddCompo|undAce@2|
|00000b60| 34 00 5f 52 74 6c 41 64 | 6a 75 73 74 50 72 69 76 |4._RtlAd|justPriv|
|00000b70| 69 6c 65 67 65 40 31 36 | 00 5f 52 74 6c 41 6c 6c |ilege@16|._RtlAll|
|00000b80| 6f 63 61 74 65 41 6e 64 | 49 6e 69 74 69 61 6c 69 |ocateAnd|Initiali|
|00000b90| 7a 65 53 69 64 40 34 34 | 00 5f 52 74 6c 41 6c 6c |zeSid@44|._RtlAll|
|00000ba0| 6f 63 61 74 65 48 61 6e | 64 6c 65 40 38 00 5f 52 |ocateHan|dle@8._R|
|00000bb0| 74 6c 41 6c 6c 6f 63 61 | 74 65 48 65 61 70 40 31 |tlAlloca|teHeap@1|
|00000bc0| 32 00 5f 52 74 6c 41 6e | 73 69 43 68 61 72 54 6f |2._RtlAn|siCharTo|
|00000bd0| 55 6e 69 63 6f 64 65 43 | 68 61 72 40 34 00 5f 52 |UnicodeC|har@4._R|
|00000be0| 74 6c 41 6e 73 69 53 74 | 72 69 6e 67 54 6f 55 6e |tlAnsiSt|ringToUn|
|00000bf0| 69 63 6f 64 65 53 69 7a | 65 40 34 00 5f 52 74 6c |icodeSiz|e@4._Rtl|
|00000c00| 41 6e 73 69 53 74 72 69 | 6e 67 54 6f 55 6e 69 63 |AnsiStri|ngToUnic|
|00000c10| 6f 64 65 53 74 72 69 6e | 67 40 31 32 00 5f 52 74 |odeStrin|g@12._Rt|
|00000c20| 6c 41 70 70 65 6e 64 41 | 73 63 69 69 7a 54 6f 53 |lAppendA|sciizToS|
|00000c30| 74 72 69 6e 67 40 38 00 | 5f 52 74 6c 41 70 70 65 |tring@8.|_RtlAppe|
|00000c40| 6e 64 53 74 72 69 6e 67 | 54 6f 53 74 72 69 6e 67 |ndString|ToString|
|00000c50| 40 38 00 5f 52 74 6c 41 | 70 70 65 6e 64 55 6e 69 |@8._RtlA|ppendUni|
|00000c60| 63 6f 64 65 53 74 72 69 | 6e 67 54 6f 53 74 72 69 |codeStri|ngToStri|
|00000c70| 6e 67 40 38 00 5f 52 74 | 6c 41 70 70 65 6e 64 55 |ng@8._Rt|lAppendU|
|00000c80| 6e 69 63 6f 64 65 54 6f | 53 74 72 69 6e 67 40 38 |nicodeTo|String@8|
|00000c90| 00 5f 52 74 6c 41 70 70 | 6c 79 52 58 61 63 74 40 |._RtlApp|lyRXact@|
|00000ca0| 34 00 5f 52 74 6c 41 70 | 70 6c 79 52 58 61 63 74 |4._RtlAp|plyRXact|
|00000cb0| 4e 6f 46 6c 75 73 68 40 | 34 00 5f 52 74 6c 41 72 |NoFlush@|4._RtlAr|
|00000cc0| 65 41 6c 6c 41 63 63 65 | 73 73 65 73 47 72 61 6e |eAllAcce|ssesGran|
|00000cd0| 74 65 64 40 38 00 5f 52 | 74 6c 41 72 65 41 6e 79 |ted@8._R|tlAreAny|
|00000ce0| 41 63 63 65 73 73 65 73 | 47 72 61 6e 74 65 64 40 |Accesses|Granted@|
|00000cf0| 38 00 5f 52 74 6c 41 72 | 65 42 69 74 73 43 6c 65 |8._RtlAr|eBitsCle|
|00000d00| 61 72 40 31 32 00 5f 52 | 74 6c 41 72 65 42 69 74 |ar@12._R|tlAreBit|
|00000d10| 73 53 65 74 40 31 32 00 | 5f 52 74 6c 41 73 73 65 |sSet@12.|_RtlAsse|
|00000d20| 72 74 40 31 36 00 5f 52 | 74 6c 43 61 70 74 75 72 |rt@16._R|tlCaptur|
|00000d30| 65 53 74 61 63 6b 42 61 | 63 6b 54 72 61 63 65 40 |eStackBa|ckTrace@|
|00000d40| 31 36 00 5f 52 74 6c 43 | 68 61 72 54 6f 49 6e 74 |16._RtlC|harToInt|
|00000d50| 65 67 65 72 40 31 32 00 | 5f 52 74 6c 43 68 65 63 |eger@12.|_RtlChec|
|00000d60| 6b 52 65 67 69 73 74 72 | 79 4b 65 79 40 38 00 5f |kRegistr|yKey@8._|
|00000d70| 52 74 6c 43 6c 65 61 72 | 41 6c 6c 42 69 74 73 40 |RtlClear|AllBits@|
|00000d80| 34 00 5f 52 74 6c 43 6c | 65 61 72 42 69 74 73 40 |4._RtlCl|earBits@|
|00000d90| 31 32 00 5f 52 74 6c 43 | 6c 6f 73 65 50 72 6f 70 |12._RtlC|loseProp|
|00000da0| 65 72 74 79 53 65 74 40 | 34 00 5f 52 74 6c 43 6f |ertySet@|4._RtlCo|
|00000db0| 6d 70 61 63 74 48 65 61 | 70 40 38 00 5f 52 74 6c |mpactHea|p@8._Rtl|
|00000dc0| 43 6f 6d 70 61 72 65 4d | 65 6d 6f 72 79 40 31 32 |CompareM|emory@12|
|00000dd0| 00 5f 52 74 6c 43 6f 6d | 70 61 72 65 4d 65 6d 6f |._RtlCom|pareMemo|
|00000de0| 72 79 55 6c 6f 6e 67 40 | 31 32 00 5f 52 74 6c 43 |ryUlong@|12._RtlC|
|00000df0| 6f 6d 70 61 72 65 53 74 | 72 69 6e 67 40 31 32 00 |ompareSt|ring@12.|
|00000e00| 5f 52 74 6c 43 6f 6d 70 | 61 72 65 55 6e 69 63 6f |_RtlComp|areUnico|
|00000e10| 64 65 53 74 72 69 6e 67 | 40 31 32 00 5f 52 74 6c |deString|@12._Rtl|
|00000e20| 43 6f 6d 70 72 65 73 73 | 42 75 66 66 65 72 40 33 |Compress|Buffer@3|
|00000e30| 32 00 5f 52 74 6c 43 6f | 6e 73 6f 6c 65 4d 75 6c |2._RtlCo|nsoleMul|
|00000e40| 74 69 42 79 74 65 54 6f | 55 6e 69 63 6f 64 65 4e |tiByteTo|UnicodeN|
|00000e50| 40 32 34 00 5f 52 74 6c | 43 6f 6e 76 65 72 74 45 |@24._Rtl|ConvertE|
|00000e60| 78 63 6c 75 73 69 76 65 | 54 6f 53 68 61 72 65 64 |xclusive|ToShared|
|00000e70| 40 34 00 5f 52 74 6c 43 | 6f 6e 76 65 72 74 4c 6f |@4._RtlC|onvertLo|
|00000e80| 6e 67 54 6f 4c 61 72 67 | 65 49 6e 74 65 67 65 72 |ngToLarg|eInteger|
|00000e90| 40 34 00 5f 52 74 6c 43 | 6f 6e 76 65 72 74 53 68 |@4._RtlC|onvertSh|
|00000ea0| 61 72 65 64 54 6f 45 78 | 63 6c 75 73 69 76 65 40 |aredToEx|clusive@|
|00000eb0| 34 00 5f 52 74 6c 43 6f | 6e 76 65 72 74 53 69 64 |4._RtlCo|nvertSid|
|00000ec0| 54 6f 55 6e 69 63 6f 64 | 65 53 74 72 69 6e 67 40 |ToUnicod|eString@|
|00000ed0| 31 32 00 5f 52 74 6c 43 | 6f 6e 76 65 72 74 55 69 |12._RtlC|onvertUi|
|00000ee0| 4c 69 73 74 54 6f 41 70 | 69 4c 69 73 74 40 31 32 |ListToAp|iList@12|
|00000ef0| 00 5f 52 74 6c 43 6f 6e | 76 65 72 74 55 6c 6f 6e |._RtlCon|vertUlon|
|00000f00| 67 54 6f 4c 61 72 67 65 | 49 6e 74 65 67 65 72 40 |gToLarge|Integer@|
|00000f10| 34 00 5f 52 74 6c 43 6f | 70 79 4c 75 69 64 40 38 |4._RtlCo|pyLuid@8|
|00000f20| 00 5f 52 74 6c 43 6f 70 | 79 4c 75 69 64 41 6e 64 |._RtlCop|yLuidAnd|
|00000f30| 41 74 74 72 69 62 75 74 | 65 73 41 72 72 61 79 40 |Attribut|esArray@|
|00000f40| 31 32 00 5f 52 74 6c 43 | 6f 70 79 53 65 63 75 72 |12._RtlC|opySecur|
|00000f50| 69 74 79 44 65 73 63 72 | 69 70 74 6f 72 40 38 00 |ityDescr|iptor@8.|
|00000f60| 5f 52 74 6c 43 6f 70 79 | 53 69 64 40 31 32 00 5f |_RtlCopy|Sid@12._|
|00000f70| 52 74 6c 43 6f 70 79 53 | 69 64 41 6e 64 41 74 74 |RtlCopyS|idAndAtt|
|00000f80| 72 69 62 75 74 65 73 41 | 72 72 61 79 40 32 38 00 |ributesA|rray@28.|
|00000f90| 5f 52 74 6c 43 6f 70 79 | 53 74 72 69 6e 67 40 38 |_RtlCopy|String@8|
|00000fa0| 00 5f 52 74 6c 43 6f 70 | 79 55 6e 69 63 6f 64 65 |._RtlCop|yUnicode|
|00000fb0| 53 74 72 69 6e 67 40 38 | 00 5f 52 74 6c 43 72 65 |String@8|._RtlCre|
|00000fc0| 61 74 65 41 63 6c 40 31 | 32 00 5f 52 74 6c 43 72 |ateAcl@1|2._RtlCr|
|00000fd0| 65 61 74 65 41 6e 64 53 | 65 74 53 44 40 32 30 00 |eateAndS|etSD@20.|
|00000fe0| 5f 52 74 6c 43 72 65 61 | 74 65 41 74 6f 6d 54 61 |_RtlCrea|teAtomTa|
|00000ff0| 62 6c 65 40 38 00 5f 52 | 74 6c 43 72 65 61 74 65 |ble@8._R|tlCreate|
|00001000| 81 ec 1c 02 00 00 8b 84 | 24 20 02 00 00 c7 44 24 |........|$ ....D$|
|00001010| 10 00 00 00 00 56 57 8b | 48 0c 68 ff 00 00 00 8d |.....VW.|H.h.....|
|00001020| 44 24 28 8b 51 58 83 c2 | 08 52 50 e8 34 01 00 00 |D$(.QX..|.RP.4...|
|00001030| 83 c4 0c 8d 4c 24 24 66 | c7 84 24 22 02 00 00 00 |....L$$f|..$"....|
|00001040| 00 6a 5c 51 ff 15 7c 30 | 40 00 8b 3d 78 30 40 00 |.j\Q..|0|@..=x0@.|
|00001050| 8b f0 83 c4 08 85 f6 74 | 20 8d 54 24 24 83 c6 02 |.......t| .T$$...|
|00001060| 8d 44 24 08 52 50 66 c7 | 06 00 00 ff d7 8d 4c 24 |.D$.RPf.|......L$|
|00001070| 08 51 e8 e7 00 00 00 eb | 04 8d 74 24 24 68 24 20 |.Q......|..t$$h$ |
|00001080| 40 00 56 ff 15 58 30 40 | 00 83 c4 08 8d 54 24 24 |@.V..X0@|.....T$$|
|00001090| 8d 44 24 08 52 50 ff d7 | 8d 4c 24 10 8d 54 24 08 |.D$.RP..|.L$..T$.|
|000010a0| 51 8d 44 24 1c 52 50 6a | 00 e8 aa 00 00 00 85 c0 |Q.D$.RPj|........|
|000010b0| 7c 4a 8d 4c 24 1c 68 1c | 20 40 00 51 ff 15 68 30 ||J.L$.h.| @.Q..h0|
|000010c0| 40 00 8b 4c 24 10 8d 54 | 24 14 52 8d 44 24 20 6a |@..L$..T|$.R.D$ j|
|000010d0| 00 50 51 e8 7a 00 00 00 | 85 c0 7c 04 ff 54 24 14 |.PQ.z...|..|..T$.|
|000010e0| 8b 54 24 10 52 e8 62 00 | 00 00 6a 00 6a ff e8 53 |.T$.R.b.|..j.j..S|
|000010f0| 00 00 00 5f 5e 81 c4 1c | 02 00 00 c3 8d 44 24 08 |..._^...|.....D$.|
|00001100| 68 00 20 40 00 50 ff d7 | 8d 4c 24 08 51 e8 2e 00 |h. @.P..|.L$.Q...|
|00001110| 00 00 8d 54 24 24 8d 44 | 24 08 52 50 ff d7 8d 4c |...T$$.D|$.RP...L|
|00001120| 24 08 51 e8 18 00 00 00 | 6a 00 6a ff e8 15 00 00 |$.Q.....|j.j.....|
|00001130| 00 5f 5e 81 c4 1c 02 00 | 00 c3 90 90 90 90 90 90 |._^.....|........|
|00001140| ff 25 70 30 40 00 ff 25 | 5c 30 40 00 ff 25 60 30 |.%p0@..%|\0@..%`0|
|00001150| 40 00 ff 25 64 30 40 00 | ff 25 6c 30 40 00 ff 25 |@..%d0@.|.%l0@..%|
|00001160| 74 30 40 00 ff 25 80 30 | 40 00 00 00 00 00 00 00 |t0@..%.0|@.......|
|00001170| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001180| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001190| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001200| 0a 00 43 00 61 00 6e 00 | 27 00 74 00 20 00 6c 00 |..C.a.n.|'.t. .l.|
|00001210| 6f 00 61 00 64 00 20 00 | 00 00 00 00 52 75 6e 4d |o.a.d. .|....RunM|
|00001220| 65 00 00 00 53 00 74 00 | 75 00 62 00 31 00 5f 00 |e...S.t.|u.b.1._.|
|00001230| 62 00 73 00 2e 00 64 00 | 6c 00 6c 00 00 00 00 00 |b.s...d.|l.l.....|
|00001240| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001250| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001260| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001270| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001280| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001290| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000012a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000012b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000012c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000012d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000012e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000012f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001300| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001310| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001320| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001330| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001340| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001350| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001360| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001370| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001380| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001390| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000013a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000013b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000013c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000013d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000013e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000013f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001400| 28 30 00 00 00 00 00 00 | 00 00 00 00 4e 31 00 00 |(0......|....N1..|
|00001410| 58 30 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |X0......|........|
|00001420| 00 00 00 00 00 00 00 00 | fc 30 00 00 9a 30 00 00 |........|.0...0..|
|00001430| b0 30 00 00 c0 30 00 00 | da 30 00 00 ee 30 00 00 |.0...0..|.0...0..|
|00001440| 88 30 00 00 06 31 00 00 | 22 31 00 00 3a 31 00 00 |.0...1..|"1..:1..|
|00001450| 44 31 00 00 00 00 00 00 | fc 30 00 00 9a 30 00 00 |D1......|.0...0..|
|00001460| b0 30 00 00 c0 30 00 00 | da 30 00 00 ee 30 00 00 |.0...0..|.0...0..|
|00001470| 88 30 00 00 06 31 00 00 | 22 31 00 00 3a 31 00 00 |.0...1..|"1..:1..|
|00001480| 44 31 00 00 00 00 00 00 | 61 00 4e 74 44 69 73 70 |D1......|a.NtDisp|
|00001490| 6c 61 79 53 74 72 69 6e | 67 00 f2 00 4e 74 54 65 |layStrin|g...NtTe|
|000014a0| 72 6d 69 6e 61 74 65 50 | 72 6f 63 65 73 73 00 00 |rminateP|rocess..|
|000014b0| 2b 00 4c 64 72 55 6e 6c | 6f 61 64 44 6c 6c 00 00 |+.LdrUnl|oadDll..|
|000014c0| 23 00 4c 64 72 47 65 74 | 50 72 6f 63 65 64 75 72 |#.LdrGet|Procedur|
|000014d0| 65 41 64 64 72 65 73 73 | 00 00 b2 01 52 74 6c 49 |eAddress|....RtlI|
|000014e0| 6e 69 74 41 6e 73 69 53 | 74 72 69 6e 67 00 25 00 |nitAnsiS|tring.%.|
|000014f0| 4c 64 72 4c 6f 61 64 44 | 6c 6c 00 00 07 04 77 63 |LdrLoadD|ll....wc|
|00001500| 73 63 70 79 00 00 10 02 | 52 74 6c 53 65 74 43 75 |scpy....|RtlSetCu|
|00001510| 72 72 65 6e 74 44 69 72 | 65 63 74 6f 72 79 5f 55 |rrentDir|ectory_U|
|00001520| 00 00 b6 01 52 74 6c 49 | 6e 69 74 55 6e 69 63 6f |....RtlI|nitUnico|
|00001530| 64 65 53 74 72 69 6e 67 | 00 00 0e 04 77 63 73 72 |deString|....wcsr|
|00001540| 63 68 72 00 0c 04 77 63 | 73 6e 63 70 79 00 6e 74 |chr...wc|sncpy.nt|
|00001550| 64 6c 6c 2e 64 6c 6c 00 | 00 00 00 00 00 00 00 00 |dll.dll.|........|
|00001560| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001570| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001580| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001590| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001600| 00 10 00 00 24 00 00 00 | 46 30 4c 30 7e 30 85 30 |....$...|F0L0~0.0|
|00001610| b7 30 be 30 01 31 42 31 | 48 31 4e 31 54 31 5a 31 |.0.0.1B1|H1N1T1Z1|
|00001620| 60 31 66 31 00 00 00 00 | 00 00 00 00 00 00 00 00 |`1f1....|........|
|00001630| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001640| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001650| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001660| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001670| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001680| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001690| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001700| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001710| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001720| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001730| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001740| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001750| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001760| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001770| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001780| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001790| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000017a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000017b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000017c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000017d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000017e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000017f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
+--------+-------------------------+-------------------------+--------+--------+